BEFORE BREAKING THE FIREWALL DEFENSE

How to set iptables to drop packets that I'm not listening on?

I've got a Kali Linux box I use for pen testing. I would like to configure my machine to DROP incoming packets, but only when I'm not listening on them. e.g. if I run a netcat listener on port 80, I would like connections from the internet to be possible, but as soon as I stop netcat I would like the packets to be dropped rather than rejected. I know this would be possible by the use of scripts, but is there any support for iptables to do this automatically? I have had a suggestion to use the NFQUEUE target for all incoming packets, but then I'll have to modify the source of the listening application (if no user-space application is listening on the specified queue, the packets are dropped). network linux iptables kali-linux shareimprove this question asked May 19 '14 at 12:57 SilverlightFox 24.7k439102

add a comment

3 Answers

activeoldestvotes

up vote3down vote

If never seen this done without a script, so here is a baseline script for you to accomplish this: checkht="lsof -c httpd | awk '{print $1}' | uniq | grep h" if [ -n "$checkht" ]; then echo "webserver is running let me shut down uptables rules blocking HTTP" iptables -vnL --line-numbers |awk '/tcp dpt:80/{print "iptables -D INPUT "$1}' | sh else iptables -A INPUT -s 0.0.0.0/0 -p tcp --dport 80 -j DROP fi Checks to see if http is running, if it is, it makes sure that IPTABLES has no rule blocking HTTP. If it's not running, it blocks the world from reaching that port. However, because you're not listening on the port, the rule to block makes little sense. There is nothing for anyone to attack since nothing is running. shareimprove this answer edited May 19 '14 at 14:15 answered May 19 '14 at 14:08 munkeyoto 7,779828

Thanks. It is possible to detect whether there is anything listening because of the RST reply - that's why it makes sense to drop it. – SilverlightFox May 19 '14 at 14:17 Understood, I usually have a drop all rule as my last rule, so no resets are sent. – munkeyoto May 19 '14 at 14:37 Do you have to remove that rule if you start services listening? – SilverlightFox May 19 '14 at 14:39 You can run it via cron to check like N amount of minutes, or... You can likely make your own apachectl like start file to run it in the background. Depends on your machine. You can run it from cron to check like every minute or so, or like I said, edit apachectl, so when you shut off HTTP, it does its checks and balances – munkeyoto May 19 '14 at 15:01 add a comment

up vote0down vote

The short answer is: no by design, and here's an example of what would need to happen if it was possible: netcat opens socket on port X by calling the relative syscall (such as listen) kernel traps syscall, executes network code (in this case, opens port) kernel talks to the relative iptables module (assuming it's available and loaded) and opens a hole in the firewall to let traffic go to the newly opened port. This would open up a potential security hole: how would the kernel know that the program is legitimate, i.e. is not a trojan that wants to open a remote shell? Here are a few answers: Because the program is whitelisted somewhere; but this would shift the security into another set of issues: how do you know that the program hasn't been compromised? You could use something like tripwire, but this opens up another security question: how can you guarantee that the master list is not compromised? how do you deal with updates? E.g. version Z of ssh can punch holes through the firewall; your system self-updates, now the hash of ssh changed, and you are locked out. Because the user launching it belongs to a privileged group: how do you deal with SUID binaries? Take a look at the ping program permissions for example. Another can of worms^W^W^W set of potential issues would be the interface between iptables (at kernel level) and the syscalls; every minor change in iptables would require a potential rewrite of the code underlying the syscalls, introducing bugs, etc. In a nutshell, you are describing the problem that application firewalls face (think about Windows or Mac firewalls). It's do-able, but it's not simple. At a networking level you might want to take a look at UPnP whose function was to allow services to punch holes through a gateway's firewall. With the obvious security consequences. Or you could use a script instead :) shareimprove this answer answered May 19 '14 at 15:29 lorenzog 1,589716

add a comment

up vote0down vote

you could write a simple bash script that parses out netcat output and builds a new iptables ruleset accordingly every time its running. You probably have to make sure that you allow connections first before you set the drop all rule else you would reset all running connections each time the script runs. Then you could set a cronjob that will run your script every minute. As lorenzog pointed out this might not be the most secure setup, on the other hand if you have no iptables running by default then this is probably better than nothing. Also you could set a range of port as a whitelist and ignore all other ports that netstat spits out... As this is about your Kali box (VM?) it should only be running for specific tasks anyways. Kali is not meant to be used as a default client/server operating system for daily tasks. So I would let you get a away with this kind of dynamic firewall setup ;) shareimprove this answer https://security.stackexchange.com/questions/58268/how-to-set-iptables-to-drop-packets-that-im-not-listening-on