IPTables-Blocklist (Questions)

Discussion in 'HOWTO-Related Questions' started by giganet, Mar 18, 2009.

  1. giganet

    giganet New Member

    Hello HTF Group...

    Today I finally got around to working with the HowTo: http://howtoforge.com/blocking-ip-addresses-of-any-country-with-iptables

    My first question pertains to after the blocklist script runs.
    The first thing the script does after using 'wget' to download the current Country IP Blocks is to run 'iptables -F' which purges IPTables of any current rules.

    The issue I have is I also utilize the following IPTables rules to try and provide some security to SSH access and then additional rules to also close unused ports.

    SSH Protection
    Code:
    iptables -A INPUT -p tcp --dport 54000 -m state --state NEW -m recent --set --name SSH -j ACCEPT
    iptables -A INPUT -p tcp --dport 54000 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j LOG --log-prefix "SSH_brute_force"
    iptables -A INPUT -p tcp --dport 54000 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j DROP
     
    THE WHITELIST
    iptables -A SSH_WHITELIST -s 65.197.209.0/25 -m recent --remove --name SSH -j ACCEPT
     
    BLOCKING RULES
    iptables -A INPUT -p tcp --dport 54000 -m state --state NEW -m recent --set --name SSH
    iptables -A INPUT -p tcp --dport 54000 -m state --state NEW -j SSH_WHITELIST
    iptables -A INPUT -p tcp --dport 54000 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j ULOG --ulog-prefix SSH_brute_force
    iptables -A INPUT -p tcp --dport 54000 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j DROPBLOCKING RULES
    
    CLOSE UNUSED PORTS
    Code:
    iptables -A INPUT -p tcp --dport 444:53999 -j DROP
    iptables -A INPUT -p tcp --dport 54001:60000 -j DROP
    After the script is finished running I have to re-enter the SSH protection and close unused ports rules manually.:mad:

    Can I add these lines at the base of the script as such to automate this as follows?
    BLOCKLIST BASH SCRIPT
    Code:
    GAMA.ORG###
    ###PUT HERE COMA SEPARATED LIST OF COUNTRY CODE###
    COUNTRIES="A1,A2,AD,AE,AF,AG,AI,AL,AM,AN,AO,AP,AQ,AR,AS,AT,AU,AW,AX,AZ,BA,BB,BD,BE,BF,BG,BH,BI,BJ,BM,BN,BO,BR,BS,BT,BV,,BW,BY,BZ,CA,CC,CD,CF,CG,CH,CI,CK,CL,CM,CN,CO,CR,CU,CV,CX,CY,CZ,DE,DJ,DK,DM,DO,DZ,EC,EE,EG,EH,ER,ES,ET,EU,FI,FJ,FK,FM,FO,FR,GA,GB,GD,GE,GF,GG,GH,GI,GL,GM,GN,GP,GQ,GR,GS,GT,GU,GW,GY,HK,HM,HN,HR,HT,HU,ID,IE,IL,IM,IN,IO,IQ,IR,IS,IT,JE,JM,JO,JP,KE,KG,KH,KI,KM,KN,KP,KR,KW,KY,KZ,LA,LB,LC,LI,LK,LB,LC,LI,LK,LR,LS,LT,LU,LV,LY,MA,MC,MD,ME,MG,MH,MK,ML,MM,MO,MP,MQ,MR,MS,MT,MU,MV,MW,MX,MY,MZ,NA,NC,NE,NF,NF,NI,NL,NO,NP,NR,NU,NZ,OM,PA,PE,PF,PG,PH,PK,PL,PM,PN,PR,PS,PT,PW,PY,QA,RE,RO,RS,RU,RW,SA,SB,SC,SD,SE,SG,SH,SI,SJ,SK,SL,SM,SN,SO,SR,ST,SV,SY,SZ,TC,TD,TF,TG,TH,TJ,TK,TL,TM,TN,TO,TR,TT,TV,TW,TZ,UA,UG,UM,UY,UZ,VA,VC,VE,VG,VI,VN,VU,WF,WS,YE,YT,ZA,ZM,ZW"
    WORKDIR="/root"
    #######################################
    cd $WORKDIR
    wget -c --output-document=iptables-blocklist.txt [URL]http://blogama.org/country_query.php?country=$COUNTRIES[/URL]
    if [ -f iptables-blocklist.txt ]; then
      iptables -F
      BLOCKDB="iptables-blocklist.txt"
      IPS=$(grep -Ev "^#" $BLOCKDB)
      for i in $IPS
      do
        iptables -A INPUT -s $i -j DROP
        iptables -A OUTPUT -d $i -j DROP
      done
    fi
    rm $WORKDIR/iptables-blocklist.txt
    do
    iptables -A INPUT -p tcp --dport 54000 -m state --state NEW -m recent --set --name SSH -j ACCEPT
    iptables -A INPUT -p tcp --dport 54000 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j LOG --log-prefix "SSH_brute_force"
    iptables -A INPUT -p tcp --dport 54000 -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j DROP
    iptables -A SSH_WHITELIST -s 65.197.209.0/25 -m recent --remove --name SSH -j ACCEPT
    iptables -A INPUT -p tcp --dport 54000 -m state --state NEW -m recent --set --name SSH
    iptables -A INPUT -p tcp --dport 54000 -m state --state NEW -j SSH_WHITELIST
    iptables -A INPUT -p tcp --dport 54000 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j ULOG --ulog-prefix SSH_brute_force
    iptables -A INPUT -p tcp --dport 54000 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j DROP
    iptables -A INPUT -p tcp --dport 444:53999 -j DROP
    iptables -A INPUT -p tcp --dport 54001:60000 -j DROP
    done
    
