Simple iptables

Problem: Forwarding external web requests through a corporate gateway to an internal web server.

Scenario: You have three computers. A) Web server on the internal corporate network; B) Gateway; C) User on an external network.

• Web Server: 172.30.30.1
• Gateway: 100.10.10.2 (eth1, facing external)

Gateway B filters and routes traffic from external users into the corporate network. Web Server A is not directly accessible from external networks. The user (C) wants to view pages on the web server. This is done by pointing the browser to the gateway (http://100.10.10.2).

Solution: Two iptables rules that forward all Gateway port 80 TCP traffic to the internal web server, port 80.

echo -n 1 > /proc/sys/net/ipv4/ip_forward

iptables -t nat -A PREROUTING -i eth1 -p tcp -d 100.10.10.2 --dport 80 -j DNAT --to 172.30.30.1:80
iptables -t nat -A POSTROUTING -d 172.30.30.1:80 -j MASQUERADE

---

Problem: Allow only computers from a certain network to ping the machine.

Scenario: Allow only computers located on the 192.168.0.X network to ping the machine and receive a response.

Solution:

iptables -A INPUT -s 192.168.0.0/24 -p icmp --icmp-type echo-request -j ACCEPT

---

Problem: Deny access to a computer or a network

Solution:

# Deny access to a single IP address
iptables -A OUTPUT -d 172.16.23.23/32 -j DROP

# Deny access to a network
iptables -A OUTPUT -d 172.16.23.0/24 -j DROP

---

Problem: Block an IP address that tries to connect "too fast, too many times"

Solution: The first two rules check to see if an IP address connecting through port 22 is on the 'sshdrop' list and has tried to connect three times in the last 30 seconds. If the IP address matches, then the first rule lots the attempt and the second rule drops the connection. The third rule places the IP address onto the 'sshdrop' list.

iptables -A INPUT -m tcp -p tcp -m recent --dport 22 --rcheck --seconds 30 --hitcount 3 \
--name sshdrop --rsource -j LOG --log-prefix "SSH ATTACK: "
iptables -A INPUT -m tcp -p tcp -m recent --dport 22 --rcheck --seconds 30 --hitcount 3 \
--name sshdrop --rsource -j DROP
iptables -A INPUT -m state --state NEW -m tcp -p tcp -m recent --dport 22 \
--set --name sshdrop --rsource -j ACCEPT

In addition, sshd can be configured (/etc/sshd_config) with parameters that will prune unauthenticated connections to the SSH daemon. The following example setting restricts the number of authentication attempts on the same connection to 8 (MaxAuthTries). In addition (MaxStartups), sshd will start denying connections with a probability of 50% once the number of unauthenticated connections reaches 4. The probability of a connection being denied increases linearly from 50% at 4 connections to 100% refusal when the number of unauthenticated connections reaches 8. See the man page for sshd_config for additional information.

MaxAuthTries 8
MaxStartups 4:50:8

---

Problem: Need to balance web requests between two mirrored web servers

Scenario: IP addresses of the web servers are 172.30.30.1 and 172.30.30.2. Connections can come in through any interface (eth+)

Solution:

echo -n 1 > /proc/sys/net/ipv4/ip_forward

iptables -t nat -A PREROUTING -i eth+ -p tcp --dport 80 -m state --state NEW \
-m statistic --mode nth --set-counter 0 0 --every 2 --packet 0 -j DNAT --to 172.30.30.1:80

iptables -t nat -A PREROUTING -i eth+ -p tcp --dport 80 -m state --state NEW \
-m statistic --mode nth --set-counter 0 0 --every 2 --packet 1 -j DNAT --to 172.30.30.2:80

iptables -t nat -A POSTROUTING -d 172.30.30.1 -j MASQUERADE
iptables -t nat -A POSTROUTING -d 172.30.30.2 -j MASQUERADE

---

Problem: Probabilistically rotate between three mirrored web servers

Scenario: Three webservers (172.30.30.1, 172.30.30.2, 172.30.30.3) are mirrored. When a request on port 80 comes in through any ethernet port (eth+), randomly select which server will service the request (0.33 probably for each).

Solution:

echo -n 1 > /proc/sys/net/ipv4/ip_forward

iptables -t nat -A PREROUTING -i eth+ -p tcp --dport 80 -m state --state NEW \
-m statistic --mode random --set-counter 0 0 --probability 0.33 -j DNAT --to 172.30.30.1:80

iptables -t nat -A PREROUTING -i eth+ -p tcp --dport 80 -m state --state NEW \
-m statistic --mode random --set-counter 0 0 --probability 0.33 -j DNAT --to 172.30.30.2:80

iptables -t nat -A PREROUTING -i eth+ -p tcp --dport 80 -m state --state NEW \
-m statistic --mode random --set-counter 0 0 -j DNAT --to 172.30.30.3:80

iptables -t nat -A POSTROUTING -d 172.30.30.1 -j MASQUERADE
iptables -t nat -A POSTROUTING -d 172.30.30.2 -j MASQUERADE
iptables -t nat -A POSTROUTING -d 172.30.30.3 -j MASQUERADE

---

Problem: Prevent access to an IP address during a certain time range

Scenario: Prevent access to a computer during "work hours". The IP address of the computer is 208.94.116.39.

Solution:

TSTART=07:00:00
TSTOP=17:00:00
iptables -A OUTPUT -d 208.94.116.39/32 -m time --timestart $TSTART --timestop $TSTOP -j DROP

---