7 Usi non comuni di Iptables

  8 Responses to “7 Usi non comuni di Iptables”

1. 

   Jonathan says:

   8 November 2010 at 16:56

   The black list isn’t that comprehensive, because most of the spam still gets through. Having a script that puts each IP address in its own command, instead of using the comma separator makes iptables unnecessarily long. Analyzing a month worth of data only provides 2 unique matches against this list on port 25. Checking all incoming traffic only has about 18 unique matches in a month.
   iptables –list
   now takes a crazy amount of time because we didn’t list at least 5 ip’s per line
   iptables.save is now 30000+ lines long because of above.

   script doesn’t integrate well with an existing rules set.
   If this could be worked into an integrated script/process and then use cron to download it once an hour that would be awesome.

   Rispondi
2. 

   Jonathan says:

   10 November 2010 at 06:37

   the firewall starting using 100% of the cpu and my bandwidth dropped in half with 3ghz of cpu processing power. Doesn’t anybody verify these tips are good idea before sharing them with others.

   Rispondi
3. 

   Mihamina Rakotomandimby says:

   6 September 2011 at 21:35

   The listed usages are not “uncommon”.

   Rispondi
   • 

     linuxari says:

     6 September 2011 at 21:38

     Thanks forr the visit,
     And well the “common” use it’s, for me, the plain firewall usage that most of the people do of Iptables…wait no, most of the people don’t even use it 😉

     Bye

     Rispondi
4. Network Newz » Blog Archive » An Iptables Eulogy, Part 1: Introduction says:

   26 September 2011 at 16:05

   […] Have you ever wanted to block brute force attacks, blacklist IP addresses, send “knocks” to open secret ports on your server, reroute port 9001 to 80, limit the number of connections to a port, or limit the amount of time a port is open? Iptables can do all of this and more. […]
5. 

   Brian Micek says:

   14 March 2012 at 06:16

   I was really motivated by your blacklist example. ipset(8) is really fast in comparison to blocking individual IP CIDRs or IP addresses. Here are my iptables rules for working with the ipset:
   iptables –new-chain BLACKLISTLOG
   # create the ipset so the below iptables rules work
   ipset create -exist BLACKLIST_DROP hash:ip 2>/dev/null
   # ensure no incoming packets are in the hash:ip space
   iptables –append INPUT –in-interface $IN –match set –match-set BLACKLIST_DROP src –jump BLACKLISTLOG
   iptables –append BLACKLISTLOG –match limit –limit 1/s –jump LOG –log-prefix “[BLACKLIST] ”
   iptables –append BLACKLISTLOG –jump DROP
   Here is my cron script to create the BLACKLIST_DROP ipset … it installs the blacklist above in about 60 seconds
   on my firewall:
   // —- start installIpsetFromNet.sh
   #!/bin/bash
   ###############################################################################
   # File:
   #
   # Description:
   #
   # History:
   # Brian Micek – March 2012
   ###############################################################################

   readonly ME=$( basename $0 )

   # —————————————————————————–
   # – help() – prints help
   # —————————————————————————–
   function help() {
   cat – <<EOF
   $ME $ME
   NAME
   $ME – Installs an ipset(8) address space in your kernel for iptables(8)

   SYNOPSIS
   $ME list-URL kernel-list-name [hash:net|hash:ip]

   TYPICAL USAGE
   $ME "http://www.ipdeny.com/ipblocks/data/countries/us.zone&quot; \\
   "us_cidrs" hash:net

   DESCRIPTION
   This bash script installs an ipset(8) IP address space in your kernel. The
   purpose of an ipset address space is to discriminate (typically incoming)
   IP packets against the list for ACCEPT, REJECT or DROP dispositions

   OPTIONS
   None

   NOTES:
   Logging by this program is sent to syslog(8) and also stderr.
   $ME $ME
   EOF
   }
   # —————————————————————————–
   # – log() – delivers log messages to stderr and syslogd
   # —————————————————————————–
   function log() { #<– variable arguments for logging
   logger -s -t $ME $@
   }

