{"id":2242,"date":"2019-02-13T11:51:49","date_gmt":"2019-02-13T09:51:49","guid":{"rendered":"https:\/\/upcloud.com\/global\/us\/resources\/tutorials\/iptables-firewall-recent-triggering-ipset\/"},"modified":"2019-02-13T11:51:49","modified_gmt":"2019-02-13T09:51:49","slug":"iptables-firewall-recent-triggering-ipset","status":"publish","type":"tutorial","link":"https:\/\/upcloud.com\/global\/resources\/tutorials\/iptables-firewall-recent-triggering-ipset\/","title":{"rendered":"How to setup iptables firewall effortlessly using ‘recent’ triggering and ipset"},"content":{"rendered":"\n

In this article are shown example instructions for a simple firewall disallowing new connections if the remote host initiates a connection too often. This is especially the case with SSH brute force attacks. Most administrators know the feeling of annoyance when they look at the system security logs and notice the enormous amounts of failed SSH logins.<\/p>\n\n\n\n

What makes the described solution effortless is that there is no need to install and configure a separate log watcher daemon \u2013 just bring in some firewall rules. The setup might be most useful in the context of security-sensitive hosts where additional security measures would be justified, even more so if, for some reason, strong (e.g. key based) authentication can\u2019t be used.<\/p>\n\n\n\n

\n
Test hosting on UpCloud!<\/a><\/div>\n<\/div>\n\n\n\n

Description<\/h2>\n\n\n\n

This article describes deploying IPv4 address bans based on how often a remote client tries to connect to a specific port, using netfilter<\/em>\u2018s iptables<\/tt> and ipset<\/tt> tools.<\/p>\n\n\n\n

Matching lists of addresses or networks by using just\u00a0iptables\u00a0is indeed messy because\u00a0iptables\u00a0itself does not support matching multiple separate addresses or networks in one rule. This means that every checked address or network would need its own rule in the ruleset. Such complicated and long rulesets bring administration and performance concerns.<\/p>\n\n\n\n

With ipset<\/tt> a list of addresses (or networks, etc.) can be matched from one rule. Performance considerations such as indexing the address set make matching and lookups a lot more efficient.<\/p>\n\n\n\n

The example is as on CentOS 7. Similar should be achievable on other systems too.<\/em><\/p>\n\n\n\n

Setup process<\/h2>\n\n\n\n

First, the needed tools should be installed:<\/p>\n\n\n\n

yum install iptables iptables-services ipset ipset-service<\/pre>\n\n\n\n
All offending IPv4 addresses are going to be saved, open the following file for edit:<\/p>\n\n\n\n
vi \/etc\/sysconfig\/ipset-config<\/pre>\n\n\n\n
And set IPSET_SAVE_ON_STOP=\"yes\"<\/tt>.<\/p>\n\n\n\n
The ipset<\/tt> in this example is created with the timeout<\/em> parameter which makes the set\u2019s entries expire. Without the timeout, the entries will last until removed by hand.<\/p>\n\n\n\n
ipset create sshin_bans hash:ip timeout 3600\nservice ipset save\nsystemctl start ipset\nsystemctl enable ipset<\/pre>\n\n\n\n
Insert desired ruleset into \/etc\/sysconfig\/iptables<\/tt>. Following is a simple example ruleset:<\/p>\n\n\n\n
*filter\n:INPUT ACCEPT [0:0]\n:FORWARD ACCEPT [0:0]\n:OUTPUT ACCEPT [0:0]\n:SSHIN - [0:0]\n\n# 1\n-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT\n-A INPUT -i lo -j ACCEPT\n-A INPUT -p tcp -m tcp --dport 22 -s 10.0.0.0\/12 -m conntrack --ctstate NEW -j ACCEPT\n\n# 2\n-A INPUT -m set --match-set sshin_bans src -j DROP\n\n# 3-4\n-A INPUT -p icmp -j ACCEPT\n-A INPUT -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -j SSHIN\n\n# 5 Block direct SSH bruteforce\n-A SSHIN -m recent --set --name bruteforce\n-A SSHIN -m recent --update --seconds 3600 --hitcount 5 --name bruteforce -j LOG --log-level info --log-prefix \"SSH blocked: \"\n-A SSHIN -m recent --update --seconds 3600 --hitcount 5 --name bruteforce -j SET --add-set sshin_bans src\n-A SSHIN -m recent --update --seconds 3600 --hitcount 5 --name bruteforce -j DROP\n-A SSHIN -j ACCEPT\n\n# 6 if you want to filter ports:\n#-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT\n#-A INPUT -j REJECT --reject-with icmp-host-prohibited\n#-A FORWARD -j REJECT --reject-with icmp-host-prohibited\n\nCOMMIT<\/pre>\n\n\n\n
Explanation of the above ruleset:<\/p>\n\n\n\n
    \n
  1. Established, localhost and new SSH connections from your private network are allowed right away.<\/li>\n\n\n\n
  2. The sshin_bans<\/tt> address list (set<\/tt>) is checked. If the source address is found from the set the connection is immediately dropped (i.e. no connections at all, to any port, are allowed from that specific address).<\/li>\n\n\n\n
  3. ICMP is allowed.<\/li>\n\n\n\n
  4. New SSH (port 22) connections are directed to SSHIN chain for further evaluation.<\/li>\n\n\n\n
  5. SSH connection counting and processing magic:\n