RE: Is this even POSSIBLE?
Willian Pires <[email protected]> Sat, 8 Jan 2022 14:03:19 +0000
| Newsgroups | gmane.linux.debian.devel.firewall |
|---|---|
| Message-ID | <PH0PR07MB8672B7FC5DFB7BB451773D13954E9@PH0PR07MB8672.namprd07.prod.outlook.com> |
--_000_PH0PR07MB8672B7FC5DFB7BB451773D13954E9PH0PR07MB8672namp_ Content-Type: text/plain; charset="iso-2022-jp" Content-Transfer-Encoding: quoted-printable Hello, let me clear, sometimes code is better than chat, First of all, you must reduce all your rules ever, the worst thing to do wi= th netfilter is create 1 match rule for each ip or port. Below is a complete firewall with all your desires plus, a small honey pot = with 10 minutes dinamic block list, The log-drop chains set made logging keeping 1 log per second control to av= oid kill your syslog server, please send all your logs to other host ! Adjust to you world, but keep this in mind: After rule set loaded it never = will be modified, only lists are modified, Use default port services to detect scanners, and systematically drop their= packets. Hope that it solve your questions #######################################CREATING BLOCK IP LIST ipset create BLOCKIPLIST hash:net family inet hashsize 1024 maxelem 65536 ipset add BLOCKIPLIST 10.0.0.0/8 ipset add BLOCKIPLIST 127.0.0.0/8 ipset add BLOCKIPLIST 192.168.0.0/16 ipset add BLOCKIPLIST 172.16.0.0/12 #######################################CREATING BLOCK PORT LIST ipset create BLOCKPORTS bitmap:port range 0-65535 ipset add BLOCKPORTS 1 ipset add BLOCKPORTS 7 ipset add BLOCKPORTS 22 ipset add BLOCKPORTS 23 ipset add BLOCKPORTS 135 ipset add BLOCKPORTS 136 ipset add BLOCKPORTS 137 ipset add BLOCKPORTS 138 ipset add BLOCKPORTS 139 ipset add BLOCKPORTS 445 ipset add BLOCKPORTS 1433 ipset add BLOCKPORTS 1701 ipset add BLOCKPORTS 3128 ipset add BLOCKPORTS 8080 ipset add BLOCKPORTS 8081 ipset add BLOCKPORTS 3389 #######################################CREATING ALLOW IP LIST ipset create ALLOWIPLIST hash:net family inet hashsize 1024 maxelem 65536 ipset add ALLOWIPLIST 8.8.8.8/32 ipset add ALLOWIPLIST 39.48.55.1/32 #######################################CREATING ALLOWED PORT LIST ipset create ALLOWPORTS bitmap:port range 0-65535 ipset add ALLOWPORTS 80 ipset add ALLOWPORTS 443 ipset add ALLOWPORTS 47122 #SSH FAKE #######################################CREATING TAR PIT create TARPIT hash:ip family inet hashsize 1024 maxelem 65536 timeout 600 ####################################### CREATING LOG-DROP-RULESET iptables -N LOGDROP_100 iptables -A LOGDROP_100 -m limit --limit 1/sec -j LOG --log-prefix " ::LOGD= ROP_100:: " iptables -A LOGDROP_100 -j DROP ####################################### CREATING LOG-TARPIT-RULESET iptables -N LOGTARPIT_100 iptables -A LOGTARPIT_100 -m limit --limit 1/sec -j LOG --log-prefix " ::LO= GDROP_100:: " iptables -A LOGTARPIT_100 -j SET --add-set TARPIT src iptables -A LOGTARPIT_100 -j DROP ####################################### CREATING LOG-ALLOW-RULESET iptables -N LOGALLOW_100 iptables -A LOGALLOW_100 -m limit --limit 1/sec -j LOG --log-prefix " ::LOG= ALLOW_100:: " iptables -A LOGALLOW_100 -m state --state NEW -j ACCEPT ####################################### CREATING IN FLOW RULESET iptables -N INFLOW_100 iptables -A INFLOW_100 -m state --state RELATED,ESTABLISHED -j ACCEPT # iptables -A INFLOW_100 -m set --match-set ALLOWIPLIST src -j LOGALLOW_100 iptables -A INFLOW_100 -m set --match-set ALLOWPORT dst -j LOGALLOW_100 # iptables -A INFLOW_100 -m set --match-set BLOCKIPLIST src -j LOGDROP_100 iptables -A INFLOW_100 -m set --match-set BLOCKPORT dst -j LOGTARPIT_100 # iptables -A INFLOW_100 -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j LOGDROP= _100 # iptables -A INFLOW_100 -m state --state INVALID -j DROP ###################################### RESTRICTING FLOW iptables -F INPUT iptables -F FORWARD iptables -F OUTPUT iptables -A INPUT -i eth0 -j INFLOW_100 iptables -A FORWARD -i eth0 -j INFLOW_100 #THIS AVOID UNRECHEABLE MESSAGES TO OTHERS IS USEFULL iptables -A OUTPUT -o eth0 -p icmp -m icmp --icmp-type 3 -j DROP ________________________________ De: linux_forum1 <[email protected]> Enviado: sexta-feira, 7 de janeiro de 2022 06:22 Para: Willian Pires <[email protected]> Cc: Dan Ritter <[email protected]>; [email protected] <de= [email protected]> Assunto: RE: Is this even POSSIBLE? Hello William, thanks for the reply! ipset would be nice, but it doesn't solve the logging issue. I have about 30 rules like the ones below that need to be logged and droppe= d if matched with iptables. (Both in INPUT and FORWARD) -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP -s 169.254.0.0/16 -j DROP -s 172.16.0.0/12 -j DROP -s 192.0.2.0/24 -j DROP As I understand it there are two ways to log and drop packets that matched = a specific rule in iptables. 1.) Separate LOG and DROP rules, for each IP, but this is inefficient. -A INPUT -j Block -A FORWARD -j Block -A Block -s 169.254.0.0/16 -j LOG -A Block -s 169.254.0.0/16 -j DROP -A Block -s 172.16.0.0/12 -j LOG -A Block -s 172.16.0.0/12 -j DROP 2.) The only other way, create separate chains for bad IPs and LOG/DROP, th= en jump in between. But Dan Ritter says this is problematic, because bad IP= s are not dropped in Block chain, but only after jumping to the Logger chai= n. -N Block -N Logger -A INPUT -j Block -A FORWARD -j Block -A Block -s 169.254.0.0/16 -j Logger -A Block -s 172.16.0.0/12 -j Logger -A Block -s 192.0.2.0/24 -j Logger -A Logger -j LOG -A Logger -j DROP I have been searching for 48h, but there is no other way to log and drop pa= ckets. =1B$B!>!>!>!>!>!>!>=1B(B Original Message =1B$B!>!>!>!>!>!>!>=1B(B On Friday, January 7th, 2022 at 6:20 AM, Willian Pires <willian_pires@hotma= il.com> wrote: Sorry, try ipset to create a list and combine it with appropriated netfilte= r rule to blocke networks in one rule, instead use 1 rule per class. Sent from my Galaxy -------- Original message -------- From: linux_forum1 <[email protected]> Date: 1/6/22 17:11 (GMT-03:00) To: Dan Ritter <[email protected]> Cc: [email protected] Subject: Re: Is this even POSSIBLE? Hello Dan! Thank you so much for the reply! Yes that helps a lot, but I have 2 follow up questions if you don't mind ha= ha. 1.) When you say " -A INPUT -j Block puts the chain in order", you mean tha= t at this point iptables will look for any rules appended to the Block chai= n, no matter where they are? This would make sense cz then the order wouldn= 't matter and you can jump to a chain in the beginning, whose rules are def= ined at the bottom for example. 2.) I want to log when one of these rules gets matched. (It's 30 - 40 rules in total) -A Block -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP -A Block -s 169.254.0.0/16 -j DROP -A Block -s 172.16.0.0/12 -j DROP -A Block -s 192.0.2.0/24 -j DROP . . This is my solution: -A INPUT -j Block -A FORWARD -j Block -A Block -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j Logger -A Block -s 169.254.0.0/16 -j Logger -A Block -s 172.16.0.0/12 -j Logger -A Block -s 192.0.2.0/24 -j Logger Then in Logger it gets logged and dropped. I considered this, but was told the above is better. -A INPUT -j Block -A FORWARD -j Block -A Block -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j LOG -A Block -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP -A Block -s 169.254.0.0/16 -j LOG -A Block -s 169.254.0.0/16 -j DROP -A Block -s 172.16.0.0/12 -j LOG -A Block -s 172.16.0.0/12 -j DROP . . Is there a better way? Thanks again. =1B$B!>!>!>!>!>!>!>=1B(B Original Message =1B$B!>!>!>!>!>!>!>=1B(B On Thursday, January 6th, 2022 at 7:26 PM, Dan Ritter <[email protected]= > wrote: > linux_forum1 wrote: > > > Hello, I have 2 questions if that's OK. > > > > INPUT DROP > > > > FORWARD DROP > > > > OUTPUT DROP > > > > -N Block > > > > -N Logger > > > > -A INPUT -j Block > > > > -A Block -p tcp -m tcp --tcp-flags SYN,FIN SYN,FIN -j Logger > > > > -A Logger -j LOG --log-level 4 > > > > -A Logger -j DROP > > > > -A INPUT -i lo -j ACCEPT > > > > -A OUTPUT -o lo -j ACCEPT > > > > There will be more rules in Block, but I just want to understand the lo= gic. > > > > 1.) How is -A INPUT -j Block possible before there are any rules append= ed to Block, does that mean iptables first searches and assembles all rules= that belong to custom chains regardless of order? Same for Logger. > > Everything has an order. You can turn on line numbers and see > > the order. > > Creating a chain (Block, Logger) does not put it into order. > > The jump (-j) to Block, from INPUT, places the chain in order. > > I note that you don't have a rule in Block to actually drop > > packets, and you do have a rule in Logger that drops packets. > > That seems... problematic to me. > > > 2.) > > > > Would this be OK to log and drop all rules in in Block? > > > > I am worried because there are four jumps, INPUT -> Block -> Logger -> = LOG -> Logger -> DROP > > In general, you can jump as many times as you like as long as > > you don't go in a circle. Note that -j LOG continues processing > > on the next rule in order, unlike ACCEPT, DROP and REJECT. If a chain > > ends without ACCEPT, DROP or REJECT happening, then when it ends > > execution picks up at the next statement in order following the > > jump to that chain. > > Does that help? > > -dsr- --_000_PH0PR07MB8672B7FC5DFB7BB451773D13954E9PH0PR07MB8672namp_ Content-Type: text/html; charset="iso-2022-jp" Content-Transfer-Encoding: quoted-printable <html> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Diso-2022-= jp"> <style type=3D"text/css" style=3D"display:none;"> P {margin-top:0;margin-bo= ttom:0;} </style> </head> <body dir=3D"ltr"> <div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;= color: rgb(0, 0, 0);"> Hello, let me clear, sometimes code is better than chat,<br> <br> First of all, you must reduce all your rules ever, the worst thing to do wi= th netfilter is <span style=3D"color: rgb(0, 0, 0); font-family: Calib= ri, Helvetica, sans-serif; font-size: 12pt;">create 1 match rule for each i= p or port.</span></div> <div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;= color: rgb(0, 0, 0);"> <br> Below is a complete firewall with all your desires plus, a small honey pot = with 10 minutes dinamic block list,<br> <br> The <span style=3D"background-color:rgb(255, 255, 255);display:inline !impo= rtant">log-drop </span>chains set made logging keeping 1 log per secon= d control to avoid kill your syslog server, please</div> <div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;= color: rgb(0, 0, 0);"> send all your logs to other host ! <br> <br> Adjust to you world, but keep this in mind: After rule set loaded it never = will be modified, only lists are modified,</div> <div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;= color: rgb(0, 0, 0);"> <br> Use default port services to detect scanners, and systematically drop their= packets.<br> <br> Hope that it solve your questions</div> <div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;= color: rgb(0, 0, 0);"> <br> </div> <div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;= color: rgb(0, 0, 0);"> <br> </div> <div style=3D"font-family: Calibri, Helvetica, sans-serif; font-size: 12pt;= color: rgb(0, 0, 0);"> <br> <br> #######################################CREATING BLOCK IP LIST<br> ipset create BLOCKIPLIST hash:net family inet hashsize 1024 maxelem 65536 <div><span style=3D"background-color:rgb(255, 255, 255);display:inline !imp= ortant">ipset<span> </span></span>add BLOCKIPLIST 10.0.0.0/8<br> </div> <div><span style=3D"margin:0px;background-color:rgb(255, 255, 255);display:= inline !important">ipset<span style=3D"margin:0px"> </span></span><spa= n style=3D"background-color:rgb(255, 255, 255);display:inline !important">a= dd BLOCKIPLIST 