Administrace komentářů

Kernel IP routing table

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface

0.0.0.0         94.229.35.129   0.0.0.0         UG    100    0        0 eth0

94.229.35.128   0.0.0.0         255.255.255.224 U     0      0        0 eth0

IPtables:

iptables -F
iptables -X
iptables -I INPUT -i lo -j ACCEPT

#drop spoofed packets from private subnets
iptables -A INPUT -i eth0 --src 192.168.0.0/16 -j DROP
iptables -A INPUT -i eth0 --src 172.16.0.0/12 -j DROP
iptables -A INPUT -i eth0 --src 10.0.0.0/8 -j DROP
iptables -A INPUT -i eth0 --src 127.0.0.0/8 -j DROP

iptables -N logdrop
iptables -A logdrop -m limit --limit 1/hour --limit-burst 5  -j LOG --log-prefix "Logdrop: "
iptables -A logdrop -j DROP

iptables -N pscanblock
iptables -A pscanblock -m limit --limit 1/min -j LOG --log-prefix "Blocking portscan: "
iptables -A pscanblock -m recent --set --name portscan

#drop invalid
iptables -A INPUT -m state --state INVALID -j DROP
iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
#let it be... (when it works, then it is OK)
iptables -I INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT
#ssh
iptables -A INPUT -p tcp -m tcp --dport 22 -s 1.2.3.4 -j ACCEPT #ja, upravene
iptables -A INPUT -p tcp -m tcp --dport 22 -j REJECT
ip6tables -A INPUT -p tcp -m tcp --dport 22 -j REJECT


#block smtp 
iptables -A INPUT -p tcp -m tcp --dport 25 -j TARPIT
ip6tables -A INPUT -p tcp -m tcp --dport 25 -j DROP


#ntp with some exceptions
iptables -A INPUT -p udp -m udp --dport 123 -s 195.113.144.201 -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 123 -s 147.231.19.43 -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 123 -s 193.171.23.163 -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 123 -s 80.50.231.226 -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 123 -s 83.19.137.3 -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 123 -j REJECT
ip6tables -A INPUT -p udp -m udp --dport 123 -j REJECT


################ CONNLIMITS ####################################3

iptables -A INPUT -p tcp --dport 80 -m connlimit --connlimit-above 30 -m limit --limit 1/hour --limit-burst 5  -j LOG  --log-prefix " Too much connections "
iptables -A INPUT -p tcp --dport 443 -m connlimit --connlimit-above 30 -m limit --limit 1/hour --limit-burst 5  -j LOG  --log-prefix " Too much connections "
iptables -A INPUT -p tcp --dport 80 -m connlimit --connlimit-above 30 -j TARPIT
iptables -A INPUT -p tcp --dport 443 -m connlimit --connlimit-above 30 -j TARPIT
#block too many connections
iptables -A INPUT -p tcp --dport 23000:30001 -m connlimit --connlimit-above 20 -j LOG --log-prefix " Too much connections "
iptables -A INPUT -p tcp --dport 23000:30001  -m connlimit --connlimit-above 3 -j LOG --log-prefix "CONNLIMIT: " --log-level debug

#block invalid packets
iptables -A INPUT -p udp --dport 23000:30001 -m length --length 0:28  -m limit --limit 1/hour --limit-burst 5 -j LOG --log-prefix " Small_packets "
iptables -A INPUT -p udp --dport 23000:30001 -m length --length 0:28 -j DROP
#deny or log everything 60 (can be 3600 or so) seconds after portscan
iptables -A INPUT -m recent --name portscan --rcheck --seconds 60 -j DROP # LOG --log-prefix "Pscantest: "
iptables -A INPUT -p tcp -m recent --name portscan --remove

iptables -A INPUT -p tcp ! --dport 80 -m state --state new -m recent --set --name NEWCONN
iptables -A INPUT -p tcp -m recent --update --seconds 10 --hitcount 10 --rttl --name NEWCONN -j pscanblock
 

net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv4.tcp_timestamps = 0