IPCop Firewall

--- James Taylor <james_n_taylor@...> wrote:
> Added to /etc/rc.d/rc.local the usual ICMP
> echo-request drop rule (I already
> have /sbin/iptables -F CUSTOMINPUT at top of file)
> 
> /sbin/iptables -A CUSTOMINPUT -i $RED_DEV -p icmp
> --icmp-type echo-request -j
> DROP
> 
> and # in front of the specific rule in
> /etc/snort/icmp.rules file.
> 
> Regards
> James

i just added 
/sbin/iptables -A CUSTOMINPUT -i $RED_DEV -p icmp
--icmp-type echo-request -j DROP
to my rc.local and when i run './rc.local', i get a
message saying -p icmp is not a valid protocol. A
search in this list tells me that Chris Meller had
this problem previously. But that thread does not
offer a solution.

what am i doing wrong?
what is the best way to block/drop these annoying icmp packets?

__________________________________
Do you Yahoo!?
Yahoo! SiteBuilder - Free, easy-to-use web site design software
http://sitebuilder.yahoo.com

see also http://www.linuxguruz.org/iptables/scripts/rc.firewall_008.txt
at http://www.linuxguruz.com/iptables/

the .txt file references:
iptables -A ICMP -p icmp --icmp-type echo-request -j WATCH
drop your -i $RED_DEV

I'll also try this tomorrow when I'm awake.  :)
paul


nishark wrote:
> --- James Taylor <james_n_taylor@...> wrote:
> 
>>Added to /etc/rc.d/rc.local the usual ICMP
>>echo-request drop rule (I already
>>have /sbin/iptables -F CUSTOMINPUT at top of file)
>>
>>/sbin/iptables -A CUSTOMINPUT -i $RED_DEV -p icmp
>>--icmp-type echo-request -j
>>DROP
>>
>>and # in front of the specific rule in
>>/etc/snort/icmp.rules file.
>>
>>Regards
>>James
> 
> 
> i just added 
> /sbin/iptables -A CUSTOMINPUT -i $RED_DEV -p icmp
> --icmp-type echo-request -j DROP
> to my rc.local and when i run './rc.local', i get a
> message saying -p icmp is not a valid protocol. A
> search in this list tells me that Chris Meller had
> this problem previously. But that thread does not
> offer a solution.
> 
> what am i doing wrong?
> what is the best way to block/drop these annoying icmp packets?
>

--- paul van allsburg <paulvan@...> wrote:
> see also http://www.linuxguruz.org/iptables/scripts/rc.firewall_008.txt
> at http://www.linuxguruz.com/iptables/
> 
> the .txt file references:
> iptables -A ICMP -p icmp --icmp-type echo-request -j WATCH
> drop your -i $RED_DEV
> 
> I'll also try this tomorrow when I'm awake.  :)
> paul
> 

So 'ICMP not valid' was a false message, sorry I thought RED_DEV was already
defined elsewhere. See previous message to define Red interface in rc.local -
should you only want to drop ICMP on the external interface.

JT

__________________________________
Do you Yahoo!?
Yahoo! SiteBuilder - Free, easy-to-use web site design software
http://sitebuilder.yahoo.com

> ATTACHMENT part 3.4 message/rfc822 
> Date: Tue, 19 Aug 2003 03:09:21 -0700 (PDT)
> From: nishark <n1shark@...>
> Subject: Re: [IPCop-user] Re: IDS log entries for ICMP PING CyberKit 2.2
> from...
> To: James Taylor <james_n_taylor@...>, ipcop-user@...
> 
> --- James Taylor <james_n_taylor@...> wrote:
> > Added to /etc/rc.d/rc.local the usual ICMP
> > echo-request drop rule (I already
> > have /sbin/iptables -F CUSTOMINPUT at top of file)
> > 
> > /sbin/iptables -A CUSTOMINPUT -i $RED_DEV -p icmp
> > --icmp-type echo-request -j
> > DROP
> > 
> > and # in front of the specific rule in
> > /etc/snort/icmp.rules file.
> > 
> > Regards
> > James
> 
> i just added 
> /sbin/iptables -A CUSTOMINPUT -i $RED_DEV -p icmp
> --icmp-type echo-request -j DROP
> to my rc.local and when i run './rc.local', i get a
> message saying -p icmp is not a valid protocol. A
> search in this list tells me that Chris Meller had
> this problem previously. But that thread does not
> offer a solution.

> 
> what am i doing wrong?

Not too sure why not as mine works - and this is the standard rule for blocking
Pings.... Perhaps some details would help? What version IPCop? What does the
rc.local look like? Did you edit the file on a windows machine? What does
'iptables -L' give you? What about the exact error message? Do you have any
other rules in rc.local that work? Sounds to me like a syntax error as icmp is,
of course, a valid protocol.

My rc.local looks like this...

