☰

iptables：將檢查與「最近」模組中的設定結合到 1 條規則中

tag-icon • tag-icon linux iptables
iptables：將檢查與「最近」模組中的設定結合到 1 條規則中

使用recent模組中iptables，如何檢查 src ip 位址是否存在於清單中，如果存在，則將其新增至另一個清單？

我正在嘗試實施端口敲門iptables與該模組一起使用（ recent）。

因此，我想透過將 src ip 位址從一個列表移動到另一個列表來偵測 TCP 封包是否按特定順序到達，從而將其移向最終列表，這將允許 src ip 存取電腦。

我的問題基本上是，當封包具有正確的目標連接埠並且位於正確的當前步驟（清單）中時，如何​​將 src ip 新增至下一步（清單），所有這些都在一則規則中。像這樣的事情：

1：

# we'd like to accept the already authenticated packets quickly, hence the first rule
iptables -A KNOCKING -m recent --rcheck --seconds 60 --reap --name knockfinal -j ACCEPT

2：

# src ip is not authenticated, let's verify the first knock
# if the first port knock was correct (port 1111), add the src ip to the 'knock1' list
iptables -A KNOCKING -p tcp --dport 1111 -m recent --name knock1 --set -j DROP

3：

# now, here is the issue...
# how do we both check if the src ip is already in the 'knock1' list
# plus the second port knock was correct (port 2222), and add the src ip to 'knock2' list
# ideally, we would write something like this
iptables -A KNOCKING -m recent --rcheck --seconds 10 --reap --name knock1 -p tcp --dport 2222 -m recent --name knock2 --set -j DROP

我已經閱讀了幾種使用 iptables 設定連接埠碰撞的不同方法，但這對我來說似乎是最微不足道的一種，所以我真的很想確認或否認使用這種方法可以做到這一點。

答案1

事實證明，我上面發布的那一行正是應該這樣寫:)我想我對iptables能夠處理這樣一個「複雜」規則的期望太悲觀了。

這是我的簡單連接埠碰撞配置的配置：

# set default policy for INPUT chain to DROP
iptables -P INPUT DROP

# accept all local traffic
iptables -A INPUT -i lo -j ACCEPT

# accept all the already-established connections
iptables -A INPUT -p tcp -m state --state RELATED,ESTABLISHED -m multiport --sports 25,80,443,465,587 -j ACCEPT

# add more of your own rules here...

# at the end, redirect all the packets into the KNOCKING chain
# this makes it easy to quickly enable/disable KNOCKING chain, if need be
iptables -A INPUT -j KNOCKING

# if the src ip is already authenticated, accept it
iptables -A KNOCKING -m recent --rcheck --seconds 60 --reap --name knockfinal -j ACCEPT

# if the packet is not authenticated and the first port knock is correct
# add the src ip into the 'knock1' list
iptables -A KNOCKING -p tcp -m tcp --dport 1111 -m recent --set --name knock1 -j DROP

# if the src ip is already in the 'knock1' list (with the expiry time of 10 seconds)
# and the 2nd port knock is correct, add the src ip to the 'knock2' list
iptables -A KNOCKING -p tcp -m recent --rcheck --seconds 10 --reap --name knock1 -m tcp --dport 2222 -m recent --set --name knock2 -j DROP

# if the src ip is already in the 'knock2' list (with the expiry time of 10 seconds)
# and the 3rd port knock is correct, add the src ip to the 'knock3' list
iptables -A KNOCKING -p tcp -m recent --rcheck --seconds 10 --reap --name knock2 -m tcp --dport 3333 -m recent --set --name knock3 -j DROP

# if the src ip is already in the 'knock3' list (with the expiry time of 10 seconds)
# and the 4th port knock is correct, add the src ip to the 'knockfinal' list
iptables -A KNOCKING -p tcp -m recent --rcheck --seconds 10 --reap --name knock3 -m tcp --dport 4444 -m recent --set --name knockfinal -j DROP

# otherwise, we don't do anything and the default INPUT policy will drop the packet

我想這是迄今為止我見過的最短的 iptables 連接埠碰撞規則集...

相關內容