As promised, I wrote a blog entry on the blocking the bogon IP's and included the full set of Iptables rules. http://cobia.typepad.com/cobia_community_blog/how_to_use_cobia/index.htm l Thanks, Martin Martin McKeay, CISSP, GSNA Cobia Product Evangelist StillSecure martin@xxxxxxxxxxxxxxx 707-495-7926 http://www.cobiablog.com -----Original Message----- From: netfilter-bounces@xxxxxxxxxxxxxxxxxxx [mailto:netfilter-bounces@xxxxxxxxxxxxxxxxxxx] On Behalf Of Martin McKeay Sent: Thursday, June 07, 2007 12:42 PM To: netfilter@xxxxxxxxxxxxxxxxxxx Subject: RE: ..prevention, was: syn DDoS attack solution I writing a blog post about the rules for blocking the bogon IP's (unused IP networks) using the firewall module of our Cobia, I was considering including the equivalent iptables rules. Would this be of interest to anyone? Martin McKeay, CISSP, GSNA Cobia Product Evangelist StillSecure martin@xxxxxxxxxxxxxxx 707-495-7926 http://www.cobiablog.com -----Original Message----- From: netfilter-bounces@xxxxxxxxxxxxxxxxxxx [mailto:netfilter-bounces@xxxxxxxxxxxxxxxxxxx] On Behalf Of Steven M Campbell Sent: Tuesday, June 05, 2007 9:41 AM To: Arnt Karlsen Cc: netfilter@xxxxxxxxxxxxxxxxxxx Subject: Re: ..prevention, was: syn DDoS attack solution Arnt Karlsen wrote: > On Tue, 05 Jun 2007 10:16:40 -0400, Steven wrote in message > <46657048.4040600@xxxxxxxxxxxxx>: > > >> And, most important for folks here, do egress filtering on your >> firewall! Help prevent zombie machines on your own networks from >> being a problem, you can't stop your end users from bringing >> infections into your network but you can control their spread. >> > > ..what tricks _are_ out there? Set up some kinda p0f deamon and cut > 'n tarpit any and all Wintendo network traffic attempts? > Or even feed them LROS thru ActiveX if they need firm hints? > > Not really very tricky, limit outbound traffic to what is needed. Do all of your workstations need UDP ports outbound? Smtp? For a lot of sites the average workstations internet requirements are very small, especially if proxys are used for SMTP,HTTP,FTP, etc. Just by blocking most of the end users from direct internet access (or at least to a small set of outbound protocol/ports) we render those machines pretty useless to the bad guys. It does, however, become very tricky if it's not done up front. It's really really tough to figure out what the requirements are if anyone could historically do anything they wanted. It's far better to seriously restrict things up front and put in the exceptions as you find them. Sites that have historically allowed all outbound traffic are a two fold problem, it's hard to fix and they are exactly the sorts of sites the bad guys like to use.
