iptables syn flood 对策

Question

找到了！问题既来自 SYN 洪水对策，它丢弃授权流而不是接受它们，也来自 SSH 暴力破解对策，它在 SYN 洪水对策之后，因此它没有丢弃任何多余的传入连接，因为这些连接已经被 SYN 洪水对策接受。

以下是该脚本的良好版本：

#!/bin/sh
IPT=/sbin/iptables

echo "Clearing firewall rules"
$IPT -F
$IPT -Z
$IPT -t nat -F
$IPT -t nat -Z
$IPT -t mangle -F
$IPT -t mangle -Z
$IPT -X

echo "Defining logging policy for dropped packets"
$IPT -N LOGDROP 
$IPT -A LOGDROP -j LOG -m limit --limit 60/min --log-level debug --log-prefix "iptables rejected: "
$IPT -A LOGDROP -j DROP 

echo "Setting firewall policy"
$IPT -P INPUT   ACCEPT
$IPT -P OUTPUT  ACCEPT
$IPT -P FORWARD ACCEPT

echo "Allowing connections from/to lo"
$IPT -I INPUT -i lo    -j ACCEPT
$IPT -I OUTPUT -o lo   -j ACCEPT

echo "Denying web server user outgoing HTTP connections on eth0"
$IPT -A OUTPUT -p tcp --dport 80 -o eth0 -m owner --uid-owner www-data -j LOGDROP
$IPT -A OUTPUT -p udp --dport 80 -o eth0 -m owner --uid-owner www-data -j LOGDROP

echo "Denying more than 3 SSH connection attempts per minute and per IP"
$IPT -A INPUT -p tcp --dport 22 -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPT -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH
$IPT -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j LOGDROP

echo "Setting SYN flood countermeasures"
$IPT -A INPUT -p tcp -i eth0 --syn -m limit --limit 30/s --limit-burst 200 -j ACCEPT
$IPT -A INPUT -p tcp -i eth0 --syn -j LOGDROP

echo "Denying 'w00tw00t' vulnerability scans"
$IPT -A INPUT -p tcp --dport 80 -i eth0 -m string --algo bm --string 'w00tw00t.at.ISC.SANS.' -j LOGDROP

echo "Denying HTTP requests concerning misconfigured anoticiapb.com.br external domain"
$IPT -A INPUT -p tcp --dport 80 -i eth0 -m string --algo bm --string "Host: anoticiapb.com.br" -j LOGDROP
$IPT -A INPUT -p tcp --dport 80 -i eth0 -m string --algo bm --string "Host: www.anoticiapb.com.br" -j LOGDROP

echo "Allowing outgoing traffic corresponding to already initiated connections"
$IPT -A OUTPUT -p ALL -m state --state ESTABLISHED,RELATED -j ACCEPT

echo "Allowing up to 10 ICMP requests per second, dropping any supernumerary ICMP request"
$IPT -A INPUT -p icmp -m limit --limit 10/second -j ACCEPT
$IPT -A INPUT -p icmp -j LOGDROP

echo "Allowing incoming HTTP(S), SMTP, NTP, PgSQL, SolR"
$IPT -A INPUT -p tcp --dport 25   -i eth0                -j ACCEPT
$IPT -A INPUT -p tcp --dport 80   -i eth0                -j ACCEPT
$IPT -A INPUT -p udp --dport 123  -i eth0                -j ACCEPT
$IPT -A INPUT -p tcp --dport 443  -i eth0                -j ACCEPT
$IPT -A INPUT -p tcp --sport 5433 -i eth0.2654 -s 172.16.0.1 -j ACCEPT
$IPT -A INPUT -p tcp --sport 8983 -i eth0.2654 -s 172.16.0.1 -j ACCEPT

echo "Allowing outgoing SSH, SMTP, whois, DNS, HTTP, SolR, PgSQL, ICMP"
$IPT -A OUTPUT -p tcp --dport 22                         -j ACCEPT
$IPT -A OUTPUT -p tcp --dport 25   -o eth0               -j ACCEPT
$IPT -A OUTPUT -p tcp --dport 43   -o eth0           -j ACCEPT
$IPT -A OUTPUT -p tcp --dport 53   -o eth0               -j ACCEPT
$IPT -A OUTPUT -p udp --dport 53   -o eth0               -j ACCEPT
$IPT -A OUTPUT -p tcp --dport 80   -o eth0               -j ACCEPT
$IPT -A OUTPUT -p tcp --dport 443  -o eth0               -j ACCEPT
$IPT -A OUTPUT -p tcp --dport 5433 -o eth0.2654      -j ACCEPT
$IPT -A OUTPUT -p tcp --dport 8983 -o eth0.2654      -j ACCEPT
$IPT -A OUTPUT -p icmp                   -j ACCEPT

echo "Allowing outgoing FTP backup"
$IPT -A OUTPUT -p tcp --dport 20:21 -o eth0 -d 91.121.190.18 -j ACCEPT

echo "Dropping and logging everything else"
$IPT -A INPUT -j LOGDROP 
$IPT -A OUTPUT -j LOGDROP
$IPT -A FORWARD -j LOGDROP

echo "Firewall loaded."