    Would this be correct and acceptible? :confused:

    One last thing I have issue with after the script runs- all services seems to function on the server afterwards however from the CLI I am unable to ping the world.
    The server returns: :eek:
    Code:
    root@giganetwireless:/home/bender# ping yahoo.com
    ping: unknown host yahoo.com
    I do notice though now that after sending E-Mails from the server I receive: Delayed Mail (still being retried)
    I am however able to receive in-bound E-Mail to this server...

    The results of 'hostname -f && hostname' are following:
    Code:
     
    [COLOR=#0000ff]root@giganetwireless:/home/bender[/COLOR]#  hostname -f localhost.localdomain
     
    [COLOR=#0000ff]root@giganetwireless:/home/bender[/COLOR]# hostname giganetwireless.net 
    
    netstat -tap Lines Of Interest
    Code:
    tcp6       0      0 [UNKNOWN]:953           *:*                     LISTEN     6261/named
    tcp6       0      0 *:smtp                  *:*                     LISTEN     6211/master
    getnameinfo failed
    getnameinfo failed
    tcp6       0      0 [UNKNOWN]:pop3          [UNKNOWN]:54015         TIME_WAIT  -
    
    tail -f /var/log/mail.log Output
    Code:
    Mar 15 21:18:47 giganetwireless postfix/smtp[25481]: 4B7EB1C882BA: to=<[EMAIL="web_admin@giganetwireless.com"]web_admin@giganetwireless.com[/EMAIL]>, relay=none, delay=1122, delays=1122/0.01/0/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=giganetwireless.com type=MX: Host not found, try again)
    Mar 15 21:18:47 giganetwireless postfix/smtp[25482]: DCA081C882B7: to=<[EMAIL="web_admin@giganetwireless.com"]web_admin@giganetwireless.com[/EMAIL]>, relay=none, delay=4721, delays=4721/0.01/0/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=giganetwireless.com type=MX: Host not found, try again)
    Mar 15 21:18:47 giganetwireless postfix/smtp[25484]: 76CBB1C882AD: to=<[EMAIL="web_admin@giganetwireless.com"]web_admin@giganetwireless.com[/EMAIL]>, relay=none, delay=8322, delays=8322/0.02/0/0, dsn=4.4.3, status=deferred (Host or domain name not found. Name service error for name=giganetwireless.com type=MX: Host not found, try again)
    
    Thanking you in advance for your time and help.

    Best Regards
     
  2. falko

    falko Super Moderator

    I think this should work.

    Regarding the connection problem: I guess this is related to your firewall problem. Please modify the script and try again.
     
  3. giganet

    giganet New Member

    Hi Falko, thank you for the reply...

    I did find that the DNS numbers used in 'resolv.conf' were in the same network as some of the blocked country numbers, after changing the DNS numbers I can ping the world now.

    The issue I am trying to resolve with this presently is that when I attempt to run 'apt-get update' apt snags on the following:
    Code:
    0% [Connecting to us.archive.ubuntu.com (91.189.88.45)] [Connecting to security.ubuntu.com (91.189.88.37)]
    
