Zabbix monitoring Iptables Firewall status whether there are discarded packets (attack-Strike)

Overview

Previously introduced by Saltstack Unified management of the online firewall rules, and is the default rule for the drop policy, that means, if not explicitly allowed to open or allow access, the firewall will reject the request, especially when the online firewall modification, may because of historical reasons do not know to open those services, Also do not know whether the service on the machine to go out of the case, it is necessary to log the firewall access log, and to see if there is a legitimate request is blocked, this will affect the business, you know, in addition if our machine is scanned, be * * *, there will be a lot of rejection, so regardless of the purpose, We need to monitor whether the firewall has blocked requests, do a little bit of it, have a problem alarm;

Method:
Because the iptables firewall records the number of drop, and can record the log of the firewall, so we can get the number of blocked packets to know if there is a rejected request, and check the log, to determine whether it is accidental or * * *, to strengthen the processing;

Example:
First add the logging to the fire wall's input ouput:

/etc/sysconfig/iptables文件中添加如下两条：-A INPUT -j LOG --log-prefix "iptables-IN-DROP:"-A OUTPUT -j LOG --log-prefix "iptables-OUT-DROP:"

This allows the firewall to log blocked logs (/var/log/message);

Check the firewall status for blocked requests:
$ sudo iptables-vnl |grep "Chain" |grep "DROP"

, the INPUT output rule has the drop

to view blocked logs :
To find out, I'll clear the firewall log first.

$ sudo iptables -Z$ telnet 115.182.6.91 60122

Since I have not allowed to go out to visit the 115.182.6.91 60122 port of this machine;
So look at the firewall log as follows:

Oct 21 10:15:48 app-backend-29 kernel: iptables-out-DROP:IN= OUT=eth0 SRC=10.8.51.29 DST=115.182.6.91 LEN=52 TOS=0x10 PREC=0x00 TTL=64 ID=13822 DF PROTO=TCP SPT=4020 DPT=60122 WINDOW=14600 RES=0x00 SYN URGP=0 Oct 21 10:15:49 app-backend-29 kernel: iptables-out-DROP:IN= OUT=eth0 SRC=10.8.51.29 DST=115.182.6.91 LEN=52 TOS=0x10 PREC=0x00 TTL=64 ID=13823 DF PROTO=TCP SPT=4020 DPT=60122 WINDOW=14600 RES=0x00 SYN URGP=0 Oct 21 10:15:49 app-backend-29 san: [euid=san]:san pts/1 2018-10-21 10:09 (172.188.103.253):[/usr/local/zabbix-3.4.4/scripts]2018-10-21 10:15:48 san telnet 115.182.6.91 60122

Based on the above basis, we can add Zabbix monitoring;

Zabbix Monitor the drop of firewall status

The implementation of the method has been described above, the idea is that the script to monitor the state of the firewall is not blocked packets, there is no output, no is 0;
Trigger alarm condition is greater than 0 o'clock and more than 100 in a minute to trigger the alarm (this threshold can be adjusted by the business); General focus on output
, because the business may invoke the outside interface, of course, there may be an unknown program out of the request, and inpupt over a long, there may be open service is blocked by the firewall or have * * *;

1. Zabbix Script

[app-backend-29 scripts]$ cat iptables_droped_status.sh #!/bin/bashcheck(){  sudo iptables -vnL |grep "Chain $1"|grep "DROP"|awk ‘{print $2,":",$5}‘|awk -F":" ‘{if($2>0) {print $2} else {print "0"}}‘}case $1 in      INPUT)     check $1     ;;     OUTPUT)     check $1     ;;     FORWARD)     check $1     ;;     *)     check     ;;esac

The script performs the following effects:

2. Zabbix Monitoring Items
With the script to get the data, but also to have monitoring items;

cat /usr/local/zabbix-3.4.4/zabbix_agentd.conf.d/iptables.conf# iptables Drop statusUserParameter=iptables.droped[*],/bin/bash /usr/local/zabbix-3.4.4/scripts/iptables_droped_status.sh $1

Here the monitoring items are added to the iptables.droped,web on the monitoring items, triggers are required; first remember;

3. Zabbix Web Configuration
Since the previous article has repeatedly documented examples of adding monitoring items and triggers, here is a simple description of
Configure--and find a template for one of the underlying monitoring templates, as follows:

Other additions are similar;
Effect

To add a trigger:

({Ickey Basic Status:iptables.droped[INPUT].last()}>0) and  ({Ickey Basic Status:iptables.droped[INPUT].count(60)}>100)

The last value is greater than 0 (that is, there is a blocked request) at the same time for a minute to block more than 100 indicates that there is a business has been blocked, and then larger may be the * * class, so you need to view the log analysis analysis!

Add here to finish!

The effect is as follows:
To view the latest data for the host:

The alarm information is as follows:

The above is based on the security of the firewall in the production of rules and regulations and monitoring, the fastest to identify problems, analysis of problems ~ If there are inappropriate welcome message, in addition, if you feel useful to you, remember to order a praise ha ~

Zabbix monitoring Iptables Firewall status whether there are discarded packets (attack-Strike)