Answer 1

找到了！问题既来自 SYN 洪水对策，它丢弃授权流而不是接受它们，也来自 SSH 暴力破解对策，它在 SYN 洪水对策之后，因此它没有丢弃任何多余的传入连接，因为这些连接已经被 SYN 洪水对策接受。

以下是该脚本的良好版本：

#!/bin/sh
IPT=/sbin/iptables

echo "Clearing firewall rules"
$IPT -F
$IPT -Z
$IPT -t nat -F
$IPT -t nat -Z
$IPT -t mangle -F
$IPT -t mangle -Z
$IPT -X

echo "Defining logging policy for dropped packets"
$IPT -N LOGDROP 
$IPT -A LOGDROP -j LOG -m limit --limit 60/min --log-level debug --log-prefix "iptables rejected: "
$IPT -A LOGDROP -j DROP 

echo "Setting firewall policy"
$IPT -P INPUT   ACCEPT
$IPT -P OUTPUT  ACCEPT
$IPT -P FORWARD ACCEPT

echo "Allowing connections from/to lo"
$IPT -I INPUT -i lo    -j ACCEPT
$IPT -I OUTPUT -o lo   -j ACCEPT

echo "Denying web server user outgoing HTTP connections on eth0"
$IPT -A OUTPUT -p tcp --dport 80 -o eth0 -m owner --uid-owner www-data -j LOGDROP
$IPT -A OUTPUT -p udp --dport 80 -o eth0 -m owner --uid-owner www-data -j LOGDROP

echo "Denying more than 3 SSH connection attempts per minute and per IP"
$IPT -A INPUT -p tcp --dport 22 -m state --state RELATED,ESTABLISHED -j ACCEPT
$IPT -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH
$IPT -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j LOGDROP

echo "Setting SYN flood countermeasures"
$IPT -A INPUT -p tcp -i eth0 --syn -m limit --limit 30/s --limit-burst 200 -j ACCEPT
$IPT -A INPUT -p tcp -i eth0 --syn -j LOGDROP

echo "Denying 'w00tw00t' vulnerability scans"
$IPT -A INPUT -p tcp --dport 80 -i eth0 -m string --algo bm --string 'w00tw00t.at.ISC.SANS.' -j LOGDROP

echo "Denying HTTP requests concerning misconfigured anoticiapb.com.br external domain"
$IPT -A INPUT -p tcp --dport 80 -i eth0 -m string --algo bm --string "Host: anoticiapb.com.br" -j LOGDROP
$IPT -A INPUT -p tcp --dport 80 -i eth0 -m string --algo bm --string "Host: www.anoticiapb.com.br" -j LOGDROP

echo "Allowing outgoing traffic corresponding to already initiated connections"
$IPT -A OUTPUT -p ALL -m state --state ESTABLISHED,RELATED -j ACCEPT

echo "Allowing up to 10 ICMP requests per second, dropping any supernumerary ICMP request"
$IPT -A INPUT -p icmp -m limit --limit 10/second -j ACCEPT
$IPT -A INPUT -p icmp -j LOGDROP

echo "Allowing incoming HTTP(S), SMTP, NTP, PgSQL, SolR"
$IPT -A INPUT -p tcp --dport 25   -i eth0                -j ACCEPT
$IPT -A INPUT -p tcp --dport 80   -i eth0                -j ACCEPT
$IPT -A INPUT -p udp --dport 123  -i eth0                -j ACCEPT
$IPT -A INPUT -p tcp --dport 443  -i eth0                -j ACCEPT
$IPT -A INPUT -p tcp --sport 5433 -i eth0.2654 -s 172.16.0.1 -j ACCEPT
$IPT -A INPUT -p tcp --sport 8983 -i eth0.2654 -s 172.16.0.1 -j ACCEPT

echo "Allowing outgoing SSH, SMTP, whois, DNS, HTTP, SolR, PgSQL, ICMP"
$IPT -A OUTPUT -p tcp --dport 22                         -j ACCEPT
$IPT -A OUTPUT -p tcp --dport 25   -o eth0               -j ACCEPT
$IPT -A OUTPUT -p tcp --dport 43   -o eth0           -j ACCEPT
$IPT -A OUTPUT -p tcp --dport 53   -o eth0               -j ACCEPT
$IPT -A OUTPUT -p udp --dport 53   -o eth0               -j ACCEPT
$IPT -A OUTPUT -p tcp --dport 80   -o eth0               -j ACCEPT
$IPT -A OUTPUT -p tcp --dport 443  -o eth0               -j ACCEPT
$IPT -A OUTPUT -p tcp --dport 5433 -o eth0.2654      -j ACCEPT
$IPT -A OUTPUT -p tcp --dport 8983 -o eth0.2654      -j ACCEPT
$IPT -A OUTPUT -p icmp                   -j ACCEPT

echo "Allowing outgoing FTP backup"
$IPT -A OUTPUT -p tcp --dport 20:21 -o eth0 -d 91.121.190.18 -j ACCEPT

echo "Dropping and logging everything else"
$IPT -A INPUT -j LOGDROP 
$IPT -A OUTPUT -j LOGDROP
$IPT -A FORWARD -j LOGDROP

echo "Firewall loaded."

iptables syn flood 对策

答案1

相关内容