127.0.0.0/8</span><br> </div> <div><span style=3D"background-color:rgb(255, 255, 255);display:inline !imp= ortant"><span style=3D"margin:0px;background-color:rgb(255, 255, 255);displ= ay:inline !important">ipset<span style=3D"margin:0px"> </span></span><= span style=3D"margin:0px;background-color:rgb(255, 255, 255);display:inline= !important">add BLOCKIPLIST 192.168.0.0/16</span><br> </span></div> <div><span style=3D"background-color:rgb(255, 255, 255);display:inline !imp= ortant"><span style=3D"margin:0px;background-color:rgb(255, 255, 255);displ= ay:inline !important"><span style=3D"margin:0px;background-color:rgb(255, 2= 55, 255);display:inline !important">ipset<span style=3D"margin:0px"> <= /span></span><span style=3D"margin:0px;background-color:rgb(255, 255, 255);= display:inline !important">add BLOCKIPLIST 172.16.0.0/12</span></span></span></div> <div><span style=3D"background-color:rgb(255, 255, 255);display:inline !imp= ortant"><span style=3D"margin:0px;background-color:rgb(255, 255, 255);displ= ay:inline !important"><span style=3D"margin:0px;background-color:rgb(255, 2= 55, 255);display:inline !important"><br> </span></span></span></div> <div><span style=3D"background-color:rgb(255, 255, 255);display:inline !imp= ortant"><span style=3D"margin:0px;background-color:rgb(255, 255, 255);displ= ay:inline !important"><span style=3D"margin:0px;background-color:rgb(255, 2= 55, 255);display:inline !important"><span style=3D"background-color:rgb(255= , 255, 255);display:inline !important">####################################= ###CREATING BLOCK PORT LIST</span><br> </span></span></span></div> <div><span style=3D"background-color:rgb(255, 255, 255);display:inline !imp= ortant"><span style=3D"margin:0px;background-color:rgb(255, 255, 255);displ= ay:inline !important"><span style=3D"margin:0px;background-color:rgb(255, 2= 55, 255);display:inline !important"><span style=3D"background-color:rgb(255= , 255, 255);display:inline !important">ipset </span>create BLOCKPORTS bitmap:port range 0-65535 <div><span style=3D"background-color:rgb(255, 255, 255);display:inline !imp= ortant">ipset </span>add <span style=3D"background-color:rgb(255,= 255, 255);display:inline !important">BLOCKPORTS</span> 1</div> <div><span style=3D"background-color:rgb(255, 255, 255);display:inline !imp= ortant">ipset </span>add <span style=3D"background-color:rgb(255,= 255, 255);display:inline !important">BLOCKPORTS</span> 7</div> <div><span style=3D"margin:0px;background-color:rgb(255, 255, 255);display:= inline !important">ipset </span><span style=3D"background-color:rgb(25= 5, 255, 255);display:inline !important">add </span><span style=3D"marg= in:0px;background-color:rgb(255, 255, 255);display:inline !important">BLOCK= PORTS</span><span style=3D"background-color:rgb(255, 255, 255);display:inli= ne !important"><span> </span>22</span><br> </div> <div><span style=3D"background-color:rgb(255, 255, 255);display:inline !imp= ortant"><span style=3D"margin:0px;background-color:rgb(255, 255, 255);displ= ay:inline !important">ipset </span><span style=3D"background-color:rgb= (255, 255, 255);display:inline !important">add </span><span style=3D"m= argin:0px;background-color:rgb(255, 255, 255);display:inline !important">BL= OCKPORTS</span><span style=3D"background-color:rgb(255, 255, 255);display:i= nline !important"><span> </span>23</span><br> </span></div> <div><span style=3D"background-color:rgb(255, 255, 255);display:inline !imp= ortant">ipset </span>add <span style=3D"background-color:rgb(255,= 255, 255);display:inline !important">BLOCKPORTS</span> 135</div> <div><span style=3D"background-color:rgb(255, 255, 255);display:inline !imp= ortant">ipset </span>add <span style=3D"background-color:rgb(255,= 255, 255);display:inline !important">BLOCKPORTS</span> 136</div> <div><span style=3D"background-color:rgb(255, 255, 255);display:inline !imp= ortant">ipset </span>add <span style=3D"background-color:rgb(255,= 255, 255);display:inline !important">BLOCKPORTS</span> 137</div> <div><span style=3D"background-color:rgb(255, 255, 255);display:inline !imp= ortant">ipset </span>add <span style=3D"background-color:rgb(255,= 255, 255);display:inline !important">BLOCKPORTS</span> 138</div> <div><span style=3D"background-color:rgb(255, 255, 255);display:inline !imp= ortant">ipset </span>add <span style=3D"background-color:rgb(255,= 255, 255);display:inline !important">BLOCKPORTS</span> 139</div> <div><span style=3D"background-color:rgb(255, 255, 255);display:inline !imp= ortant">ipset </span>add <span style=3D"background-color:rgb(255,= 255, 255);display:inline !important">BLOCKPORTS</span> 445</div> <div><span style=3D"background-color:rgb(255, 255, 255);display:inline !imp= ortant">ipset add BLOCKPORTS 1433</span><br> ipset add BLOCKPORTS 1701<br> <span style=3D"background-color:rgb(255, 255, 255);display:inline !importan= t">ipset add BLOCKPORTS 3128<br> </span><span style=3D"background-color:rgb(255, 255, 255);display:inline !i= mportant">ipset add BLOCKPORTS 8080<br> </span><span style=3D"background-color:rgb(255, 255, 255);display:inline !i= mportant">ipset add BLOCKPORTS 8081<br> </span><span style=3D"background-color:rgb(255, 255, 255);display:inline !i= mportant">ipset add BLOCKPORTS 3389</span><br> </div> </span></span></span></div> <div><span style=3D"background-color:rgb(255, 255, 255);display:inline !imp= ortant"><span style=3D"margin:0px;background-color:rgb(255, 255, 255);displ= ay:inline !important"><span style=3D"margin:0px;background-color:rgb(255, 2= 55, 255);display:inline !important"><span><br> </span></span></span></span></div> <div><span style=3D"background-color:rgb(255, 255, 255);display:inline !imp= ortant"><span style=3D"margin:0px;background-color:rgb(255, 255, 255);displ= ay:inline !important"><span style=3D"margin:0px;background-color:rgb(255, 2= 55, 255);display:inline !important"><span><span style=3D"margin:0px;backgro= und-color:rgb(255, 