Link to home
Start Free TrialLog in
Avatar of ltpitt
ltpitt

asked on

I'm sending through my Linux Proxy / Gateway port scans to public ips

I got an email with this content:

>MYSERVERIP was observed probing AGUYWEBSITE for security holes. It
>has been blocked at our border routers. It may be compromised.
>
>For more info contact THEGUY
>Please include the entire subject line of the original message
>
>     THEGUY
>
>(time zone of log is PST, which is UTC-08:00, date is MMDD)
>log entries are from Cisco netflow, time is flow start time
>date.time         srcIP          srcPort dstIP          dstPort proto
>#pkts
>0225.13:47:49.302 MYSERVERIP   3876 HISSERVERIP        445    6
>2
>0225.14:03:35.086 MYSERVERIP   2875 HISSERVERIP      445    6
>2

-SNIP-

My LAN connects to the internet using a Debian Firewall / Gateway / Proxy.

How can I track down where's the problem?
Avatar of giltjr
giltjr
Flag of United States of America image

Well first of all is there any reason why you would want to allow traffic destine for TCP port 445 out of your network?  That is used for MS networking which typically you don't do over the Internet.

If there is no reason to, then I would just block it.

However, to find out what might be doing that, just run tcpdump on your linux box capturing anything that has a destination of TCP port 445.

Best bet is to allow it to run for awhile so

nohup tcpdump -i "insideinterface" -s 0 tcp port 445 -w filename.cap &

Where "insideinterface" is the NIC that is on the "inside" of your proxy.  Do not include the quotes.

Let it run for awhile then kill the pid, and use Wireshark to look at the file
Avatar of ltpitt
ltpitt

ASKER

This is really what I needed!

Can you please suggest me how to block all ports but 80?

I will try the other suggestion but the 1st sounds the best idea.
Are you really running a proxy on the Linux box, like Squid, or is it just a "router/gateway" that is doing NAT'ing.
Avatar of ltpitt

ASKER

Both.

Clients use squid for internet but also need to get to other services (pop3, smtp, other stuff)
O.K. going through squid will stop most other protocols/services.

For the other services you need to setup IP tables properly.   Can you post your iptables configuration?  If you have any public IP addresses directly on this Linux box make sure you hid them, just "x" out the first three octets.
Avatar of ltpitt

ASKER

Here's my firewall script:

#!/bin/sh

PATH=/usr/sbin:/sbin:/bin:/usr/bin

#
# delete all existing rules.
#
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X

# Always accept loopback traffic
iptables -A INPUT -i lo -j ACCEPT

# Allow established connections, and those not coming from the outside
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state NEW -i ! eth1 -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow outgoing connections from the LAN side.
iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT

# Masquerade.
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

# Enable routing.
echo 1 > /proc/sys/net/ipv4/ip_forward

# Blacklist
iptables -A OUTPUT -d 82.112.106.19/24 -j DROP
iptables -A OUTPUT -d 149.20.56.0/24 -j DROP
iptables -A OUTPUT -d 38.102.150.27/24 -j DROP

Open in new window

What traffic MUST you allow through other than http/https?
Oh and is there any traffic that you must allow TO the Linux box.

 Example:  You will need to allow ssh to the Linux box, but you may not need to allow ssh through it.
Avatar of ltpitt

ASKER

Main problem is to allow users to use internet and email.

Of course problems will come and if you can be so kind to give an example about how to enable rules I'd be very thankful :)
By Internet I am assuming you mean to access web servers, http and https, which should be handled by Squid.

For e-mail, I would need to know more details.  What e-mail clients do they use and what type of e-mail servers?  Do they need pop3, imap, smtp?  Do any of them need to be encrypted.
ASKER CERTIFIED SOLUTION
Avatar of giltjr
giltjr
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial