Skip to contentSkip to conversation

..prevention, was: syn DDoS attack solution

DISCUSSION Martin McKeay 4 participants 9 messages Jun 7, 2007 – Jun 14, 2007 1 message not in the archive

lore
Share & tools
lore

A message that is not in the archive (sent off-list or not yet received): [email protected]

Martin McKeay

author
#1 lore raw

I writing a blog post about the rules for blocking the bogon IP's (unused IP networks) using the firewall module of our Cobia, I was considering including the equivalent iptables rules. Would this be of interest to anyone?

Martin McKeay, CISSP, GSNA
Cobia Product Evangelist
StillSecure
[email protected]
707-495-7926
http://www.cobiablog.com

-----Original Message-----
From: [email protected] [mailto:[email protected]] On Behalf Of Steven M Campbell
Sent: Tuesday, June 05, 2007 9:41 AM
To: Arnt Karlsen
Cc: [email protected]
Subject: Re: ..prevention, was: syn DDoS attack solution

Quoted 10 lines · Arnt Karlsen

On Tue, 05 Jun 2007 10:16:40 -0400, Steven wrote in message <[email protected]>:

Quoted 5 lines

And, most important for folks here, do egress filtering on your
firewall! Help prevent zombie machines on your own networks from
being a problem, you can't stop your end users from bringing infections into your network but you can control their spread.

Quoted 5 lines

..what tricks _are_ out there? Set up some kinda p0f deamon and cut 'n tarpit any and all Wintendo network traffic attempts? Or even feed them LROS thru ActiveX if they need firm hints?

Not really very tricky, limit outbound traffic to what is needed. Do
all of your workstations need UDP ports outbound? Smtp? For a lot of

sites the average workstations internet requirements are very small, especially if proxys are used for SMTP,HTTP,FTP, etc. Just by blocking most of the end users from direct internet access (or at least to a small set of outbound protocol/ports) we render those machines pretty useless to the bad guys.

It does, however, become very tricky if it's not done up front. It's really really tough to figure out what the requirements are if anyone
could historically do anything they wanted. It's far better to
seriously restrict things up front and put in the exceptions as you find

them. Sites that have historically allowed all outbound traffic are a
two fold problem, it's hard to fix and they are exactly the sorts of sites the bad guys like to use.

#2 lore raw

On Thu, 7 Jun 2007 12:41:44 -0600, Martin wrote in message <[email protected]>:

Quoted 4 lines

I writing a blog post about the rules for blocking the bogon IP's (unused IP networks) using the firewall module of our Cobia, I was considering including the equivalent iptables rules. Would this be of interest to anyone?

..yup. Is _why_ I posted.

Quoted 12 lines

Martin McKeay, CISSP, GSNA
Cobia Product Evangelist
StillSecure
[email protected]
707-495-7926
http://www.cobiablog.com

Quoted 4 lines · Arnt Karlsen

..what tricks _are_ out there? Set up some kinda p0f deamon and cut 'n tarpit any and all Wintendo network traffic attempts? Or even feed them LROS thru ActiveX if they need firm hints?

Signature · 4 lines
..med vennlig hilsen = with Kind Regards from Arnt... ;o)
...with a number of polar bear hunters in his ancestry...
  Scenarios always come in sets of three: 
  best case, worst case, and just in case.
author
#3 lore raw
In reply to Martin McKeay

As promised, I wrote a blog entry on the blocking the bogon IP's and included the full set of Iptables rules.
http://cobia.typepad.com/cobia_community_blog/how_to_use_cobia/index.htm
l

Thanks,

Martin

Martin McKeay, CISSP, GSNA
Cobia Product Evangelist
StillSecure
[email protected]
707-495-7926
http://www.cobiablog.com

-----Original Message-----
From: [email protected] [mailto:[email protected]] On Behalf Of Martin McKeay
Sent: Thursday, June 07, 2007 12:42 PM
To: [email protected]
Subject: RE: ..prevention, was: syn DDoS attack solution

I writing a blog post about the rules for blocking the bogon IP's (unused IP networks) using the firewall module of our Cobia, I was considering including the equivalent iptables rules. Would this be of interest to anyone?

Martin McKeay, CISSP, GSNA
Cobia Product Evangelist
StillSecure
[email protected]
707-495-7926
http://www.cobiablog.com

-----Original Message-----
From: [email protected] [mailto:[email protected]] On Behalf Of Steven M Campbell
Sent: Tuesday, June 05, 2007 9:41 AM
To: Arnt Karlsen
Cc: [email protected]
Subject: Re: ..prevention, was: syn DDoS attack solution

Quoted 10 lines · Arnt Karlsen

On Tue, 05 Jun 2007 10:16:40 -0400, Steven wrote in message <[email protected]>:

Quoted 5 lines

And, most important for folks here, do egress filtering on your
firewall! Help prevent zombie machines on your own networks from
being a problem, you can't stop your end users from bringing infections into your network but you can control their spread.

Quoted 5 lines

..what tricks _are_ out there? Set up some kinda p0f deamon and cut 'n tarpit any and all Wintendo network traffic attempts? Or even feed them LROS thru ActiveX if they need firm hints?

Not really very tricky, limit outbound traffic to what is needed. Do
all of your workstations need UDP ports outbound? Smtp? For a lot of

sites the average workstations internet requirements are very small, especially if proxys are used for SMTP,HTTP,FTP, etc. Just by blocking most of the end users from direct internet access (or at least to a small set of outbound protocol/ports) we render those machines pretty useless to the bad guys.

It does, however, become very tricky if it's not done up front. It's really really tough to figure out what the requirements are if anyone
could historically do anything they wanted. It's far better to
seriously restrict things up front and put in the exceptions as you find

them. Sites that have historically allowed all outbound traffic are a
two fold problem, it's hard to fix and they are exactly the sorts of sites the bad guys like to use.

#4 lore raw

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

With references to updating the continually changing bogon IP's, and how to add rules for those changes?

Thanks,

Ron DuFresne

Quoted 73 lines · Martin McKeay

As promised, I wrote a blog entry on the blocking the bogon IP's and included the full set of Iptables rules.
http://cobia.typepad.com/cobia_community_blog/how_to_use_cobia/index.htm
l

Thanks,

Martin

Martin McKeay, CISSP, GSNA
Cobia Product Evangelist
StillSecure
[email protected]
707-495-7926
http://www.cobiablog.com

-----Original Message-----
From: [email protected] [mailto:[email protected]] On Behalf Of Martin McKeay
Sent: Thursday, June 07, 2007 12:42 PM
To: [email protected]
Subject: RE: ..prevention, was: syn DDoS attack solution

I writing a blog post about the rules for blocking the bogon IP's (unused IP networks) using the firewall module of our Cobia, I was considering including the equivalent iptables rules. Would this be of interest to anyone?

Martin McKeay, CISSP, GSNA
Cobia Product Evangelist
StillSecure
[email protected]
707-495-7926
http://www.cobiablog.com

-----Original Message-----
From: [email protected] [mailto:[email protected]] On Behalf Of Steven M Campbell
Sent: Tuesday, June 05, 2007 9:41 AM
To: Arnt Karlsen
Cc: [email protected]
Subject: Re: ..prevention, was: syn DDoS attack solution

Quoted 10 lines · Arnt Karlsen

On Tue, 05 Jun 2007 10:16:40 -0400, Steven wrote in message <[email protected]>:

Quoted 5 lines

And, most important for folks here, do egress filtering on your
firewall! Help prevent zombie machines on your own networks from
being a problem, you can't stop your end users from bringing infections into your network but you can control their spread.

Quoted 5 lines

..what tricks _are_ out there? Set up some kinda p0f deamon and cut 'n tarpit any and all Wintendo network traffic attempts? Or even feed them LROS thru ActiveX if they need firm hints?

Not really very tricky, limit outbound traffic to what is needed. Do
all of your workstations need UDP ports outbound? Smtp? For a lot of

sites the average workstations internet requirements are very small, especially if proxys are used for SMTP,HTTP,FTP, etc. Just by blocking most of the end users from direct internet access (or at least to a small set of outbound protocol/ports) we render those machines pretty useless to the bad guys.

