iptables-essentials

You can harden your network stack by configuring kernel parameters using sysctl. These settings are applied by adding them to a configuration file in /etc/sysctl.d/ (e.g., /etc/sysctl.d/40-custom.conf).

Common security hardening tasks include:

• Enabling Reverse Path Filtering (rp_filter): Protects against IP spoofing by ensuring responses go out the same interface they arrived on.
• Logging Martian Packets (log_martians): Enables logging for packets with malformed IP addresses.
• Disabling ICMP Redirects: Prevents the system from sending (send_redirects = 0) or accepting (accept_redirects = 0) ICMP redirect packets.
• Disabling Source Routing (accept_source_route): Prevents the use of Strict Source Route (SSR) or Loose Source Routing (LSR) options.
• Enabling SYN-flood Protection (tcp_syncookies): Protects against Denial of Service (DoS) attacks.
• Ignoring ICMP Broadcasts (icmp_echo_ignore_broadcasts): Prevents the system from responding to ping broadcasts.
• Enabling IP Forwarding (ip_forward): Required if the machine acts as a router or performs NAT.

# Example: Enable SYN-flood protection
cat << EOF >> /etc/sysctl.d/40-custom.conf
net/ipv4/tcp_syncookies = 1
EOF

# Example: Disable ICMP redirects
cat << EOF >> /etc/sysctl.d/40-custom.conf
net/ipv4/conf/all/send_redirects = 0
EOF

These patterns allow traffic for specific services by matching the protocol (-p), destination port (--dport), and connection state (-m conntrack --ctstate).

Note: For bidirectional communication, you often need to allow the incoming request on the service port and the outgoing response on the source port (--sport).

# Allow All Incoming SSH
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT

# Allow Incoming HTTP and HTTPS (using multiport)
iptables -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate ESTABLISHED -j ACCEPT

# Allow MySQL from a specific subnet
iptables -A INPUT -p tcp -s 192.168.240.0/24 --dport 3306 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 3306 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Port knocking secures services like SSH by dropping all standard requests and only allowing access after a specific sequence of packets (a "knock") is detected in userspace.

1. Configure Iptables

First, drop all incoming SSH requests on port 22, then redirect specific secret port traffic to NFQUEUE queue 1:

iptables -t filter -I INPUT -p tcp --dport 22 -j DROP
iptables -t raw -I PREROUTING -p tcp --sport 65534 --dport 65535 -j NFQUEUE --queue-num 1

2. Userspace Port Knocking Script

The following Python script monitors queue 1. When it detects a packet with the correct SOURCEPORT (65534) and SECRETPORT (65535), it dynamically inserts an iptables rule to allow that source IP to access SSH for a defined EXPIRETIME (default 30 minutes).

#!/usr/bin/python3

from os	import system
from netfilterqueue import NetfilterQueue
from scapy.layers.inet import IP
from time import time

SOURCEPORT=65534
SECRETPORT=65535
EXPIRETIME=30
ALLOWED={}

def portknocking(pkt):
    packet=IP(pkt.get_payload())
    currtime=time()
    for item in list(ALLOWED):
        if(currtime-ALLOWED[item] >= EXPIRETIME*60):
            del ALLOWED[item]
    if(packet.sport==SOURCEPORT and packet.dport==SECRETPORT and packet.src not in ALLOWED):
        print(f"Port {packet.dport} knocked by {packet.src}:{packet.sport}")
        system(f"iptables -I INPUT -p tcp --dport 22 -s {packet.src} -j ACCEPT")
        system(f"echo 'iptables -D INPUT -p tcp --dport 22 -s {packet.src} -j ACCEPT' | at now + {EXPIRETIME} minutes")
        ALLOWED[packet.src]=time()
        pkt.drop()

nfqueue=NetfilterQueue()
nfqueue.bind(1, portknocking)

try:
    nfqueue.run()
except KeyboardInterrupt:
    print("\nExit with Keyboard Interrupt")

3. Perform the Knock

To trigger the access from a client machine, use nc (netcat) to send a packet to the server's secret ports:

nc -p 65534 SERVER 65535