Well it’s a simple deal but iptables can count the number of connections in a time period and block based on it.  For example:

iptables -N SSH_CHECK
iptables -A INPUT -p tcp --dport 22 -m state NEW -j SSH_CHECK
iptables -A SSH_CHECK -m recent --set --name SSH
iptables -A SSH_CHECK -m recent --update --seconds 60 --hitcount 4 --name SSH -j DROP

So no more than 4 connections from the same ip in 60 seconds or you get blocked.

Just like most sysadmins I have to deal with developers who want to zip off a quick email after their application finishes processing, sounds good right?  Yes it is… but the internet is not a happy place and spam is around every corner.  I avoid getting tagged as spam your systems email should really be sent via an internal relay.  The internal relay should be registered with an MX entry in DNS to get the clear from all SPAM applicances and filtering.   As such I want to use iptables to stop outgoing smtp requests unless they go to my central relay (123.123.123.123)

-A OUTPUT -p tcp -d 123.123.123.123 --dport 25 -m state --state NEW -j ACCEPT

-A OUTPUT -p tcp –dport 25 -m state —state NEW -j DROP

Works great… if you use a local mail programs you might want to add this line first

-A OUTPUT -p tcp -d 127.0.0.1 –dport 25 -m state –state NEW -j ACCEPT

I am constantly having to check firewall rules for sevices I have not yet setup.  In this post I will reference the client (Source address) and server (Destination address).

Checking TCP

Server:

Open a tcp port with netcat so for example to open port 80 tcp I would use:

nc -l 80

Client:

Check the tcp port with telnet so to connect to port 80:

telnet destination_ip 80

Checking UDP

To open a udp (destination)listener on port 80 you would use the following command:

nc -lu 80

To Connect to your destination udp on port 80 use the following command from your source:

nc -zu destination_ip 80

Netcat fun

Netcat (nc) can also be used for a lot of other purposes.  It can also be used as a very fast basic port scanner:

To scan a range of UDP ports 80-4000

nc -zu destination_ip 80-4000

In order to get more information, you can add v, for more verbose, add another v

nc -vvzu destination_ip 80-4000

To scan a range of TCP ports 80-4000

nc -z destination_ip 80-4000

What is the use of blocking out going traffic?  Imagine if you have a web server and you want to allow customers to access your webserver but you do not want to allow rogue software to send message from yoru web server to other people.  This rule is for you.

iptables -A OUTPUT -m state –state ESTABLISHED -j ACCEPT

iptables -A OUTPUT -j REJECT

The average personal PC has need to be able to reach out into the internet and communicate but no need for people to reach from the internet to your PC.  This set of rules takes advantage of the stateful nature of iptables to allow incomming messages on ESTABLISHED (prevously set by OUTPUT) connections.

iptables -A input -m state –state ESTABLISHED -j ACCEPT

iptables -A input -j REJECT

You want to stop all traffic.  Allowing nothing in our out.

iptables -A INPUT -j REJECT

iptables -A OUTPUT -j REJECT

iptables -A FORWARD -j REJECT

Allow web and ssh connections SSH and web both require out going messages on established tcp connections.

iptables -A OUTPUT -o eth0 -m state –state ESTABLISHED,RELATED -j ACCEPT

Then you need to allow incomming connections on port 80 and 22 and possibly 443

iptables -A INPUT -p tcp -i eth0 –dport 22 –sport 1024:65535 -m state –state NEW -j ACCEPT

iptables -A INPUT -p tcp -i eth0 –dport 80 –sport 1024:65535 -m state –state NEW -j ACCEPT

iptables -A INPUT -p tcp -i eth0 –dport 443 –sport 1024:65535 -m state –state NEW -j ACCEPT