SIPVicious attacks: Migration from iptables-extensions

[Benjamin Lefoul]

Hi!

I have inherited a system using the following in order to prevent SIPVicious attacks:

iptables -I INPUT -p udp --dport 5060 -m string --string "friendly-scanner" --algo bm -j DROP
iptables -I INPUT -p tcp --dport 5060 -m string --string "friendly-scanner" --algo bm -j DROP

Now that we are migrating to firewalld, I am not quite sure how to translate this into the firewalld semantics.

Do I have to use a rich rule with "protocol value="?

Any idea?

Thanks,

Benjamin Lefoul
nWISE AB

[Thomas Woerner]

Hello Benjamin,

On 04/01/2016 12:29 PM, Benjamin Lefoul wrote:
> Hi!
>
> I have inherited a system using the following in order to prevent 
> SIPVicious attacks:
>
> iptables -I INPUT -p udp --dport 5060 -m string --string 
> "friendly-scanner" --algo bm -j DROP
> iptables -I INPUT -p tcp --dport 5060 -m string --string 
> "friendly-scanner" --algo bm -j DROP
>
> Now that we are migrating to firewalld, I am not quite sure how to 
> translate this into the firewalld semantics.
>
> Do I have to use a rich rule with "protocol value="?
>
> Any idea?

As the string extension is not usable by firewalld, there is no way to 
add this in a rich rule. But it is possible to add direct rules for 
this. Direct rules can (since version 0.4.0) also be added to zones by 
using zone chains for the direct rules like for example IN_public_log, 
IN_public_deny and IN_public_allow. There is no automatism to select the 
proper chain by rule settings like table, chain and target yet.

In your case the proper chain should be IN_public_deny if you want to 
add the rule to the public zone only. Otherwise you could simply use 
INPUT_direct. Add the rule also in the permanent environment to have it 
also after reboot or restart of the service.
> Thanks,
>
> Benjamin Lefoul
> nWISE AB
>
> firewalld-users mailing list
> [e-mail]
> https://lists.fedorahosted.org/admin/lists/[e-mail]...

Regards,
Thomas

[Benjamin Lefoul]

________________________________________
From: Thomas Woerner 
Sent: 01 April 2016 15:11
To: Firewalld users discussion list
Subject: Re: SIPVicious attacks: Migration from iptables-extensions

Hello Benjamin,

On 04/01/2016 12:29 PM, Benjamin Lefoul wrote:
> Hi!
>
> I have inherited a system using the following in order to prevent
> SIPVicious attacks:
>
> iptables -I INPUT -p udp --dport 5060 -m string --string
> "friendly-scanner" --algo bm -j DROP
> iptables -I INPUT -p tcp --dport 5060 -m string --string
> "friendly-scanner" --algo bm -j DROP
>
> Now that we are migrating to firewalld, I am not quite sure how to
> translate this into the firewalld semantics.
>
> Do I have to use a rich rule with "protocol value="?
>
> Any idea?

As the string extension is not usable by firewalld, there is no way to
add this in a rich rule. But it is possible to add direct rules for
this. Direct rules can (since version 0.4.0) also be added to zones by
using zone chains for the direct rules like for example IN_public_log,
IN_public_deny and IN_public_allow. There is no automatism to select the
proper chain by rule settings like table, chain and target yet.

In your case the proper chain should be IN_public_deny if you want to
add the rule to the public zone only. Otherwise you could simply use
INPUT_direct. Add the rule also in the permanent environment to have it
also after reboot or restart of the service.
> Thanks,
>
> Benjamin Lefoul
> nWISE AB
>
> firewalld-users mailing list
> [e-mail]
> https://lists.fedorahosted.org/admin/lists/[e-mail]...

Regards,
Thomas
_______________________________________________
firewalld-users mailing list
[e-mail]
https://lists.fedorahosted.org/admin/lists/[e-mail]...

Hi all, and Thomas thanks for your response a week ago.

Regarding the original question: How would such a direct rule be formatted in the XML? Could this be done with a module in a service file?
Regarding zones, chains and default targets, we are so confused. All the doc seems to take it for granted that we know what a chain is.

For instance, according to man firewalld.zone:

target="ACCEPT|%%REJECT%%|DROP"
           Can be used to accept, reject or drop every packet. The ACCEPT target is used in the trusted
           zone, every packet will be accepted. The %%REJECT%% target is used in the block zone, every
           packet will be rejected with the default firewalld reject type. The DROP target is used in
           the drop zone, every packet will be dropped. The default target is {chain}_ZONE_{zone} and
           will be used if the target is not specified. If other than the default target is used, all
           settings except interface and source are ignored, because the first rule created in firewall
           for this zone is 'jump to target'.

What does "{chain}_ZONE_{zone}" mean? And if all settings except "interface" and "source" are ignored when target is set to "ACCEPT", why is it that "forward-port" seems to be working fine? (oh and, why the percentages around "REJECT"?)

Thanks in advance,

Benjamin