On my mac, I looked at the Mail Connection Doctor and one of the things I noticed was an expiration date for my Parallel Panel self-signed root certificate.
Is that something I have to renew or does it auto renew itself?
I'm using a virtual dedicated server and didn't buy the certificate, it was there by default.
What I'm trying to do is block RST attacks with IPTables.
When I do a search for it, I'm seeing rules where packets with the RST flag set is being rate limited.
I'm questioning it a little bit. I think I need to rate limit RST / ACK and not RST
If I'm not mistaken, when a client decides to abort an existing connection, a RST / ACK packet will be received by the server and the server responds with ACK and closes the connection.
So, normally a server never gets or sends out RST packets. I think it's always RST / ACK
Unless a client is being spoofed and the attacker inserts the RST flag.
But why would that close the connection ?
I'm probably wrong because I'm seeing it everywhere I look but I think an attacker needs to insert RST / ACK , is that not correct ?
Is a server not able to see the difference between RST / ACK and RST without ACK ?
match = -m matchname [per-match-options]
But it confuses me. Here's an example :
iptables -A INPUT -p tcp -m multiport --dports 23,79 --tcp-flags ALL SYN -m recent --update --seconds 180 -m comment --comment "SYN" -j DROP
Can someone explain to me the theory behind it, why I don't have to use -m before --tcp-flags (maybe I should ?), like this :
iptables -A INPUT -p tcp -m multiport --dports 23,79 -m --tcp-flags ALL SYN -m recent --update --seconds 180 -m comment --comment "SYN" -j DROP
It would make more sense to me if it was written like this :
iptables -A INPUT -p tcp -m tcp --tcp-flags ALL SYN -m multiport --dports 23,79 -m recent --update --seconds 180 -m comment --comment "SYN" -j DROP
And why should I use -m for comment ? I see it everywhere but I would like to know why and not something else. I'm questioning it a little bit because it's not a match, so that's a bit weird.
Thank you.
IPtables for a virtual dedicated server.
I would like to block UDP scans and I was wondering whether there's a minimum packet size for a DNS lookup?
Nmap sends 0-byte UDP packets (source : http://nmap.org/bennieston-tutorial/ ), but there're probably tools available that allow you to add a few bytes.
Also, I don't quite understand how nmap's UDP packets can be 0 bytes.
Firewall for a virtual dedicated server.
I was looking into how to prevent a FIN scan and it got me thinking about the consequences.
A lot of people are using this rule:
-p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN -j DROP
So when someone sends me a packet with a FIN = 1 , I'm unable to send FIN/ACK back.
It seems unlikely but does that mean my established connection won't be stopped ?
How does that work ? Does my connection stay alive and if so, for how long ?
How does that actually work when someone closes his / her browser ? It sends a FIN to my server, my server replies with FIN/ACK ... but the browser is unable to receive that, right ? Who gets the packet, where does it go ?
And what if ... a remote machine sends my server a SYN, my reply is SYN/ACK and let's say that I'm not getting the ACK back, how long is my server waiting for it ?
Is there a name for unfinished 3 way handshakes ? Thank you.
I'm working on a firewall for a virtual dedicated server and one of the things I'm looking into is port scanners. TCP flags are used for protection. I have 2 questions.
The rule:
-p tcp --tcp-flags SYN,ACK,FIN,RST SYN -j DROP
First argument says check packets with flag SYN
Second argument says make sure the flags ACK,FIN,RST SYN are set
And when that's the case (there's a match), drop the tcp packet
First question:
I understand the meaning of RST and RST/ACK but in the second argument RST SYN is being used.
What's the difference between RST SYN and RST and SYN RST ?
Is there a "SYN RST" flag in a 3 way handshake ?
Second question is about the difference between
-p tcp --tcp-flags SYN,ACK,FIN,RST SYN -j DROP
and
-p tcp --tcp-flags ALL SYN,ACK,FIN,RST SYN -j DROP
When should ALL be used ?
When I use ALL, does that mean if the tcp packet with the syn flag doesn't have the ACK "and" the FIN "and" the RST SYN flags set, there will be no match ?
iptables -N NEW_TCP_PACKETS_NO_SYN
iptables -A INPUT NEW_TCP_PACKETS_NO_SYN -p tcp ! --syn -m state --state NEW -m limit --limit 10/day -j LOG --log-prefix "New packets but not syn:"
iptables -A INPUT NEW_TCP_PACKETS_NO_SYN -p tcp ! --syn -m state --state NEW -j DROP
iptables -A INPUT NEW_TCP_PACKETS_NO_SYN -f -j DROP
1) I'm making a new user generated chain with the -N option
2) I'm logging NEW packets that aren't syn, and I'm adding a limit trying to prevent my log files from getting flooded
3) I'm dropping the NEW packets that aren't SYN
4) I'm using -f because I'm left with the fragmented packets, and I want to drop those packets.
A recommendation to improve something similar was found here https://serverfault.com/a/245713/114606 , which is to add it in -t raw -A PREROUTING
A) I don't quite understand what's being said, how do I add it "in" ?
And it seems like a risky thing to do, because it sets a mark on packets that they should not be handled by the connection tracking system.
B) And why is that necessary ? I'm dropping those packets so what exactly is the benefit of marking those packets ?
All that being said, is there anything that can be done when I do get the initial SYN fragment, but I don't get the last one ?
When I do a trace on the www.google.com domain from my laptop, am I using icmp or udp ?
I thought it was icmp type 11 but while searching for something else I came across rules where icmp type 30 was used and I saw rules where udp was used.
Can someone explain to me how that works ?
I'm working on a firewall (iptables) for a virtual dedicated server.
Virtual Dedicated Server hosts 10 websites. 1 firewall made with iptables
If one of those 10 websites gets hit by too many ping requests coming from one IP address, how do I limit or drop it without dropping it for the other 9 websites?
Do I create a firewall for every website ? If so, how? Or is it better to change my rules? If so, how? Thank you.
Original question was posted here https://serverfault.com/questions/373259/iptables-whats-best-practice-when-therere-several-websites-but-you-want-to-us but it was too vague.
Let me know if more info is needed.
I'm working on a firewall and I would like to know how to calculate how many bytes there're in a packet or at least have an idea what the averages are.
When I googled it, 1500 bytes was mentioned a lot but it appears to depend on the file size and the protocol.
1500 bytes, is that for tcp ? What about icmp ?
Out of curiosity: what's the max size ?
How do I log what's not being accepted by the following rule:
iptables -A OUTPUT -p icmp --icmp-type 3 -m -limit --limit 10/minute -j ACCEPT
And how do I limit what's being logged because I don't want to log 1000s of pings?
My first thought was:
iptables -A OUTPUT -p icmp --icmp-type 3 -m -limit --limit 50/day -j LOG
iptables -A OUTPUT -p icmp --icmp-type 3 -m -limit --limit 10/minute -j ACCEPT
But that doesn't seem right to me.
I think this limits the logging to 50/day but not necessarily what is not being accepted, or am I wrong?
See title for the question.
This question relates to a previous question wherein I asked the difference between NEW,ESTABLISHED and RELATED , see it here iptables: difference between NEW, ESTABLISHED and RELATED packets One of the rules has NEW in it, and I'm concerned packets will slip through because I'm accepting ssh traffic once it passes the rule. I think I need to ad ESTABLISHED to the rule as well. And maybe even RELATED if it's possible to spoof both. So that's the question. Is it possible ?