Rozdíly

Zde můžete vidět rozdíly mezi vybranou verzí a aktuální verzí dané stránky.

--- linux:net:firewall [12.08.2005 07:41]
127.0.0.1 external edit
+++ linux:net:firewall [13.03.2020 18:43] (aktuální)
@@ Řádek 1: / Řádek 1: @@
-[[:start]] --- [[:linux]]
+{{page>:menu}}
-----
 ====== Firewall ======
@@ Řádek 6: / Řádek 6: @@
   * firewall na základě scriptu [[http://www.petricek.cz/mpfw/|M.Petříčka]]
   * jednotlivé díly na publikované na [[http://www.root.cz|ROOT]]u: [[http://www.root.cz/clanek.phtml?id=980|1]], [[http://www.root.cz/clanek.phtml?id=990|2]],[[http://www.root.cz/clanek.phtml?id=995|3]]
+===== Petříček =====
 <code bash>
 #!/bin/sh
@@ Řádek 227: / Řádek 230: @@
 # Ostatni pakety logujeme (nemely by byt zadne takove)
 $IPTABLES -A OUTPUT -j LOG --log-prefix "OUTPUT drop: "
+</code>
+===== Dynamický blacklist =====
+  *dynamický blacklist pro SSH spojení - http://olivier.sessink.nl/publications/blacklisting/index.html
+<code bash>
+### Dynamic blacklist for SSH connection
+# create properREJECT chain that does different rejects for tcp/udp
+$IPTABLES -N properREJECT
+$IPTABLES -A properREJECT -p tcp -j REJECT --reject-with tcp-reset
+$IPTABLES -A properREJECT -j REJECT --reject-with icmp-port-unreachable
+#
+$IPTABLES -N blacklistdrop
+$IPTABLES -A blacklistdrop -j LOG --log-prefix "adding to BLACKLIST: "
+$IPTABLES -A blacklistdrop -m recent --name BLACKLIST --set -j DROP
+#
+#
+# on external hosts, do rate limiting on incoming ssh packets, and keep a blacklist for 30 seconds
+# this rule drops *any* packet if the IP is in the blacklist
+# icmp 'destination-unreachable' packets should not update BLACKLIST, because
+# they are generated by our own REJECT rule in the extern_out chain
+$IPTABLES -A extern_in -m recent --name BLACKLIST --update --seconds 120 -j DROP
+#
+# all *established* ssh connections simply continue
+$IPTABLES -A extern_in  -p tcp --dport 22 -m state --state ESTABLISHED,RELATED -j ACCEPT
+#
+# *new* ssh connections are all put into a list 'sshconn', and if there are 3 such packets in 30 seconds
+# we send the package to chain 'blacklistdrop' which puts the IP in the blacklist
+$IPTABLES -A extern_in  -p tcp --dport 22 -m state --state NEW -m recent --name sshconn --rcheck --seconds 30 --hitcount 3 -j blacklistdrop
+#
+# if we have seen less then 3 such packets in the last 30 seconds we accept
+$IPTABLES -A extern_in  -p tcp --dport 22 -m state --state NEW -m recent --name sshconn --set -j ACCEPT
+#
+# if the destination address is in the blacklist, we REJECT *any* packet
+$IPTABLES -A extern_out -m recent --name BLACKLIST --rdest --rcheck --seconds 30 -j properREJECT
+#
+# outgoing we accept all ssh traffic, with connection tracking
+$IPTABLES -A extern_out -p tcp --sport 22 -m state --state ESTABLISHED,NEW,RELATED -j ACCEPT
 </code>
@@ Řádek 237: / Řádek 278: @@
   * http://www.gege.org/iptables/ - analyzátor logů
+===== /etc/sysconfig/iptables =====
+<code>
+*filter
+:INPUT DROP [0:0]
+:FORWARD DROP [0:0]
+:OUTPUT DROP [0:0]
+######################################################################
+# Retezec LOGOVANI
+#
+-N logIN
