As a result of experiences deploying PortSentry behind an ipchains firewall recently, I started considering how iptables could be used to deploy a dynamic firewall which would be able to modify itself in response to predefined events.
Be very careful with this. I've seen savvy attackers spoof attacks from the root name servers in order to make the firewall DoS the local environment. :(
Q: Has anyone considered or suggested this before?
Yup, and the feature is built into many commercial firewalls (FW-1, PIX, etc.). I know Bill Stearns was working on this at one point. You might be able to find more info at:
http://www.stearns.org
1 two new targets: ENLIST, DELIST
These targets effectively cause one or more new rules to be automatically added/removed to/from the firewall in response to matching the associated rule.
Depending on your IDS, you can script this as well. I seem to remember a paper floating around at one point that shows how to set this up with Snort and iptables.
I would like to write a rule which asserts: "BLACKLIST any host that sends a SYN packet to any ports between 1025-50000 unless there is a socket listening to the port at the time the packet arrives".
Hummm, so if I back door your system the firewall will happily update the ruleset to permit me access to that port. That's very polite of it. ;-)
HTH, C
