RE: Is this even POSSIBLE?
Willian Pires <[email protected]> Fri, 7 Jan 2022 05:20:09 +0000
| Newsgroups | gmane.linux.debian.devel.firewall |
|---|---|
| Message-ID | <PH0PR07MB8672574DA6CA87FF3E7AD61D954D9@PH0PR07MB8672.namprd07.prod.outlook.com> |
--_000_PH0PR07MB8672574DA6CA87FF3E7AD61D954D9PH0PR07MB8672namp_ Content-Type: text/plain; charset="iso-2022-jp" Content-Transfer-Encoding: quoted-printable Sorry, try ipset to create a list and combine it with appropriated netfilte= r rule to blocke networks in one rule, instead use 1 rule per class. Sent from my Galaxy -------- Original message -------- From: linux_forum1 <[email protected]> Date: 1/6/22 17:11 (GMT-03:00) To: Dan Ritter <[email protected]> Cc: [email protected] Subject: Re: Is this even POSSIBLE? Hello Dan! Thank you so much for the reply! Yes that helps a lot, but I have 2 follow up questions if you don't mind ha= ha. 1.) When you say " -A INPUT -j Block puts the chain in order", you mean tha= t at this point iptables will look for any rules appended to the Block chai= n, no matter where they are? This would make sense cz then the order wouldn= 't matter and you can jump to a chain in the beginning, whose rules are def= ined at the bottom for example. 2.) I want to log when one of these rules gets matched. (It's 30 - 40 rules in total) -A Block -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP -A Block -s 169.254.0.0/16 -j DROP -A Block -s 172.16.0.0/12 -j DROP -A Block -s 192.0.2.0/24 -j DROP . . This is my solution: -A INPUT -j Block -A FORWARD -j Block -A Block -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j Logger -A Block -s 169.254.0.0/16 -j Logger -A Block -s 172.16.0.0/12 -j Logger -A Block -s 192.0.2.0/24 -j Logger Then in Logger it gets logged and dropped. I considered this, but was told the above is better. -A INPUT -j Block -A FORWARD -j Block -A Block -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j LOG -A Block -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP -A Block -s 169.254.0.0/16 -j LOG -A Block -s 169.254.0.0/16 -j DROP -A Block -s 172.16.0.0/12 -j LOG -A Block -s 172.16.0.0/12 -j DROP . . Is there a better way? Thanks again. =1B$B!>!>!>!>!>!>!>=1B(B Original Message =1B$B!>!>!>!>!>!>!>=1B(B On Thursday, January 6th, 2022 at 7:26 PM, Dan Ritter <[email protected]= > wrote: > linux_forum1 wrote: > > > Hello, I have 2 questions if that's OK. > > > > INPUT DROP > > > > FORWARD DROP > > > > OUTPUT DROP > > > > -N Block > > > > -N Logger > > > > -A INPUT -j Block > > > > -A Block -p tcp -m tcp --tcp-flags SYN,FIN SYN,FIN -j Logger > > > > -A Logger -j LOG --log-level 4 > > > > -A Logger -j DROP > > > > -A INPUT -i lo -j ACCEPT > > > > -A OUTPUT -o lo -j ACCEPT > > > > There will be more rules in Block, but I just want to understand the lo= gic. > > > > 1.) How is -A INPUT -j Block possible before there are any rules append= ed to Block, does that mean iptables first searches and assembles all rules= that belong to custom chains regardless of order? Same for Logger. > > Everything has an order. You can turn on line numbers and see > > the order. > > Creating a chain (Block, Logger) does not put it into order. > > The jump (-j) to Block, from INPUT, places the chain in order. > > I note that you don't have a rule in Block to actually drop > > packets, and you do have a rule in Logger that drops packets. > > That seems... problematic to me. > > > 2.) > > > > Would this be OK to log and drop all rules in in Block? > > > > I am worried because there are four jumps, INPUT -> Block -> Logger -> = LOG -> Logger -> DROP > > In general, you can jump as many times as you like as long as > > you don't go in a circle. Note that -j LOG continues processing > > on the next rule in order, unlike ACCEPT, DROP and REJECT. If a chain > > ends without ACCEPT, DROP or REJECT happening, then when it ends > > execution picks up at the next statement in order following the > > jump to that chain. > > Does that help? > > -dsr- --_000_PH0PR07MB8672574DA6CA87FF3E7AD61D954D9PH0PR07MB8672namp_ Content-Type: text/html; charset="iso-2022-jp" Content-Transfer-Encoding: quoted-printable <html> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-2022-= jp"> <meta name=3D"Generator" content=3D"Microsoft Exchange Server"> <!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; pad= ding-left: 4pt; border-left: #800000 2px solid; } --></style> </head> <body> <div dir=3D"auto"> <div dir=3D"auto">Sorry, try ipset to create a list and combine it with app= ropriated netfilter rule to blocke networks in one rule, instead use 1 rule= per class.