Aqui está a configuração:
iptables -A INPUT -p tcp --dport 8888 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 8888 -m state --state ESTABLISHED -j ACCEPT
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP
e os resultados para determinada configuração no dispositivo linux:
[root@jibe-eek /ecr]# iptables -L
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp dpt:8888 state NEW,ESTABLISHED
Chain FORWARD (policy DROP)
target prot opt source destination
Chain OUTPUT (policy DROP)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp spt:8888 state ESTABLISHED
[root@jibe-eek /ecr]#
Aqui está a varredura do nmap para esse dispositivo (eu examinei apenas as portas 8800-9000 para resposta rápida):
change@ubuntu ~$ sudo nmap -sS -sU -PN -O -p 8800-9000 192.168.20.196
Starting Nmap 5.21 ( http://nmap.org ) at 2017-02-01 08:49 EET
Nmap scan report for 192.168.20.196
Host is up (0.0011s latency).
Not shown: 201 open|filtered ports, 200 filtered ports
PORT STATE SERVICE
8888/tcp closed sun-answerbook
MAC Address: 9C:14:65:10:0F:C3 (Unknown)
Too many fingerprints match this host to give specific OS details
Network Distance: 1 hop
OS detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 9.97 seconds
change@ubuntu ~$
Como você vê, minha porta 8888 está aberta, mas quero torná-la aberta | filtrado. Existe uma maneira de fazer isso? Abaixo, você verá um exemplo de varredura do nmap do ubuntu.
Aqui está um exemplo do ubuntu computer nmap scan:
change@ubuntu ~$ sudo nmap -sS -sU -PN -O -p 8800-9000 192.168.20.251
Starting Nmap 5.21 ( http://nmap.org ) at 2017-01-31 16:59 EET
Nmap scan report for 192.168.20.251
Host is up (0.000048s latency).
All 402 scanned ports on 192.168.20.251 are closed
Too many fingerprints match this host to give specific OS details
Network Distance: 0 hops
OS detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 1.75 seconds
change@ubuntu ~$ sudo nmap -sS -sU -PN -O -p 1-9000 192.168.20.251
Starting Nmap 5.21 ( http://nmap.org ) at 2017-01-31 17:00 EET
Nmap scan report for 192.168.20.251
Host is up (0.000057s latency).
Not shown: 17992 closed ports
PORT STATE SERVICE
22/tcp open ssh
111/tcp open rpcbind
2049/tcp open nfs
68/udp open|filtered dhcpc
111/udp open rpcbind
601/udp open|filtered unknown
2049/udp open nfs
5353/udp open|filtered zeroconf
No exact OS matches for host (If you know what OS is running on it, see http://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=5.21%D=1/31%OT=22%CT=1%CU=1%PV=Y%DS=0%DC=L%G=Y%TM=5890A68C%P=i686
OS:-pc-linux-gnu)SEQ(SP=108%GCD=1%ISR=10C%TI=Z%CI=I%II=I%TS=8)OPS(O1=M400CS
OS:T11NW4%O2=M400CST11NW4%O3=M400CNNT11NW4%O4=M400CST11NW4%O5=M400CST11NW4%
OS:O6=M400CST11)WIN(W1=8000%W2=8000%W3=8000%W4=8000%W5=8000%W6=8000)ECN(R=Y
OS:%DF=Y%T=40%W=8018%O=M400CNNSNW4%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%R
OS:D=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%
OS:DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%
OS:O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=4
OS:0%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S)
Network Distance: 0 hops
OS detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 13.04 seconds
change@ubuntu ~$
Como você vê alguns port STATEs estão abertos | filtrados. Posso fazer portas tcp filtradas no meu dispositivo linux?
Você também pode ver na imagem o que eu quero deixar mais claro: IMAGENS DE DISPOSITIVO E IPTABLES
Tente com isso:
_safeNetwork="192.168.0.0/24"
iptables -A INPUT -p tcp -s $_safeNetwork --dport 8888 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 8888 -m state --state ESTABLISHED -j ACCEPT
Desta forma, filtrará as conexões para as suas máquinas apenas a partir da sua "rede segura" e eliminará o resto.