255, 255)"><span style=3D"margin:0px;background-color:rg= b(255, 255, 255);display:inline !important"><span style=3D"margin:0px;backg= round-color:rgb(255, 255, 255);display:inline !important"><span style=3D"ma= rgin:0px;background-color:rgb(255, 255, 255);display:inline !important"><sp= an style=3D"margin:0px;background-color:rgb(255, 255, 255);display:inline != important"><span style=3D"margin:0px;background-color:rgb(255, 255, 255);di= splay:inline !important">#######################################CREATING ALLOW IP LIST</span><br> <span style=3D"margin:0px;background-color:rgb(255, 255, 255);display:inlin= e !important">ipset create<span> </span><span style=3D"margin:0px;back= ground-color:rgb(255, 255, 255);display:inline !important">ALLOW</span>IPLI= ST hash:net family inet hashsize 1024 maxelem 65536</span> <div style=3D"margin:0px;background-color:rgb(255, 255, 255)"><span style= =3D"margin:0px;background-color:rgb(255, 255, 255);display:inline !importan= t">ipset<span style=3D"margin:0px"> </span></span>add<span> </spa= n><span style=3D"margin:0px;background-color:rgb(255, 255, 255);display:inl= ine !important">ALLOW</span>IPLIST 8.8.8.8/32<br> </div> <span style=3D"margin:0px;background-color:rgb(255, 255, 255)"><span style= =3D"margin:0px;background-color:rgb(255, 255, 255);display:inline !importan= t">ipset<span style=3D"margin:0px"> </span></span><span style=3D"margi= n:0px;background-color:rgb(255, 255, 255);display:inline !important">add<sp= an style=3D"margin:0px"> </span></span><span style=3D"margin:0px;backg= round-color:rgb(255, 255, 255);display:inline !important">ALLOW</span><span= style=3D"margin:0px;background-color:rgb(255, 255, 255);display:inline !im= portant">IPLIST 39.48.55.1/32</span></span><br> </span></span></span></span></span></span></span></span></span></div> <div><span style=3D"background-color:rgb(255, 255, 255);display:inline !imp= ortant"><span style=3D"margin:0px;background-color:rgb(255, 255, 255);displ= ay:inline !important"><span style=3D"margin:0px;background-color:rgb(255, 2= 55, 255);display:inline !important"><span><span style=3D"margin:0px;backgro= und-color:rgb(255, 255, 255)"><span style=3D"margin:0px;background-color:rg= b(255, 255, 255);display:inline !important"><span style=3D"margin:0px;backg= round-color:rgb(255, 255, 255);display:inline !important"><span style=3D"ma= rgin:0px;background-color:rgb(255, 255, 255);display:inline !important"><sp= an style=3D"margin:0px;background-color:rgb(255, 255, 255);display:inline != important"><br> </span></span></span></span></span></span></span></span></span></div> <div><span style=3D"background-color:rgb(255, 255, 255);display:inline !imp= ortant"><span style=3D"margin:0px;background-color:rgb(255, 255, 255);displ= ay:inline !important"><span style=3D"margin:0px;background-color:rgb(255, 2= 55, 255);display:inline !important"><span><span style=3D"margin:0px;backgro= und-color:rgb(255, 255, 255)"><span style=3D"margin:0px;background-color:rg= b(255, 255, 255);display:inline !important"><span style=3D"margin:0px;backg= round-color:rgb(255, 255, 255);display:inline !important"><span style=3D"ma= rgin:0px;background-color:rgb(255, 255, 255);display:inline !important"><sp= an style=3D"margin:0px;background-color:rgb(255, 255, 255);display:inline != important">#######################################CREATING ALLOWED PORT LIST</span><br> </span></span></span></span> <div style=3D"margin:0px;background-color:rgb(255, 255, 255)"><span style= =3D"margin:0px;background-color:rgb(255, 255, 255);display:inline !importan= t"><span style=3D"margin:0px;background-color:rgb(255, 255, 255);display:in= line !important"><span style=3D"margin:0px;background-color:rgb(255, 255, 2= 55);display:inline !important"><span style=3D"margin:0px;background-color:r= gb(255, 255, 255);display:inline !important">ipset </span>create ALLOWPORTS bitmap:port range 0-65535 <div style=3D"margin:0px"><span style=3D"margin:0px;background-color:rgb(25= 5, 255, 255);display:inline !important">ipset </span>add <span st= yle=3D"background-color:rgb(255, 255, 255);display:inline !important">ALLOW= PORTS</span><span> 80</span></div> <span style=3D"margin:0px"><span style=3D"margin:0px;background-color:rgb(2= 55, 255, 255);display:inline !important">ipset </span>add <span s= tyle=3D"background-color:rgb(255, 255, 255);display:inline !important">ALLO= WPORTS</span><span> 443</span></span></span></span></span></div> <div style=3D"margin:0px;background-color:rgb(255, 255, 255)"><span style= =3D"margin:0px;background-color:rgb(255, 255, 255);display:inline !importan= t"><span style=3D"margin:0px;background-color:rgb(255, 255, 255);display:in= line !important"><span style=3D"margin:0px;background-color:rgb(255, 255, 2= 55);display:inline !important"><span style=3D"margin:0px"><span><span style= =3D"margin:0px;background-color:rgb(255, 255, 255);display:inline !importan= t">ipset </span><span style=3D"background-color:rgb(255, 255, 255);dis= play:inline !important">add </span><span style=3D"margin:0px;backgroun= d-color:rgb(255, 255, 255);display:inline !important">ALLOWPORTS</span><spa= n style=3D"margin:0px;background-color:rgb(255, 255, 255)"> 47122 #SSH FAKE</span><br> </span></span></span></span></span></div> </span></span></span></span></div> <div><br> </div> <div><span style=3D"background-color:rgb(255, 255, 255);display:inline !imp= ortant"><span style=3D"margin:0px;background-color:rgb(255, 255, 255);displ= ay:inline !important"><span style=3D"margin:0px;background-color:rgb(255, 2= 55, 255);display:inline !important"><span><span style=3D"background-color:r= gb(255, 255, 255);display:inline !important">##############################= #########CREATING TAR PIT</span><br> </span></span></span></span></div> <div><span style=3D"background-color:rgb(255, 255, 255);display:inline !imp= ortant"><span style=3D"margin:0px;background-color:rgb(255, 255, 