On Sat, Apr 30, 2005 at 02:23:24PM +0200, Mogens Valentin wrote:
> Ken Hilliard wrote:
> > In reading different firewall scripts/tutorials many of them recommend
> > filtering ICMP packets. I added ICMP filter in my firewall but was
> > unsure of the value as well. What is the consensus view out there?
>
> Not wanting to comment what the consensus are, but some types are
> generally considered nessesary to filter/allow.
>
> But its really not just a matter of filtering this-or-that, also what's
> set in /proc . There's a lot to read...
> A few ideas:
>
> Filtering ICMP:
>
> ### Define icmp_packets chain:
> $IPT -F icmp_packets
> $IPT -X icmp_packets
> $IPT -N icmp_packets
> $IPT -A icmp_packets -p icmp --icmp-type echo-request -j ACCEPT
> $IPT -A icmp_packets -p icmp --icmp-type echo-reply -j ACCEPT
> $IPT -A icmp_packets -p icmp --icmp-type destination-unreachable -j
> ACCEPTlog
> $IPT -A icmp_packets -p icmp --icmp-type network-unreachable -j
> ACCEPTlog
> $IPT -A icmp_packets -p icmp --icmp-type network-prohibited -j
> ACCEPTlog
> $IPT -A icmp_packets -p icmp --icmp-type source-quench -j ACCEPTlog
> $IPT -A icmp_packets -p icmp --icmp-type parameter-problem -j ACCEPTlog
> $IPT -A icmp_packets -p icmp --icmp-type time-exceeded -j ACCEPTlog
> $IPT -A icmp_packets -p icmp --icmp-type fragmentation-needed -j
> ACCEPTlog
> #$IPT -A icmp_packets -p icmp -j ACCEPTlog
> $IPT -A icmp_packets -p icmp -j LOG
why not use
-m limit --limit 1/s --limit-burst 5
as well to limit them and then drop the rest!
>
>
>
> A few /proc settings:
>
> ### /proc settings:
> setup_procfs() {
>
> # Disable forwarding while setting up rules (needed for
> masquerading):
> # Note: this is now done in forwarding.def
> #echo "0" >/proc/sys/net/ipv4/ip_forward
>
> # Initially, disable ICMP echo-requests altogether (normally only
> used if DoSed):
> # Note: this is now done in forwarding.def
> #echo "1" >/proc/sys/net/ipv4/icmp_echo_ignore_all
>
> # Disable ICMP echo-request to broadcast addresses (Smurf amplifier):
> echo "1" >/proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
>
> # Enable syn-cookies (prevent syn-flood attacks):
> echo "1" >/proc/sys/net/ipv4/tcp_syncookies
>
> # Reduce number of possible SYN Floods:
> echo "1024" >/proc/sys/net/ipv4/tcp_max_syn_backlog
>
> # Enable defrag error protection:
> echo 1 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
>
> # Enable time-wait assassination hazards in tcp (RFC 1337):
> echo "1" >/proc/sys/net/ipv4/tcp_rfc1337
>
> # Prevent remote digging of OS-type and uptime (RFC1323):
> #echo "1" >/proc/sys/net/ipv4/tcp_timestamps # enable
> timestamps
> echo "0" >/proc/sys/net/ipv4/tcp_timestamps # disable
> timestamps
>
> # Disable RFC2018 TCP Selective Acknowledgements:
> echo 0 > /proc/sys/net/ipv4/tcp_sack
>
>
> # Sourcerouting and spoofing:
> for i in /proc/sys/net/ipv4/conf/*; do
> # Drop all source-routed packets:
> echo "0" >$i/accept_source_route
>
> # Deactivate normal ICMP redirect accept/send:
> echo "0" >$i/accept_redirects
> echo "0" >$i/send_redirects
>
> # Activate secure ICMP redirects (send only?) (on by
> default):
> echo "1" >$i/secure_redirects
>
> # Enable ingress + egress source-address verification
> (prevent spoofing):
> #echo "0" >$i/rp_filter # disable
> echo "1" >$i/rp_filter # enable
> done
>
> # Log spoofed, source routed and redirect packets:
> #echo 1 >/proc/sys/net/ipv4/conf/all/log_martians
> echo 0 >/proc/sys/net/ipv4/conf/all/log_martians
>
> }
>
> --
> Kind regards,
> Mogens Valentin
>
>
> Q: How does a hacker fix a function which doesn't
> work for all of the elements in its domain?
> A: He changes the domain.
> -- unknown
>
>
>
Attachment:
signature.asc
Description: Digital signature
