HELLO_wORLD
Very Senior Member
Hello to all.
In a constant quest to improve security of the firewall, I recently added some rules to deal with port scan.
The idea of this thread is to share our experiences and experimentation to make our firewalls better.
It is open to comments, critics, improvements, etc...
Here is my iptables mangle table. Some rules are put there by the firmware, other (bolemo_xxx) are mine.
The way it works is as follow: it creates two recent lists bad_bl and scan_bl
When a new connection attempt is made from WAN to specific UDP and TCP ports I don’t use, it bans the IP for 30 seconds (bad_bl) for any connection. The logic is if you attempt a connection to these ports, there is not reason for it, therefore I assume you have bad intentions.
When a new TCP or UDP connection is made more than 10 times on the last 30 seconds, it bans the IP for 30 seconds (scan_bl) for any new connection, however, if a connection is established or related with the same IP, it is instantly unbanned (as http for example can have more than 10 new requests incoming in 30 seconds).
The result is satisfying so far. ShieldsUp scan does not detect any open port (all stealth), including open ones like 80 or 443.
However, from WAN, I can reach for example my http(s) services without being blocked.
The flaw I can see in this is if a port scanner is not incremental and establishes a connection on port 80 for example, it will not be in the banned scan list.
However, this can allow to build a list of port scanners active toward my ip, and therefore regularly add them in an aegis blocklist for example.
In a constant quest to improve security of the firewall, I recently added some rules to deal with port scan.
The idea of this thread is to share our experiences and experimentation to make our firewalls better.
It is open to comments, critics, improvements, etc...
Here is my iptables mangle table. Some rules are put there by the firmware, other (bolemo_xxx) are mine.
The way it works is as follow: it creates two recent lists bad_bl and scan_bl
When a new connection attempt is made from WAN to specific UDP and TCP ports I don’t use, it bans the IP for 30 seconds (bad_bl) for any connection. The logic is if you attempt a connection to these ports, there is not reason for it, therefore I assume you have bad intentions.
When a new TCP or UDP connection is made more than 10 times on the last 30 seconds, it bans the IP for 30 seconds (scan_bl) for any new connection, however, if a connection is established or related with the same IP, it is instantly unbanned (as http for example can have more than 10 new requests incoming in 30 seconds).
The result is satisfying so far. ShieldsUp scan does not detect any open port (all stealth), including open ones like 80 or 443.
However, from WAN, I can reach for example my http(s) services without being blocked.
The flaw I can see in this is if a port scanner is not incremental and establishes a connection on port 80 for example, it will not be in the banned scan list.
However, this can allow to build a list of port scanners active toward my ip, and therefore regularly add them in an aegis blocklist for example.
Code:
-A PREROUTING -d 192.168.0.0/24 -i brwan -j DROP
-A PREROUTING -i brwan -j bolemo_ddos
-A INPUT -i brwan -p tcp -m tcp --tcp-flags URG URG -j DROP
-A OUTPUT -o brwan -p icmp -m icmp --icmp-type 3 -j DROP
-A bolemo_ddos -m conntrack --ctstate INVALID -j DROP
-A bolemo_ddos -m recent --update --seconds 30 --name bad_bl --rsource -j DROP
-A bolemo_ddos -p tcp -j bolemo_tcp
-A bolemo_ddos -p udp -j bolemo_udp
-A bolemo_ddos -p icmp -m icmp --icmp-type 8 -m limit --limit 20/sec -j RETURN
-A bolemo_ddos -p icmp -m icmp --icmp-type 8 -j DROP
-A bolemo_pscan -m state --state RELATED,ESTABLISHED -m recent --remove --name scan_bl --rsource -j RETURN
-A bolemo_pscan -m state --state NEW -m recent --update --seconds 30 --reap --hitcount 10 --name scan_bl --rsource -j DROP
-A bolemo_pscan -m recent --set --name scan_bl --rsource -j RETURN
-A bolemo_tcp -p tcp -m multiport --dports 20:23,79,88,119,139,445,5000 -m state --state NEW -m recent --set --name bad_bl --rsource -j DROP
-A bolemo_tcp -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW -j DROP
-A bolemo_tcp -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK RST -m limit --limit 1/sec -j RETURN
-A bolemo_tcp -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK RST -j DROP
-A bolemo_tcp -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 10000/sec --limit-burst 100 -j RETURN
-A bolemo_tcp -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j DROP
-A bolemo_tcp -j bolemo_pscan
-A bolemo_udp -p udp -m multiport --dports 79,88,137,138,445,1900 -m state --state NEW -m recent --set --name bad_bl --rsource -j DROP
-A bolemo_udp -j bolemo_pscan
