How to blacklist or whitelist lots or few ip ranges with ipset and iptables + fail2ban
EDIT:
It's astonishing how the urge to find a solution sometimes is sufficient to slowly but steadily lead one towards a solution. Also, the more often I reread my question in order to clarify it, I realize that this "question" rather exceeds the scope of a 'simple' question or the idea of getting things answered by this community.
I will rewrap the structure of this question within the next hours as I more and more understood the operational concepts of iptables. The process of understanding also yielded some way more specific questions which I will provide to this community soon and link to this question.
In a nutshell: My problem is to find the right set of rules to make:
- my own rules
- fail2ban
- additional dns blacklist work together, whereas "my rules" also implies either whitelisting my country for ssh and hence blocking all other countries for ssh, BUT allowing all countries/ranges/IPs for DNS queries, except a set of blacklisted ones.
In numbers:
- for ssh: whitelist 50 ranges OR blacklist approx. 620.000 ranges (composed via ipdeny.com etc.)
- blacklist entries for dns: approx. 140 (set of u32 rules, script(s))
- 25+/- rules for the additional services (see below)
Lyric version: I'm struggling with an implementation of a solution for my needs: Scenario as follows. I have a (assume DNS for now) server. Besides bind ssh, sendmail, https and munin need to be taken into account:
This in general was easy to achieve. Additionally I fail2ban was installed as I was facing some (d)dos attacks from all over the world. My primary goal was to lock down the server as much as possible.
My idea was to whitelist only some ip ranges of my country which matches possible dynamic dns allocations of ISPs I have access to - i.e. DSL & mobile. That way I won't lock myself out.
I looked up all the net ranges of my ISPs which resulted in my following script / rule set:
#ports:
# 22: SSH (#4,#5) (ssh)
# 25: SMTP (#20) (outgoing, sendmail for f2b report)
# 53: DNS (!!#16!! see end of #16 as differs for ns1&2) (outgoing, bind)
# 443: HTTPS (#10) (outgoing, dns-blacklist update)
#4949: munin (#26) (outgoing, sending client stats to server)
# Modify this file accordingly for your specific requirement.
# http://www.thegeekstuff.com: http://www.thegeekstuff.com/scripts/iptables-rules
# 1. Delete all existing rules
#iptables -F
# 2. Set default chain policies
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP
# 4. Allow ALL incoming SSH
#iptables -A INPUT -i eth1 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
#iptables -A OUTPUT -o eth1 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
# 5. Allow incoming SSH only from a sepcific network (kabelBW/Unitymedia, Telekom, Accelerated)
# note: Using '-I' instead of '-A' to insert to top of INPUT chain to put rule in front of fail2ban!
iptables -A INPUT -i eth0 -p tcp -s 5.10.48.0/20 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 5.10.160.0/19 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 5.56.176.0/20 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 5.56.192.0/18 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 5.146.0.0/15 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 5.158.128.0/18 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 24.134.0.0/16 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 31.16.0.0/14 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 37.4.0.0/15 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 37.24.0.0/16 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 37.49.0.0/17 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 37.114.96.0/19 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 37.201.0.0/16 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 37.209.0.0/17 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 46.5.0.0/16 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 46.223.0.0/16 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 46.237.192.0/18 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 46.252.128.0/20 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 62.143.0.0/16 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 77.20.0.0/14 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 78.42.0.0/15 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 78.94.0.0/16 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 80.69.96.0/20 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 81.210.128.0/17 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 82.211.0.0/18 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 82.212.0.0/18 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 83.169.128.0/18 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 84.200.0.0/16 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 84.201.0.0/18 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 85.216.0.0/17 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 88.134.0.0/16 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 88.152.0.0/15 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 91.64.0.0/14 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 91.89.0.0/16 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 92.50.64.0/18 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 94.79.128.0/18 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 95.88.0.0/14 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 95.208.0.0/16 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 95.222.0.0/15 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 109.90.0.0/15 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 109.192.0.0/15 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 130.180.0.0/17 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 134.3.0.0/16 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 146.52.0.0/16 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 149.172.0.0/16 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 176.198.0.0/15 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 178.24.0.0/14 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 178.200.0.0/14 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 188.192.0.0/14 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -s 217.8.48.0/20 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
service fail2ban restart
# 10. Allow outgoing HTTPS
iptables -A OUTPUT -o eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
# 12. Ping from inside to outside
iptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
# 13. Ping from outside to inside
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT
# 14. Allow loopback access
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
# 16. Allow outbound DNS
iptables -A OUTPUT -p udp -o eth0 --dport 53 -j ACCEPT
iptables -A INPUT -p udp -i eth0 --sport 53 -j ACCEPT
#Allow inbound DNS
iptables -A INPUT -p udp -s 0/0 --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p udp --sport 53 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -p udp -s 0/0 --sport 53 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p udp --sport 53 -d 0/0 --dport 53 -m state --state ESTABLISHED -j ACCEPT
# 20. Allow Sendmail or Postfix
iptables -A OUTPUT -p tcp --dport 25 -j ACCEPT
iptables -A INPUT -p tcp --sport 25 -m state --state ESTABLISHED -j ACCEPT
# 26. Allow Munin Stats
iptables -A INPUT -p tcp --dport 4949 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 4949 -j ACCEPT
service munin-node restart
sh /root/update_domain_blacklist.sh
Restarting fail2ban before rule set #10 is to ensure chains are (re)setup correctly after being purged from iptable (flushed by -F at the beginning of the script. Same applies for munin, which complained about not being able reach it's server if not being restartet after applying exception rules).
