Iptables: DNAT

DNAT stands for Destination NAT. It is a type of NAT. The other one is SNAT which stands for Source NAT. What's the difference I hear you ask. Good question! :) DNAT changes destination of relevant packets. SNAT changes the source of relevant packets. Last week, my boss asked me to open an internal system in order to be accessed publicly.

Let's say my internal system server's IP is 192.168.2.123 and the system is a web-based system (port 80). It is behind a firewall which has a public IP say 111.222.333.444. To access the internal system from internet, the firewall IP should be used as a gateway to reach the internal system server.

Internet ----> Firewall ----> Internal system

I want to make any packets destined to port 3256 on firewall should be NAT'ed to internal system server on port 80. So the DNAT in firewall is:

iptables -t nat -I PREROUTING -s ! 192.168.2.0/24 -p tcp --dport 3256 -j DNAT --to 192.168.2.123:80

There you go. All packets destined to firewall on port 3256 will be redirected to internal system server on port 80. There are other ways to achieve this using other tools like xinetd but I leave that one for exercise for readers. :)

fail2ban - Yet another tool to protect your server

What is Fail2ban?

Fail2ban scans log files like /var/log/auth.log or /var/log/apache/error_log and bans IP that makes too many password failures. It updates firewall rules to reject the IP address. These rules can be defined by the user. Fail2ban can read multiple log files such as sshd or Apache web server ones. You need python >= 2.3, gamin >= 0.0.21 (optional) and one of these : iptables, shorewall or tcpwrapper.

What does the version number of Fail2ban mean?

The structure of the version number is major.minor.revision. Currently the major number is 0. The policy for minor is:

• odd numbers (0.5, 0.7, etc) are development versions.
• even numbers (0.6, 0.8, etc) are stable versions.

Fail2ban is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

Where can I get it?

fail2ban source can be downloaded from here. Distro-specific packages can be downloaded from http://www.fail2ban.org/wiki/index.php/Downloads. You might want to try using package manager first. It might be in your distros repositories. Chances are it is the older version. That's why I like to install from source :). For debianista, apt-get install fail2ban will take care of it.

Installation

As of this writing, the latest version is 0.8.1.
1. Extracting : tar xjvf fail2ban-0.8.1.tar.bz2
2. cd fail2ban-0.8.1
3. python setup.py install

This will install Fail2Ban into /usr/share/fail2ban. The executable scripts are placed into /usr/bin.

Fail2Ban should be correctly installed now. Just type:

fail2ban-client -h

to see if everything is alright. You should always use fail2ban-client and never call fail2ban-server directly. UPDATE: to be able to activate and control fail2ban server, you need to copy init file specific for your distro in fail2ban-0.8.1/files directory. For Mandriva, you can use RedHat one. Copy file redhat-initd to /etc/init.d directory :

cp redhat-initd /etc/init.d/fail2ban

There are also init files for SuSe and Gentoo.

Configuration

1. Edit file /etc/fail2ban/fail2ban.conf using your favorite editor. I used joe for it. So:

cd /etc/fail2ban
joe fail2ban.conf

In this file, you may want to increase the loglevel to 4 for more verbose log for troubleshooting purposes.

2. Edit file /etc/fail2ban/jail.conf
joe jail.conf

In this file, uncomment sections that you want to activate and change enabled = false to enabled = true. Say, you want fail2ban to monitor port 22 (ssh) for login attempts :

[ssh-iptables]
enabled = true
filter = sshd
action = iptables[name=SSH, port=ssh, protocol=tcp]
# sendmail-whois[name=SSH, dest=you@mail.com, sender=fail2ban@mail.com]
logpath = /var/log/auth.log
maxretry = 4

There are many sections in there for monitoring other ports like ftp, http, etc. It's up to you to monitor which ports. Just uncomment the sections you want and change enabled = true to activate in those sections. If you want to be notified, uncomment the commented line above and replace your email address for dest (and for sender too to reflect your system mails). I change the log path to /var/log/auth.log because this is the authentication log for my system. Change it accordingly for your system. All fail2ban actions are logged and can be reviewed by tail /var/log/fail2ban.log. Example of fail2ban.log on my system:

-- START --
2007-10-26 00:24:56,880 fail2ban.filter : DEBUG /var/log/auth.log has been modified
2007-10-26 00:24:56,880 fail2ban.filter : DEBUG Opened /var/log/auth.log
2007-10-26 00:24:56,881 fail2ban.filter : DEBUG Setting file position to 783921 for /var/log/auth.log
2007-10-26 00:24:56,882 fail2ban.filter : DEBUG Found 200.32.73.4
2007-10-26 00:24:56,883 fail2ban.filter : DEBUG Found 200.32.73.4
2007-10-26 00:24:56,883 fail2ban.filter.datedetector: DEBUG Sorting the template list
2007-10-26 00:24:57,868 fail2ban.actions: WARNING [ssh-iptables] Ban 200.32.73.4
2007-10-26 00:24:57,868 fail2ban.actions.action: DEBUG iptables -n -L INPUT | grep -q fail2ban-SSH
2007-10-26 00:24:57,886 fail2ban.actions.action: DEBUG iptables -n -L INPUT | grep -q fail2ban-SSH returned successfully
2007-10-26 00:24:57,886 fail2ban.actions.action: DEBUG iptables -I fail2ban-SSH 1 -s 200.32.73.4 -j DROP
2007-10-26 00:24:57,891 fail2ban.actions.action: DEBUG iptables -I fail2ban-SSH 1 -s 200.32.73.4 -j DROP returned successfully
2007-10-26 00:26:57,873 fail2ban.filter : DEBUG /var/log/auth.log has been modified
2007-10-26 00:26:57,873 fail2ban.filter : DEBUG Opened /var/log/auth.log
2007-10-26 00:26:57,874 fail2ban.filter : DEBUG Setting file position to 784190 for /var/log/auth.log
2007-10-26 00:26:57,875 fail2ban.filter.datedetector: DEBUG Sorting the template list
2007-10-26 00:34:58,860 fail2ban.actions: WARNING [ssh-iptables] Unban 200.32.73.4
2007-10-26 00:34:58,860 fail2ban.actions.action: DEBUG iptables -n -L INPUT | grep -q fail2ban-SSH
2007-10-26 00:34:58,867 fail2ban.actions.action: DEBUG iptables -n -L INPUT | grep -q fail2ban-SSH returned successfully
2007-10-26 00:34:58,867 fail2ban.actions.action: DEBUG iptables -D fail2ban-SSH -s 200.32.73.4 -j DROP
2007-10-26 00:34:58,872 fail2ban.actions.action: DEBUG iptables -D fail2ban-SSH -s 200.32.73.4 -j DROP returned successfully
2007-10-26 06:07:39,998 fail2ban.filter : DEBUG /var/log/auth.log has been modified
2007-10-26 06:07:39,998 fail2ban.filter : DEBUG Opened /var/log/auth.log
2007-10-26 06:07:39,999 fail2ban.filter : DEBUG Setting file position to 784279 for /var/log/auth.log
2007-10-26 06:07:40,000 fail2ban.filter.datedetector: DEBUG Sorting the template list
2007-10-26 11:23:50,076 fail2ban.filter : DEBUG /var/log/auth.log has been modified
2007-10-26 11:23:50,087 fail2ban.filter : DEBUG Opened /var/log/auth.log
2007-10-26 11:23:50,116 fail2ban.filter : DEBUG Setting file position to 784372 for /var/log/auth.log
2007-10-26 11:23:50,123 fail2ban.filter.datedetector: DEBUG Sorting the template list
-- End--

As you can see above, there's IP being banned by fail2ban by way of iptables and after a period of time, it will be unbanned. All these can be modified in /etc/fail2ban/jail.conf

To see whether the actions really happen, see iptables rules:

iptables -L -n

Chain INPUT (policy ACCEPT)
target prot opt source destination
fail2ban-SSH tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
REJECT all -- 85.185.250.20 0.0.0.0/0 reject-with icmp-port-unreachable

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Chain fail2ban-SSH (1 references)
target prot opt source destination
RETURN all -- 0.0.0.0/0 0.0.0.0/0

Please read the documentations in the tarball for latest updates and on how to configure it. With fail2ban, it is another weapon for system administrators to combat brute-force attacks. Enjoy :)

An encounter with VLAN

2 days ago, I helped my friend setting up internet connection for his office's LAN. As he showed me the network diagram, I realised that there are 6 VLAN that I need to cover to make them connect to the internet.

6 VLANS-->CORE SWITCH-->ROUTER+PROXY+DNS-->GATEWAY-->INTERNET

The problem was to get the clients in each VLAN to communicate each other and to communicate with router. All clients should also be able to access dhcp server located in one of the VLANS. After struggling about two days, I managed to get all clients in different VLANS talking to each other and the router. The problem was that I didn't understand how each VLAN talk to each other. The solution was located on coe switch. The commands below did the job:

route add -net 172.20.10.0 netmask 255.255.255.0 gw 172.20.30.254 eth0
route add -net 172.20.20.0 netmask 255.255.255.0 gw 172.20.30.254 eth0
route add -net 172.20.30.0 netmask 255.255.255.0 gw 172.20.30.254 eth0
route add -net 172.20.40.0 netmask 255.255.255.0 gw 172.20.30.254 eth0
route add -net 172.20.50.0 netmask 255.255.255.0 gw 172.20.30.254 eth0
route add -net 172.20.60.0 netmask 255.255.255.0 gw 172.20.30.254 eth0

If you can see above, the gateway is the same to be able all VLANs talking to each other and .30.254 is the gateway of the router.

