Bloqueia https pelo endereço mac. Lula ou iptables

Question

Bloqueia https pelo endereço mac. Lula ou iptables

#1 resposta do (1 votos)
#2 resposta do (0 votos)

1

Eu quero bloquear o acesso à web (http e https) para determinados endereços mac. Eu era capaz de fazer isso por http usando o squid, mas ainda permite que os sites https passem.

acl denylist arp "/etc/squid/mac-deny-list.lst
http_access deny denylist

Como posso fazer o mesmo para https / 443?

Eu tentei usar o iptables

iptables -I INPUT -p tcp --dport 443 -m mac --mac-source XX:XX:XX:XX:XX:XX -j DROP

e

 iptables -I FORWARD -p tcp --dport 443 -m mac --mac-source XX:XX:XX:XX:XX:XX -j DROP

Eu também tentei usar REJECT em vez de DROP . Nem está funcionando.

O restante das regras do iptables são:

*nat
:PREROUTING ACCEPT [467:49957]
:POSTROUTING ACCEPT [4:784]
:OUTPUT ACCEPT [6:960]
-A PREROUTING -i eth1.10 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128 
-A POSTROUTING -o eth0 -j MASQUERADE 
COMMIT
*filter
:INPUT ACCEPT [122012:18388989]
:FORWARD ACCEPT [10802:1834986]
:OUTPUT ACCEPT [1807836:1494699352]
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT 
-A INPUT -i lo -j ACCEPT 
-A INPUT -p icmp -j ACCEPT 
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -p tcp -m state --state NEW -m tcp --dport 5667 -j ACCEPT 
-A INPUT -p tcp -m state --state NEW -m tcp --dport 5666 -j ACCEPT 
-A INPUT -p udp -m udp --dport 161 -j ACCEPT 
-A INPUT -p udp -m udp --dport 162 -j ACCEPT 
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A FORWARD -i tun0 -m state --state NEW -j ACCEPT 
-A FORWARD -i eth1.10 -o eth0 -j ACCEPT 
COMMIT

Atualizar

Chain INPUT (policy ACCEPT 1 packets, 334 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:443 MAC XX:XX:XX:XX:XX:XX
   41  2624 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22 
  386 42629 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
60371 5794K ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           
6558K 2220M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:5667 
60264 3616K ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:5666 
    3   211 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:161 
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:162 

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       tcp  --  eth1.10 *       0.0.0.0/0            0.0.0.0/0           tcp dpt:443 MAC XX:XX:XX:XX:XX:XX 
  61M   46G ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
48857 3337K ACCEPT     all  --  tun0   *       0.0.0.0/0            0.0.0.0/0           state NEW 
 159K   17M ACCEPT     all  --  eth1.10 eth0    0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy ACCEPT 49 packets, 6584 bytes)
 pkts bytes target     prot opt in     out     source               destination

TCPDUMP (truncado)

