Estou trabalhando em um projeto que está quase concluído: conseguir interromper a conexão de internet dos meus filhos com o toque de um botão. Implementei parte da solução basicamente chamando:
ufw negar do IP
A ameaça de matar a Internet funciona metade das vezes, e o que foi dito acima funciona metade da metade restante. Onde encontro problemas são os longos vídeos do YouTube. Às vezes é conveniente que as conexões existentes continuem, mas também gostaria de ter um botão que eliminasse todo o tráfego existente de/para o IP. Isto revelou-se muito mais difícil do que o esperado.
Eu tentei o cortador, que parece nem funcionar no Ubuntu 14.04. Eu tentei tcpkill. Parece funcionar, mas não parece fazer nada (forneci ambas as interfaces Ethernet) e parece querer funcionar continuamente. Embora meu ufw seja persistente, prefiro que o kill imediatamente seja sem estado e simplesmente elimine todas as conexões existentes.
Conntrack parecia promissor (http://conntrack-tools.netfilter.org/manual.html) e tinha o seguinte:
Exclua uma entrada, isso pode ser usado para bloquear o tráfego se:
Você tem um conjunto de regras com estado que bloqueia o tráfego no estado INVÁLIDO.
Você configurou /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_loose ou /proc/sys/net/netfilter/nf_conntrack_tcp_loose, dependendo da versão do seu kernel, como zero.
O comando
conntrack -D -s <IP>
parece pegar e mostrar exclusões de alguma coisa, mas o vídeo do YouTube continua zumbindo e vejo conexões se reformando quando faço isso
conntrack -L
eu fiz
echo 0 > nf_conntrack_tcp_loose
e cat'ed para ter certeza de que travou, mas não parece excluir as conexões.
Não tenho 100% de certeza do que significa "um conjunto de regras com estado que bloqueia o tráfego no estado INVÁLIDO", mas vejo a seguinte regra
DROP all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID
ao fazer um "iptables -L -n", se é isso que ele faz referência.
Eu encontrei o seguinte:
iptables -A INPUT -s "$BLOCK_THIS_IP" -j DROP
Não funcionou para mim, mas provavelmente é devido ao fato de ter seguido uma regra geral para permitir todo o tráfego na rede interna e, com a reordenação, pode funcionar. Prefiro não misturar comandos iptables com comandos ufw. Dado que o UFW já configurou o iptables para negar quaisquer novas conexões, configurar uma queda no iptables parece redundante, e eu realmente não quero misturar UFW com comandos iptable, se puder evitar.
Alguém pode me dizer como posso usar "conntrack -D" para encerrar conexões existentes de/para um host, ou alguma outra maneira de desativar a rede ou interface e depois voltar? Descobrir como fazer isso tem sido mais difícil do que se imaginava.
Obrigado,
Marca
Fiz mais alguns testes que gostaria de compartilhar.
Primeiro, comecei a verificar o kill com apenas uma conexão ssh. Na verdade, isso acabou sendo bastante fácil. Tanto o método quanto os métodos tcpkill conntrack -Dfuncionaram. (Eu também tentei com nf_conntrack_tcp_loose=1 (padrão para meu sistema) e confirmei que você precisa defini-lo como 0 para que o conntrack -Dmétodo funcione).
Não sei como funcionam as conexões do YouTube, mas parecem difíceis de eliminar. Se eu chamar conntrack -D IPo método apenas uma vez, ele não morre. Mas se eu configurar o seguinte loop
while sleep 1 ; do conntrack -D -s 10.42.43.25 ; done
eventualmente morreria.
O registro era:
conntrack v1.4.1 (conntrack-tools): 17 flow entries have been deleted.
udp 17 10 src=___.___.43.25 dst=___.___.43.1 sport=57859 dport=53 src=___.___.43.1 dst=___.___.43.25 sport=53 dport=57859 mark=0 use=1
tcp 6 431980 ESTABLISHED src=___.___.43.25 dst=___.___.163.19 sport=59023 dport=80 src=___.___.163.19 dst=___.___.221.222 sport=80 dport=59023 [ASSURED] mark=0 use=1
tcp 6 431980 ESTABLISHED src=___.___.43.25 dst=___.___.218.3 sport=59033 dport=443 src=___.___.218.3 dst=___.___.221.222 sport=443 dport=59033 [ASSURED] mark=0 use=1
tcp 6 102 TIME_WAIT src=___.___.43.25 dst=___.___.242.247 sport=59044 dport=443 src=___.___.242.247 dst=___.___.221.222 sport=443 dport=59044 [ASSURED] mark=0 use=1
tcp 6 431980 ESTABLISHED src=___.___.43.25 dst=___.___.247.248 sport=59024 dport=443 src=___.___.247.248 dst=___.___.221.222 sport=443 dport=59024 [ASSURED] mark=0 use=1
tcp 6 299 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59042 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59042 [ASSURED] mark=0 use=1
udp 17 0 src=___.___.43.25 dst=___.___.43.1 sport=60775 dport=53 src=___.___.43.1 dst=___.___.43.25 sport=53 dport=60775 mark=0 use=1
tcp 6 431980 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.78 sport=59035 dport=443 src=sss.sss.sss.78 dst=___.___.221.222 sport=443 dport=59035 [ASSURED] mark=0 use=1
tcp 6 97 TIME_WAIT src=___.___.43.25 dst=___.___.234.25 sport=59039 dport=443 src=___.___.234.25 dst=___.___.221.222 sport=443 dport=59039 [ASSURED] mark=0 use=1
udp 17 11 src=___.___.43.25 dst=___.___.43.1 sport=56527 dport=53 src=___.___.43.1 dst=___.___.43.25 sport=53 dport=56527 mark=0 use=1
tcp 6 431980 ESTABLISHED src=___.___.43.25 dst=___.___.218.110 sport=59020 dport=443 src=___.___.218.110 dst=___.___.221.222 sport=443 dport=59020 [ASSURED] mark=0 use=1
tcp 6 431999 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59043 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59043 [ASSURED] mark=0 use=1
tcp 6 431948 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.97 sport=59025 dport=443 src=sss.sss.sss.97 dst=___.___.221.222 sport=443 dport=59025 [ASSURED] mark=0 use=1
udp 17 6 src=___.___.43.25 dst=___.___.43.1 sport=53498 dport=53 src=___.___.43.1 dst=___.___.43.25 sport=53 dport=53498 mark=0 use=1
tcp 6 431988 ESTABLISHED src=___.___.43.25 dst=___.___.10.188 sport=58987 dport=5228 src=___.___.10.188 dst=___.___.221.222 sport=5228 dport=58987 [ASSURED] mark=0 use=1
tcp 6 431999 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.138 sport=59021 dport=443 src=sss.sss.sss.138 dst=___.___.221.222 sport=443 dport=59021 [ASSURED] mark=0 use=1
tcp 6 431979 ESTABLISHED src=___.___.43.25 dst=___.___.103.74 sport=59038 dport=443 src=___.___.103.74 dst=___.___.221.222 sport=443 dport=59038 [ASSURED] mark=0 use=1
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 2 flow entries have been deleted.
tcp 6 299 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59049 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59049 [ASSURED] mark=0 use=1
tcp 6 299 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59050 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59050 [ASSURED] mark=0 use=1
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 1 flow entries have been deleted.
tcp 6 299 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59052 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59052 [ASSURED] mark=0 use=1
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 1 flow entries have been deleted.
tcp 6 299 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59053 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59053 [ASSURED] mark=0 use=1
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 1 flow entries have been deleted.
tcp 6 431999 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59055 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59055 [ASSURED] mark=0 use=1
...
tcp 6 299 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59089 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59089 [ASSURED] mark=0 use=1
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 1 flow entries have been deleted.
tcp 6 300 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59090 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59090 [ASSURED] mark=0 use=1
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 1 flow entries have been deleted.
tcp 6 299 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59092 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59092 [ASSURED] mark=0 use=2
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 1 flow entries have been deleted.
tcp 6 300 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.138 sport=59094 dport=443 src=sss.sss.sss.138 dst=___.___.221.222 sport=443 dport=59094 [ASSURED] mark=0 use=1
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 1 flow entries have been deleted.
tcp 6 299 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59095 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59095 [ASSURED] mark=0 use=1
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
... (finally dead)
Então a questão agora é o que está acontecendo aqui? Como as entradas de fluxo são estabelecidas depois de eu ter excluído inicialmente todos os fluxos? o que estou perdendo? Existe algo sobre como tudo isso funciona onde eu não posso simplesmente encerrar com um comando único?
Apenas mais algumas informações. Eu me convenci de que o buffer local não está afetando minha percepção do que está acontecendo. Depois de fazer uma única exclusão, posso ver a quantidade de dados no buffer continuar a crescer. Além disso, posso gravar um vídeo longo e arrastar o tempo do quadro do YouTube para o futuro, muito além da marca d'água do buffer, e o vídeo funciona muito mais tarde.
