How to use both syn proxy and connlimit rules with iptables?
I want to write both syn proxy and connlimit rules. I want to send packets to syn proxy first because of performance issue.
Here is rule sample.
#syn proxy rule
iptables -t raw -A PREROUTING -i eth1 -p tcp -m tcp --syn -j CT --notrack
iptables -t filter -A FORWARD -i eth1 -p tcp -m tcp -m state --state INVALID,UNTRACKED -j SYNPROXY --sack-perm --timestamp --wscale 7 --mss 1460
iptables -t filter -A FORWARD -i eth1 -m state --state INVALID -j DROP
#connlimit rule
iptables -t filter -A FORWARD -i eth1 -p tcp -m tcp --syn -m connlimit --connlimit-above 100 -j DROP
Problem is that since syn packets (packet that open connection) can not go beyond syn proxy rule, they can not match connlimit. I am looking for alternative way to write connlimit so that it can work with synproxy.
rhel iptables firewall
asked Jan 23 '15 at 9:57
ibrahimibrahim
402312
bumped to the homepage by Community♦ 13 mins ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
add a comment |
I want to write both syn proxy and connlimit rules. I want to send packets to syn proxy first because of performance issue.
Here is rule sample.
#syn proxy rule
iptables -t raw -A PREROUTING -i eth1 -p tcp -m tcp --syn -j CT --notrack
iptables -t filter -A FORWARD -i eth1 -p tcp -m tcp -m state --state INVALID,UNTRACKED -j SYNPROXY --sack-perm --timestamp --wscale 7 --mss 1460
iptables -t filter -A FORWARD -i eth1 -m state --state INVALID -j DROP
#connlimit rule
iptables -t filter -A FORWARD -i eth1 -p tcp -m tcp --syn -m connlimit --connlimit-above 100 -j DROP
Problem is that since syn packets (packet that open connection) can not go beyond syn proxy rule, they can not match connlimit. I am looking for alternative way to write connlimit so that it can work with synproxy.
rhel iptables firewall
asked Jan 23 '15 at 9:57
ibrahimibrahim
402312
bumped to the homepage by Community♦ 13 mins ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
An option is to usehashlimitbeforehand in the raw table.
– jofel
Jan 23 '15 at 11:02
I want to process synproxy first so that a spoofed ip doesnt match connlimit rule. Only solution I found so far that to put connlimit rule mangle/postrouting.
– ibrahim
Jan 23 '15 at 13:10
add a comment |
I want to write both syn proxy and connlimit rules. I want to send packets to syn proxy first because of performance issue.
Here is rule sample.
#syn proxy rule
iptables -t raw -A PREROUTING -i eth1 -p tcp -m tcp --syn -j CT --notrack
iptables -t filter -A FORWARD -i eth1 -p tcp -m tcp -m state --state INVALID,UNTRACKED -j SYNPROXY --sack-perm --timestamp --wscale 7 --mss 1460
iptables -t filter -A FORWARD -i eth1 -m state --state INVALID -j DROP
#connlimit rule
iptables -t filter -A FORWARD -i eth1 -p tcp -m tcp --syn -m connlimit --connlimit-above 100 -j DROP
Problem is that since syn packets (packet that open connection) can not go beyond syn proxy rule, they can not match connlimit. I am looking for alternative way to write connlimit so that it can work with synproxy.
rhel iptables firewall
asked Jan 23 '15 at 9:57
ibrahimibrahim
402312
I want to write both syn proxy and connlimit rules. I want to send packets to syn proxy first because of performance issue.
Here is rule sample.
#syn proxy rule
iptables -t raw -A PREROUTING -i eth1 -p tcp -m tcp --syn -j CT --notrack
iptables -t filter -A FORWARD -i eth1 -p tcp -m tcp -m state --state INVALID,UNTRACKED -j SYNPROXY --sack-perm --timestamp --wscale 7 --mss 1460
iptables -t filter -A FORWARD -i eth1 -m state --state INVALID -j DROP
#connlimit rule
iptables -t filter -A FORWARD -i eth1 -p tcp -m tcp --syn -m connlimit --connlimit-above 100 -j DROP
Problem is that since syn packets (packet that open connection) can not go beyond syn proxy rule, they can not match connlimit. I am looking for alternative way to write connlimit so that it can work with synproxy.
rhel iptables firewall
rhel iptables firewall
asked Jan 23 '15 at 9:57
ibrahimibrahim
402312
asked Jan 23 '15 at 9:57
ibrahimibrahim
402312
edited Nov 30 '17 at 5:44
ibrahim
asked Jan 23 '15 at 9:57
ibrahimibrahim
402312
asked Jan 23 '15 at 9:57
ibrahimibrahim
402312
asked Jan 23 '15 at 9:57
ibrahimibrahim
402312
402312
bumped to the homepage by Community♦ 13 mins ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
bumped to the homepage by Community♦ 13 mins ago
This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.
