Probleme mit iptables (rules greifen nicht)

M

madmaxxx

New Member
Hallo!

Seit heute greifen die IPtables rules nicht mehr, hatte eine Festplatten defekt, und habe ein Backup eingespielt.

Darum bitte ich höfflich um Hilfe :)

Auszüge vom Skript:

Code: 
    # Tabelle flushen
    iptables -F
    iptables -t nat -F
    iptables -t mangle -F
    iptables -X
    iptables -t nat -X
    iptables -t mangle -X

[---]

iptables -A INPUT -i eth0 -m state --state NEW -s xxx.xxx.xxx.xxx/29 -p tcp --dport 22 -j ACCEPT

    # Default-Policies mit REJECT
    iptables -A INPUT -j MY_REJECT
    iptables -A OUTPUT -j MY_REJECT

Trotzdem kann ich mich von einer beliebigen IP einloggen...

Auszug iptables -L
Code: 
Chain INPUT (policy DROP)
target     prot opt source               destination         
DROP       all  --  anywhere             anywhere            state INVALID 
MY_DROP    tcp  --  anywhere             anywhere            tcp flags:FIN,SYN,RST,PSH,ACK,URG/NONE 
MY_DROP    tcp  --  anywhere             anywhere            tcp flags:FIN,SYN/FIN,SYN 
MY_DROP    tcp  --  anywhere             anywhere            tcp flags:SYN,RST/SYN,RST 
MY_DROP    tcp  --  anywhere             anywhere            tcp flags:FIN,RST/FIN,RST 
MY_DROP    tcp  --  anywhere             anywhere            tcp flags:FIN,ACK/FIN 
MY_DROP    tcp  --  anywhere             anywhere            tcp flags:PSH,ACK/PSH 
MY_DROP    tcp  --  anywhere             anywhere            tcp flags:ACK,URG/URG 
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     all  --  10.8.0.0/24          anywhere            state NEW 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:www 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:https 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:smtp 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:pop3 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:pop3s 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:domain 
ACCEPT     udp  --  anywhere             anywhere            state NEW udp dpt:domain 
REJECT     tcp  --  anywhere             anywhere            tcp dpt:ftp flags:FIN,SYN,RST,ACK/SYN #conn/32 > 3 reject-with icmp-port-unreachable 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ftp 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ftp-data 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ftps-data 
ACCEPT     udp  --  anywhere             anywhere            state NEW udp dpt:989 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ftps 
ACCEPT     udp  --  anywhere             anywhere            state NEW udp dpt:990 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpts:65333:65535 
ACCEPT     tcp  --  xxx.xxx.xxx.xxx/29       anywhere            state NEW tcp dpt:ssh 

[....]

lsmod:
Code: 
ipt_REJECT              1517  4 
iptable_mangle          2325  0 
iptable_nat             3551  0 
nf_nat                 10568  1 iptable_nat
nf_conntrack_ipv4       7597  46 iptable_nat,nf_nat
nf_conntrack           38083  7 xt_connlimit,xt_state,iptable_nat,nf_nat,nf_conntrack_ftp,nf_conntrack_irc,nf_conntrack_ipv4
nf_defrag_ipv4           779  1 nf_conntrack_ipv4
xt_multiport            1775  0 
iptable_filter          1790  1 
ip_tables               7706  3 iptable_mangle,iptable_nat,iptable_filter
x_tables                8327  7 xt_connlimit,xt_tcpudp,xt_state,ipt_REJECT,iptable_nat,xt_multiport,ip_tables


Hat vielleicht irgendwer eine Idee an was das liegen könnte?

Danke

Edit:
Hm, fail2ban funktioniert auch nicht mehr (google tips halfen auch nichts....):
Code: 
2012-01-31 16:51:52,923 fail2ban.actions.action: ERROR  iptables -D INPUT -p tcp -m multiport --dports smtp,ssmtp -j fail2ban-postfix
iptables -F fail2ban-postfix
iptables -X fail2ban-postfix returned 100
2012-01-31 16:51:52,924 fail2ban.jail   : INFO   Jail 'postfix' stopped
2012-01-31 16:51:53,036 fail2ban.actions.action: ERROR  iptables -D INPUT -p tcp -m multiport --dports smtp,ssmtp,imap2,imap3,imaps,pop3,pop3s -j fail2ban-courierauth
iptables -F fail2ban-courierauth
iptables -X fail2ban-courierauth returned 100
2012-01-31 16:51:53,037 fail2ban.jail   : INFO   Jail 'courierauth' stopped
2012-01-31 16:51:53,934 fail2ban.actions.action: ERROR  iptables -D INPUT -p tcp -m multiport --dports ssh -j fail2ban-ssh
iptables -F fail2ban-ssh
iptables -X fail2ban-ssh returned 100
2012-01-31 16:51:53,934 fail2ban.jail   : INFO   Jail 'ssh' stopped
2012-01-31 16:51:53,936 fail2ban.server : INFO   Exiting Fail2ban

Für Hinweise wäre ich dankbar...
 
Last edited by a moderator:
mr_brain said:
Vollständiges Skript bitte.
Click to expand...

Aber gerne:
Code: 
#!/bin/bash
# ---------------------------------------------------------------------
# Linux-iptables-Firewallskript, Copyright (c) 2008 under the GPL
# Autogenerated by iptables Generator v1.22 (c) 2002-2007 by Harald Bertram�
# Please visit http://harry.homelinux.org for new versions of
# the iptables Generator (c).
# 
# This Script was generated by request from:
# [email protected] on: 2008-3-13 15:39.35 MET.
# 
# If you have questions about the iptables Generator or about
# your Firewall-Skript feel free to take a look at out website or
# send me an E-Mail to [email protected].
# 
# My special thanks are going to Lutz Heinrich (trinitywork at hotmail dot com)
# who made lots of Beta-Testing and gave me lots of well qualified
# Feedback that made me able to improve the iptables Generator.
# --------------------------------------------------------------------

case "$1" in
  start)
    echo "Starte IP-Paketfilter"

    # iptables-Modul
    modprobe ip_tables
    # Connection-Tracking-Module
    modprobe ip_conntrack
    # Das Modul ip_conntrack_irc ist erst bei Kerneln >= 2.4.19 verfuegbar
    modprobe ip_conntrack_irc
    modprobe ip_conntrack_ftp

    # Tabelle flushen
    iptables -F
    iptables -t nat -F
    iptables -t mangle -F
    iptables -X
    iptables -t nat -X
    iptables -t mangle -X

    # Default-Policies setzen
    iptables -P INPUT DROP
    iptables -P OUTPUT DROP
    iptables -P FORWARD DROP

    # MY_REJECT-Chain
    iptables -N MY_REJECT

    # MY_REJECT fuellen
    iptables -A MY_REJECT -p tcp -j REJECT --reject-with tcp-reset
    iptables -A MY_REJECT -p udp -j REJECT --reject-with icmp-port-unreachable
    #iptables -A MY_REJECT -p icmp -j DROP
    iptables -A MY_REJECT -p icmp -j ACCEPT
    iptables -A MY_REJECT -j REJECT --reject-with icmp-proto-unreachable

    # MY_DROP-Chain
    iptables -N MY_DROP
    iptables -A MY_DROP -j DROP

    # Korrupte Pakete zurueckweisen
    iptables -A INPUT -m state --state INVALID -j DROP
    iptables -A OUTPUT -m state --state INVALID -j DROP

    # Stealth Scans etc. DROPpen
    # Keine Flags gesetzt
    iptables -A INPUT -p tcp --tcp-flags ALL NONE -j MY_DROP

    # SYN und FIN gesetzt
    iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j MY_DROP

    # SYN und RST gleichzeitig gesetzt
    iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j MY_DROP

    # FIN und RST gleichzeitig gesetzt
    iptables -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j MY_DROP

    # FIN ohne ACK
    iptables -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j MY_DROP

    # PSH ohne ACK
    iptables -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j MY_DROP

    # URG ohne ACK
    iptables -A INPUT -p tcp --tcp-flags ACK,URG URG -j MY_DROP

    # Loopback-Netzwerk-Kommunikation zulassen
    iptables -A INPUT -i lo -j ACCEPT
    iptables -A OUTPUT -o lo -j ACCEPT

    # Connection-Tracking aktivieren
    iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
    iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

    
    ### Ab hier die erlaubten Ports eintragen ###

    ### Alles was uebers tun0 (Openvpn) device kommt, wird erlaubt ###
    iptables -A INPUT -i tun0 -m state --state NEW -s 10.8.0.0/24 -j ACCEPT

    # HTTP
    iptables -A INPUT -i eth0 -m state --state NEW -p tcp --dport 80 -j ACCEPT
    
    # HTTPS
    iptables -A INPUT -i eth0 -m state --state NEW -p tcp --dport 443 -j ACCEPT
    
    # SMTP
    iptables -A INPUT -i eth0 -m state --state NEW -p tcp --dport 25 -j ACCEPT
    
    # POP3
    iptables -A INPUT -i eth0 -m state --state NEW -p tcp --dport 110 -j ACCEPT
    
    # POP3 SSL
    iptables -A INPUT -i eth0 -m state --state NEW -p tcp --dport 995 -j ACCEPT

    # DNS
    iptables -A INPUT -i eth0 -m state --state NEW -p tcp --dport 53 -j ACCEPT
    iptables -A INPUT -i eth0 -m state --state NEW -p udp --dport 53 -j ACCEPT

    # FTP
    # es werden nur 3 gleichzeitige verbindungen pro IP erlaubt
    iptables -A INPUT -p tcp --syn --dport 21 -m connlimit --connlimit-above 3 -j REJECT
    iptables -A INPUT -i eth0 -m state --state NEW -p tcp --dport 21 -j ACCEPT
    iptables -A INPUT -i eth0 -m state --state NEW -p tcp --dport 20 -j ACCEPT
    
    # FTPS
    iptables -A INPUT -i eth0 -m state --state NEW -p tcp --dport 989 -j ACCEPT
    iptables -A INPUT -i eth0 -m state --state NEW -p udp --dport 989 -j ACCEPT
    iptables -A INPUT -i eth0 -m state --state NEW -p tcp --dport 990 -j ACCEPT
    iptables -A INPUT -i eth0 -m state --state NEW -p udp --dport 990 -j ACCEPT
    iptables -A INPUT -i eth0 -m state --state NEW -p tcp --dport 65333:65535 -j ACCEPT 
    