255);displ= ay:inline !important"><span style=3D"margin:0px;background-color:rgb(255, 2= 55, 255);display:inline !important"><span>create TARPIT hash:ip family inet hashsize 1024 maxelem 65536 timeout 600<br> </span></span></span></span></div> <div><br> </div> <div><span style=3D"background-color:rgb(255, 255, 255);display:inline !imp= ortant"><span style=3D"margin:0px;background-color:rgb(255, 255, 255);displ= ay:inline !important">####################################### CREATING LOG-= DROP-RULESET<br> iptables -N LOGDROP_100<br> <span style=3D"background-color:rgb(255, 255, 255);display:inline !importan= t">iptables -A LOGDROP_100 -m limit --limit 1/sec -j LOG --log-prefix = " ::<span style=3D"background-color:rgb(255, 255, 255);display:inline = !important">LOGDROP_100</span>:: "</span></span></span></div> <div><span style=3D"background-color:rgb(255, 255, 255);display:inline !imp= ortant"><span style=3D"margin:0px;background-color:rgb(255, 255, 255);displ= ay:inline !important"><span style=3D"background-color:rgb(255, 255, 255);di= splay:inline !important"><span style=3D"background-color:rgb(255, 255, 255)= ;display:inline !important">iptables -A LOGDROP_100 -j DROP</span><br> </span></span></span></div> <div><span style=3D"background-color:rgb(255, 255, 255);display:inline !imp= ortant"><span style=3D"margin:0px;background-color:rgb(255, 255, 255);displ= ay:inline !important"><br> </span></span></div> <div><span style=3D"background-color:rgb(255, 255, 255);display:inline !imp= ortant"><span style=3D"margin:0px;background-color:rgb(255, 255, 255);displ= ay:inline !important"> <div style=3D"margin:0px;background-color:rgb(255, 255, 255)"><span style= =3D"margin:0px;background-color:rgb(255, 255, 255);display:inline !importan= t"><span style=3D"margin:0px;background-color:rgb(255, 255, 255);display:in= line !important">####################################### CREATING LOG-TARPIT-RULESET<br> iptables -N LOGTARPIT_100<br> <span style=3D"margin:0px;background-color:rgb(255, 255, 255);display:inlin= e !important">iptables -A <span style=3D"background-color:rgb(255, 255, 255);display:inline !importan= t">LOGTARPIT</span>_100 -m limit --limit 1/sec -j LOG --log-prefix &qu= ot; ::<span style=3D"margin:0px;background-color:rgb(255, 255, 255);display= :inline !important">LOGDROP_100</span>:: "</span></span></span></div> <div style=3D"margin:0px;background-color:rgb(255, 255, 255)"><span style= =3D"margin:0px;background-color:rgb(255, 255, 255);display:inline !importan= t"><span style=3D"margin:0px;background-color:rgb(255, 255, 255);display:in= line !important"><span style=3D"margin:0px;background-color:rgb(255, 255, 2= 55);display:inline !important"><span style=3D"margin:0px;background-color:r= gb(255, 255, 255);display:inline !important">iptables -A <span style=3D"background-color:rgb(255, 255, 255);display:inline !impo= rtant">LOGTARPIT</span>_100 -j SET --add-set <span style=3D"background-color:rgb(255, 255, 255);display:inline !importan= t">TARPIT</span> src</span><br> </span></span></span></div> <div style=3D"margin:0px;background-color:rgb(255, 255, 255)"><span style= =3D"margin:0px;background-color:rgb(255, 255, 255);display:inline !importan= t"><span style=3D"margin:0px;background-color:rgb(255, 255, 255);display:in= line !important"><span style=3D"margin:0px;background-color:rgb(255, 255, 2= 55);display:inline !important"><span style=3D"margin:0px;background-color:r= gb(255, 255, 255);display:inline !important"><span style=3D"background-colo= r:rgb(255, 255, 255);display:inline !important">iptables -A <span style=3D"margin:0px;background-color:rgb(255, 255, 255);disp= lay:inline !important">LOGTARPIT</span><span style=3D"background-color:rgb(= 255, 255, 255);display:inline !important">_100 -j DROP</span></span><br> </span></span></span></span></div> </span></span></div> <div><br> </div> <div><span style=3D"background-color:rgb(255, 255, 255);display:inline !imp= ortant"><span style=3D"margin:0px;background-color:rgb(255, 255, 255);displ= ay:inline !important"> <div style=3D"margin:0px;background-color:rgb(255, 255, 255)"><span style= =3D"margin:0px;background-color:rgb(255, 255, 255);display:inline !importan= t"><span style=3D"margin:0px;background-color:rgb(255, 255, 255);display:in= line !important">####################################### CREATING LOG-ALLOW-RULESET<br> iptables -N LOGALLOW_100<br> <span style=3D"margin:0px;background-color:rgb(255, 255, 255);display:inlin= e !important">iptables -A LOGALLOW_100 -m limit --limit 1/sec -j LOG -= -log-prefix " ::<span style=3D"margin:0px;background-color:rgb(255, 25= 5, 255);display:inline !important">LOGALLOW_100</span>:: "</span></span></span></div> <div style=3D"margin:0px;background-color:rgb(255, 255, 255)"><span style= =3D"margin:0px;background-color:rgb(255, 255, 255);display:inline !importan= t"><span style=3D"margin:0px;background-color:rgb(255, 255, 255);display:in= line !important"><span style=3D"margin:0px;background-color:rgb(255, 255, 2= 55);display:inline !important"><span style=3D"margin:0px;background-color:r= gb(255, 255, 255);display:inline !important">iptables -A LOGALLOW_100 -m state --state NEW -j ACCEPT</span><br> </span></span></span></div> </span></span></div> <div><br> </div> <div><span style=3D"background-color:rgb(255, 255, 255);display:inline !imp= ortant"><span style=3D"margin:0px;background-color:rgb(255, 255, 255);displ= ay:inline !important"> <div style=3D"margin:0px;background-color:rgb(255, 255, 255)"><span style= =3D"margin:0px;background-color:rgb(255, 255, 255);display:inline !importan= t"><span style=3D"margin:0px;background-color:rgb(255, 255, 255);display:in= line !important">####################################### CREATING IN FLOW RULESET<br> iptables -N INFLOW_100</span></span></div> <div style=3D"margin:0px;background-color:rgb(255, 255, 255)"><span style= =3D"margin:0px;background-color:rgb(255, 