DOS attack--Prob with iptables.pls reply urgent!!!!!

[hetal gaglani]

hi,

i went thru the quries that u ahve solved..didnt know how to post
one..so m mailing to u..pls reply to this one..

after limiting the no of ping requests using the limit rule in
iptables...how do i write a rule to generate a particular display like
this:

clients m/c on cmd prompt :  ping server_ip -t
reply from server_ip....
reply from server_ip...
reply from server_ip....
destination host unreachable.

i.e i want my server to limit the no of reply packets to 3 even if the
-t option is given and the drop any icmp packets coming from the
client.

I have my iptables rules on the server m/c which has a linux platform
but my client is a windows system.

Another query:how to test this????

also the ping of death attack which increases the size of packet to
>65535....what shud be done to avoid ping of death attack...if u know
any rule for the same pls let me know.

Hoping for a reply from u....
Thanking in advance,

Regards,
Hetal

[Daniel Givens]

On 3/23/06, hetal gaglani <hetal.gaglani@...> wrote:
> after limiting the no of ping requests using the limit rule in
> iptables...

> i.e i want my server to limit the no of reply packets to 3 even if the
> -t option is given and the drop any icmp packets coming from the
> client.

Try this:
# iptables -A INPUT -p icmp -i <EXTERNALIF> -m limit --limit 3/hr
--limit-burst 3 -j ACCEPT
# iptables -A INPUT -p icmp -i <EXTERNALIF> -j DROP

Order matters, since iptables evaluates in a top down fashion. When
you are putting commands into iptables, they are stored in exactly
that order and the tests on incoming and/or outgoing packets are done
in that order. That is why the above works. It will accept the first
three icmp packets and drop the rest until an hour passes. For more on
limit and limit-burst, see here:

http://www.netfilter.org/documentation/HOWTO//packet-filtering-HOWTO.html#toc4


> Another query:how to test this????

Ping the linux system. If the client is on the internal side of the
firewall and the ICMP rule is on the external side, then go to any of
the free web based ping tools. Here is one:

http://www.dnsstuff.com/

My ISP blocks ICMP. Obviously, you have a reason to want to block ICMP
so that isn't the case.

> also the ping of death attack which increases the size of packet to
> >65535....what shud be done to avoid ping of death attack...if u know
> any rule for the same pls let me know.

The ping of death has not been an issue for a long time. Unless you
system is running a kernel that is older than the early 2.4's, you
don't have to worry about this.

Regards,
Daniel

[Pablo-3]

> Try this:
> # iptables -A INPUT -p icmp -i <EXTERNALIF> -m limit --limit 3/hr
--limit-burst 3 -j ACCEPT
> # iptables -A INPUT -p icmp -i <EXTERNALIF> -j DROP

Can this work:

        iptables -A INPUT -p icmp -m limit --limit 3/hr -j DROP ; droping
only 3 pings per hour?

Thanks in advance.



-----Mensaje original-----
De: rugmonster@... [mailto:rugmonster@...] En nombre de Daniel
Givens
Enviado el: Jueves, 23 de Marzo de 2006 10:21 a.m.
Para: debian-firewall@...
Asunto: DOS attack--Prob with iptables.pls reply urgent!!!!!

On 3/23/06, hetal gaglani <hetal.gaglani@...> wrote:
> after limiting the no of ping requests using the limit rule in
> iptables...

> i.e i want my server to limit the no of reply packets to 3 even if the
> -t option is given and the drop any icmp packets coming from the
> client.

Try this:
# iptables -A INPUT -p icmp -i <EXTERNALIF> -m limit --limit 3/hr
--limit-burst 3 -j ACCEPT
# iptables -A INPUT -p icmp -i <EXTERNALIF> -j DROP

Order matters, since iptables evaluates in a top down fashion. When
you are putting commands into iptables, they are stored in exactly
that order and the tests on incoming and/or outgoing packets are done
in that order. That is why the above works. It will accept the first
three icmp packets and drop the rest until an hour passes. For more on
limit and limit-burst, see here:

http://www.netfilter.org/documentation/HOWTO//packet-filtering-HOWTO.html#to
c4


> Another query:how to test this????

Ping the linux system. If the client is on the internal side of the
firewall and the ICMP rule is on the external side, then go to any of
the free web based ping tools. Here is one:

http://www.dnsstuff.com/

My ISP blocks ICMP. Obviously, you have a reason to want to block ICMP
so that isn't the case.

> also the ping of death attack which increases the size of packet to
> >65535....what shud be done to avoid ping of death attack...if u know
> any rule for the same pls let me know.

The ping of death has not been an issue for a long time. Unless you
system is running a kernel that is older than the early 2.4's, you
don't have to worry about this.