Chain INPUT (policy DROP)
target prot opt source destination
fail2ban-ssh tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 22
ufw-before-logging-input all -- 0.0.0.0/0 0.0.0.0/0
ufw-before-input all -- 0.0.0.0/0 0.0.0.0/0
ufw-after-input all -- 0.0.0.0/0 0.0.0.0/0
ufw-after-logging-input all -- 0.0.0.0/0 0.0.0.0/0
ufw-reject-input all -- 0.0.0.0/0 0.0.0.0/0
ufw-track-input all -- 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ufw-before-logging-forward all -- 0.0.0.0/0 0.0.0.0/0
ufw-before-forward all -- 0.0.0.0/0 0.0.0.0/0
ufw-after-forward all -- 0.0.0.0/0 0.0.0.0/0
ufw-after-logging-forward all -- 0.0.0.0/0 0.0.0.0/0
ufw-reject-forward all -- 0.0.0.0/0 0.0.0.0/0
ufw-track-forward all -- 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ufw-before-logging-output all -- 0.0.0.0/0 0.0.0.0/0
ufw-before-output all -- 0.0.0.0/0 0.0.0.0/0
ufw-after-output all -- 0.0.0.0/0 0.0.0.0/0
ufw-after-logging-output all -- 0.0.0.0/0 0.0.0.0/0
ufw-reject-output all -- 0.0.0.0/0 0.0.0.0/0
ufw-track-output all -- 0.0.0.0/0 0.0.0.0/0
Chain fail2ban-ssh (1 references)
target prot opt source destination
REJECT all -- 116.31.116.41 0.0.0.0/0 reject-with icmp-port-unreachable
RETURN all -- 0.0.0.0/0 0.0.0.0/0
Chain ufw-after-forward (1 references)
target prot opt source destination
Chain ufw-after-input (1 references)
target prot opt source destination
ufw-skip-to-policy-input udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:137
ufw-skip-to-policy-input udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:138
ufw-skip-to-policy-input tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:139
ufw-skip-to-policy-input tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:445
ufw-skip-to-policy-input udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:67
ufw-skip-to-policy-input udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:68
ufw-skip-to-policy-input all -- 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match dst-type BROADCAST
Chain ufw-after-logging-forward (1 references)
target prot opt source destination
Chain ufw-after-logging-input (1 references)
target prot opt source destination
LOG all -- 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "
Chain ufw-after-logging-output (1 references)
target prot opt source destination
Chain ufw-after-output (1 references)
target prot opt source destination
Chain ufw-before-forward (1 references)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 3
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 4
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 11
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 12
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 8
ufw-user-forward all -- 0.0.0.0/0 0.0.0.0/0
Chain ufw-before-input (1 references)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
ufw-logging-deny all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID
DROP all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 3
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 4
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 11
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 12
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 8
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp spt:67 dpt:68
ufw-not-local all -- 0.0.0.0/0 0.0.0.0/0
ACCEPT udp -- 0.0.0.0/0 224.0.0.251 udp dpt:5353
ACCEPT udp -- 0.0.0.0/0 239.255.255.250 udp dpt:1900
ufw-user-input all -- 0.0.0.0/0 0.0.0.0/0
Chain ufw-before-logging-forward (1 references)
target prot opt source destination
Chain ufw-before-logging-input (1 references)
target prot opt source destination
Chain ufw-before-logging-output (1 references)
target prot opt source destination
Chain ufw-before-output (1 references)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
ufw-user-output all -- 0.0.0.0/0 0.0.0.0/0
Chain ufw-logging-allow (0 references)
target prot opt source destination
LOG all -- 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW ALLOW] "
Chain ufw-logging-deny (2 references)
target prot opt source destination
RETURN all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID limit: avg 3/min burst 10
LOG all -- 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "
Chain ufw-not-local (1 references)
target prot opt source destination
RETURN all -- 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match dst-type LOCAL
RETURN all -- 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match dst-type MULTICAST
RETURN all -- 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match dst-type BROADCAST
ufw-logging-deny all -- 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 10
DROP all -- 0.0.0.0/0 0.0.0.0/0
Chain ufw-reject-forward (1 references)
target prot opt source destination
Chain ufw-reject-input (1 references)
target prot opt source destination
Chain ufw-reject-output (1 references)
target prot opt source destination
Chain ufw-skip-to-policy-forward (0 references)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
Chain ufw-skip-to-policy-input (7 references)
target prot opt source destination
DROP all -- 0.0.0.0/0 0.0.0.0/0
Chain ufw-skip-to-policy-output (0 references)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
Chain ufw-track-forward (1 references)
target prot opt source destination
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 ctstate NEW
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 ctstate NEW
Chain ufw-track-input (1 references)
target prot opt source destination
Chain ufw-track-output (1 references)
target prot opt source destination
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 ctstate NEW
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 ctstate NEW
Chain ufw-user-forward (1 references)
target prot opt source destination
Chain ufw-user-input (1 references)
target prot opt source destination
ACCEPT all -- 10.42.43.25 0.0.0.0/0
ACCEPT all -- 10.42.43.0/24 0.0.0.0/0
Chain ufw-user-limit (0 references)
target prot opt source destination
LOG all -- 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 LOG flags 0 level 4 prefix "[UFW LIMIT BLOCK] "
REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
Chain ufw-user-limit-accept (0 references)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
Chain ufw-user-logging-forward (0 references)
target prot opt source destination
Chain ufw-user-logging-input (0 references)
target prot opt source destination
Chain ufw-user-logging-output (0 references)
target prot opt source destination
Chain ufw-user-output (1 references)
target prot opt source destination
Quando altero o estado para desligar uma determinada máquina, a alteração do log é representada na seguinte diferença:
158c157
< ACCEPT all -- 10.42.43.25 0.0.0.0/0
---
> DROP all -- 10.42.43.25 0.0.0.0/0