    The above IP originates from the U.K., Canonical

    Presently in 'apt' my 'sources.list' is as follows:
    Code:
    # deb [URL]http://us.archive.ubuntu.com/ubuntu/[/URL] gutsy main restricted
    # deb [URL]http://us.archive.ubuntu.com/ubuntu/[/URL] gutsy-updates main restricted
    # deb [URL]http://us.archive.ubuntu.com/ubuntu[/URL] gutsy-security main restricted
    # See [URL]http://help.ubuntu.com/community/UpgradeNotes[/URL] for how to upgrade to
    # newer versions of the distribution.
    deb [URL]http://us.archive.ubuntu.com/ubuntu/[/URL] gutsy main restricted
    deb-src [URL]http://us.archive.ubuntu.com/ubuntu/[/URL] gutsy main restricted
    ## Major bug fix updates produced after the final release of the
    ## distribution.
    deb [URL]http://us.archive.ubuntu.com/ubuntu/[/URL] gutsy-updates main restricted
    deb-src [URL]http://us.archive.ubuntu.com/ubuntu/[/URL] gutsy-updates main restricted
    ## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu
    ## team, and may not be under a free licence. Please satisfy yourself as to
    ## your rights to use the software. Also, please note that software in
    ## universe WILL NOT receive any review or updates from the Ubuntu security
    ## team.
    deb [URL]http://us.archive.ubuntu.com/ubuntu/[/URL] gutsy universe
    deb-src [URL]http://us.archive.ubuntu.com/ubuntu/[/URL] gutsy universe
    deb [URL]http://us.archive.ubuntu.com/ubuntu/[/URL] gutsy-updates universe
    deb-src [URL]http://us.archive.ubuntu.com/ubuntu/[/URL] gutsy-updates universe
    ## N.B. software from this repository is ENTIRELY UNSUPPORTED by the Ubuntu
    ## team, and may not be under a free licence. Please satisfy yourself as to
    ## your rights to use the software. Also, please note that software in
    ## multiverse WILL NOT receive any review or updates from the Ubuntu
    ## security team.
    deb [URL]http://us.archive.ubuntu.com/ubuntu/[/URL] gutsy multiverse
    deb-src [URL]http://us.archive.ubuntu.com/ubuntu/[/URL] gutsy multiverse
    deb [URL]http://us.archive.ubuntu.com/ubuntu/[/URL] gutsy-updates multiverse
    deb-src [URL]http://us.archive.ubuntu.com/ubuntu/[/URL] gutsy-updates multiverse
    ## Uncomment the following two lines to add software from the 'backports'
    ## repository.
    ## N.B. software from this repository may not have been tested as
    ## extensively as that contained in the main release, although it includes
    ## newer versions of some applications which may provide useful features.
    ## Also, please note that software in backports WILL NOT receive any review
    ## or updates from the Ubuntu security team.
    # deb [URL]http://us.archive.ubuntu.com/ubuntu/[/URL] gutsy-backports main restricted universe multiverse
    # deb-src [URL]http://us.archive.ubuntu.com/ubuntu/[/URL] gutsy-backports main restricted universe multiverse
    ## Uncomment the following two lines to add software from Canonical's
    ## 'partner' repository. This software is not part of Ubuntu, but is
    ## offered by Canonical and the respective vendors as a service to Ubuntu
    ## users.
    # deb [URL]http://archive.canonical.com/ubuntu[/URL] gutsy partner
    # deb-src [URL]http://archive.canonical.com/ubuntu[/URL] gutsy partner
    deb [URL]http://security.ubuntu.com/ubuntu[/URL] gutsy-security main restricted
    deb-src [URL]http://security.ubuntu.com/ubuntu[/URL] gutsy-security main restricted
    deb [URL]http://security.ubuntu.com/ubuntu[/URL] gutsy-security universe
    deb-src [URL]http://security.ubuntu.com/ubuntu[/URL] gutsy-security universe
    deb [URL]http://security.ubuntu.com/ubuntu[/URL] gutsy-security multiverse
    deb-src [URL]http://security.ubuntu.com/ubuntu[/URL] gutsy-security multiverse
    
    What would the U.S. sources URL be for the security?

    BTW: the OS is UBUNTU 7.10

    Thank you

    Best Regards
     
  4. giganet

    giganet New Member

    Issue solved

    ISSUE SOLVED

    I had to open a few ports which I had closed down and also set new DNS numbers in resolv.conf and VIOLA! ;)

    Thank you Falko

    Best Regards
     
  5. adam0x54

    adam0x54 New Member

    A suggestion here...

    instead of blacklisting ports why dont you whitelist ports and make a default drop policy?


    -Adam
     
  6. giganet

    giganet New Member

    Hi Adam...

    Thank you for the reply.

    Excuse my ignorance, but in short detail what measures would I take to implement a port whitelist including DROP policy?

    Once again, thank you for sharing your knowlege too!

    Best Regards
     
  7. adam0x54

    adam0x54 New Member

  8. glennbb

    glennbb New Member

    What ports?


    I'm having the same issue on one of my machines here. Would you mind elaborating on what ports you had to open to get this to work? (I already have 80 open)

    Thanks

    Glenn
     
  9. falko

    falko Super Moderator

    To what service (web server, FTP server, mail server, etc.) are you referring?
     
  10. glennbb

    glennbb New Member

    Aptitude...

    Aptitude; I've been having similar problems with updates and was wondering what ports poster giganet opened to solve his problem. :cool:

    Glenn
     
  11. falko

    falko Super Moderator

    Do you have valid nameservers in /etc/resolv.conf?
     

Share This Page