</div> <div dir=3D"auto"><br> </div> <div dir=3D"auto"><br> </div> <div dir=3D"auto"><br> </div> <div dir=3D"auto"><br> </div> <div dir=3D"auto"><br> </div> <div id=3D"x_composer_signature" dir=3D"auto"> <div dir=3D"auto" style=3D"font-size:12px; color:#575757">Sent from my Gala= xy</div> </div> <div dir=3D"auto"><br> </div> <div><br> </div> <div><br> </div> <div>-------- Original message --------</div> <div>From: linux_forum1 <[email protected]> </div> <div>Date: 1/6/22 17:11 (GMT-03:00) </div> <div>To: Dan Ritter <[email protected]> </div> <div>Cc: [email protected] </div> <div>Subject: Re: Is this even POSSIBLE? </div> <div><br> </div> </div> <font size=3D"2"><span style=3D"font-size:11pt;"> <div class=3D"PlainText"><br> <br> Hello Dan!<br> <br> Thank you so much for the reply!<br> <br> Yes that helps a lot, but I have 2 follow up questions if you don't mind ha= ha.<br> <br> 1.) When you say " -A INPUT -j Block puts the chain in order", yo= u mean that at this point iptables will look for any rules appended to the = Block chain, no matter where they are? This would make sense cz then the or= der wouldn't matter and you can jump to a chain in the beginning, whose rules are defined at the bottom for example.= <br> <br> 2.) I want to log when one of these rules gets matched.<br> (It's 30 - 40 rules in total)<br> <br> -A Block -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP<br> -A Block -s 169.254.0.0/16 -j DROP<br> -A Block -s 172.16.0.0/12 -j DROP<br> -A Block -s 192.0.2.0/24 -j DROP<br> .<br> .<br> <br> This is my solution:<br> <br> -A INPUT -j Block<br> -A FORWARD -j Block<br> <br> -A Block -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j Logger<br> -A Block -s 169.254.0.0/16 -j Logger<br> -A Block -s 172.16.0.0/12 -j Logger<br> -A Block -s 192.0.2.0/24 -j Logger<br> <br> Then in Logger it gets logged and dropped.<br> <br> I considered this, but was told the above is better.<br> <br> -A INPUT -j Block<br> -A FORWARD -j Block<br> <br> -A Block -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j LOG<br> -A Block -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP<br> -A Block -s 169.254.0.0/16 -j LOG<br> -A Block -s 169.254.0.0/16 -j DROP<br> -A Block -s 172.16.0.0/12 -j LOG<br> -A Block -s 172.16.0.0/12 -j DROP<br> .<br> .<br> <br> Is there a better way? Thanks again.<br> <br> =1B$B!>!>!>!>!>!>!>=1B(B Original Message =1B$B!>!>!>!>!>!>!>=1B(B<br> <br> On Thursday, January 6th, 2022 at 7:26 PM, Dan Ritter <dsr@randomstring.= org> wrote:<br> <br> > linux_forum1 wrote:<br> ><br> > > Hello, I have 2 questions if that's OK.<br> > ><br> > > INPUT DROP<br> > ><br> > > FORWARD DROP<br> > ><br> > > OUTPUT DROP<br> > ><br> > > -N Block<br> > ><br> > > -N Logger<br> > ><br> > > -A INPUT -j Block<br> > ><br> > > -A Block -p tcp -m tcp --tcp-flags SYN,FIN SYN,FIN -j Logger<br> > ><br> > > -A Logger -j LOG --log-level 4<br> > ><br> > > -A Logger -j DROP<br> > ><br> > > -A INPUT -i lo -j ACCEPT<br> > ><br> > > -A OUTPUT -o lo -j ACCEPT<br> > ><br> > > There will be more rules in Block, but I just want to understand = the logic.<br> > ><br> > > 1.) How is -A INPUT -j Block possible before there are any rules = appended to Block, does that mean iptables first searches and assembles all= rules that belong to custom chains regardless of order? Same for Logger.<b= r> ><br> > Everything has an order. You can turn on line numbers and see<br> ><br> > the order.<br> ><br> > Creating a chain (Block, Logger) does not put it into order.<br> ><br> > The jump (-j) to Block, from INPUT, places the chain in order.<br> ><br> > I note that you don't have a rule in Block to actually drop<br> ><br> > packets, and you do have a rule in Logger that drops packets.<br> ><br> > That seems... problematic to me.<br> ><br> > > 2.)<br> > ><br> > > Would this be OK to log and drop all rules in in Block?<br> > ><br> > > I am worried because there are four jumps, INPUT -> Block ->= ; Logger -> LOG -> Logger -> DROP<br> ><br> > In general, you can jump as many times as you like as long as<br> ><br> > you don't go in a circle. Note that -j LOG continues processing<br> ><br> > on the next rule in order, unlike ACCEPT, DROP and REJECT. If a chain<= br> ><br> > ends without ACCEPT, DROP or REJECT happening, then when it ends<br> ><br> > execution picks up at the next statement in order following the<br> ><br> > jump to that chain.<br> ><br> > Does that help?<br> ><br> > -dsr-<br> <br> </div> </span></font> </body> </html> --_000_PH0PR07MB8672574DA6CA87FF3E7AD61D954D9PH0PR07MB8672namp_--