Regards,
Daniel


--
To UNSUBSCRIBE, email to debian-firewall-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

[Daniel Givens]

On 3/23/06, Pablo <paa-listas@...> wrote:
> Can this work:
>
>         iptables -A INPUT -p icmp -m limit --limit 3/hr -j DROP ; droping
> only 3 pings per hour?

You first set the limit of how many you want to accept, then once that
limit is passed, it goes to the next rule, which is to drop it.  The
original message asked how to limit the pings to only three allowed
and then the rest blocked.  You're rule blocks the first three and
provided you have the policy set to allow, allow the rest.

~Daniel

[Aro Sadoyan]

Daniel Givens wrote:

>On 3/23/06, Pablo <paa-listas@...> wrote:
>  
>
>>Can this work:
>>
>>        iptables -A INPUT -p icmp -m limit --limit 3/hr -j DROP ; droping
>>only 3 pings per hour?
>>    
>>
>
>You first set the limit of how many you want to accept, then once that
>limit is passed, it goes to the next rule, which is to drop it.  The
>original message asked how to limit the pings to only three allowed
>and then the rest blocked.  You're rule blocks the first three and
>provided you have the policy set to allow, allow the rest.
>
>~Daniel
>
>  
>

iptables -A OUTPUT -p icmp --icmp-type 8 -j ACCEPT
iptables -A INPUT  -p icmp --icmp-type 8 -m length --length 128:65535  
-j LOG --log-level debug --log-prefix IP"ICMP Oversize:"
iptables -A INPUT  -p icmp --icmp-type 8 -m length --length 128:65535  
-j REJECT #--reject-with icmp-host-prohibited
iptables -A INPUT  -p icmp --icmp-type 8 -m limit   --limit 3/s        
-j ACCEPT
iptables -A INPUT  -p icmp -f  -j LOG --log-prefix "ICMP Fagment:"
iptables -A INPUT  -p icmp -f  -j REJECT

This Is a  good solution of filtering ICMP I use it and it is working fine
It alow only 3 ping per second and ICMP packet sise is  maximum 128


--
To UNSUBSCRIBE, email to debian-firewall-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

[Pascal Hambourg]

Hello,

Aro Sadoyan a écrit :

>>  
> iptables -A INPUT  -p icmp --icmp-type 8 -m length --length 128:65535  
> -j LOG --log-level debug --log-prefix IP"ICMP Oversize:"
> iptables -A INPUT  -p icmp --icmp-type 8 -m length --length 128:65535  
> -j REJECT #--reject-with icmp-host-prohibited
> iptables -A INPUT  -p icmp --icmp-type 8 -m limit   --limit 3/s        
> -j ACCEPT
> iptables -A INPUT  -p icmp -f  -j LOG --log-prefix "ICMP Fagment:"
> iptables -A INPUT  -p icmp -f  -j REJECT
>
> This Is a  good solution of filtering ICMP I use it and it is working fine
> It alow only 3 ping per second and ICMP packet sise is  maximum 128

Notes :
ICMP type "echo-request" instead of 8 is more explicit.

The -f flag will never match if connection tracking (ip_conntrack) is
active (used by the nat table or state match for example) because the
connection tracking needs to reassemble fragments before the packet
enters the iptables chains.

I would rather DROP unwanted ICMP packets instead of REJECT.


--
To UNSUBSCRIBE, email to debian-firewall-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

[Aro Sadoyan]

Pascal Hambourg wrote:

> Hello,
>
> Aro Sadoyan a écrit :
>
>>>  
>>
>> iptables -A INPUT  -p icmp --icmp-type 8 -m length --length
>> 128:65535   -j LOG --log-level debug --log-prefix IP"ICMP Oversize:"
>> iptables -A INPUT  -p icmp --icmp-type 8 -m length --length
>> 128:65535   -j REJECT #--reject-with icmp-host-prohibited
>> iptables -A INPUT  -p icmp --icmp-type 8 -m limit   --limit
>> 3/s         -j ACCEPT
>> iptables -A INPUT  -p icmp -f  -j LOG --log-prefix "ICMP Fagment:"
>> iptables -A INPUT  -p icmp -f  -j REJECT
>>
>> This Is a  good solution of filtering ICMP I use it and it is working
>> fine
>> It alow only 3 ping per second and ICMP packet sise is  maximum 128
>
>
> Notes :
> ICMP type "echo-request" instead of 8 is more explicit.
>
> The -f flag will never match if connection tracking (ip_conntrack) is
> active (used by the nat table or state match for example) because the
> connection tracking needs to reassemble fragments before the packet
> enters the iptables chains.
>
> I would rather DROP unwanted ICMP packets instead of REJECT.
>
>

Maybeyou are righ but  this solution works fine with my configuration  
which can be difficult that your one


--
To UNSUBSCRIBE, email to debian-firewall-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...