iptables tips and tricks-3

IPTables Tips and Tricks: More Than Just ACCEPT and DROPGary Smith, Pacific Northwest National Laboratory

A Little Context

The Five Golden Principles of SecurityKnow your systemPrinciple of Least PrivilegeDefense in DepthProtection is key but detection is a must.Know your enemy.

2

Avoiding Locking Yourself Out

Scenario: You are going to make changes to the IPTables policy rules. You want to avoid locking yourself, and potentially everybody else out too (this costs time and money).Tips #1: Take a backup of your IPTables configuration before you ever start working on it.

/sbin/iptables-save > /root/iptables-works

Even better, include a timestamp as part of the file name:/sbin/iptables-save > /root/iptables-works-`date +%F`You get a file with a name like

/root/IPTablesworks-2014-04-14.If you do something that prevents your system from working, you can quickly restore it.

/sbin/iptables-restore < /root/iptables-works-2014-04-14

3

Avoiding Locking Yourself Out (2)

Tip #2: Every time you create a backup copy of the IPTables policy, create a link to the file with ‘latest’ as part of the name.

ln –s /root/iptables-works-`date +%F` /root/iptables-works-latest

Create a cron script that will reload to your ‘latest’ working saved policy every 5 minutes during testing.

4


Tip #3: Have an IPMI/KVM console ready and waiting.If you’re working on a physical server, connect to the IPMI port on the server and log into the server.If you’re working on a VM, start up a console session on the VM and log into the VM.

5


Tip #4: Put specific rules at the top of the policy and generic rules at the bottom.The more criteria you specify in the rule, the less chance you will have of locking yourself out.

iptables -A INPUT -p tcp --dport 22 –s 10.0.0.0/8 –d 192.168.100.101 -j DROP

Avoid generic rules like this at the top of the policy rules:iptables -A INPUT -p tcp --dport 22 -j DROP

There are plenty of ways that you can be more specific. For example, using "-i eth0" will limit the processing to a single NIC in your server. This way, it will not apply the rule to eth1.

6


Tip #5: Whitelist your IP address at the top of your policy rules.This is a very effective method of not getting locked out.Everybody else, not so much.

iptables -I INPUT -s <your IP> -j ACCEPTYou need to put this as the FIRST rule in order for it to work properly. Remember, "-I" inserts it as the first rule; "-A" appends it to the end of the list.

7


Tip #6: Know and understand all of the rules in your current policy.Not making the mistake in the first place is half the battle.If you understand the inner workings behind your IPTables policy, it will make your life easier. Draw a flow chart if you must.Also remember: What the policy does and what it is supposed to do can be two different things.

8

Setting Up a Workstation Firewall Policy

Scenario: You want to set up a workstation with a restrictive firewall policy:Tip #1: Set the default policy as DROP.Tip #2: Allow only the minimum amount of services needed to let the user get work done.

# Set a default policy of DROP*filter:INPUT DROP [0:0]:FORWARD DROP [0:0]:OUTPUT DROP [0:0]

9

Setting Up a Workstation Firewall Policy (2)

# Accept any related or established connections-I INPUT 1 -m state --state RELATED,ESTABLISHED -j ACCEPT-I OUTPUT 1 -m state --state RELATED,ESTABLISHED -j ACCEPT

# Allow all traffic on the loopback interface-A INPUT -i lo -j ACCEPT-A OUTPUT -o lo -j ACCEPT

# Allow outbound DHCP request -A OUTPUT –o eth0 -p udp --dport 67:68 --sport 67:68 -j ACCEPT

10


# Allow inbound SSH-A INPUT -i eth0 -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT

# Allow outbound email-A INPUT -i eth0 -p tcp -m tcp --dport 25 -m state --state NEW -j ACCEPT

# Outbound DNS lookups-A OUTPUT -o eth0 -p udp -m udp --dport 53 -j ACCEPT

# Outbound PING requests-A OUTPUT –o eth0 -p icmp -j ACCEPT

# Outbound Network Time Protocol (NTP) request-A OUTPUT –o eth0 -p udp --dport 123 --sport 123 -j ACCEPT

11


# Outbound HTTP-A OUTPUT -o eth0 -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT-A OUTPUT -o eth0 -p tcp -m tcp --dport 443 -m state --state NEW -j ACCEPT

COMMIT

12

Restricting an IP Address Range

Scenario: You’re employees are spending too much time on Facebook and not getting their work done.You want to block access to Facebook.Tip: Use this process to block access to Facebook.

Find out all ip addresses of facebook.com:host -t a www.facebook.comwww.facebook.com is an alias for star.c10r.facebook.com.star.c10r.facebook.com has address 31.13.65.17whois 31.13.65.17 | grep inetnuminetnum: 31.13.64.0 - 31.13.127.255

13

Restricting an IP Address Range (2)

Convert that range to CIDR notation (http://www.ipaddressguide.com/cidr) and you get 31.13.64.0/18.To prevent outgoing access to www.facebook.com, doiptables -A OUTPUT -p tcp -i eth0 –o eth1 –d 31.13.64.0/18 -j DROP

14

Regulating by Time

Scenario: The backlash from your employees over denying access to Facebook is causes you to relent (a little). You decide to allow access to facebook.com only at lunch time (1200 to 1300).Tip: Use the time features of IPTables to open up the access.

iptables –A OUTPUT -p tcp -m multiport –dport http,https -i eth0 -o eth1 -m time --timestart 12:00 --timestop 13:00 –d 31.13.64.0/18 -j ACCEPT

This presumes a default policy of DROP.

15

Regulating by Time (2)

Scenario: Drop all TCP/UDP traffic during service hours (between 02:00 and 03:00), that is, for maintenance’s tasks which should not be disrupted by incoming traffic.

iptables -A INPUT -p tcp -m time --timestart 02:00 --timestop 03:00 -j DROP iptables -A INPUT -p udp -m time --timestart 02:00 --timestop 03:00 -j DROP

16

Limiting Connections with IPTables

Scenario: You suspect a bad actor is attempting to DoS your webserver. Tip #1: You can restrict the number of connections a single IP address can have to your webserver.

iptables –A INPUT –p tcp –syn -m multiport -–dport 80,443 –m connlimit -–connlimit-above 20 –j REJECT -–reject-with-tcp-reset

17

Limiting Connections by Time (2)

Tip #2: You can drop incoming connections if the IP address makes more than 10 connections to port 80/443 in 100 seconds.

iptables –A INPUT –p tcp -m multiport -–dport 80,443 –m state d–state NEW –m recent -–setiptables –A INPUT –p tcp -m multiport -–dport 80,443 –m state -–state NEW –m recent -–update -–seconds 100 –hitcount 10 –j DROP

18

Monitoring IPTables

Scenario: You would like to monitor what’s going on with IPTables in real time, sort of like with “top”.Tip #1: Issue this command as root:

watch --interval=5 ’iptables -nvL | grep -v "0 0"’Note: the spacing on the “grep” command is important.The result looks like this:

19

Monitoring IPTables (2)

20


Tip #2: Use this Perl script from perlmonks.org http://www.perlmonks.org/?node_id=513732. It does a more comprehensive display.

21


22

Reporting on IPTables

Scenario: You (Your boss) think(s) this dynamic stuff is just great, but a daily activity report would also be great.Tip: Use FWReport (http://fwreport.sourceforge.net/).FWReport is a log parser and reporting tool for IPTables. It generates daily and monthly summaries of the log files, allowing the security administrator to free up substantial time, maintain better control over security of the network, and reduce unnoticed attacks.

23

Reporting on IPTables (2)

24

Visualizing IPTables Log Files

Scenario: It’s almost time for the monthly operations review and you would like to have a really great graphical representation of the activity on the firewall for the past month.Tip: There is an excellent tutorial on how to use psad, afterglow, and graphviz to visualize the activity in your IPTables firewall logs (http://lintut.com/use-afterglow-to-visualize-iptables-logs-on-centos-rhel-fedora/)Here are some examples:

25

Visualizing IPTables Firewall Input

26

Visualizing IPTables Firewall Output

27

In Conclusion…

We’ve covered many facets of IPTables; all the way from making sure you don’t lock yourself out when working with IPTables to monitoring IPTables to visualizing the activity of an IPTables firewall.These are just some of the tips and tricks that exist for IPTables.These will get you started down the path to realizing even more IPTables tips and tricks.There REALLY is more to IPTables than just ACCEPT and DROP.

28

References

Convert an address range to CIDR - www.ipaddressguide.com/cidrReal-time IPTables Monitor - www.perlmonks.org/?node_id=513732FWReport - http://fwreport.sourceforge.netUsing Afterglow to Visualize IPTables Logs - http://lintut.com/use-afterglow-to-visualize-IPTables-logs-on-centos-rhel-fedora/IPTables - http://www.netfilter.org/

29

Questions?

30

Gary SmithInformation System Security Officer, Molecular

Science Computing, Pacific Northwest National Laboratory

Richland, [email protected]

mailto:[email protected]

mailto:[email protected]

iptables tips and tricks-3

Documents