   # —————————————————————————–
   # – getList() – gets an IP or CIDR list from the net
   # —————————————————————————–
   function getList() { #<– 1 argument of URL
   log Fetching and parsing $@
   wget -qO – $@ |
   awk -F "." '/^[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}/ {
   if ( NF == 4 ) {
   for ( i = 1; i = 1 ) {
   if ( ar[ 1 ] 255 ) {
   next
   }
   }
   if ( n >= 2 ) {
   if ( ar[ 2 ] 32 ) {
   next
   }
   }
   }
   print
   }
   }’
   }

   # —————————————————————————–
   # – appendList() – Inserts rules into the custom chain to accept and log
   # – the candidate IP address
   # —————————————————————————–
   function appendList() { #<– 2 arguments, list-name, cidr
   local listname=$1
   local cidr=$2
   ipset add -exist $listname $cidr
   return $?
   }
   # —————————————————————————–
   # – addList() – Reads records from stdin and add them to the ipset IP space
   # —————————————————————————–
   function addList() { #<– 2 args, type and name
   local type=$1
   local name=$2

   readonly TEMP_SET=TEMP_$2
   log Creating temporary ipset $TEMP_SET
   ipset create -exist $TEMP_SET $type
   # in case it already existed, flush it
   ipset flush $TEMP_SET

   local c=0
   # Insert each successful CIDR into iptables. W
   while read cidr
   do
   c=$[ $c + 1 ]
   local v=$[ c % 1000 ]
   if [ $v -eq 0 ]
   then
   log Installed $c rules on $TEMP_SET
   fi
   appendList $TEMP_SET $cidr
   if [ $? -ne 0 ]
   then
   log List append error
   break
   fi
   done
   if [ $c -gt 1 ]
   then
   log Finished, installed $c CIDRs on $TEMP_SET
   log Swapping new list $TEMP_SET with $name
   ipset swap $TEMP_SET $name
   if [ $? -ne 0 ]
   then
   # Probably this is the first time this program was run
   # and the destination does not exist yet.
   log IP set doesnt apprear to exist, renaming
   ipset rename $TEMP_SET $name
   if [ $? -ne 0 ]
   then
   log ERROR ERROR ERROR issuing ipset swap $TEMP_SET $name $type
   # I'm not quite sure what to do here, most likely the
   # new set was created with a differing type
   exit 1
   fi
   else
   # else the swap worked and TEMP_SET now holds old data
   log Flushing old data in $TEMP_SET
   ipset flush $TEMP_SET
   log Deleting old data in $TEMP_SET
   ipset destroy $TEMP_SET
   fi
   else
   # Else we were not able to install any darn rules
   log ERROR did not install any rules destined for $name
   # Leave the old chain intact and flush and delete TEMP_SET
   log Flushing old data in $TEMP_SET
   ipset flush $TEMP_SET
   log Deleting old data in $TEMP_SET
   ipset destroy $TEMP_SET
   fi
   log $( ipset list -terse $name )
   }
   # —————————————————————————–
   # MAIN
   # —————————————————————————–
   # installChain "http://www.ipdeny.com/ipblocks/data/countries/us.zone&quot; "us_cidrs" hash:net
   #
   if [ $# -lt 2 ]
   then
   help
   exit 1
   elif [ $# -eq 2 ]
   then
   type="hash:net"
   else
   type=$3
   fi
   case "$type" in
   "hash:net") ;;
   "hash:ip") ;;
   *) help ;;
   esac
   url="$1"
   name="$2"
   start=$( date +%s )
   installChain $type $url $name
   stop=$( date +%s )
   delta=$[ $stop – $start ]
   log Finished, took $delta seconds for $name

   // —- end installIpsetFromNet.sh

   Now in /etc/cron.daily, something like this will update the blacklist every night
   installIpsetFromNet.sh http://infiltrated.net/blacklisted BLACKLIST_DROP hash:ip

   Rispondi
6. 

   Brian Micek says:

   14 March 2012 at 06:18

   I’m sorry about the indentation, whitespace was stripped from my upload

   Rispondi
   • 

     linuxari says:

     15 March 2012 at 22:14

     No problem.
     And thanks for the feedback, i’m thinking to use it for anothet article 😉

     Rispondi

 Leave a Reply Cancel reply

Your Comment

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

Name (required)

E-mail (required)

URI

Codice CAPTCHA *