255, 255);display:inline !importan= t"><span style=3D"margin:0px;background-color:rgb(255, 255, 255);display:in= line !important">iptables -A <span style=3D"background-color:rgb(255, = 255, 255);display:inline !important">INFLOW_100 -m state --state RELATED,ESTABLISHED -j ACCEPT</span></span></span></div> <div style=3D"margin:0px;background-color:rgb(255, 255, 255)"><span style= =3D"margin:0px;background-color:rgb(255, 255, 255);display:inline !importan= t"><span style=3D"margin:0px;background-color:rgb(255, 255, 255);display:in= line !important"><span style=3D"background-color:rgb(255, 255, 255);display= :inline !important">#</span></span></span></div> <div style=3D"margin:0px;background-color:rgb(255, 255, 255)"><span style= =3D"margin:0px;background-color:rgb(255, 255, 255);display:inline !importan= t"><span style=3D"margin:0px;background-color:rgb(255, 255, 255);display:in= line !important"><span style=3D"background-color:rgb(255, 255, 255);display= :inline !important">iptables -A INFLOW_100 </span>-m set --match-set <span style=3D"margin:0px;bac= kground-color:rgb(255, 255, 255);display:inline !important"> ALLOW</span><span style=3D"margin:0px;background-color:rgb(255, 255, 255);d= isplay:inline !important">IPLIST</span> src -j <span style=3D"background-color:rgb(255, 255, 255);display:inline !importan= t">LOGALLOW_100</span></span></span></div> <div style=3D"margin:0px;background-color:rgb(255, 255, 255)"><span style= =3D"margin:0px;background-color:rgb(255, 255, 255);display:inline !importan= t"><span style=3D"margin:0px;background-color:rgb(255, 255, 255);display:in= line !important"><span style=3D"background-color:rgb(255, 255, 255);display= :inline !important"><span style=3D"margin:0px;background-color:rgb(255, 255= , 255);display:inline !important">iptables -A INFLOW_100 </span><span style=3D"margin:0px;background-color:rgb(2= 55, 255, 255);display:inline !important">-m set --match-set<span style=3D"m= argin:0px"> ALLOWPORT</span></span><span style=3D"margin:0px;backgroun= d-color:rgb(255, 255, 255);display:inline !important"><span style=3D"margin= :0px"> dst</span> -j<span style=3D"margin:0px"> <span style= =3D"margin:0px;background-color:rgb(255, 255, 255);display:inline !importan= t">LOGALLOW_100</span></span></span><br> </span></span></span></div> <div style=3D"margin:0px;background-color:rgb(255, 255, 255)"><span style= =3D"margin:0px;background-color:rgb(255, 255, 255);display:inline !importan= t"><span style=3D"margin:0px;background-color:rgb(255, 255, 255);display:in= line !important"><span style=3D"background-color:rgb(255, 255, 255);display= :inline !important"><span style=3D"margin:0px;background-color:rgb(255, 255= , 255);display:inline !important"><span style=3D"margin:0px"><span style=3D= "margin:0px;background-color:rgb(255, 255, 255);display:inline !important">= #</span></span></span></span></span></span></div> <div style=3D"margin:0px;background-color:rgb(255, 255, 255)">iptables -A I= NFLOW_100 -m set --match-set BLOCKIPLIST src -j LOGDROP= _100<br> </div> <div style=3D"margin:0px;background-color:rgb(255, 255, 255)"><span style= =3D"margin:0px;background-color:rgb(255, 255, 255);display:inline !importan= t"><span style=3D"margin:0px;background-color:rgb(255, 255, 255);display:in= line !important"><span style=3D"margin:0px;background-color:rgb(255, 255, 2= 55);display:inline !important"><span style=3D"margin:0px;background-color:r= gb(255, 255, 255);display:inline !important">iptables -A INFLOW_100 </span><span style=3D"margin:0px;background-color:rgb(2= 55, 255, 255);display:inline !important">-m set --match-set<span style=3D"m= argin:0px"> BLOCKPORT</span></span><span style=3D"margin:0px;backgroun= d-color:rgb(255, 255, 255);display:inline !important"><span style=3D"margin= :0px"> dst</span> -j<span style=3D"margin:0px"> </span></spa= n><span style=3D"margin:0px;background-color:rgb(255, 255, 255);display:inl= ine !important">LOGTARPIT_100</span></span></span></span></div> <div style=3D"margin:0px;background-color:rgb(255, 255, 255)"><span style= =3D"margin:0px;background-color:rgb(255, 255, 255);display:inline !importan= t"><span style=3D"margin:0px;background-color:rgb(255, 255, 255);display:in= line !important"><span style=3D"margin:0px;background-color:rgb(255, 255, 2= 55);display:inline !important"><span style=3D"margin:0px;background-color:r= gb(255, 255, 255);display:inline !important">#</span></span></span></span><= /div> <div style=3D"margin:0px;background-color:rgb(255, 255, 255)"><span style= =3D"margin:0px;background-color:rgb(255, 255, 255);display:inline !importan= t"><span style=3D"margin:0px;background-color:rgb(255, 255, 255);display:in= line !important"><span style=3D"margin:0px;background-color:rgb(255, 255, 2= 55);display:inline !important"><span style=3D"margin:0px;background-color:r= gb(255, 255, 255);display:inline !important">iptables -A INFLOW_100 -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j LOGDROP_10= 0<br> #</span></span></span></span></div> <div style=3D"margin:0px;background-color:rgb(255, 255, 255)"><span style= =3D"margin:0px;background-color:rgb(255, 255, 255);display:inline !importan= t"><span style=3D"margin:0px;background-color:rgb(255, 255, 255);display:in= line !important">iptables -A INFLOW_100 -m state --state INVALID -j DROP<br> </span></span></div> <br> ###################################### RESTRICTING FLOW<br> iptables -F INPUT<br> iptables -F FORWARD</span></span></div> <div><span style=3D"background-color:rgb(255, 255, 255);display:inline !imp= ortant"><span style=3D"margin:0px;background-color:rgb(255, 255, 255);displ= ay:inline !important">iptables -F OUTPUT<br> <br> iptables -A INPUT -i eth0 -j <span style=3D"background-color:rgb(255, = 255, 255);display:inline !important">INFLOW_100<br> <span style=3D"background-color:rgb(255, 255, 255);display:inline !importan= t">iptables -A FORWARD -i eth0 -j </span><span style=3D"margin:0px;bac= kground-color:rgb(255, 255, 255);display:inline !important">INFLOW_100<br> <br> #THIS AVOID UNRECHEABLE MESSAGES TO OTHERS IS USEFULL <br> </span><span style=3D"background-color:rgb(255, 255, 255);display:inline !i= mportant">iptables -A OUTPUT -o eth0 -p icmp -m icmp --icmp-type 3 -j = DROP</span><br> </span></span></span></div> <div><br> </div> </div> <div id=3D"appendonsend"></div> <hr style=3D"display:inline-block;width:98%" tabindex=3D"-1"> <div id=3D"divRplyFwdMsg" dir=3D"ltr"><font face=3D"Calibri, sans-serif" st= yle=3D"font-size:11pt" color=3D"#000000"><b>De:</b> linux_forum1 <linux_= [email protected]><br> <b>Enviado:</b> sexta-feira, 7 de janeiro de 2022 06:22<br> <b>Para:</b> Willian Pires <[email protected]><br> <b>Cc:</b> Dan Ritter <[email protected]>; [email protected]= ebian.org <[email protected]><br> <b>Assunto:</b> RE: Is this even POSSIBLE?</font> <div> </div> </div> <div> <div style=3D"font-family:arial; font-size:14px"> <div style=3D"font-family:arial; font-size:14px">Hello William, thanks for = the reply!<br> </div> <div style=3D"font-family:arial; font-size:14px"><br> </div> <div style=3D"font-family:arial; font-size:14px">ipset would be nice, but i= t doesn't solve the logging issue.<br> </div> <div style=3D"font-family:arial; font-size:14px"><br> </div> <div style=3D"font-family:arial; font-size:14px">I have about 30 rules like= the ones below that need to be logged and dropped if matched with iptables= . (Both in INPUT and FORWARD)<br> </div> <div style=3D"font-family:arial; font-size:14px"><br> </div> </div> <div><span style=3D"color:rgb(38,42,51); font-style:normal; font-variant-li= gatures:normal; font-variant-caps:normal; font-weight:400; letter-spacing:n= ormal; orphans:2; text-align:start; text-indent:0px; text-transform:none; w= hite-space:normal; widows:2; word-spacing:0px; background-color:rgb(255,255= ,255); text-decoration-style:initial; text-decoration-color:initial; float:= none; display:inline!important"><span style=3D""><span class=3D"x_font" sty= le=3D""><span style=3D""><span class=3D"x_size" style=3D"font-size:14.6667p= x"> -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP</span></span></span></span>= </span><br> </div> <div style=3D"font-family:arial; font-size:14px"><span style=3D"color:rgb(3= 8,42,51)"><span class=3D"x_font" style=3D""><span class=3D"x_size" style=3D= "font-size:14.6667px"> -s 169.254.0.0/16 -j DROP</span></span></span><= br> </div> <div><span style=3D"color:rgb(38,42,51); font-style:normal; font-variant-li= gatures:normal; font-variant-caps:normal; font-weight:400; letter-spacing:n= ormal; orphans:2; text-align:start; text-indent:0px; text-transform:none; w= hite-space:normal; widows:2; word-spacing:0px; background-color:rgb(255,255= ,255); text-decoration-style:initial; text-decoration-color:initial; float:= none; display:inline!important"><span style=3D""><span class=3D"x_font" sty= le=3D""><span style=3D""><span class=3D"x_size" style=3D"font-size:14.6667p= x"> -s 172.16.0.0/12 -j DROP</span></span></span></span></span><br> </div> <div><span style=3D"font-style:normal; font-variant-ligatures:normal; font-= variant-caps:normal; font-weight:400; letter-spacing:normal; orphans:2; tex= t-align:start; text-indent:0px; text-transform:none; white-space:normal; wi= dows:2; word-spacing:0px; background-color:rgb(255,255,255); text-decoratio= n-style:initial; text-decoration-color:initial; float:none; display:inline!= important"><span style=3D""><span style=3D""> -s 192.0.2.0/24 -j DROP</span></span></span><br> </div> <div style=3D"font-family:arial; font-size:14px"><br> </div> <div style=3D"font-family:arial; font-size:14px">As I understand it there a= re two ways to log and drop packets that matched a specific rule in iptable= s.<br> </div> <div style=3D"font-family:arial; font-size:14px"><br> </div> <div style=3D"font-family:arial; font-size:14px">1.) Separate LOG and= DROP rules, for each IP, but this is inefficient.<br> </div> <div style=3D"font-family:arial; font-size:14px"><br> </div> <div style=3D"font-family:arial; font-size:14px">-A INPUT -j Block<br> </div> <div style=3D"font-family:arial; font-size:14px">-A FORWARD -j Block<br> </div> <div style=3D"font-family:arial; font-size:14px"><br> </div> <div style=3D"font-family:arial; font-size:14px">-A Block -s 169.254.0.0/16= -j LOG<br> </div> <div style=3D"font-family:arial; font-size:14px">-A Block -s 169.254.0.0/16= -j DROP<br> </div> <div style=3D"font-family:arial; font-size:14px">-A Block -s 172.16.0.0/12 = -j LOG<br> </div> <div style=3D"font-family:arial; font-size:14px">-A Block -s 172.16.0.0/12 = -j DROP<br> </div> <div style=3D"font-family:arial; font-size:14px"><br> </div> <div style=3D"font-family:arial; font-size:14px">2.) The only other way, cr= eate separate chains for bad IPs and LOG/DROP, then jump in between. But Da= n Ritter says this is problematic, because bad IPs are not dropped in Block= chain, but only after jumping to the Logger chain.<br> </div> <div style=3D"font-family:arial; font-size:14px"><br> </div> <div style=3D"font-family:arial; font-size:14px">-N Block<br> </div> <div style=3D"font-family:arial; font-size:14px">-N Logger<br> </div> <div style=3D"font-family:arial; font-size:14px">-A INPUT -j Block<br> </div> <div style=3D"font-family:arial; font-size:14px">-A FORWARD -j Block<br> </div> <div style=3D"font-family:arial; font-size:14px"><br> </div> <div style=3D"font-family:arial; font-size:14px">-A Block -s 169.254.0.0/16= -j Logger<br> </div> <div style=3D"font-family:arial; font-size:14px">-A Block -s 172.16.0.0/12 = -j Logger<br> </div> <div style=3D"font-family:arial; font-size:14px">-A Block -s 192.0.2.0/24 -= j Logger<br> </div> <div style=3D"font-family:arial; font-size:14px"><br> </div> <div style=3D"font-family:arial; font-size:14px">-A Logger -j LOG<br> </div> <div style=3D"font-family:arial; font-size:14px">-A Logger -j DROP<br> </div> <div style=3D"font-family:arial; font-size:14px"><br> </div> <div style=3D"font-family:arial; font-size:14px">I have been searching for = 48h, but there is no other way to log and drop packets.