route add default gw xxx.xxx.xxx.xxx

xxx.xxx.xxx.xxx is the gateway public IP (usually a modem). Don't forget that the router should enable ip forwarding. change it in /etc/sysctl.conf and run sysctl -p to make it effective. NAT and forward table really depends on it.

iptables and squid

I setup squid for faster internet access and save internet bandwidth. For each VLAN, we have to make rules.

iptables -t nat -A PREROUTING -s 172.20.10.0/24 -p tcp --dport 80 -j REDIRECT --to-ports 3128
iptables -t nat -A PREROUTING -s 172.20.20.0/24 -p tcp --dport 80 -j REDIRECT --to-ports 3128
iptables -t nat -A PREROUTING -s 172.20.30.0/24 -p tcp --dport 80 -j REDIRECT --to-ports 3128
iptables -t nat -A PREROUTING -s 172.20.40.0/24 -p tcp --dport 80 -j REDIRECT --to-ports 3128
iptables -t nat -A PREROUTING -s 172.20.50.0/24 -p tcp --dport 80 -j REDIRECT --to-ports 3128
iptables -t nat -A PREROUTING -s 172.20.60.0/24 -p tcp --dport 80 -j REDIRECT --to-ports 3128

Note that 3128 is the squid port.

That's it. Now the clients on every VLAN can access to the internet and communicate with each other.

squid and iptables - revisited

One of best combinations for internet connected LAN is squid, a proxy server and iptables, a packet filtering ruleset. To make it useful, this combination is used to configure transparent proxy for a LAN or more.

iptables -t nat -I PREROUTING -s 192.168.0.0/24 -p tcp --dport 80 -j REDIRECT --to-port 3128

Above command is for LAN (192.168.0.0/24) connecting to the internet via proxy server running on port 3128.

To make https proxied( it is not actually because we can't proxied encrypted packets but they are just forwarded), the command is as below :

iptables -t nat -I PREROUTING -s 192.168.0.0/24 -p tcp --dport 443 -j REDIRECT --to-port 3128

You can NOT do the same for ftp (port 21). For ftp, you have manually inserted the proxy address for ftp protocol in your browser connection setting.

By above command executed on a proxy server (a.k.a firewall), the PCs in the LAN need not be configured one by one to use the proxy server. Less work for system/network administrator :). They are said to be connected to the internet using proxy server transparently. Now you got it? :)

There's one more way to handle https connection. Instead of going through squid, you can also NAT it. Drop the above https command and use this :

iptables -t nat -I POSTROUTING -s 192.168.0.0/24 -p tcp --dport 443 -j SNAT --to 111.222.333.444

where 111.222.333.444 is your proxy server public IP address.

It is up to you which way you want to use. I can say that from my experience, there's no noticeable difference in terms of performance. If you do not agree, please do not hesitate to write comment and state your experience.

Setting up transparent proxy server

Hi all,

Today, while setting up ip for my internal network, i found out that i have run out of IPs and the internet access was very slow. I ran into a situation called "bottleneck". A situation where a road becomes narrow with heavy traffic. How to speed up this? The answer is proxy server.

On with the theory

Proxy server is a server that can cache visited web pages. Dynamic web pages are not cached. When a client access a website, the proxy server , on behalf of the client access the website and cache it. the next the client or other client wants to connect to the site, the proxy server just give the cached site to the client. Thus reducing the response time from the actual site.

Transparent proxy

In a normal proxy case, you have to set manually for each client to connect to outside. It is not a practical solution if you have a lot of workstations + many apps to connect to the internet. What is more practical solution? The answer is "transparent proxy" and now iptables comes into play.

What you have to do first?
1. Setup a server
OS : Linux (whatever flavor you want)
proxy server : Squid (install the latest one)
utilities : netfilter packages (for iptables)

Squid.conf

Your squid.conf location is dependent on how you install squid package. If u use source code and compile it without tweaking ./configure options, meaning it is in /usr/local/squid/etc. If you use your package manager, it is in /etc. Wherever it is, you have to edit it before you can use it as a transparent proxy.

What to edit
httpd_accel_host virtual
httpd_accel_port 80
httpd_accel_with_proxy on
httpd_accel_uses_host_header on
acl lan src 192.168.1.1 192.168.2.0/24
http_access allow localhost
http_access allow lan


Please change "lan" to suit your network environment. This file is heavily documented. Please read the comments before you change anything unless you know what you're doing.

I don't want to explain in detail on how to setup linux for your server. Please consult your spesific Linux distribution HOWTOs and FAQs. After you have complete setting up Linux, you should setup SQUID. More information on squid, pls visit http://www.squid-cache.org. squid usually readily packaged for your distro. You should check that first whether you can just install it from CD. If not, you have to download from the link above.

After you have edited squid.conf, this is the iptables command you should run on the proxy server.

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128

provided that your proxy server is using port 3128. If not, change it accordingly.