I intend to apply the rules via /etc/rc.local. That implies that already chains for fail2ban and munin are created.
The firewall checking flow I'd like to achieve is: request is DNS? -> (a); ssh? -> (b); one of my other services? -> (c); anything else? -> (d):
- (a): serve, if not blacklisted DNS blacklist script
- (b): serve, if not blacklisted OR if whitelisted according to my net range set
- (c): serve, according to my defined rules
- (d): DROP/TARPIT/whatever best practice
- if (b), additionally pass fail2ban
Problems with above rules:
- fail2ban kicks in before whitelist check - good for my ssh part, bad for my dns part: my guess
I then tried to use ipset to block/blacklist "the whole world" except for my 50 ranges. Theoretically possible, but parsing of the 620k ranges lasts for like more than 10 minutes; I cancelled the operation and went back to my whitelist ranges. Next idea: still use ipset for the 50 ranges and block/blacklist the inverse of that list for ssh:
!/bin/bash
#Script to process ip ranges to ban using IPSet and IPTables
# 10. Allow outgoing HTTPS
iptables -I OUTPUT -o eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -I INPUT -i eth0 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
# 12. Ping from inside to outside
iptables -I OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -I INPUT -p icmp --icmp-type echo-reply -j ACCEPT
# 14. Allow loopback access
iptables -I INPUT -i lo -j ACCEPT
iptables -I OUTPUT -o lo -j ACCEPT
# 16. Allow outbound DNS
iptables -I OUTPUT -p udp -o eth0 --dport 53 -j ACCEPT
iptables -I INPUT -p udp -i eth0 --sport 53 -j ACCEPT
#Allow inbound DNS
iptables -I INPUT -p udp -s 0/0 --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -I OUTPUT -p udp --sport 53 -d 0/0 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
iptables -I INPUT -p udp -s 0/0 --sport 53 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -I OUTPUT -p udp --sport 53 -d 0/0 --dport 53 -m state --state ESTABLISHED -j ACCEPT
# 20. Allow Sendmail or Postfix #to mail.awib.it (82.211.19.134)
iptables -I OUTPUT -p tcp --dport 25 -j ACCEPT
iptables -I INPUT -p tcp --sport 25 -m state --state ESTABLISHED -j ACCEPT
# 26. Allow Munin Stats
iptables -I INPUT -p tcp --dport 4949 -j ACCEPT
iptables -I OUTPUT -p tcp --sport 4949 -j ACCEPT
#iptables -I OUTPUT -o eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
ipset create countryblock hash:net
while read line; do ipset add countryblock $line; done < blocklist.txt
iptables -A INPUT -m set ! --match-set countryblock src -j DROP
whereas 'blocklist.txt' contains my 50 ranges to be whitelisted or the inverse of that getting blacklisted. But the inverse of that set also implies ALL DNS traffic to get blocked etc... this drives me nuts! :-D
But for some reason I either had no access to my server at all, or the inverse did not work (tried some web2ssh applets just to check for a ssh prompt).
I also found corresponding fail2ban createaction rule definitions in it's configs; but to reduce overhead I really would love to leave munin's and f2b's default rules as they are and apply necessary modifications to my own rules and maybe to the dns-blacklist script.
I know that this question/request might not be the easiest one and you might ask why not just simply using fail2ban? I like to know if there are suspicious actions and hence getting blocked host report is nice. Though I do not want to have this for every foreign hosts (tenfold, as I'm running fail2ban on over 10 servers).
Another approach maybe would be a dedicated firewall server/router, handling all the traffic. But this would be a rather complex rule setup and I don't want to accidentally lock out ALL my servers due to a stupid misconfig / faulty rule or whatever. Also this would exceed my free traffic, which currently gets split up among all 10 servers.
I hope some geeky insighty friend is around willing to assist me getting the rules sorted correctly.
Prior to unnecessarily padding out this question I am on hold now, providing infos as requested.
PS: maybe someone can add the "ipset" tag, as I cannot create it due to lack of reputation. Thanks!
Solution 1:
Looks awfully complicated....
I think you may find great value in security and performance by just moving sshd and munin to different ports.
Running those services on ports that do not match the default will quell most of the brute force/dos traffic. Fail2ban should be able to pick up any outliers after that.
By moving to custom ports, you essentially create the following:
iptables -A "Anyone that doesn't know the correct ssh port" -j DROP
You can still log attempts to connect to port 22 but I think you could probably find better uses for the disk space.