Re: bridging and iptables -- strange behaviour
- From: "Postmaster" <postmaster@xxxxxxxxx>
- Date: Fri, 03 Feb 2006 22:53:23 GMT
"beau" <beausephine@xxxxxxxxx> wrote in message
news:1139002023.067948.5570@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
I've noticed some very strange behaviour in my firewall lately. If I
do a port scan on my desktop machine (XP) from a site like
security.symantec.com then I get some open ports listed, such as
25,80,110... These ports aren't open on my machine, fport even says
so. Even if I explicitly block 110 on my firewall the scan reports it
as being open. I'm using Fedora Core 4 with 2.6.11-1 kernel and
iptables to filter traffic over a bridge. When I block 110 I insert a
rule like this:
iptables -I FORWARD 1 -p tcp --dport 110 -j DROP
the packet counters for this rule are incrementing when I port scan, so
packets are matching. Has anyone seen anything like this before??? Is
it possible that something upstream from my firewall is causing this???
Beau
Beau,
I get more aggressive on blocking things at the firewall :-)
KPORT=XXX <- Port you want seriously blocked.
/sbin/iptables -A INPUT -i $EXTINT -p TCP --dport $KPORT -j DROP
/sbin/iptables -A INPUT -i $INTINT -p TCP --sport $KPORT -j DROP
/sbin/iptables -t nat -A PREROUTING -i $EXTINT -p TCP --dport $KPORT -j DROP
/sbin/iptables -t nat -A PREROUTING -i $INTINT -p TCP --sport $KPORT -j DROP
/sbin/iptables -A OUTPUT -o $EXTINT -p TCP --sport $KPORT -j DROP
/sbin/iptables -A OUTPUT -o $INTINT -p TCP --dport $KPORT -j DROP
/sbin/iptables -t nat -A POSTROUTING -o $EXTINT -p TCP --sport $KPORT -j
DROP
/sbin/iptables -t nat -A OUTPUT -o $EXTINT -p TCP --sport $KPORT -j DROP
/sbin/iptables -t nat -A POSTROUTING -o $INTINT -p TCP --dport $KPORT -j
DROP
/sbin/iptables -A FORWARD -p TCP --dport $KPORT -j DROP
Enjoy,
Postmaster
.
- Follow-Ups:
- Re: bridging and iptables -- strange behaviour
- From: Grant
- Re: bridging and iptables -- strange behaviour
- References:
- bridging and iptables -- strange behaviour
- From: beau
- bridging and iptables -- strange behaviour
- Prev by Date: Re: linux sockets - connect()
- Next by Date: Re: bridging and iptables -- strange behaviour
- Previous by thread: bridging and iptables -- strange behaviour
- Next by thread: Re: bridging and iptables -- strange behaviour
- Index(es):
Relevant Pages
|
