Re: [PLUG] Quick & dirty IP blocking

["Paul W. Roach III" <paul@isaroach.com>]

Definitely a cool tool!  Something to consider:

 

Nullroutes don't affect incoming traffic, they affect outgoing traffic.  This means that their packets will still hit you (and whatever service is on the other end of the port in question), but your replies will be nullrouted into the bit bucket.

 

If you have an exposed service that's vulnerable to a UDP attack, you're still exposed.  Or if you had a vulnerability that could be triggered by any single packet or a stream that required no handshake or reply, TCP or otherwise.

This doesn't limit you from locking yourself out either, if you're in that subnet.  The iptables equivalent would be:

 

iptables -A INPUT -s 192.168.192.0/24 -j DROP

 

If you wanted to ensure no return traffic to that destination left your box:

 

iptables -A OUTPUT -d 192.168.192.0/24 -j DROP

 

If you wanted to ensure (on most distros) that these rules survive reboot:

 

/etc/init.d/iptables save

 

Either with this or with nullrouting, you're just as (un)likely to lock yourself out, and you have the ability to filter the packets at the kernel before they hit the daemon on the other end of the port.

Do you have any data to suggest that routing is any more or less overhead than iptables?  Both happen in the kernel, and netfilter is, in my experience, VERY efficient -- and is always running, whether you think it is or not.  When you do /etc/init.d/iptables stop, or "turn off the service", it simply zeros out the rules.  Every packet still traverses the tables and chains, as evidenced by this output from a machine with "iptables off"

 

[root@erwin ~]# iptables -L -nv
Chain INPUT (policy ACCEPT 33M packets, 9042M bytes)
 pkts bytes target     prot opt in     out     source               destination

...

Chain OUTPUT (policy ACCEPT 28M packets, 6744M bytes)
 pkts bytes target     prot opt in     out     source               destination

 

Thanks,

-P

 

On Fri, Feb 3, 2012 at 3:05 AM, sean finney <seanius@seanius.net> wrote:

On Thu, Feb 02, 2012 at 11:53:18PM -0500, JP Vossen wrote:
> But then I found 'ip route add blackhole ...'
> http://en.wikipedia.org/wiki/Nullroute

neato, did not know about that :)

> addresses, and had added that to /etc/rc.local, after testing, so it
> will survive a reboot.  I'm sure there's a better, ifcfg-related
> place to put it, but this worked for me.  Unlike iptables or

one thing you might want to watch out for is that depending on your
distro / environment, restarting networking (or even just losing
your link for a moment) might lose that routing info on the live system.

for "traditional" debian/ubuntu networking (/etc/network/interfaces),
you could put in an "up" stanza in your config:

       iface eth0 inet dhcp
               up ip route add blackhole...

I think NetworkManager will may respect that on systems that
use /e/n/i.  Don't know about RH/FC but would imagine they have
a similar type of hook action.


       sean

___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug

___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug