a packet matching a rule will be directed to a chain
a packet always goes trough one of these 3 chains :
Input : a packet going to the system incoming in an interface
Output : a packet generated by the system leaving an interface
Forward : a packet going though the system
The following chains cannot be redefinned
ACCEPT : the packet is accepted
DROP : the packet is ignored
RETURN : end of the current program or application of the default policy for Input, Output and Forward
REJECT : the packet is rejected without any error message
LOG : the packet is logged
QUEUE : the packet is forwarded to a user program which will decide of it's fate
2.2 Filtering possibilities
on input or output of an interface
INPUT: always on the interface input
OUTPUT: always on the interface output
FORWARD: on the interface input or output
on source or destination address with or without a netmask
service type
protocol
fragments or not
ICMP type and code
TCP and UDP: source and destination port with or without a range
TCP
tcp options: SYN, ACK, FIN, RST, URG et PSH
connection requets or data transfers
2.3 Connexion tracing
tracing of TCP, UDP and ICMP connections
available options:
INVALID: packet is invalid
internal error while processing the packet
ICMP error packet not corresponding to any connection
ESTABLISHED: packet is part of an established connection
RELATED:
error packet matching an existing communication (reset / icmp)
a packet matching a request for a ftp data connection (active or passive mode)
NEW : packet does not match any know connection
(not necessarily a new connection)
list of the logged connections : cat /proc/net/ip_conntrack
Number of connection (by default 8184) :
echo 16384 > /proc/sys/net/ipv4/ip_conntrack_max
2.4 Technical tests
ICMP (ping):
an echo-reply from the server does not match a connection and is ignored
an echo-request from the client opens a "connection" for 30s
any echo-request from the client reinitializes the countdown for 30s
UDP:
an UDP packet from the server not matching a connection is ignored
an UDP packet from the client opens a connection in the state "UNREPLIED" for 30s
an UDP packet from the client reinitializes the countdown for 30s
an UDP packet from the server brings the connection in "CONNECTED" state for 180s
An ICMP port unreachable doesn't close the connection.
TCP:
before the client sends a SYN or SYN-FIN : no packet goes through
a SYN or SYN-FIN packet opens a connection in the state : "SYN_SENT"
a RST or SYN-RST:
from the client closes the connection without being transfered
from the server puts the connection in the state : "CLOSE" for 10 seconds wihout being transfered
a SYN-ACK from the server puts the connection in the state : "ESTABLISHED". The coutdown is set to 432000 second (5 days)
any RST or SYN-RST packet immediately closes the connection without being transfered
a FIN-ACK packet from one of the stations puts the connection in the state "CLOSE_WAIT" for 60s
a FIN_ACK from the other puts the connection in the state : "TIME WAIT" for 120s
2.5 Drawbacks
As soon as the connection table is full, it becomes impossible to connect. SYN_FLOOD on open ports is possible because only the two packets are necessary to put the connection in the "ESTABLISHED" state.
Has been corrected: A connexion is concidered established only after the third packet has been seen.
Sequence numbers are not controlled.
Has been corrected:
Rusty's poor-man's sequence track : sequence numbers are checked for the first three pakets.
Jozsef Kadlecsik has written a ptach based on the document "Real Stateful TCP Packet Filtering in IP Filter" written by Guido van Rooij describing the stateful implementation of IP Filter
This patch breaks NAT for FTP and IRC modules for the time.
2.6 Other filtering possibilities
mac: check the source mac address
limit: put a limit on the use of a rule (max 3h)
limit the number of packets logged per second: iptables -A FORWARD -m limit --limit 3/s -j LOG
limit the number of SYN packets per second: iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT
limit the efficiency of port scanners
limit the number of echo-request icmp query per second
owner : match a packet created locally
filter by uid,gid,pid,sid
owner can only be applied to the OUTPUT chain
some packets have no owner : icmp reply ...
Kernel mailing list (200 messages a day / 0,5 Mb)
echo "subscribe linux-kernel your_email@your_ISP" | mail majordomo@vger.rutgers.edu
echo "subscribe linux-kernel-digest your_email@your_ISP" | mail majordomo@vger.rutgers.edu
Linux netfilter Hacking HOWTO http://www.samba.org/netfilter/unreliable-guides/netfilter-hacking-HOWTO.html
Rusty Russel This document describes the netfilter architecture for Linux, how to hack it, and some of the major systems which sit on top of it, such as packet filtering, connection tracking and Network Address Translation.
® © Hervé Schauer Consultants 2000 -
4 bis, rue de la gare -
92300 Levallois-Perret