Skip to contentSkip to conversation

Filtered address in can login

DISCUSSION vladimir 4 participants 5 messages Aug 16, 2005 – Aug 17, 2005

lore
Share & tools
lore

vladimir

author
#0 lore raw

Hi, I have iptables-1.2.7a and 2.4.26 kernel and there is something strange.
I have the following rule:
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -s 0/0 --protocol tcp --destination-port 80 -j ACCEPT iptables -A INPUT -s IP_ADDR --protocol tcp --destination-port 22 -j ACCEPT
iptables -A INPUT -p tcp --syn -j DROP

So I expect that only the specified IP_ADDR can ssh to port 22 in my server.
But in /var/log/secure I see that some other IP's for example 168.179.113.141 try to login to ssh with different user names to my server.
However, then I try ssh to that server not from IP_ADDR I can not, as expected.
Please tell me how this 168.179.113.141 bypass my firewall. Thank you very much,
Vladimir

Signature · 3 lines
www.FetchBook.Info
Find the lowest price - Compare more than a hundred book stores in a
click
#1 lore raw

Are you sure your default POLICIES are ok? I mean...
do you have somewhere:
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP
... your script ...
iptables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

You should also consider adding rules for the DNS to work.

Quoted 20 lines · vladimir

Hi, I have iptables-1.2.7a and 2.4.26 kernel and there is something strange.
I have the following rule:
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -s 0/0 --protocol tcp --destination-port 80 -j ACCEPT iptables -A INPUT -s IP_ADDR --protocol tcp --destination-port 22 -j ACCEPT
iptables -A INPUT -p tcp --syn -j DROP

So I expect that only the specified IP_ADDR can ssh to port 22 in my server.
But in /var/log/secure I see that some other IP's for example 168.179.113.141 try to login to ssh with different user names to my server.
However, then I try ssh to that server not from IP_ADDR I can not, as expected.
Please tell me how this 168.179.113.141 bypass my firewall. Thank you very much, Vladimir

#2 lore raw
In reply to vladimir

The only thing that comes to mind is that 168.79.113.141 might be getting in under the "--state RELATED" rule if you had an outgoing connection to that IP it would possibly be able to get back in.

Grant. . . .

Quoted 18 lines · vladimir

Hi, I have iptables-1.2.7a and 2.4.26 kernel and there is something strange.
I have the following rule:
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -s 0/0 --protocol tcp --destination-port 80 -j ACCEPT iptables -A INPUT -s IP_ADDR --protocol tcp --destination-port 22 -j ACCEPT
iptables -A INPUT -p tcp --syn -j DROP

So I expect that only the specified IP_ADDR can ssh to port 22 in my server.
But in /var/log/secure I see that some other IP's for example 168.179.113.141 try to login to ssh with different user names to my server.
However, then I try ssh to that server not from IP_ADDR I can not, as expected.
Please tell me how this 168.179.113.141 bypass my firewall. Thank you very much, Vladimir

#3 lore raw
Quoted 4 lines

The only thing that comes to mind is that 168.79.113.141 might be getting in under the "--state RELATED" rule if you had an outgoing connection to that IP it would possibly be able to get back in.

Heh, webserver hacked?

Quoted 1 line
Quoted 1 line

iptables -A INPUT -s 0/0 --protocol tcp --destination-port 80 -j ACCEPT

Jan Engelhardt

Signature · 1 line
| Alphagate Systems, http://alphagate.hopto.org/
#4 lore raw

Possibly, but I hate to speculate.

Grant. . . .

Quoted 1 line · Jan Engelhardt

Heh, webserver hacked?