0

Can you tell me if my iptables script is good? The final rules protect against DOS attacks. Are they useful? I have no server and my pc is only used for surfing the internet.

Here's my script:

iptables -t filter -F
iptables -t filter -X
iptables -t filter -P INPUT DROP
iptables -t filter -P FORWARD DROP
iptables -t filter -P OUTPUT DROP
iptables -t filter -A INPUT -o lo -s 0.0.0.0/0 -d 0.0.0.0/0 -j ACCEPT
or
iptables -A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -p icmp -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT --protocol tcp --tcp-flags ALL SYN,ACK -j DROP
iptables -A INPUT -m pkttype --pkt-type broadcast -j DROP
iptables -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT
iptables -A OUTPUT -m state ! --state INVALID -j ACCEPT
#if I want to open a port:
iptables -t filter -A INPUT -s 192.168.0.0/24 --dport 110 -j ACCEPT
iptables -t filter -A OUTPUT -s 192.168.0.0/24 --sport 110 -j ACCEPT
#
iptables -A INPUT -m limit --limit 5/min -j LOG --log-prefix   "iptables denied: " --log-level 7
iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
iptables -A FORWARD -p tcp --syn -m limit --limit 1/second -j ACCEPT
iptables -A FORWARD -p udp -m limit --limit 1/second -j ACCEPT
iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/second -j ACCEPT
iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT

Thanks in advance.

#

So I changed the script.
Basic connection (no server, no router, no DHCP and the Ipv6 is disabled)

I did 2 scripts. The second one is, I hope, more secure. What do you think?

script one:

  iptables -F
  iptables -X -t filter
  iptables -P INPUT DROP 
  iptables -P FORWARD DROP 
  iptables -P OUTPUT ACCEPT

  #lo
  iptables -A INPUT -i lo -j ACCEPT
  iptables -A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT
  iptables -A OUTPUT -o lo -j ACCEPT

  #CONNECTION
  iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT

  #PING ACCEPTED AND OPENING PORTS THAT I NEED
  iptables -A INPUT -p icmp --icmp-type echo-request -m conntrack --ctstate NEW -m limit --limit 1/s --limit-burst 1 -j ACCEPT
  iptables -A INPUT -p tcp --dport xxxx -j ACCEPT
  iptables -A INPUT -p udp --dport xxxx -j ACCEPT

  #LOG
  iptables -A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7
  iptables -A FORWARD -j LOG

Script 2 (more secure):

  iptables -F
  iptables -X -t filter
  iptables -P INPUT -j DROP
  iptables -P FORWARD DROP 
  iptables -P OUTPUT -j DROP

  modprobe ip-conntrack

  #lo
  iptables -A INPUT -i lo -j ACCEPT
  iptables -A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT
  iptables -A OUTPUT -o lo -j ACCEPT

  #connection
  iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT
  iptables -A OUTPUT -m state ! --state INVALID -j ACCEPT

  #PING ACCEPTED AND OPENING PORTS THAT I NEED
  iptables -A INPUT -p icmp --icmp-type echo-request -m conntrack --ctstate NEW -m limit --limit 1/s --limit-burst 1 -j ACCEPT
  iptables -A INPUT -d 0.0.0.0/0 -p tcp --sport xxxx -m state --state ESTABLISHED -j ACCEPT (I don't know if I must add 0.0.0.0/0 or 192.168.0.0/24)
  iptables -A INPUT -m limit --limit 7/s -j LOG

  #LOG
  iptables -A OUTPUT -m limit --limit 7/s -j LOG
  iptables -A FORWARD -m limit --limit 7/s -j LOG

Thanks in advance.

  • I looked at your Script 2 and gave a new answer. I might look at your new Script 1 some other time. – Doug Smythies Dec 30 '16 at 17:27
0

This answer is specific to script number 2 from the second set of scripts.

First: Please at least try to load your script before posting it here, and get the syntax sorted out.

  • You are still referring to a table called "filter" which doesn't exist.
  • There is no need to force load modules, they will autoload once referenced.
  • I would suggest to always use a unique log-prefix for every logging line, becuase it makes it much easier to correlate log entries to script location for debugging and just plain clarity.
  • There is no need to specify destination address in your specific port line, but don't you want dport instead of sport?
  • There is no need for that line anyhow because the previous, more generic, ESTABLISHED line means the rule will never be hit.
  • I do not know if you will have troubles using only ESTABLISHED instead of RELATED,ESTABLISHED.
  • As previously mentioned, you do not need any FORWARD rules, but I understand that maybe you just want to log it, in case.
  • For your ping stuff, it is not clear to me that you will achieve your objective with the rule, although I admit I do not know what your objective is. I was still able to flood ping the computer the way you had it. Perhaps you need to specifically deal with the other path, the one that doesn't trigger the rule. Have a look at what I did.

So, I am running this:

#!/bin/sh
# See: http://askubuntu.com/questions/858878/i-need-advice-for-iptables-rules

iptables -F
iptables -X
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

#lo
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT ! -i lo -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -o lo -j ACCEPT

#PING ACCEPTED AND OPENING PORTS THAT I NEED
iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s --limit-burst 1 -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -j DROP

#connection
iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -m state ! --state INVALID -j ACCEPT

#LOG
iptables -A INPUT -m limit --limit 7/s -j LOG --log-prefix "ICATCH:" --log-level info
iptables -A OUTPUT -m limit --limit 7/s -j LOG --log-prefix "OCATCH:" --log-level info
iptables -A FORWARD -m limit --limit 7/s -j LOG --log-prefix "FCATCH:" --log-level info

Giving this, so far:

$ sudo iptables -v -x -n -L
Chain INPUT (policy DROP 218 packets, 21841 bytes)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
       0        0 REJECT     all  --  !lo    *       0.0.0.0/0            127.0.0.0/8          reject-with icmp-port-unreachable
       5      420 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8 limit: avg 1/sec burst 1
     329    27636 DROP       icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8
    3081   206772 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state ESTABLISHED
     213    21380 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 7/sec burst 5 LOG flags 0 level 6 prefix "ICATCH:"

Chain FORWARD (policy DROP 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 7/sec burst 5 LOG flags 0 level 6 prefix "FCATCH:"

Chain OUTPUT (policy DROP 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 ACCEPT     all  --  *      lo      0.0.0.0/0            0.0.0.0/0
    5726  7988360 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ! state INVALID
       0        0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 7/sec burst 5 LOG flags 0 level 6 prefix "OCATCH:"
  • @Abigael : If my answer was good, then please accept it. – Doug Smythies Jan 10 '17 at 18:27
0

No, your iptables script is not very good (and sorry if that sounds harsh).
No, your DOS attack rules are not useful, and I think the INPUT chain one might hinder normal performance. Your FORWARD chain ones are not needed, because you are not using the FORWARD chain (your computer is not acting as a router).

You have many -t filter lines, but your haven't defined a chain called "filter".

I am not familiar with the pkttype module, and so can not comment on that line.

I think you will need to allow some DHCP (ports 67 and 68) traffic, depending on how you assign your IP addresses.

  • Why do you mean by "you haven't defined a chain called 'filter""? Do I add *filter at the top of the script? DHCP is for the server, no? But I have no server. – Abigael Dec 12 '16 at 18:41
  • I mean you are referring to a chain that you did not create. Anyway, and for example, I think you want this iptables -P INPUT DROP instead of this iptables -t filter -P INPUT DROP. If you use DHCP, you need to allow it. – Doug Smythies Dec 12 '16 at 19:35
  • OK thanks. One more quick question: this rule is for opening a port on my private lan: iptables -A INPUT -p tcp -s 192.168.0.0/24 --dport 6881 -j ACCEPT. But if I connect to a FREE Wi-Fi internet, can I use this kind of rule or should I make this rule: iptables -A INPUT -p tcp --dport 6881 -j ACCEPT? – Abigael Dec 15 '16 at 11:42
  • @Abigael: You can try the version of the command that doesn't specify a sub-net. Often Wi-Fi hotspot routers do not allow client to client traffic, so it still might not work. – Doug Smythies Dec 16 '16 at 0:12
  • OK thank you. I'll change the script – Abigael Dec 19 '16 at 11:04

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.