Chris Cooper - PowerPoint PPT Presentation

���������������������������� Chris Cooper Slides & Scripts: http://QCCoLab.com/ipset

����������������������

�������� • Linux Based • Cheap • Feature Rich • Rugged • Advanced IPTables

��������

����� • Address Lists for IPTables • IPSet project – http://ipset.netfilter.org/ • Patch for Kernel 2.4.36 • Officially included in Kernel 2.6.39 • Nomatch & TC support added in 3.7 • Binary included in all major repos

���������������� • IPSet can store many types of data – IP – Single IP addresses – Net – Variable length subnets (using CIDR) – Ports – Lump multiple service ports together – IP,Port – A specific port at a specific IP – IP,port,IP – A specific connection – IP,MAC – For your Layer 2 filtering needs – Set – Group sets together (Yo, dawg…)

�������� • IPSet will match hosts inside networks • Nomatch can be used for exceptions

�������� • IPSet Simplifies Rules • Creates objects to work with

����� �� • Fail2Ban – Bans IP’s that cause trouble – http://www.fail2ban.org/ • Modular Design • Watches logs for keys like failed logins • Can take a variety of actions – Default is IPTables rules to block – Creates a long ugly list of block rules

����� �� • IPSet support added very recently • Not yet in any repos. Check GitHub – action.d/iptables-ipset-proto4.conf • IPSet is IPv6 friendly Oops. This refers to the version of – action.d/iptables-ipset-proto6.conf IPSet used by fail2ban. Although IPSet does still support IPv6, fail2ban vs does not.

����!���� • DenyHosts – Similar to fail2ban – http://www.denyhosts.net/ • Centralized Server

����!���� • 12,000 IPTables rules is not practical – Adds ~5ms latency to every connection • Uses hosts.deny – Requires tcpwrapper – Stock Apache & OpenSSH not supported – Only protects local services (not a firewall)

��"�������������# • IPSet’s Hash Tables are really fast http://daemonkeeper.net/781/mass-blocking-ip-addresses-with-ipset/

����!���� • DenyHosts supports external scripts • Add a quick script for setup • PLUGIN_DENY PLUGIN_PURGE • Just called for local trips (not database)

����!���� • Finally, add a script to cron • Loads central databse entries • Swap used for no interruption

�����!�$$���������������� • IPSet supports timeouts – Create rules that automatically expire • Iptables rules can add entries to a set – Create your own IPS systems inside netfilter

���$� �%��������������$�� • Identify 3 SSH connections in 60 seconds • Block the IP for 15 minutes

�����&������� • Hit TCP 123 • Within 5 seconds hit TCP 1338 • Within 5 seconds hit UDP 1175 • Open access for 5 minutes

���������� • Detect & Block Port Scans – UDP/TCP Port 0 – Look for invalid TCP Flags • FIN,URG,PSH – Xmas Tree Scan • FWSnort can convert Snort to IPTables – Pick specific rules you understand – http://www.cipherdyne.org/fwsnort/ • Beware of false positives!

'�%�������������������()� • Be creative with targets • DNAT – Forward hostile hosts to a honeypot • REDIRECT – Redirect to a “Captive Portal” page until auth – Warn users (Don’t be Comcast) • LIMIT – Rate limit new connections

'�%�������������������()� • Mark packets for use with iproute2 – Route some users out a different connection – Use statistic for source-based routing • Throttle users with TC – Detect p2p or bittorrent presence • Easy to find, Hard to block – Throttle all non-HTTP(s) traffic to dial-up – Timeouts minimize false-positive impact

*%�������� • Chris Cooper – Twitter: @CC_DKP – CCooper@QCColab.com • Slides & Scripts: – http://QCCoLab.com/ipset