***********
#!/bin/sh

# Define Red IFace IP
RED_IF=`/bin/cat /var/ipcop/red/iface | /usr/bin/tr -d '\012'`

# Custom Input Chain
/sbin/iptables -F CUSTOMINPUT

# Block ICMP echo-request (Ping) on RED due to Nachi Worm
/sbin/iptables -A CUSTOMINPUT -i $RED_IF -p icmp --icmp-type echo-request -j
DROP

**********
But '$RED_DEV' should work...

JT

__________________________________
Do you Yahoo!?
Yahoo! SiteBuilder - Free, easy-to-use web site design software
http://sitebuilder.yahoo.com

--- paul van allsburg <paulvan@...> wrote:
> see also
>
http://www.linuxguruz.org/iptables/scripts/rc.firewall_008.txt
> at http://www.linuxguruz.com/iptables/
> 
> the .txt file references:
> iptables -A ICMP -p icmp --icmp-type echo-request -j
> WATCH
> drop your -i $RED_DEV
> 

ok, here's what my /etc/rc.local file looks like

---
#!/bin/sh
/sbin/iptables -A CUSTOMINPUT
/sbin/iptables -A ICMP -p icmp --icmp-type
echo-request -j WATCH
---

and this is what i'm getting when i run ./rc.local
---
iptables v1.2.7a: Couldn't load target
`WATCH':/lib/iptables/libipt_WATCH.so: cannot open
shared object file: No such file or directory
---

what's missing where? please bear with me, as i'm not
versed with the intricacies of linux and as much i
would've liked to learn about iptables, i just dont
have enuf time right now... thanks all.

__________________________________
Do you Yahoo!?
Yahoo! SiteBuilder - Free, easy-to-use web site design software
http://sitebuilder.yahoo.com

--- James Taylor <james_n_taylor@...> wrote:
> Perhaps some details would help? What
> version IPCop? What does the
> rc.local look like? Did you edit the file on a
> windows machine? What does
> 'iptables -L' give you? What about the exact error
> message? Do you have any
> other rules in rc.local that work? Sounds to me like
> a syntax error as icmp is,
> of course, a valid protocol.
> 
> My rc.local looks like this...
> 
> ***********
> #!/bin/sh
> 
> # Define Red IFace IP
> RED_IF=`/bin/cat /var/ipcop/red/iface | /usr/bin/tr
> -d '\012'`
> 
> # Custom Input Chain
> /sbin/iptables -F CUSTOMINPUT
> 
> # Block ICMP echo-request (Ping) on RED due to Nachi
> Worm
> /sbin/iptables -A CUSTOMINPUT -i $RED_IF -p icmp
> --icmp-type echo-request -j
> DROP
> 
> **********
> But '$RED_DEV' should work...
> 
> JT

--> using version 1.3.0
--> edited rc.local on the ipcop pc, that is i still
have a monitor and keyboard plugged into the ipcop pc,
i logged in there as root and edited the file
--> i pasted the rc.local file and the exact error
message in another post
--> iptables -L gives me a lot of info. what specific
info would u like? 
Chain INPUT (policy DROP) has something like
ACCEPT icmp -- anywhere anywhere

let me know if more info is required

__________________________________
Do you Yahoo!?
Yahoo! SiteBuilder - Free, easy-to-use web site design software
http://sitebuilder.yahoo.com

** wrong sender address on my previous mail **

Hi James

I tried your additions to rc.local too, but doesn't work here either.
Runnin ipcop 1.3.0 with fixes up to 3 installed.

Guy


On Wed, 2003-08-20 at 05:29, James Taylor wrote:
> --- paul van allsburg <paulvan@...> wrote:
> > see also http://www.linuxguruz.org/iptables/scripts/rc.firewall_008.txt
> > at http://www.linuxguruz.com/iptables/
> > 
> > the .txt file references:
> > iptables -A ICMP -p icmp --icmp-type echo-request -j WATCH
> > drop your -i $RED_DEV
> > 
> > I'll also try this tomorrow when I'm awake.  :)
> > paul
> > 
> 
> So 'ICMP not valid' was a false message, sorry I thought RED_DEV was already
> defined elsewhere. See previous message to define Red interface in rc.local -
> should you only want to drop ICMP on the external interface.
> 
> JT
> 
> __________________________________
> Do you Yahoo!?
> Yahoo! SiteBuilder - Free, easy-to-use web site design software
> http://sitebuilder.yahoo.com
> 
> 
> -------------------------------------------------------
> This SF.net email is sponsored by Dice.com.
> Did you know that Dice has over 25,000 tech jobs available today? From
> careers in IT to Engineering to Tech Sales, Dice has tech jobs from the
> best hiring companies. http://www.dice.com/index.epl?rel_code=104
> _______________________________________________
> IPCop-user mailing list
> IPCop-user@...
> https://lists.sourceforge.net/lists/listinfo/ipcop-user
-- 
Guy Van Sanden <gvs@...>

Is anyone seeing any reduction in this activity yet ?? 

I am not. Hits are now up to 50 an hour and internet performance is C**P
!
I just wonder how long it wil be before there becomes a significant DoS
if this continues.