Protect your Web server from a full explanation of iptables firewall scripts

 

This article assumes that you have a basic understanding of iptables. Otherwise, read the iptables entry.

 

On our Web server, the system's default policy is that INPUT is DROP, OUTPUT; FORWARD chain is ACCEPT, and DROP is relatively loose, because we know that the outgoing packets are safer.

 

Preparations

 

To verify the versatility of the script, I checked the kernel and iptables version of the server:

 

# Uname-

Linux ud50041 2.6.9-34. ELsmp #1 SMP Fri Feb 24 16:54:53 EST 2006 i686 i686 i386 GNU/Linux

# Iptables-V

Iptables v1.2.11

# Lsb_release-

LSB Version: core-3.0-ia32: core-3.0-noarch: graphics-3.0-ia32: graphics-3.0-noarch

Distributor ID: RedHatEnterpriseAS

Description: Red Hat Enterprise Linux AS release 4 (Nahant Update 3)

Release: 4

Codename: NahantUpdate3

We can find that the system, kernel, and iptables versions of this server are relatively old. The script described in this article involves the recent security module, which requires the system kernel (the recent module is also frequently used in host protection scripts ). Therefore, if you want to use iptables as the host firewall, we recommend that you use CentOS 5.6 x86_64 or a more advanced version. Otherwise, the system will prompt the following error message:

 

Iptables: Unknown error 18446744073709551615

Iptables: Invalid argument

The following error message is prompted during tail-f/var/log/messages:

 

Ip_tables: connlimit match: invalid size 32! = 16

Ip_tables: connlimit match: invalid size 32! = 24

In addition, before debugging the iptables script in the production environment, we strongly recommend that you write a crontab task and close the iptables script every five minutes to prevent improper operations and lock your SSH client out:

 

*/5 * root/etc/init. d/iptables stop

These are the preparations. The following is the iptables script content.

 

Script content

 

#! /Bin/bash

Iptables-F

Iptables-F-t nat

Iptables-X

 

Iptables-P INPUT DROP

Iptables-P OUTPUT ACCEPT

Iptables-P FORWARD ACCEPT

 

# Load connection-tracking modules

Modprobe iptable_nat

Modprobe ip_conntrack_ftp

Modprobe ip_nat_ftp

 

Iptables-a input-f-m limit -- limit 100/sec -- limit-burst 100-j ACCEPT

Iptables-a forward-p icmp -- icmp-type echo-request-m limit -- limit 1/s -- limit-burst 10-j ACCEPT

Iptables-a input-p tcp-m tcp -- tcp-flags SYN, RST, ack syn-m limit -- limit 20/sec -- limit-burst 200-j ACCEPT

 

Iptables-a input-s 122.70.x.x-j ACCEPT

Iptables-a input-I lo-j ACCEPT

Iptables-a output-o lo-j ACCEPT

Iptables-a input-m state -- state ESTABLISHED, RELATED-j ACCEPT

Iptables-a input-p tcp-m multiport -- dport 80, 22-j ACCEPT

Save the script file and use

 

# Sh iptables. sh

Run the script. After running the script, check the following:

 

# Iptables-nv-L

Script description

 

Because the Web server is placed behind the Server Load balancer, we need to allow the data source address to pass through the Load balancer packet:

 

Iptables-a input-s 122.70.x.x-j ACCEPT

If monitoring systems such as Nagios are configured, add them here. If neither monitoring nor LB is done, skip this line.

 

In addition, this script is also deployed on many small LNMP-based websites. Because the Web service and MySQL database are installed on one machine at the same time, port 3306 is not enabled.

 

In this script, we have configured some security measures to prevent external ping and SYN flood attacks, and considering that the external crazy Port Scan software may affect the server's entry bandwidth, therefore, the following restrictions are also imposed:

 

Iptables-a input-p tcp -- syn-m limit -- limit 100/s -- limit-burst 100-j ACCEPT

The preceding command allows up to 100 new connections per second. Note that the New connection refers to the data packet whose state is New. Later, we also configure the data that is allowed to pass in the state of ESTABLISHED and RELATED. In addition, 100 this threshold value should be adjusted based on the actual situation of the server. If it is a server with a small number of concurrent requests, it should be adjusted to a smaller value. If it is a server with a large access volume and a large number of concurrent requests, this value needs to be increased.

 

Iptables-a input-p icmp -- icmp-type echo-request-m limit -- limit 1/s-limit-burst 10-j ACCEPT

To prevent ping flood attacks, a maximum of 10 ping packets per second are allowed.

 

Iptables-a input-p tcp-m tcp -- tcp-flags SYN, RST, ack syn-m limit -- limit 20/sec -- limit-burst 200-j ACCEPT

The above command prevents various port scans and limits SYN and ack syn to no more than 200 per second, so as not to exhaust the bandwidth of the server.

 

Subsequent reinforcement work

 

After the iptables firewall is running, run the nmap tool for scanning:

 

# Nmap-P0-sS 211.143.6.x

Starting Nmap 4.11 (http://www.insecure.org/nmap/) at CST

Interesting ports on 211.143.6.X:

Not shown: 1668 closed ports

PORT STATE SERVICE

22/tcp open ssh

25/tcp open smtp

80/tcp open http

110/tcp open pop3

111/tcp open rpcbind

143/tcp open imap

443/tcp open https465/tcp open smtps

587/tcp open submission

993/tcp open imaps

995/tcp open pop3s

1014/tcp open unknown

Here, we found that a 1014 terminal was opened by a process and it was opened by rpc. statd through lsof-I: 1014. This service uses different ports every time! If rpc. statd cannot correctly process the SIGPID signal, remote attackers can use this vulnerability to close the process and initiate a Denial-of-Service attack. We found that rpc. statd is enabled by the nfslock service. Further query shows that rpc. statd is an optional process, which allows the NFS client to lock files on the server. This process corresponds to the nfslock service, so we disable this service:

 

Service nfslock stop

Chkconfig nfslock off

Finally, if there is no hardware firewall protection, try to deploy the iptables firewall on every machine with a public IP address!

 

Author: Yu hongchun (fuqin Liquor-making Weibo), author of "building high-availability Linux Server", yipai System Architect, Senior Project management engineer, ChinaUnix cluster, and high-availability version moderator.