Исходное сообщение
"Опять грабли" Отправлено Evseniy Goldman, 11-Сен-09 11:01
Да и покажите iptables-save У меня на дебиане выглядит так # Generated by iptables-save v1.4.2 on Fri Sep 11 13:00:48 2009 *mangle :PREROUTING ACCEPT [3443:847093] :INPUT ACCEPT [3377:819535] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [10771:1747034] :POSTROUTING ACCEPT [10771:1747034] -A PREROUTING -p tcp -m tcp --dport 20 -j TOS --set-tos 0x08/0x3f -A PREROUTING -p tcp -m tcp --dport 21 -j TOS --set-tos 0x10/0x3f -A PREROUTING -p tcp -m tcp --dport 22 -j TOS --set-tos 0x10/0x3f -A PREROUTING -p tcp -m tcp --dport 23 -j TOS --set-tos 0x10/0x3f -A PREROUTING -p tcp -m tcp --dport 25 -j TOS --set-tos 0x10/0x3f -A PREROUTING -p udp -m udp --dport 53 -j TOS --set-tos 0x10/0x3f -A PREROUTING -p tcp -m tcp --dport 67 -j TOS --set-tos 0x10/0x3f -A PREROUTING -p tcp -m tcp --dport 80 -j TOS --set-tos 0x08/0x3f -A PREROUTING -p tcp -m tcp --dport 110 -j TOS --set-tos 0x08/0x3f -A PREROUTING -p tcp -m tcp --dport 113 -j TOS --set-tos 0x10/0x3f -A PREROUTING -p tcp -m tcp --dport 123 -j TOS --set-tos 0x10/0x3f -A PREROUTING -p tcp -m tcp --dport 143 -j TOS --set-tos 0x08/0x3f -A PREROUTING -p tcp -m tcp --dport 443 -j TOS --set-tos 0x08/0x3f -A PREROUTING -p tcp -m tcp --dport 993 -j TOS --set-tos 0x08/0x3f -A PREROUTING -p tcp -m tcp --dport 995 -j TOS --set-tos 0x08/0x3f -A PREROUTING -p tcp -m tcp --dport 1080 -j TOS --set-tos 0x10/0x3f -A PREROUTING -p tcp -m tcp --dport 6000:6063 -j TOS --set-tos 0x08/0x3f -A OUTPUT -o inet -p tcp -m tcp --dport 20 -j TOS --set-tos 0x08/0x3f -A OUTPUT -o inet -p tcp -m tcp --dport 21 -j TOS --set-tos 0x10/0x3f -A OUTPUT -o inet -p tcp -m tcp --dport 22 -j TOS --set-tos 0x10/0x3f -A OUTPUT -o inet -p tcp -m tcp --dport 23 -j TOS --set-tos 0x10/0x3f -A OUTPUT -o inet -p tcp -m tcp --dport 25 -j TOS --set-tos 0x10/0x3f -A OUTPUT -o inet -p udp -m udp --dport 53 -j TOS --set-tos 0x08/0x3f -A OUTPUT -o inet -p tcp -m tcp --dport 67 -j TOS --set-tos 0x10/0x3f -A OUTPUT -o inet -p tcp -m tcp --dport 80 -j TOS --set-tos 0x08/0x3f -A OUTPUT -o inet -p tcp -m tcp --dport 110 -j TOS --set-tos 0x08/0x3f -A OUTPUT -o inet -p tcp -m tcp --dport 113 -j TOS --set-tos 0x10/0x3f -A OUTPUT -o inet -p tcp -m tcp --dport 123 -j TOS --set-tos 0x10/0x3f -A OUTPUT -o inet -p tcp -m tcp --dport 143 -j TOS --set-tos 0x08/0x3f -A OUTPUT -o inet -p tcp -m tcp --dport 443 -j TOS --set-tos 0x08/0x3f -A OUTPUT -o inet -p tcp -m tcp --dport 993 -j TOS --set-tos 0x08/0x3f -A OUTPUT -o inet -p tcp -m tcp --dport 995 -j TOS --set-tos 0x08/0x3f -A OUTPUT -o inet -p tcp -m tcp --dport 1080 -j TOS --set-tos 0x10/0x3f -A OUTPUT -o inet -p tcp -m tcp --dport 6000:6063 -j TOS --set-tos 0x08/0x3f COMMIT # Completed on Fri Sep 11 13:00:48 2009 # Generated by iptables-save v1.4.2 on Fri Sep 11 13:00:48 2009 *nat :PREROUTING ACCEPT [326:43659] :POSTROUTING ACCEPT [7720:496284] :OUTPUT ACCEPT [7720:496284] -A POSTROUTING -s 10.0.0.0/8 -o inet -j MASQUERADE --random COMMIT # Completed on Fri Sep 11 13:00:48 2009 # Generated by iptables-save v1.4.2 on Fri Sep 11 13:00:48 2009 *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [1222:107963] :DMZ_INET_FORWARD_CHAIN - [0:0] :DMZ_INPUT_CHAIN - [0:0] :DMZ_LAN_FORWARD_CHAIN - [0:0] :EXT_ICMP_FLOOD_CHAIN - [0:0] :EXT_INPUT_CHAIN - [0:0] :EXT_OUTPUT_CHAIN - [0:0] :HOST_BLOCK - [0:0] :INET_DMZ_FORWARD_CHAIN - [0:0] :LAN_INET_FORWARD_CHAIN - [0:0] :LAN_INPUT_CHAIN - [0:0] :MAC_FILTER - [0:0] :RESERVED_NET_CHK - [0:0] :SPOOF_CHK - [0:0] :SSH_CHK - [0:0] :SSH_LOG_DROP - [0:0] :UPNP_FORWARD - [0:0] :VALID_CHK - [0:0] -A INPUT -i lo -j ACCEPT -A INPUT -m state --state ESTABLISHED -j ACCEPT -A INPUT -p tcp -m state --state RELATED -m tcp --dport 1024:65535 -j ACCEPT -A INPUT -p udp -m state --state RELATED -m udp --dport 1024:65535 -j ACCEPT -A INPUT -p icmp -m state --state RELATED -j ACCEPT -A INPUT -j HOST_BLOCK -A INPUT -i lan -j MAC_FILTER -A INPUT -i ppp+ -j MAC_FILTER -A INPUT -j SPOOF_CHK -A INPUT -i inet -j VALID_CHK -A INPUT -i inet -p ! icmp -m state --state NEW -j EXT_INPUT_CHAIN -A INPUT -i inet -p icmp -m state --state NEW -m limit --limit 60/sec --limit-burst 100 -j EXT_INPUT_CHAIN -A INPUT -i inet -p icmp -m state --state NEW -j EXT_ICMP_FLOOD_CHAIN -A INPUT -i lan -j LAN_INPUT_CHAIN -A INPUT -i ppp+ -j LAN_INPUT_CHAIN -A INPUT -m limit --limit 1/sec -j LOG --log-prefix "Dropped INPUT packet: " --log-level 6 -A INPUT -j DROP -A FORWARD -i lo -j ACCEPT -A FORWARD -o inet -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu -A FORWARD -m state --state ESTABLISHED -j ACCEPT -A FORWARD -p tcp -m state --state RELATED -m tcp --dport 1024:65535 -j ACCEPT -A FORWARD -p udp -m state --state RELATED -m udp --dport 1024:65535 -j ACCEPT -A FORWARD -p icmp -m state --state RELATED -j ACCEPT -A FORWARD -j HOST_BLOCK -A FORWARD -i lan -j MAC_FILTER -A FORWARD -i ppp+ -j MAC_FILTER -A FORWARD -i inet -o ! inet -j UPNP_FORWARD -A FORWARD -j SPOOF_CHK -A FORWARD -i inet -j VALID_CHK -A FORWARD -i lan -o lan -j ACCEPT -A FORWARD -i lan -o inet -j LAN_INET_FORWARD_CHAIN -A FORWARD -i ppp+ -o ppp+ -j ACCEPT -A FORWARD -i ppp+ -o inet -j LAN_INET_FORWARD_CHAIN -A FORWARD -m limit --limit 1/min --limit-burst 3 -j LOG --log-prefix "Dropped FORWARD packet: " --log-level 6 -A FORWARD -j DROP -A FORWARD -j LOG --log-prefix "FORWARDED Traffic" --log-level 6 -A OUTPUT -o inet -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu -A OUTPUT -m state --state ESTABLISHED -j ACCEPT -A OUTPUT -j HOST_BLOCK -A OUTPUT -f -m limit --limit 3/min -j LOG --log-prefix "FRAGMENTED PACKET (OUT): " --log-level 6 -A OUTPUT -f -j DROP -A OUTPUT -o inet -j EXT_OUTPUT_CHAIN -A EXT_ICMP_FLOOD_CHAIN -p icmp -m icmp --icmp-type 8 -m limit --limit 12/hour --limit-burst 1 -j LOG --log-prefix "ICMP-request(ping) flood: " --log-level 6 -A EXT_ICMP_FLOOD_CHAIN -p icmp -m icmp --icmp-type 8 -j DROP -A EXT_ICMP_FLOOD_CHAIN -p icmp -m icmp --icmp-type 3 -m limit --limit 12/hour --limit-burst 1 -j LOG --log-prefix "ICMP-unreachable flood: " --log-level 6 -A EXT_ICMP_FLOOD_CHAIN -p icmp -m icmp --icmp-type 3 -j DROP -A EXT_ICMP_FLOOD_CHAIN -p icmp -m icmp --icmp-type 4 -m limit --limit 12/hour --limit-burst 1 -j LOG --log-prefix "ICMP-source-quench flood: " --log-level 6 -A EXT_ICMP_FLOOD_CHAIN -p icmp -m icmp --icmp-type 4 -j DROP -A EXT_ICMP_FLOOD_CHAIN -p icmp -m icmp --icmp-type 11 -m limit --limit 12/hour --limit-burst 1 -j LOG --log-prefix "ICMP-time-exceeded flood: " --log-level 6 -A EXT_ICMP_FLOOD_CHAIN -p icmp -m icmp --icmp-type 11 -j DROP -A EXT_ICMP_FLOOD_CHAIN -p icmp -m icmp --icmp-type 12 -m limit --limit 12/hour --limit-burst 1 -j LOG --log-prefix "ICMP-param.-problem flood: " --log-level 6 -A EXT_ICMP_FLOOD_CHAIN -p icmp -m icmp --icmp-type 12 -j DROP -A EXT_ICMP_FLOOD_CHAIN -p icmp -m limit --limit 12/hour --limit-burst 1 -j LOG --log-prefix "ICMP(other) flood: " --log-level 6 -A EXT_ICMP_FLOOD_CHAIN -p icmp -j DROP -A EXT_INPUT_CHAIN -p tcp -m tcp --dport 22 -m state --state NEW -j SSH_CHK -A EXT_INPUT_CHAIN -p tcp -m tcp --dport 0 -m limit --limit 6/hour --limit-burst 1 -j LOG --log-prefix "TCP port 0 OS fingerprint: " --log-level 6 -A EXT_INPUT_CHAIN -p udp -m udp --dport 0 -m limit --limit 6/hour --limit-burst 1 -j LOG --log-prefix "UDP port 0 OS fingerprint: " --log-level 6 -A EXT_INPUT_CHAIN -p tcp -m tcp --dport 0 -j DROP -A EXT_INPUT_CHAIN -p udp -m udp --dport 0 -j DROP -A EXT_INPUT_CHAIN -p tcp -m tcp --sport 0 -m limit --limit 6/hour -j LOG --log-prefix "TCP source port 0: " --log-level 6 -A EXT_INPUT_CHAIN -p udp -m udp --sport 0 -m limit --limit 6/hour -j LOG --log-prefix "UDP source port 0: " --log-level 6 -A EXT_INPUT_CHAIN -p tcp -m tcp --sport 0 -j DROP -A EXT_INPUT_CHAIN -p udp -m udp --sport 0 -j DROP -A EXT_INPUT_CHAIN -p tcp -m tcp -j ACCEPT -A EXT_INPUT_CHAIN -p udp -m udp -j ACCEPT -A EXT_INPUT_CHAIN -p icmp -m icmp --icmp-type 8 -m limit --limit 3/min --limit-burst 1 -j LOG --log-prefix "ICMP-request: " --log-level 6 -A EXT_INPUT_CHAIN -p icmp -m icmp --icmp-type 3 -m limit --limit 12/hour --limit-burst 1 -j LOG --log-prefix "ICMP-unreachable: " --log-level 6 -A EXT_INPUT_CHAIN -p icmp -m icmp --icmp-type 4 -m limit --limit 12/hour --limit-burst 1 -j LOG --log-prefix "ICMP-source-quench: " --log-level 6 -A EXT_INPUT_CHAIN -p icmp -m icmp --icmp-type 11 -m limit --limit 12/hour --limit-burst 1 -j LOG --log-prefix "ICMP-time-exceeded: " --log-level 6 -A EXT_INPUT_CHAIN -p icmp -m icmp --icmp-type 12 -m limit --limit 12/hour --limit-burst 1 -j LOG --log-prefix "ICMP-param.-problem: " --log-level 6 -A EXT_INPUT_CHAIN -p tcp -m tcp --dport 1024:65535 ! --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 3/min -j LOG --log-prefix "Stealth scan (UNPRIV)?: " --log-level 6 -A EXT_INPUT_CHAIN -p tcp -m tcp --dport 0:1023 ! --tcp-flags FIN,SYN,RST,ACK SYN -m limit --limit 3/min -j LOG --log-prefix "Stealth scan (PRIV)?: " --log-level 6 -A EXT_INPUT_CHAIN -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -j DROP -A EXT_INPUT_CHAIN -p tcp -j DROP -A EXT_INPUT_CHAIN -p udp -j DROP -A EXT_INPUT_CHAIN -p icmp -j DROP -A EXT_INPUT_CHAIN -m limit --limit 1/min -j LOG --log-prefix "Other-IP connection attempt: " --log-level 6 -A EXT_INPUT_CHAIN -j DROP -A EXT_OUTPUT_CHAIN -j ACCEPT -A LAN_INET_FORWARD_CHAIN -p icmp -m icmp --icmp-type 8 -m limit --limit 20/sec --limit-burst 100 -j ACCEPT -A LAN_INET_FORWARD_CHAIN -p icmp -m icmp --icmp-type 8 -m limit --limit 3/min --limit-burst 1 -j LOG --log-prefix "ICMP-request: " --log-level 6 -A LAN_INET_FORWARD_CHAIN -p icmp -m icmp --icmp-type 8 -j DROP -A LAN_INET_FORWARD_CHAIN -j ACCEPT -A LAN_INPUT_CHAIN -p icmp -m icmp --icmp-type 8 -m limit --limit 20/sec --limit-burst 100 -j ACCEPT -A LAN_INPUT_CHAIN -p icmp -m icmp --icmp-type 8 -m limit --limit 3/min --limit-burst 1 -j LOG --log-prefix "ICMP-request: " --log-level 6 -A LAN_INPUT_CHAIN -p icmp -m icmp --icmp-type 8 -j DROP -A LAN_INPUT_CHAIN -j ACCEPT -A RESERVED_NET_CHK -s 10.0.0.0/8 -m limit --limit 1/min --limit-burst 1 -j LOG --log-prefix "Class A address: " --log-level 6 -A RESERVED_NET_CHK -s 172.16.0.0/12 -m limit --limit 1/min --limit-burst 1 -j LOG --log-prefix "Class B address: " --log-level 6 -A RESERVED_NET_CHK -s 192.168.0.0/16 -m limit --limit 1/min --limit-burst 1 -j LOG --log-prefix "Class C address: " --log-level 6 -A RESERVED_NET_CHK -s 169.254.0.0/16 -m limit --limit 1/min --limit-burst 1 -j LOG --log-prefix "Class M$ address: " --log-level 6 -A RESERVED_NET_CHK -s 172.16.0.0/12 -j DROP -A RESERVED_NET_CHK -s 192.168.0.0/16 -j DROP -A RESERVED_NET_CHK -s 169.254.0.0/16 -j DROP -A SPOOF_CHK -j RETURN -A