<br> </div> <div style=3D"font-family:arial; font-size:14px"><span style=3D"font-style:= normal; font-variant-ligatures:normal; font-variant-caps:normal; font-weigh= t:400; letter-spacing:normal; orphans:2; text-align:start; text-indent:0px;= text-transform:none; white-space:normal; widows:2; word-spacing:0px; backg= round-color:rgb(255,255,255); text-decoration-style:initial; text-decoratio= n-color:initial; float:none; display:inline!important"><span style=3D""><sp= an style=3D""></span></span></span><br> </div> <div style=3D""> <div style=3D""><br> </div> <div style=3D"font-family:arial; font-size:14px"><br> </div> </div> <div style=3D"font-family:arial; font-size:14px"><br> </div> <div class=3D"x_protonmail_quote">=1B$B!>!>!>!>!>!>!>=1B(B Original Message= =1B$B!>!>!>!>!>!>!>=1B(B<br> On Friday, January 7th, 2022 at 6:20 AM, Willian Pires <willian_pires@ho= tmail.com> wrote:<br> <blockquote type=3D"cite" class=3D"x_protonmail_quote"> <div dir=3D"auto"> <div dir=3D"auto">Sorry, try ipset to create a list and combine it with app= ropriated netfilter rule to blocke networks in one rule, instead use 1 rule= per class.</div> <div dir=3D"auto"><br> </div> <div dir=3D"auto"><br> </div> <div dir=3D"auto"><br> </div> <div dir=3D"auto"><br> </div> <div dir=3D"auto"><br> </div> <div dir=3D"auto"> <div dir=3D"auto" style=3D"font-size:12px; color:#575757">Sent from my Gala= xy</div> </div> <div dir=3D"auto"><br> </div> <div><br> </div> <div><br> </div> <div>-------- Original message --------</div> <div>From: linux_forum1 <[email protected]> </div> <div>Date: 1/6/22 17:11 (GMT-03:00) </div> <div>To: Dan Ritter <[email protected]> </div> <div>Cc: [email protected] </div> <div>Subject: Re: Is this even POSSIBLE? </div> <div><br> </div> </div> <font size=3D"2"><span style=3D"font-size:11pt"> <div><br> <br> Hello Dan!<br> <br> Thank you so much for the reply!<br> <br> Yes that helps a lot, but I have 2 follow up questions if you don't mind ha= ha.<br> <br> 1.) When you say " -A INPUT -j Block puts the chain in order", yo= u mean that at this point iptables will look for any rules appended to the = Block chain, no matter where they are? This would make sense cz then the or= der wouldn't matter and you can jump to a chain in the beginning, whose rules are defined at the bottom for example.= <br> <br> 2.) I want to log when one of these rules gets matched.<br> (It's 30 - 40 rules in total)<br> <br> -A Block -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP<br> -A Block -s 169.254.0.0/16 -j DROP<br> -A Block -s 172.16.0.0/12 -j DROP<br> -A Block -s 192.0.2.0/24 -j DROP<br> .<br> .<br> <br> This is my solution:<br> <br> -A INPUT -j Block<br> -A FORWARD -j Block<br> <br> -A Block -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j Logger<br> -A Block -s 169.254.0.0/16 -j Logger<br> -A Block -s 172.16.0.0/12 -j Logger<br> -A Block -s 192.0.2.0/24 -j Logger<br> <br> Then in Logger it gets logged and dropped.<br> <br> I considered this, but was told the above is better.<br> <br> -A INPUT -j Block<br> -A FORWARD -j Block<br> <br> -A Block -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j LOG<br> -A Block -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP<br> -A Block -s 169.254.0.0/16 -j LOG<br> -A Block -s 169.254.0.0/16 -j DROP<br> -A Block -s 172.16.0.0/12 -j LOG<br> -A Block -s 172.16.0.0/12 -j DROP<br> .<br> .<br> <br> Is there a better way? Thanks again.<br> <br> =1B$B!>!>!>!>!>!>!>=1B(B Original Message =1B$B!>!>!>!>!>!>!>=1B(B<br> <br> On Thursday, January 6th, 2022 at 7:26 PM, Dan Ritter <dsr@randomstring.= org> wrote:<br> <br> > linux_forum1 wrote:<br> ><br> > > Hello, I have 2 questions if that's OK.<br> > ><br> > > INPUT DROP<br> > ><br> > > FORWARD DROP<br> > ><br> > > OUTPUT DROP<br> > ><br> > > -N Block<br> > ><br> > > -N Logger<br> > ><br> > > -A INPUT -j Block<br> > ><br> > > -A Block -p tcp -m tcp --tcp-flags SYN,FIN SYN,FIN -j Logger<br> > ><br> > > -A Logger -j LOG --log-level 4<br> > ><br> > > -A Logger -j DROP<br> > ><br> > > -A INPUT -i lo -j ACCEPT<br> > ><br> > > -A OUTPUT -o lo -j ACCEPT<br> > ><br> > > There will be more rules in Block, but I just want to understand = the logic.<br> > ><br> > > 1.) How is -A INPUT -j Block possible before there are any rules = appended to Block, does that mean iptables first searches and assembles all= rules that belong to custom chains regardless of order? Same for Logger.<b= r> ><br> > Everything has an order. You can turn on line numbers and see<br> ><br> > the order.<br> ><br> > Creating a chain (Block, Logger) does not put it into order.<br> ><br> > The jump (-j) to Block, from INPUT, places the chain in order.<br> ><br> > I note that you don't have a rule in Block to actually drop<br> ><br> > packets, and you do have a rule in Logger that drops packets.<br> ><br> > That seems... problematic to me.<br> ><br> > > 2.)<br> > ><br> > > Would this be OK to log and drop all rules in in Block?<br> > ><br> > > I am worried because there are four jumps, INPUT -> Block ->= ; Logger -> LOG -> Logger -> DROP<br> ><br> > In general, you can jump as many times as you like as long as<br> ><br> > you don't go in a circle. Note that -j LOG continues processing<br> ><br> > on the next rule in order, unlike ACCEPT, DROP and REJECT. If a chain<= br> ><br> > ends without ACCEPT, DROP or REJECT happening, then when it ends<br> ><br> > execution picks up at the next statement in order following the<br> ><br> > jump to that chain.<br> ><br> > Does that help?<br> ><br> > -dsr-<br> <br> </div> </span></font></blockquote> <br> </div> </div> </body> </html> --_000_PH0PR07MB8672B7FC5DFB7BB451773D13954E9PH0PR07MB8672namp_--