Quoted 13 lines

It does, however, become very tricky if it's not done up front. It's really really tough to figure out what the requirements are if anyone
could historically do anything they wanted. It's far better to
seriously restrict things up front and put in the exceptions as you find

them. Sites that have historically allowed all outbound traffic are a
two fold problem, it's hard to fix and they are exactly the sorts of sites the bad guys like to use.

- -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
admin & senior security consultant: sysinfo.com
http://sysinfo.com
Key fingerprint = 9401 4B13 B918 164C 647A E838 B2DF AFCC 94B0 6629

...We waste time looking for the perfect lover
instead of creating the perfect love.

-Tom Robbins <Still Life With Woodpecker>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iD8DBQFGbyHYst+vzJSwZikRAsrtAKCEycOkf9ZeXynCnUDfAn5g+OoLpACfc+pZ f1EvxxUjYYdHtR9Qo1+SMsc=
=xmHn
-----END PGP SIGNATURE-----

author
#5 lore raw

It's manual at this point. The bogons aren't changing that often to the best of my knowledge, maybe 3-4 times a year at most.

Martin

Martin McKeay, CISSP, GSNA
Cobia Product Evangelist
StillSecure
[email protected]
707-495-7926
http://www.cobiablog.com

-----Original Message-----
From: R. DuFresne [mailto:[email protected]]
Sent: Tuesday, June 12, 2007 4:45 PM
To: Martin McKeay
Cc: [email protected]
Subject: RE: ..prevention, was: syn DDoS attack solution

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

With references to updating the continually changing bogon IP's, and how to add rules for those changes?

Thanks,

Ron DuFresne

Quoted 6 lines · Martin McKeay

As promised, I wrote a blog entry on the blocking the bogon IP's and included the full set of Iptables rules.
http://cobia.typepad.com/cobia_community_blog/how_to_use_cobia/index.h
tm
l

#6 lore raw

On Wed, 13 Jun 2007 08:24:24 -0600, Martin wrote in message <[email protected]>:

Quoted 2 lines

It's manual at this point. The bogons aren't changing that often to the best of my knowledge, maybe 3-4 times a year at most.

..rare enough to forgen't all about it then. Cron job?

Signature · 4 lines
..med vennlig hilsen = with Kind Regards from Arnt... ;o)
...with a number of polar bear hunters in his ancestry...
  Scenarios always come in sets of three: 
  best case, worst case, and just in case.
author
#7 lore raw

I'm not directly involved in the firewall for the corporation in my current postion, but as the Security Manager at my last employer, one of the things we did was set up a schedule of regular firewall reviews by a committee consisting of the firewall admin, the network admin and myself. We had a check list of the minimum requirements for the firewalls, including the bogons and a final deny all rule. It was a e-commerce software/hosting company, so we had over 30 firewalls we managed. Our entire IT department, including myself and the IT Director was 7 people, so you can guess this wasn't something people liked making time for, but it saved us a more than once when someone had made a mistake in the firewall configuration.

I like the idea of an automatic update, but I think it's more important to have regular peer review of the firewall configuration. It's worked well for me in the past

Martin

Martin McKeay, CISSP, GSNA
Cobia Product Evangelist
StillSecure
[email protected]
707-495-7926
http://www.cobiablog.com

-----Original Message-----
From: Arnt Karlsen [mailto:[email protected]]
Sent: Wednesday, June 13, 2007 11:26 AM
To: Martin McKeay
Cc: R. DuFresne; [email protected]
Subject: Re: ..prevention, was: syn DDoS attack solution

On Wed, 13 Jun 2007 08:24:24 -0600, Martin wrote in message <[email protected]>:

Quoted 2 lines

It's manual at this point. The bogons aren't changing that often to the best of my knowledge, maybe 3-4 times a year at most.

..rare enough to forgen't all about it then. Cron job?

--
..med vennlig hilsen = with Kind Regards from Arnt... ;o) ...with a number of polar bear hunters in his ancestry...
Scenarios always come in sets of three:
best case, worst case, and just in case.

#8 lore raw

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 12 lines · Martin McKeay

I'm not directly involved in the firewall for the corporation in my current postion, but as the Security Manager at my last employer, one of the things we did was set up a schedule of regular firewall reviews by a committee consisting of the firewall admin, the network admin and myself. We had a check list of the minimum requirements for the firewalls, including the bogons and a final deny all rule. It was a e-commerce software/hosting company, so we had over 30 firewalls we managed. Our entire IT department, including myself and the IT Director was 7 people, so you can guess this wasn't something people liked making time for, but it saved us a more than once when someone had made a mistake in the firewall configuration.

Quoted 4 lines

I like the idea of an automatic update, but I think it's more important to have regular peer review of the firewall configuration. It's worked well for me in the past

That's kinda a lame cop-out for not wanting to update your online documentation and work up some scripts to accompany it. Such a review does not have to negate an automated function to deall with blocking bogon blocks nor spam controls. And automating such tasks is a good way to make sure rules and info are uptodate and currnet, even prior to a review.

Thanks,

Ron DuFresne
- -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
admin & senior security consultant: sysinfo.com
http://sysinfo.com
Key fingerprint = 9401 4B13 B918 164C 647A E838 B2DF AFCC 94B0 6629

...We waste time looking for the perfect lover
instead of creating the perfect love.

-Tom Robbins <Still Life With Woodpecker>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iD8DBQFGcZp1st+vzJSwZikRAuv+AKDRGgGHaO010LFNxEqB5lYQoFzY4QCdEA4L 5QXNf/5/W6UUAyGLgH7O7+M=
=uzzl
-----END PGP SIGNATURE-----

#9 lore raw
Quoted 37 lines · R. DuFresne

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Quoted 12 lines · Martin McKeay

I'm not directly involved in the firewall for the corporation in my current postion, but as the Security Manager at my last employer, one of the things we did was set up a schedule of regular firewall reviews by a committee consisting of the firewall admin, the network admin and myself. We had a check list of the minimum requirements for the firewalls, including the bogons and a final deny all rule. It was a e-commerce software/hosting company, so we had over 30 firewalls we managed. Our entire IT department, including myself and the IT Director was 7 people, so you can guess this wasn't something people liked making time for, but it saved us a more than once when someone had made a mistake in the firewall configuration.

Quoted 4 lines

I like the idea of an automatic update, but I think it's more important to have regular peer review of the firewall configuration. It's worked well for me in the past

That's kinda a lame cop-out for not wanting to update your online documentation and work up some scripts to accompany it. Such a review does not have to negate an automated function to deall with blocking bogon blocks nor spam controls. And automating such tasks is a good way to make sure rules and info are uptodate and currnet, even prior to a review.

Thanks,

Ron DuFresne
- -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
admin & senior security consultant: sysinfo.com
http://sysinfo.com
Key fingerprint = 9401 4B13 B918 164C 647A E838 B2DF AFCC 94B0 6629

...We waste time looking for the perfect lover
instead of creating the perfect love.

Quoted 10 lines

-Tom Robbins <Still Life With Woodpecker>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iD8DBQFGcZp1st+vzJSwZikRAuv+AKDRGgGHaO010LFNxEqB5lYQoFzY4QCdEA4L 5QXNf/5/W6UUAyGLgH7O7+M=
=uzzl
-----END PGP SIGNATURE-----

Hi All,

For your info , the APF iptables firewall script has a bogon blocker , and also a cron mechanism to update the bogon list.

It also has some other excellent features such as

reactive address blocking (RAB), next generation in-line intrusion prevention
packet flow rate limiting that prevents abuse on the most widely abused protocol, icmp dshield.org block list support to ban networks exhibiting suspicious activity advanced packet sanity checks to make sure traffic coming and going meets the strictest of standards filter attacks such as fragmented UDP, port zero floods, stuffed routing, arp poisoning and more configurable kernel hooks (ties) to harden the system further to syn-flood attacks & routing abuses

I would suggest you have a look at the script.

Kev