Re: Dynamic Deny rule

[Rob Sterenborg <rsterenborg@xxxxxxxxx>]

Athan wrote:
> On Sat, Jan 04, 2003 at 10:53:16AM -0800, Bob Sully wrote:
>
> > Here's the excerpt from my script:
> >
> >  # Refuse any connections to/from problem sites.
> [snip]
>
> >  if [ -f /etc/firewall/firewall.banned ]; then
> >     while read BANNED; do
> >         iptables -A INPUT -i $EXTERNAL_INTERFACE -s $BANNED -j DROP
> >         iptables -A INPUT -i $EXTERNAL_INTERFACE -d $BANNED -j DROP
> >         iptables -A OUTPUT -o $EXTERNAL_INTERFACE -s $BANNED -j DROP
> >         iptables -A OUTPUT -o $EXTERNAL_INTERFACE -d $BANNED -j DROP
> >     done < /etc/firewall/firewall.banned
> >  fi
This way you'd have to reload the complete INPUT and OUTPUT rules over 
and over which is something I wouldn't do.

If you *are* going to use iptables for this, how about creating user 
BAN_IN and BAN_OUT chains.
Then let cron start a script every 5 minutes that clears the BAN chains 
and refills them with the values from the /etc/firewall/firewall.banned 
file.

Something like this (I didn't test this..) :

-----------

#!/bin/bash

EXT_IF="eth0"

# If a chain doesn't exist, "iptables -L" will output an error.
# Let's not display these errors..

IN=`iptables -L BAN_IN 2>&1|grep Chain|awk '{print $2}'`
OUT=`iptables -L BAN_OUT 2>&1|grep Chain|awk '{print $2}'`

if [ -f /etc/firewall/firewall.banned ]; then

  # Check to see if user chains exist ;
  # If they do : clear them.
  # If they don't : create and redirect the packets from the
  #   INPUT and OUTPUT chains to the BAN chains first.

  if [ -n "$IN" ] ; then
    iptables -F BAN_IN
  else
    iptables -N BAN_IN
    iptables -I INPUT 1 -j BAN_IN
  fi
  if [ -n "$OUT" ] ; then
    iptables -F BAN_OUT
  else
    iptables -N BAN_OUT
    iptables -I OUTPUT 1 -j BAN_OUT
  fi

  # Fill BAN chains.
  # Slightly modified from above...

  while read BAN_IP; do
    iptables -A BAN_IN -i $EXT_IF -s $BAN_IP -j DROP
    iptables -A BAN_OUT -o $EXT_IF -d $BAN_IP -j DROP
  done < /etc/firewall/firewall.banned

else

  # The ban file doesn't exist ; we don't need the chains.
  # Get rid of the BAN redirects in the INPUT and OUTPUT chains
  #   if we have them.

  L_IN=`iptables -L INPUT --line-numbers|grep BAN_IN|awk '{print $1}'`
  L_OUT=`iptables -L OUTPUT --line-numbers|grep BAN_OUT| \
           awk '{print $1}'`
  [ -n "$IN" ] && iptables -D INPUT $L_IN
  [ -n "$OUT" ] && iptables -D OUTPUT $L_OUT

  # Clear and get rid of the BAN chains if we have them.

  if [ -n "$IN" ] ; then
    iptables -F BAN_IN
    iptables -X BAN_IN
  fi
  if [ -n "$OUT" ] ; then
    iptables -F BAN_OUT
    iptables -X BAN_OUT
  fi

fi