    # SSH
    iptables -A INPUT -i eth0 -m state --state NEW -s x.x.x.x/29 -p tcp --dport 22 -j ACCEPT
    iptables -A INPUT -i eth0 -m state --state NEW -s x.x.x.x/24 -p tcp --dport 22 -j ACCEPT
    iptables -A INPUT -i eth0 -m state --state NEW -s x.x.x.x/32 -p tcp --dport 22 -j ACCEPT
    iptables -A INPUT -i eth0 -m state --state NEW -s x.x.x.x -p tcp --dport 22 -j ACCEPT
    iptables -A INPUT -i eth0 -m state --state NEW -s x.x.x.x -p tcp --dport 22 -j ACCEPT
    iptables -A INPUT -i eth0 -m state --state NEW -s x.x.x.x/29 -p tcp --dport 22 -j ACCEPT
    iptables -A INPUT -i eth0 -m state --state NEW -s x.x.x.x  -p tcp --dport 22 -j ACCEPT
    iptables -A INPUT -i eth0 -m state --state NEW -s x.x.x.x  -p tcp --dport 22 -j ACCEPT
    iptables -A INPUT -i eth0 -m state --state NEW -s x.x.x.x -p tcp --dport 22 -j ACCEPT
    iptables -A INPUT -i eth0 -m state --state NEW -s x.x.x.x -p tcp --dport 22 -j ACCEPT
    iptables -A INPUT -i eth0 -m state --state NEW -s x.x.x.x -p tcp --dport 22 -j ACCEPT
    iptables -A INPUT -i eth0 -m state --state NEW -s x.x.x.x -p tcp --dport 22 -j ACCEPT
    iptables -A INPUT -i eth0 -m state --state NEW -s x.x.x.x/12 -p tcp --dport 22 -j ACCEPT
    iptables -A INPUT -i eth0 -m state --state NEW -s x.x.x.x/29 -p tcp --dport 22 -j ACCEPT
    iptables -A INPUT -i eth0 -m state --state NEW -s x.x.x.x -p tcp --dport 22 -j ACCEPT
    iptables -A INPUT -i eth0 -m state --state NEW -s x.x.x.x/17 -p tcp --dport 22 -j ACCEPT  
    iptables -A INPUT -i eth0 -m state --state NEW -s x.x.x.x/17 -p tcp --dport 22 -j ACCEPT
    iptables -A INPUT -i eth0 -m state --state NEW -s x.x.x.x/29 -p tcp --dport 22 -j ACCEPT
    iptables -A INPUT -i eth0 -m state --state NEW -s x.x.x.x -p tcp --dport 22 -j ACCEPT
#  iptables -A INPUT -i eth0 -m state --state NEW -p tcp --dport 22 -j ACCEPT
#    iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --set
#    iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 -j LOG 
#    iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 -j REJECT	


## Teamspeak
    iptables -A INPUT -i eth0 -m state --state NEW -p tcp --dport 30033 -j ACCEPT
    iptables -A INPUT -i eth0 -m state --state NEW -p tcp --dport 10011 -j ACCEPT
    iptables -A INPUT -i eth0 -m state --state NEW -p udp --dport 9987 -j ACCEPT
    iptables -A INPUT -i eth0 -m state --state NEW -p udp --dport 9988 -j ACCEPT

    # Default-Policies mit REJECT
    iptables -A INPUT -j MY_REJECT
    iptables -A OUTPUT -j MY_REJECT

    # Max. 500/Sekunde (5/Jiffie) senden
    echo 5 > /proc/sys/net/ipv4/icmp_ratelimit

    # Speicherallozierung und -timing f�r IP-De/-Fragmentierung
    echo 262144 > /proc/sys/net/ipv4/ipfrag_high_thresh
    echo 196608 > /proc/sys/net/ipv4/ipfrag_low_thresh
    echo 30 > /proc/sys/net/ipv4/ipfrag_time

    # TCP-FIN-Timeout zum Schutz vor DoS-Attacken setzen
    echo 30 > /proc/sys/net/ipv4/tcp_fin_timeout

    # Maximal 3 Antworten auf ein TCP-SYN
    echo 3 > /proc/sys/net/ipv4/tcp_retries1

    # TCP-Pakete maximal 15x wiederholen
    echo 15 > /proc/sys/net/ipv4/tcp_retries2

    ;;

  stop)
    echo "Stoppe IP-Paketfilter"
    # Tabelle flushen
    iptables -F
    iptables -t nat -F
    iptables -t mangle -F
    iptables -X
    iptables -t nat -X
    iptables -t mangle -X
    # Default-Policies setzen
    iptables -P INPUT ACCEPT
    iptables -P OUTPUT ACCEPT
    iptables -P FORWARD ACCEPT
    ;;

  status)
    echo "Tabelle filter"
    iptables -L -vn
    echo "Tabelle nat"
    iptables -t nat -L -vn
    echo "Tabelle mangle"
    iptables -t mangle -L -vn
    ;;

  *)
    echo "Fehlerhafter Aufruf"
    echo "Syntax: $0 {start|stop|status}"
    exit 1
    ;;

esac


Danke!
 
Hm, komischerweise funktioniert dieses Skript:

Code: 
#!/bin/sh
SYSCTL="/sbin/sysctl -w"
IPT="/sbin/iptables"
IPTS="/sbin/iptables-save"
IPTR="/sbin/iptables-restore"

# Internet Interface
INET_IFACE="eth0"
INET_ADDRESS="xxx.xxx.xxx.xxx"

# Localhost Interface
LO_IFACE="lo"
LO_IP="127.0.0.1"
if [ "$1" = "save" ]
then
        echo -n "Saving firewall to /etc/sysconfig/iptables ... "
        $IPTS > /etc/sysconfig/iptables
        echo "done"
        exit 0
elif [ "$1" = "restore" ]
then
        echo -n "Restoring firewall from /etc/sysconfig/iptables ... "
        $IPTR < /etc/sysconfig/iptables
        echo "done"
        exit 0
fi
echo "Loading kernel modules ..."
/sbin/modprobe ip_tables
/sbin/modprobe ip_conntrack
/sbin/modprobe ip_nat_ftp
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_conntrack_irc
if [ "$SYSCTL" = "" ]
then
    echo "1" > /proc/sys/net/ipv4/tcp_syncookies
else
    $SYSCTL net.ipv4.tcp_syncookies="1"
fi
if [ "$SYSCTL" = "" ]
then
    echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
else
    $SYSCTL net.ipv4.conf.all.rp_filter="1"
fi
if [ "$SYSCTL" = "" ]
then
    echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
else
    $SYSCTL net.ipv4.icmp_echo_ignore_broadcasts="1"
fi
if [ "$SYSCTL" = "" ]
then
    echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route
else
    $SYSCTL net.ipv4.conf.all.accept_source_route="0"
fi
if [ "$SYSCTL" = "" ]
then
    echo "1" > /proc/sys/net/ipv4/conf/all/secure_redirects
else
    $SYSCTL net.ipv4.conf.all.secure_redirects="1"
fi
if [ "$SYSCTL" = "" ]
then
    echo "1" > /proc/sys/net/ipv4/conf/all/log_martians
else
    $SYSCTL net.ipv4.conf.all.log_martians="1"
fi
echo "Flushing Tables ..."

# Reset Default Policies
$IPT -P INPUT ACCEPT
$IPT -P FORWARD ACCEPT
$IPT -P OUTPUT ACCEPT
$IPT -t nat -P PREROUTING ACCEPT
$IPT -t nat -P POSTROUTING ACCEPT
$IPT -t nat -P OUTPUT ACCEPT
$IPT -t mangle -P PREROUTING ACCEPT
$IPT -t mangle -P OUTPUT ACCEPT

# Flush all rules
$IPT -F
$IPT -t nat -F
$IPT -t mangle -F

# Erase all non-default chains
$IPT -X
$IPT -t nat -X
$IPT -t mangle -X

if [ "$1" = "stop" ]
then
        echo "Firewall completely flushed!  Now running with no firewall."
        exit 0
fi
# Set Policies
$IPT -P INPUT DROP
$IPT -P OUTPUT DROP
$IPT -P FORWARD DROP
echo "Create and populate custom rule chains ..."
$IPT -N bad_packets
$IPT -N bad_tcp_packets
$IPT -N icmp_packets
$IPT -N udp_inbound
$IPT -N udp_outbound
$IPT -N tcp_inbound
$IPT -N tcp_outbound
# Drop INVALID packets immediately
$IPT -A bad_packets -p ALL -m state --state INVALID -j LOG \
    --log-prefix "fp=bad_packets:1 a=DROP "

$IPT -A bad_packets -p ALL -m state --state INVALID -j DROP

# Then check the tcp packets for additional problems
$IPT -A bad_packets -p tcp -j bad_tcp_packets

# All good, so return
$IPT -A bad_packets -p ALL -j RETURN
$IPT -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG \
    --log-prefix "fp=bad_tcp_packets:1 a=DROP "
$IPT -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP

$IPT -A bad_tcp_packets -p tcp --tcp-flags ALL NONE -j LOG \
    --log-prefix "fp=bad_tcp_packets:2 a=DROP "
$IPT -A bad_tcp_packets -p tcp --tcp-flags ALL NONE -j DROP

$IPT -A bad_tcp_packets -p tcp --tcp-flags ALL ALL -j LOG \
    --log-prefix "fp=bad_tcp_packets:3 a=DROP "
$IPT -A bad_tcp_packets -p tcp --tcp-flags ALL ALL -j DROP

$IPT -A bad_tcp_packets -p tcp --tcp-flags ALL FIN,URG,PSH -j LOG \
    --log-prefix "fp=bad_tcp_packets:4 a=DROP "
$IPT -A bad_tcp_packets -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP

$IPT -A bad_tcp_packets -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j LOG \
    --log-prefix "fp=bad_tcp_packets:5 a=DROP "
$IPT -A bad_tcp_packets -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP

$IPT -A bad_tcp_packets -p tcp --tcp-flags SYN,RST SYN,RST -j LOG \
    --log-prefix "fp=bad_tcp_packets:6 a=DROP "
$IPT -A bad_tcp_packets -p tcp --tcp-flags SYN,RST SYN,RST -j DROP

$IPT -A bad_tcp_packets -p tcp --tcp-flags SYN,FIN SYN,FIN -j LOG \
    --log-prefix "fp=bad_tcp_packets:7 a=DROP "
$IPT -A bad_tcp_packets -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
$IPT -A bad_tcp_packets -p tcp -j RETURN
$IPT -A icmp_packets --fragment -p ICMP -j LOG \
    --log-prefix "fp=icmp_packets:1 a=DROP "
$IPT -A icmp_packets --fragment -p ICMP -j DROP
$IPT -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j DROP

# Time Exceeded
$IPT -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT

# Not matched, so return so it will be logged
$IPT -A icmp_packets -p ICMP -j RETURN
$IPT -A udp_inbound -p UDP -s 0/0 --destination-port 137 -j DROP
$IPT -A udp_inbound -p UDP -s 0/0 --destination-port 138 -j DROP
# Not matched, so return for logging
$IPT -A udp_inbound -p UDP -j RETURN
# No match, so ACCEPT
$IPT -A udp_outbound -p UDP -s 0/0 -j ACCEPT
$IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 80 -j ACCEPT

# HTTPS (Secure Web Server)
$IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 443 -j ACCEPT

# Email Server (SMTP)
$IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 25 -j ACCEPT

# Email Server (POP3)
$IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 110 -j ACCEPT

# Email Server (IMAP4)
$IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 143 -j ACCEPT

# SSL Email Server (POP3)
$IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 995 -j ACCEPT

# SSL Email Server (IMAP4)
$IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 993 -j ACCEPT

# sshd
$IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 22 -j ACCEPT
# Not matched, so return so it will be logged
$IPT -A tcp_inbound -p TCP -j RETURN
# No match, so ACCEPT
$IPT -A tcp_outbound -p TCP -s 0/0 -j ACCEPT

# INPUT Chain

echo "Process INPUT chain ..."

# Allow all on localhost interface
$IPT -A INPUT -p ALL -i $LO_IFACE -j ACCEPT

# Drop bad packets
$IPT -A INPUT -p ALL -j bad_packets
echo "Process INPUT chain ..."

# Allow all on localhost interface
$IPT -A INPUT -p ALL -i $LO_IFACE -j ACCEPT

# Drop bad packets
$IPT -A INPUT -p ALL -j bad_packets
$IPT -A INPUT -p ALL -d 224.0.0.1 -j DROP

# Accept Established Connections
$IPT -A INPUT -p ALL -i $INET_IFACE -m state --state ESTABLISHED,RELATED \
     -j ACCEPT

# Route the rest to the appropriate user chain
$IPT -A INPUT -p TCP -i $INET_IFACE -j tcp_inbound
$IPT -A INPUT -p UDP -i $INET_IFACE -j udp_inbound
$IPT -A INPUT -p ICMP -i $INET_IFACE -j icmp_packets

$IPT -A INPUT -m pkttype --pkt-type broadcast -j DROP

# Log packets that still don't match
$IPT -A INPUT -j LOG --log-prefix "fp=INPUT:99 a=DROP "

# OUTPUT Chain
echo "Process OUTPUT chain ..."
# to prevent a possible exploit.
$IPT -A OUTPUT -m state -p icmp --state INVALID -j DROP

# Localhost
$IPT -A OUTPUT -p ALL -s $LO_IP -j ACCEPT
$IPT -A OUTPUT -p ALL -o $LO_IFACE -j ACCEPT

# To internet
$IPT -A OUTPUT -p ALL -o $INET_IFACE -j ACCEPT

# Log packets that still don't match
$IPT -A OUTPUT -j LOG --log-prefix "fp=OUTPUT:99 a=DROP "

Ausgabe iptables -L -v:
Code: 
Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  lo     any     anywhere             anywhere            
   11   812 bad_packets  all  --  any    any     anywhere             anywhere            
    0     0 DROP       all  --  any    any     anywhere             all-systems.mcast.net 
   11   812 ACCEPT     all  --  eth0   any     anywhere             anywhere            state RELATED,ESTABLISHED 
    0     0 tcp_inbound  tcp  --  eth0   any     anywhere             anywhere            
    0     0 udp_inbound  udp  --  eth0   any     anywhere             anywhere            
    0     0 icmp_packets  icmp --  eth0   any     anywhere             anywhere            
    0     0 DROP       all  --  any    any     anywhere             anywhere            PKTTYPE = broadcast 
    0     0 LOG        all  --  any    any     anywhere             anywhere            LOG level warning prefix `fp=INPUT:99 a=DROP ' 

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       icmp --  any    any     anywhere             anywhere            state INVALID 
    0     0 ACCEPT     all  --  any    any     nwsit.com            anywhere            
    0     0 ACCEPT     all  --  any    lo      anywhere             anywhere            
    5   868 ACCEPT     all  --  any    eth0    anywhere             anywhere            
    0     0 LOG        all  --  any    any     anywhere             anywhere            LOG level warning prefix `fp=OUTPUT:99 a=DROP ' 

Chain bad_packets (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 LOG        all  --  any    any     anywhere             anywhere            state INVALID LOG level warning prefix `fp=bad_packets:1 a=DROP ' 
    0     0 DROP       all  --  any    any     anywhere             anywhere            state INVALID 
   11   812 bad_tcp_packets  tcp  --  any    any     anywhere             anywhere            
   11   812 RETURN     all  --  any    any     anywhere             anywhere            

Chain bad_tcp_packets (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 LOG        tcp  --  any    any     anywhere             anywhere            tcp flags:!FIN,SYN,RST,ACK/SYN state NEW LOG level warning prefix `fp=bad_tcp_packets:1 a=DROP ' 
    0     0 DROP       tcp  --  any    any     anywhere             anywhere            tcp flags:!FIN,SYN,RST,ACK/SYN state NEW 
    0     0 LOG        tcp  --  any    any     anywhere             anywhere            tcp flags:FIN,SYN,RST,PSH,ACK,URG/NONE LOG level warning prefix `fp=bad_tcp_packets:2 a=DROP ' 
    0     0 DROP       tcp  --  any    any     anywhere             anywhere            tcp flags:FIN,SYN,RST,PSH,ACK,URG/NONE 
    0     0 LOG        tcp  --  any    any     anywhere             anywhere            tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,PSH,ACK,URG LOG level warning prefix `fp=bad_tcp_packets:3 a=DROP ' 
    0     0 DROP       tcp  --  any    any     anywhere             anywhere            tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,PSH,ACK,URG 
    0     0 LOG        tcp  --  any    any     anywhere             anywhere            tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,PSH,URG LOG level warning prefix `fp=bad_tcp_packets:4 a=DROP ' 
    0     0 DROP       tcp  --  any    any     anywhere             anywhere            tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,PSH,URG 
    0     0 LOG        tcp  --  any    any     anywhere             anywhere            tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,ACK,URG LOG level warning prefix `fp=bad_tcp_packets:5 a=DROP ' 
    0     0 DROP       tcp  --  any    any     anywhere             anywhere            tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,ACK,URG 
    0     0 LOG        tcp  --  any    any     anywhere             anywhere            tcp flags:SYN,RST/SYN,RST LOG level warning prefix `fp=bad_tcp_packets:6 a=DROP ' 
    0     0 DROP       tcp  --  any    any     anywhere             anywhere            tcp flags:SYN,RST/SYN,RST 
    0     0 LOG        tcp  --  any    any     anywhere             anywhere            tcp flags:FIN,SYN/FIN,SYN LOG level warning prefix `fp=bad_tcp_packets:7 a=DROP ' 
    0     0 DROP       tcp  --  any    any     anywhere             anywhere            tcp flags:FIN,SYN/FIN,SYN 
   11   812 RETURN     tcp  --  any    any     anywhere             anywhere            

Chain icmp_packets (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 LOG        icmp -f  any    any     anywhere             anywhere            LOG level warning prefix `fp=icmp_packets:1 a=DROP ' 
    0     0 DROP       icmp -f  any    any     anywhere             anywhere            
    0     0 DROP       icmp --  any    any     anywhere             anywhere            icmp echo-request 
    0     0 ACCEPT     icmp --  any    any     anywhere             anywhere            icmp time-exceeded 
    0     0 RETURN     icmp --  any    any     anywhere             anywhere            

Chain tcp_inbound (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:www 
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:https 
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:smtp 
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:pop3 
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:imap2 
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:pop3s 
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:imaps 
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:ssh 
    0     0 RETURN     tcp  --  any    any     anywhere             anywhere            

Chain tcp_outbound (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            

Chain udp_inbound (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       udp  --  any    any     anywhere             anywhere            udp dpt:netbios-ns 
    0     0 DROP       udp  --  any    any     anywhere             anywhere            udp dpt:netbios-dgm 
    0     0 RETURN     udp  --  any    any     anywhere             anywhere            

Chain udp_outbound (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     udp  --  any    any     anywhere             anywhere

Hm, jetzt ist die Frage, warum mein bisheriges (bis vor 2 Tagen funktionierendes) Skript und fail2ban nicht funktionieren...

Bitte um Hilfe
 
Funktioniert das Skript aus dem Userkontext heraus noch?
Der erste auffällige, wichtige Unterschied ist, dass du keine absoluten Pfade verwendest (welche im zweiten Skript genutzt werden).
 
wstuermer said:
Funktioniert das Skript aus dem Userkontext heraus noch?
Der erste auffällige, wichtige Unterschied ist, dass du keine absoluten Pfade verwendest (welche im zweiten Skript genutzt werden).
Click to expand...

Erstmal danke für die Antwort.

Skript funktioniert auch im Userkontext heraus nicht...

Allerdings wenn ich nur zb. diese rule in der shell ausführe
Code: 
iptables -A INPUT -i eth0 -m state --state NEW -p tcp --dport 110 -j REJECT
funktioniert das Reject. Und nichts anderes wird im Skript bzw. bei fail2ban auch ausgeführt...
Ausgabe iptables -L:
Code: 
iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
REJECT     tcp  --  anywhere             anywhere            state NEW tcp dpt:pop3 reject-with icmp-port-unreachable 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Also entweder ist ein Fehler in der Matrix, oder ich sehe den Wald vor lauter Bäume nicht...

MfG
 
You must log in or register to reply here.
Back
Top