+-A logIN -j LOG -m limit --limit 10/minute --log-level 4  --log-prefix "INPUT RULE 2 -- DROP "
+-A logIN -j RETURN
+-N logPS
+-A logPS -j LOG -m limit --limit 10/minute --log-level 4  --log-prefix "PORTSCAN RULE 3 -- DROP "
+-A logPS -j RETURN
+######################################################################
+# Retezec INPUT
+#
+# Navazovani spojeni ala Microsoft -
+# Paket navazuje spojeni, ale nema nastaveny priznak SYN, pryc s nim
+-A INPUT -p tcp ! --syn -m state --state NEW -j DROP
+# Portscan s nastavenym SYN,FIN
+-A INPUT -p tcp -i eth0 --tcp-flags SYN,FIN SYN,FIN -j logPS
+-A INPUT -p tcp -i eth0 --tcp-flags SYN,FIN SYN,FIN -j DROP
+# navazana spojeni
+-A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
+# Loopback neomezovat
+-A INPUT -i lo -j ACCEPT
+# Ping
+-A INPUT -i eth0 -p icmp --icmp-type echo-request -j ACCEPT
+## --- Sluzby pro vsechny ---
+# FTP
+-A INPUT -i eth0 -p tcp --dport 21 -j ACCEPT
+# passivni prenos pro FTP
+-A INPUT -i eth0 -p tcp --dport 49160:49170 -j ACCEPT
+-A INPUT -i eth0 -p tcp --dport 80 -j ACCEPT
+-A INPUT -i eth0 -p tcp --dport 443 -j ACCEPT
+## --- Omezeny pristup na sluzby ---
+# Datron DMZ
+-A INPUT -s 212.158.133.128/255.255.255.224 -p tcp -m multiport --destination-port 22,3306 -j ACCEPT
+# Klfree
+-A INPUT -s 81.201.48.0/255.255.255.192 -p tcp --dport 22 -j ACCEPT
+# z domova
+-A INPUT -s 86.63.200.73 -p tcp --dport 22 -j ACCEPT
+# Broadcasty na lokalnim rozhrani jsou take nase
+#-A INPUT -i eth1 -d 10.10.255.255 -j ACCEPT
+# Stejne jako pakety z lokalni site, jsou-li urceny pro nas
+#-A INPUT -i eth1 -d 10.10.30.23 -j ACCEPT
+# MS klienti maji chybu v implementaci DHCP - nechceme DHCP - dropujeme
+-A INPUT -i eth0 -p udp --dport 67 -j DROP
+-A INPUT -i eth1 -p udp --dport 67 -j DROP
+# Ostatni pakety mimo nasi DMZ pred zahozenim logujeme
+-A INPUT -s ! 212.158.133.128/27 -j logIN
+######################################################################
+# Retezec OUTPUT
+#
+# TOS flagy slouzi k optimalizaci datovych cest
+-t mangle -A OUTPUT -o eth0 -p tcp --sport ssh -j TOS --set-tos Minimize-Delay
+-t mangle -A OUTPUT -o eth0 -p tcp --dport ssh -j TOS --set-tos Minimize-Delay
+-t mangle -A OUTPUT -o eth0 -p tcp --sport ftp -j TOS --set-tos Minimize-Delay
+-t mangle -A OUTPUT -o eth0 -p tcp --dport ftp -j TOS --set-tos Minimize-Delay
+-t mangle -A OUTPUT -o eth0 -p tcp --dport telnet -j TOS --set-tos Minimize-Delay
+-t mangle -A OUTPUT -o eth0 -p tcp --sport ftp-data -j TOS --set-tos Maximize-Throughput
+# odchozi pakety veschny
+-A OUTPUT -s 212.158.133.135  -j ACCEPT
+-A OUTPUT -s 10.10.30.23  -j ACCEPT
+## --- Povolime DHCP broadcasty na LAN rozhrani ---
+#-A OUTPUT -o eth1 -p UDP --dport 68 --sport 67 -j ACCEPT
+# Ostatni pakety logujeme (nemely by byt zadne takove)
+-A OUTPUT -j LOG --log-prefix "OUTPUT RULE 1 -- DROP "
+COMMIT
+# Generated by webmin
+*mangle
+:FORWARD ACCEPT [0:0]
+:INPUT ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+:PREROUTING ACCEPT [0:0]
+:POSTROUTING ACCEPT [0:0]
+COMMIT
+# Completed
+# Generated by webmin
+*nat
+:OUTPUT ACCEPT [0:0]
+:PREROUTING ACCEPT [0:0]
+:POSTROUTING ACCEPT [0:0]
+COMMIT
+# Completed
+</code>