| View previous topic :: View next topic |
| Author |
Message |
feardapenguin
Guru
Joined: 23 Jul 2003
Posts: 414
Location: Texas
|
 Posted: Sat Nov 13, 2004 12:59 am Post subject: iptables question... |
 |
|
I've been working on tightening the iptable rules of my firewall and have been unable to determine where the following hole is. (For what it's worth the firewall is running on my local "user" machine but is behind a wireless router with NAT firewall.)
The head scratcher involves a result when I test via "Shields Up" (https://grc.com/x/ne.dll?bh0bkyd2). The rules seem to pass for everything except this one item. I'm not too clear on exactly what it is referring to or whether it is getting the ack from my box or the router.
| Quote: | | Unsolicited Packets: RECEIVED (FAILED) Your system's personal security countermeasures unwisely attempted to probe us in response to our probes. |
My rules are as follows:
| Code: | # iptables -L
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere
badflags tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,PSH,URG
badflags tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,PSH,ACK,URG
badflags tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,ACK,URG
badflags tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/NONE
badflags tcp -- anywhere anywhere tcp flags:SYN,RST/SYN,RST
badflags tcp -- anywhere anywhere tcp flags:FIN,SYN/FIN,SYN
ACCEPT icmp -- anywhere anywhere icmp echo-reply
ACCEPT icmp -- anywhere anywhere icmp destination-unreachable
ACCEPT icmp -- anywhere anywhere icmp time-exceeded
firewall icmp -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
silent udp -- anywhere anywhere udp spt:netbios-ns dpt:netbios-ns
dropwall all -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
DROP all -- anywhere anywhere state INVALID,NEW
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain badflags (6 references)
target prot opt source destination
LOG all -- anywhere anywhere limit: avg 15/min burst 5 LOG level warning prefix `Badflags:'
DROP all -- anywhere anywhere
Chain dropwall (1 references)
target prot opt source destination
LOG all -- anywhere anywhere limit: avg 15/min burst 5 LOG level warning prefix `Dropwall:'
DROP all -- anywhere anywhere
Chain firewall (1 references)
target prot opt source destination
LOG all -- anywhere anywhere limit: avg 15/min burst 5 LOG level warning prefix `Firewall:'
DROP all -- anywhere anywhere
Chain silent (1 references)
target prot opt source destination
DROP all -- anywhere anywhere |
(I have no idea if this is enough information for anyone to help.) |
|
| Back to top |
|
 |
theturner
Tux's lil' helper
Joined: 12 Mar 2004
Posts: 111
Location: United Socialist Republic of Europe
|
| Posted: Sat Nov 13, 2004 1:50 am Post subject: |
|
|
I built a pretty standard firewall with Firestarter, and I pass that test.
Make sure your Firewall denies unwanted packets, instead of rejecting them. |
|
| Back to top |
|
|
feardapenguin
Guru
Joined: 23 Jul 2003
Posts: 414
Location: Texas
|
| Posted: Sat Nov 13, 2004 4:51 am Post subject: |
|
|
| As shown above there is nothing set to REJECT. All are either ACCEPT or DROP. |
|
| Back to top |
|
|
CriminalMastermind
Tux's lil' helper
Joined: 19 Nov 2003
Posts: 132
Location: toronto
|
| Posted: Sat Nov 13, 2004 11:35 pm Post subject: |
|
|
well i do see one problem that has nothing to do with iptables and one way you can trouble shoot this further.
if you are behind a nat box then grc is scanning it's ports, not the ports of your local box... so your wireless router/nat/firewall is probably what is responding to them. you could have forwarded all the ports from your nat box to your local firewall boxes ip, but i don't think this bypasses it and i think it would respond under some situations.
what i would sugest you do to try and narrow things down is to break out your favorit packet sniffer and run it on your local box. then run the port scan and see what goes back to grc. | Code: | | tcpdump 'dst INSERT_GRC_SCANNING_IP_HERE' |
should do it i think. that should give you some info as to what kind of packets are getting back to grc.
if this is a local lan box you just want to test out the firewall rules on, why not just use nmap to scan it from another local lan computer? (unless you don't have one)
_________________
"I can picture a perfect world that knows of no war... and I can picture me attacking that world, because they'd never expect it." |
|
| Back to top |
|
|
feardapenguin
Guru
Joined: 23 Jul 2003
Posts: 414
Location: Texas
|
| Posted: Sun Nov 14, 2004 5:22 am Post subject: |
|
|
The problem turned out to be auth. This rule did the trick:
| Code: | | [0:0] -A OUTPUT -p tcp -m tcp --dport 113 -j silent |
|
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
Networking & Security