SSH_CHK -s 172.16.200.200/32 -j RETURN -A SSH_CHK -s 172.16.200.201/32 -j RETURN -A SSH_CHK -m recent --set --name sshchk --rsource -A SSH_CHK -m recent --update --seconds 60 --hitcount 4 --name sshchk --rsource -j SSH_LOG_DROP -A SSH_CHK -m recent --update --seconds 1800 --hitcount 10 --name sshchk --rsource -j SSH_LOG_DROP -A SSH_CHK -j LOG --log-prefix "SSH Traffic" -A SSH_LOG_DROP -m limit --limit 1/min --limit-burst 1 -j LOG --log-prefix "SSH Brute force attack?: " --log-level 6 -A SSH_LOG_DROP -j DROP -A VALID_CHK -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -m limit --limit 3/min -j LOG --log-prefix "Stealth XMAS scan: " --log-level 6 -A VALID_CHK -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -m limit --limit 3/min -j LOG --log-prefix "Stealth XMAS-PSH scan: " --log-level 6 -A VALID_CHK -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -m limit --limit 3/min -j LOG --log-prefix "Stealth XMAS-ALL scan: " --log-level 6 -A VALID_CHK -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN -m limit --limit 3/min -j LOG --log-prefix "Stealth FIN scan: " --log-level 6 -A VALID_CHK -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -m limit --limit 3/min -j LOG --log-prefix "Stealth SYN/RST scan: " --log-level 6 -A VALID_CHK -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -m limit --limit 3/min -j LOG --log-prefix "Stealth SYN/FIN scan(?): " --log-level 6 -A VALID_CHK -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -m limit --limit 3/min -j LOG --log-prefix "Stealth Null scan: " --log-level 6 -A VALID_CHK -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP -A VALID_CHK -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j DROP -A VALID_CHK -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP -A VALID_CHK -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN -j DROP -A VALID_CHK -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP -A VALID_CHK -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP -A VALID_CHK -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP -A VALID_CHK -p tcp -m tcp --tcp-option 64 -m limit --limit 3/min --limit-burst 1 -j LOG --log-prefix "Bad TCP flag(64): " --log-level 6 -A VALID_CHK -p tcp -m tcp --tcp-option 128 -m limit --limit 3/min --limit-burst 1 -j LOG --log-prefix "Bad TCP flag(128): " --log-level 6 -A VALID_CHK -p tcp -m tcp --tcp-option 64 -j DROP -A VALID_CHK -p tcp -m tcp --tcp-option 128 -j DROP -A VALID_CHK -m state --state INVALID -j DROP -A VALID_CHK -f -m limit --limit 3/min --limit-burst 1 -j LOG --log-prefix "Fragmented packet: " --log-level 6 -A VALID_CHK -f -j DROP COMMIT # Completed on Fri Sep 11 13:00:48 2009