Firewall

Port Knocking

  1. fwknop: http://www.cipherdyne.org/fwknop/|[[Single Packet Authorization and Port Knocking]]

  2. Knock on the firewall by connections to some random ports, thus getting the firewall to open a door to the required service.
  3. Using Iptables for port knocking.

-A INPUT -m state --state NEW -p tcp -m tcp --dport 22 --tcp-flags SYN,RST,ACK SYN -m recent --check --seconds 60 --name SSH_ALLOW -j ACCEPT

-A INPUT -m state --state NEW -p tcp -m tcp --dport 123 --tcp-flags SYN,RST,ACK SYN -m recent --set --name SSH_FIRST -j DROP

-A INPUT -m state --state NEW -p tcp -m tcp --dport 234 --tcp-flags SYN,RST,ACK SYN -m recent --check --seconds 10 --rttl --name SSH_FIRST -j SSH_SECOND
-A SSH_SECOND  --tcp-flags SYN,RST,ACK SYN -m recent --set --name SSH_SECOND
-A SSH_SECOND  --tcp-flags SYN,RST,ACK SYN -m recent --remove --name SSH_FIRST
-A SSH_SECOND -j DROP

-A INPUT -m state --state NEW -p tcp -m tcp --dport 345 --tcp-flags SYN,RST,ACK SYN -m recent --check --seconds 10 --rttl --name SSH_SECOND -j SSH_THIRD
-A SSH_THIRD  --tcp-flags SYN,RST,ACK SYN -m recent --set --name SSH_THIRD
-A SSH_THIRD  --tcp-flags SYN,RST,ACK SYN -m recent --remove --name SSH_SECOND
-A SSH_THIRD -j DROP

-A INPUT -m state --state NEW -p tcp -m tcp --dport 456 --tcp-flags SYN,RST,ACK SYN -m recent --check --seconds 10 --rttl --name SSH_THIRD -j SSH_FOURTH
-A SSH_FOURTH  --tcp-flags SYN,RST,ACK SYN -m recent --set --name SSH_ALLOW
-A SSH_FOURTH  --tcp-flags SYN,RST,ACK SYN -m recent --remove --name SSH_THIRD
-A SSH_FOURTH -j DROP

server https accept with knock hidden
iptables -A knock_hidden -s %IP% -j ACCEPT
iptables -D knock_hidden -s %IP% -j ACCEPT

...


CategoryLinux

linux/firewall (last edited 2016-06-01 17:01:02 by PieterSmit)