On Wed, 2006-10-04 at 18:57 -0700, Ryan Tandy wrote:
> Michael Sullivan wrote:
> > I'm having a problem with ipkungfu on one of my boxes.  According to the
> > log files, it's running, but it doesn't seem to be firewall-ing.  It's
> > not working on 192.168.1.2.  Here's nmap output from 192.168.1.3:
> > 
> > camille ~ # nmap -sT -PT 192.168.1.2
> > 
> > Starting Nmap 4.01 ( http://www.insecure.org/nmap/ ) at 2006-10-04 20:39
> > CDT
> > Interesting ports on bullet.espersunited.com (192.168.1.2):
> > (The 1657 ports scanned but not shown below are in state: closed)
> > PORT     STATE SERVICE
> > 21/tcp   open  ftp
> > 22/tcp   open  ssh
> > 25/tcp   open  smtp
> > 53/tcp   open  domain
> > 80/tcp   open  http
> > 111/tcp  open  rpcbind
> > 139/tcp  open  netbios-ssn
> > 143/tcp  open  imap
> > 445/tcp  open  microsoft-ds
> > 587/tcp  open  submission
> > 631/tcp  open  ipp
> > 746/tcp  open  unknown
> > 993/tcp  open  imaps
> > 2049/tcp open  nfs
> > 3632/tcp open  distccd
> > MAC Address: 00:10:4B:73:8E:81 (3com)
> > 
> > Nmap finished: 1 IP address (1 host up) scanned in 0.597 seconds
> > 
> 
> OK.  What does iptables -L report?  Is iptables in your default 
> runlevel? (hint: it shouldn't be.)  If iptables is being started after 
> ipkungfu for some reason, it may be overwriting ipkungfu's iptables 
> rules with its saved (blank) ruleset.  Try 'rc-update del iptables && 
> reboot' if iptables is present in any runlevels.  When you start 
> ipkungfu, are there any error messages?

bullet ipkungfu # iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere            state
RELATED,ESTABLISHED
LOG        all  --  0.0.0.1              anywhere            LOG level
warning prefix `IPKF IPKungFu (--init)'
DROP       all  --  125.250.19.90        anywhere
DROP       all  --  abo-140-170-68.bab.modulonet.fr  anywhere
DROP       all  --  220.163.199.101      anywhere
DROP       all  --  217.10.189.30        anywhere
ACCEPT     all  --  bullet.espersunited.com  anywhere
ACCEPT     all  --  camille.espersunited.com  anywhere
ACCEPT     all  --  catherine.espersunited.com  anywhere
ACCEPT     all  --  bubbles.espersonline.com  anywhere
ACCEPT     all  --  192.168.1.101        anywhere
ACCEPT     all  --  192.168.1.102        anywhere
ACCEPT     all  --  192.168.1.103        anywhere
DROP       all  --  anywhere             anywhere            recent:
CHECK seconds: 120 name: badguy side: source
LOG        tcp  --  anywhere             anywhere            tcp
flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,PSH,ACK,URG limit: avg 3/sec
burst 5 LOG level warning prefix `IPKF flags ALL: '
LOG        tcp  --  anywhere             anywhere            tcp
flags:FIN,SYN,RST,PSH,ACK,URG/NONE limit: avg 3/sec burst 5 LOG level
warning prefix `IPKF flags NONE: '
LOG        tcp  --  anywhere             anywhere            tcp
flags:FIN,SYN,RST,PSH,ACK,URG/FIN,PSH,URG limit: avg 3/sec burst 5 LOG
level warning prefix `IPKF PORTSCAN (nmap XMAS): '
LOG        tcp  --  anywhere             anywhere            tcp
flags:FIN,SYN,RST,PSH,ACK,URG/FIN limit: avg 3/sec burst 5 LOG level
warning prefix `IPKF PORTSCAN (nmap FIN): '
LOG        tcp  --  anywhere             anywhere            tcp
flags:FIN,SYN/FIN,SYN limit: avg 3/sec burst 5 LOG level warning prefix
`IPKF flags SYN,FIN: '
LOG        tcp  --  anywhere             anywhere            tcp
flags:SYN,RST/SYN,RST limit: avg 3/sec burst 5 LOG level warning prefix
`IPKF flags SYN,RST: '
LOG        tcp  --  anywhere             anywhere            tcp
flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,ACK,URG limit: avg 3/sec burst
5 LOG level warning prefix `IPKF SYN,RST,ACK,FIN,URG: '
LOG        tcp  --  anywhere             anywhere            tcp
flags:FIN,SYN,RST,PSH,ACK,URG/NONE limit: avg 3/sec burst 5 LOG level
warning prefix `IPKF PORTSCAN (nmap NULL): '
DROP       tcp  --  anywhere             anywhere            tcp
flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,ACK,URG
DROP       tcp  --  anywhere             anywhere            tcp
flags:FIN,SYN,RST,PSH,ACK,URG/NONE
DROP       tcp  --  anywhere             anywhere            tcp
flags:FIN,SYN/FIN,SYN
DROP       tcp  --  anywhere             anywhere            tcp
flags:SYN,RST/SYN,RST
DROP       tcp  --  anywhere             anywhere            tcp
flags:FIN,SYN,RST,PSH,ACK,URG/FIN,PSH,URG
DROP       tcp  --  anywhere             anywhere            tcp
flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,PSH,ACK,URG
DROP       tcp  --  anywhere             anywhere            tcp
flags:FIN,SYN,RST,PSH,ACK,URG/FIN
DROP       tcp  --  anywhere             anywhere            tcp
flags:FIN,SYN,RST,PSH,ACK,URG/NONE
ACCEPT     icmp --  anywhere             anywhere            icmp
echo-request
LOG        all  --  anywhere             anywhere            state
INVALID limit: avg 3/sec burst 5 LOG level warning prefix `IPKF Invalid
TCP flag: '
DROP       all  --  anywhere             anywhere            state
INVALID
LOG        all  -f  anywhere             anywhere            limit: avg
3/sec burst 5 LOG level warning prefix `IPKF Fragmented Packet: '
DROP       all  -f  anywhere             anywhere
LOG        icmp --  anywhere             anywhere            icmp
timestamp-request limit: avg 3/sec burst 5 LOG level warning prefix
`IPKF ICMP Timestamp: '
DROP       icmp --  anywhere             anywhere            icmp
timestamp-request
syn-flood  tcp  --  anywhere             anywhere            tcp
flags:FIN,SYN,RST,ACK/SYN
LOG        tcp  --  anywhere             anywhere            tcp flags:!
SYN,RST,ACK/SYN state NEW limit: avg 3/sec burst 5 LOG level warning
prefix `IPKF New Not SYN: '
DROP       tcp  --  anywhere             anywhere            tcp flags:!
SYN,RST,ACK/SYN state NEW
DROP       tcp  --  anywhere             anywhere            multiport
dports netbios-ns,6666
DROP       udp  --  anywhere             anywhere            multiport
dports ms-sql-m
ACCEPT     tcp  --  anywhere             anywhere            state NEW
multiport dports ftp,ssh,smtp,http
ACCEPT     all  --  anywhere             anywhere            state NEW
ACCEPT     all  --  192.168.1.0/24       anywhere            state NEW
REJECT     tcp  --  anywhere             anywhere            tcp
dpt:auth reject-with tcp-reset
LOG       !icmp --  anywhere             anywhere            limit: avg
3/sec burst 5 LOG level warning prefix `IPKF INPUT Catch-all: '