An option is to usehashlimitbeforehand in the raw table.
– jofel
Jan 23 '15 at 11:02
I want to process synproxy first so that a spoofed ip doesnt match connlimit rule. Only solution I found so far that to put connlimit rule mangle/postrouting.
– ibrahim
Jan 23 '15 at 13:10
add a comment |
An option is to usehashlimitbeforehand in the raw table.
– jofel
Jan 23 '15 at 11:02
I want to process synproxy first so that a spoofed ip doesnt match connlimit rule. Only solution I found so far that to put connlimit rule mangle/postrouting.
– ibrahim
Jan 23 '15 at 13:10
An option is to use
hashlimit beforehand in the raw table.– jofel
Jan 23 '15 at 11:02
An option is to use
hashlimit beforehand in the raw table.– jofel
Jan 23 '15 at 11:02
I want to process synproxy first so that a spoofed ip doesnt match connlimit rule. Only solution I found so far that to put connlimit rule mangle/postrouting.
– ibrahim
Jan 23 '15 at 13:10
I want to process synproxy first so that a spoofed ip doesnt match connlimit rule. Only solution I found so far that to put connlimit rule mangle/postrouting.
– ibrahim
Jan 23 '15 at 13:10
add a comment |
1 Answer
1
active
oldest
votes
I was using the same rule (synproxy on a bridge) but realized that the normal tcp request would not work, i.e., after implementing the synproxy rules ALL syn request got blocked. I have monitored with tcpdump.
I wonder if your synproxy rules work as expected?
answered Feb 22 '15 at 3:05
JingJing
11
Yes. As I mentioned on my comment, I put the connlimit rules to mangle/postrouting chain and then both synproxy and connlimit worked.
– ibrahim
Feb 23 '15 at 12:27
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f180608%2fhow-to-use-both-syn-proxy-and-connlimit-rules-with-iptables%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
I was using the same rule (synproxy on a bridge) but realized that the normal tcp request would not work, i.e., after implementing the synproxy rules ALL syn request got blocked. I have monitored with tcpdump.
I wonder if your synproxy rules work as expected?
answered Feb 22 '15 at 3:05
JingJing
11
Yes. As I mentioned on my comment, I put the connlimit rules to mangle/postrouting chain and then both synproxy and connlimit worked.
– ibrahim
Feb 23 '15 at 12:27
add a comment |
I was using the same rule (synproxy on a bridge) but realized that the normal tcp request would not work, i.e., after implementing the synproxy rules ALL syn request got blocked. I have monitored with tcpdump.
I wonder if your synproxy rules work as expected?
answered Feb 22 '15 at 3:05
JingJing
11
Yes. As I mentioned on my comment, I put the connlimit rules to mangle/postrouting chain and then both synproxy and connlimit worked.
– ibrahim
Feb 23 '15 at 12:27
add a comment |
I was using the same rule (synproxy on a bridge) but realized that the normal tcp request would not work, i.e., after implementing the synproxy rules ALL syn request got blocked. I have monitored with tcpdump.
I wonder if your synproxy rules work as expected?
answered Feb 22 '15 at 3:05
JingJing
11
I was using the same rule (synproxy on a bridge) but realized that the normal tcp request would not work, i.e., after implementing the synproxy rules ALL syn request got blocked. I have monitored with tcpdump.
I wonder if your synproxy rules work as expected?
answered Feb 22 '15 at 3:05
JingJing
11
answered Feb 22 '15 at 3:05
JingJing
11
answered Feb 22 '15 at 3:05
JingJing
11
answered Feb 22 '15 at 3:05
JingJing
11
11
Yes. As I mentioned on my comment, I put the connlimit rules to mangle/postrouting chain and then both synproxy and connlimit worked.
– ibrahim
Feb 23 '15 at 12:27
add a comment |
Yes. As I mentioned on my comment, I put the connlimit rules to mangle/postrouting chain and then both synproxy and connlimit worked.
– ibrahim
Feb 23 '15 at 12:27
Yes. As I mentioned on my comment, I put the connlimit rules to mangle/postrouting chain and then both synproxy and connlimit worked.
– ibrahim
Feb 23 '15 at 12:27
Yes. As I mentioned on my comment, I put the connlimit rules to mangle/postrouting chain and then both synproxy and connlimit worked.
– ibrahim
Feb 23 '15 at 12:27
add a comment |
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f180608%2fhow-to-use-both-syn-proxy-and-connlimit-rules-with-iptables%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
An option is to use
hashlimitbeforehand in the raw table.– jofel
Jan 23 '15 at 11:02
I want to process synproxy first so that a spoofed ip doesnt match connlimit rule. Only solution I found so far that to put connlimit rule mangle/postrouting.
– ibrahim
Jan 23 '15 at 13:10