DROP       all  --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere            state
RELATED,ESTABLISHED
ACCEPT     all  --  bullet.espersunited.com  anywhere
ACCEPT     all  --  camille.espersunited.com  anywhere
ACCEPT     all  --  catherine.espersunited.com  anywhere
ACCEPT     all  --  bubbles.espersonline.com  anywhere
ACCEPT     all  --  192.168.1.101        anywhere
ACCEPT     all  --  192.168.1.102        anywhere
ACCEPT     all  --  192.168.1.103        anywhere
DROP       all  --  anywhere             anywhere            recent:
CHECK seconds: 120 name: badguy side: source
LOG        tcp  --  anywhere             anywhere            tcp
flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,PSH,ACK,URG limit: avg 3/sec
burst 5 LOG level warning prefix `IPKF flags ALL: '
LOG        tcp  --  anywhere             anywhere            tcp
flags:FIN,SYN,RST,PSH,ACK,URG/NONE limit: avg 3/sec burst 5 LOG level
warning prefix `IPKF flags NONE: '
LOG        tcp  --  anywhere             anywhere            tcp
flags:FIN,SYN,RST,PSH,ACK,URG/FIN,PSH,URG limit: avg 3/sec burst 5 LOG
level warning prefix `IPKF flags FIN,URG,PSH: '
LOG        tcp  --  anywhere             anywhere            tcp
flags:FIN,SYN,RST,PSH,ACK,URG/FIN limit: avg 3/sec burst 5 LOG level
warning prefix `IPKF PORTSCAN (nmap XMAS): '
LOG        tcp  --  anywhere             anywhere            tcp
flags:FIN,SYN/FIN,SYN limit: avg 3/sec burst 5 LOG level warning prefix
`IPKF flags SYN,FIN: '
LOG        tcp  --  anywhere             anywhere            tcp
flags:SYN,RST/SYN,RST limit: avg 3/sec burst 5 LOG level warning prefix
`IPKF flags SYN,RST: '
LOG        tcp  --  anywhere             anywhere            tcp
flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,ACK,URG limit: avg 3/sec burst
5 LOG level warning prefix `IPKF SYN,RST,ACK,FIN,URG: '
LOG        tcp  --  anywhere             anywhere            tcp
flags:FIN,SYN,RST,PSH,ACK,URG/NONE limit: avg 3/sec burst 5 LOG level
warning prefix `IPKF PORTSCAN (nmap NULL): '
DROP       tcp  --  anywhere             anywhere            tcp
flags:FIN,SYN,RST,PSH,ACK,URG/NONE
DROP       tcp  --  anywhere             anywhere            tcp
flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,ACK,URG
DROP       tcp  --  anywhere             anywhere            tcp
flags:FIN,SYN,RST,PSH,ACK,URG/NONE
DROP       tcp  --  anywhere             anywhere            tcp
flags:FIN,SYN/FIN,SYN
DROP       tcp  --  anywhere             anywhere            tcp
flags:SYN,RST/SYN,RST
DROP       tcp  --  anywhere             anywhere            tcp
flags:FIN,SYN,RST,PSH,ACK,URG/FIN,PSH,URG
DROP       tcp  --  anywhere             anywhere            tcp
flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,PSH,ACK,URG
DROP       tcp  --  anywhere             anywhere            tcp
flags:FIN,SYN,RST,PSH,ACK,URG/FIN
LOG        all  --  anywhere             anywhere            state
INVALID limit: avg 3/sec burst 5 LOG level warning prefix `IPKF Invalid
TCP flag: '
DROP       all  --  anywhere             anywhere            state
INVALID
LOG        all  -f  anywhere             anywhere            limit: avg
3/sec burst 5 LOG level warning prefix `IPKF Fragmented Packet: '
DROP       all  -f  anywhere             anywhere
LOG        icmp --  anywhere             anywhere            icmp
timestamp-request limit: avg 3/sec burst 5 LOG level warning prefix
`IPKF ICMP Timestamp: '
DROP       icmp --  anywhere             anywhere            icmp
timestamp-request
syn-flood  tcp  --  anywhere             anywhere            tcp
flags:FIN,SYN,RST,ACK/SYN
LOG        tcp  --  anywhere             anywhere            tcp flags:!
SYN,RST,ACK/SYN state NEW limit: avg 3/sec burst 5 LOG level warning
prefix `IPKF New Not SYN: '
DROP       tcp  --  anywhere             anywhere            tcp flags:!
SYN,RST,ACK/SYN state NEW
DROP       tcp  --  anywhere             anywhere            multiport
dports netbios-ns,6666
DROP       udp  --  anywhere             anywhere            multiport
dports ms-sql-m
REJECT     tcp  --  anywhere             anywhere            tcp
dpt:auth reject-with tcp-reset

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere            state
RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere            state NEW

Chain syn-flood (2 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere            limit: avg
10/sec burst 24
LOG        all  --  anywhere             anywhere            limit: avg
3/sec burst 5 LOG level warning prefix `IPKF SYN flood: '
DROP       all  --  anywhere             anywhere
bullet ipkungfu # rc-update show | grep 'iptables'
bullet ipkungfu # /etc/init.d/ipkungfu restart
 * Stopping ipkungfu ...
Stopping ipkungfu:                                              [  OK  ]
[ ok ] * Starting ipkungfu ...
[ ok ]bullet ipkungfu #

And I can still detect all those ports open from nmap on another
machine.

-- 
gentoo-user@gentoo.org mailing list

Reply via email to