tcpdump -e -i eth1.10 '!(host 10.15.248.122)' and 'ether host 00:60:dd:44:85:43'
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1.10, link-type EN10MB (Ethernet), capture size 65535 bytes
14:01:47.452656 00:08:54:23:fa:93 (oui Unknown) > 00:60:dd:44:85:43 (oui Unknown), ethertype IPv4 (0x0800), length 116: resolver1.opendns.com.domain > 172.31.235.114.63561: 6769 2/0/0 CNAME star.c10r.facebook.com., A 31.13.77.6 (74)
14:01:47.470098 00:08:54:23:fa:93 (oui Unknown) > 00:60:dd:44:85:43 (oui Unknown), ethertype IPv4 (0x0800), length 66: edge-star-shv-01-sjc2.facebook.com.https > 172.31.235.114.50452: Flags [S.], seq 2645004585, ack 3584915781, win 14100, options [mss 1410,nop,nop,sackOK,nop,wscale 8], length 0
14:01:47.485180 00:08:54:23:fa:93 (oui Unknown) > 00:60:dd:44:85:43 (oui Unknown), ethertype IPv4 (0x0800), length 54: edge-star-shv-01-sjc2.facebook.com.https > 172.31.235.114.50452: Flags [.], ack 518, win 67, length 0
14:01:47.485398 00:08:54:23:fa:93 (oui Unknown) > 00:60:dd:44:85:43 (oui Unknown), ethertype IPv4 (0x0800), length 236: edge-star-shv-01-sjc2.facebook.com.https > 172.31.235.114.50452: Flags [P.], seq 1:183, ack 518, win 67, length 182
14:01:47.500703 00:08:54:23:fa:93 (oui Unknown) > 00:60:dd:44:85:43 (oui Unknown), ethertype IPv4 (0x0800), length 54: edge-star-shv-01-sjc2.facebook.com.https > 172.31.235.114.50452: Flags [.], ack 634, win 67, length 0
14:01:47.500891 00:08:54:23:fa:93 (oui Unknown) > 00:60:dd:44:85:43 (oui Unknown), ethertype IPv4 (0x0800), length 111: edge-star-shv-01-sjc2.facebook.com.https > 172.31.235.114.50452: Flags [P.], seq 183:240, ack 634, win 67, length 57
14:01:47.503275 00:08:54:23:fa:93 (oui Unknown) > 00:60:dd:44:85:43 (oui Unknown), ethertype IPv4 (0x0800), length 54: edge-star-shv-01-sjc2.facebook.com.https > 172.31.235.114.50452: Flags [.], ack 691, win 67, length 0
14:01:47.503302 00:08:54:23:fa:93 (oui Unknown) > 00:60:dd:44:85:43 (oui Unknown), ethertype IPv4 (0x0800), length 54: edge-star-shv-01-sjc2.facebook.com.https > 172.31.235.114.50452: Flags [.], ack 736, win 67, length 0
14:01:47.503372 00:08:54:23:fa:93 (oui Unknown) > 00:60:dd:44:85:43 (oui Unknown), ethertype IPv4 (0x0800), length 54: edge-star-shv-01-sjc2.facebook.com.https > 172.31.235.114.50452: Flags [.], ack 1181, win 78, length 0
14:01:47.503585 00:08:54:23:fa:93 (oui Unknown) > 00:60:dd:44:85:43 (oui Unknown), ethertype IPv4 (0x0800), length 99: edge-star-shv-01-sjc2.facebook.com.https > 172.31.235.114.50452: Flags [P.], seq 240:285, ack 1181, win 78, length 45
14:01:47.566820 00:08:54:23:fa:93 (oui Unknown) > 00:60:dd:44:85:43 (oui Unknown), ethertype IPv4 (0x0800), length 1464: edge-star-shv-01-sjc2.facebook.com.https > 172.31.235.114.50452: Flags [.], seq 285:1695, ack 1181, win 78, length 1410
14:01:47.566838 00:08:54:23:fa:93 (oui Unknown) > 00:60:dd:44:85:43 (oui Unknown), ethertype IPv4 (0x0800), length 266: edge-star-shv-01-sjc2.facebook.com.https > 172.31.235.114.50452: Flags [P.], seq 1695:1907, ack 1181, win 78, length 212
14:01:47.566965 00:08:54:23:fa:93 (oui Unknown) > 00:60:dd:44:85:43 (oui Unknown), ethertype IPv4 (0x0800), length 1464: edge-star-shv-01-sjc2.facebook.com.https > 172.31.235.114.50452: Flags [.], seq 1907:3317, ack 1181, win 78, length 1410
14:01:47.567072 00:08:54:23:fa:93 (oui Unknown) > 00:60:dd:44:85:43 (oui Unknown), ethertype IPv4 (0x0800), length 1282: edge-star-shv-01-sjc2.facebook.com.https > 172.31.235.114.50452: Flags [P.], seq 3317:4545, ack 1181, win 78, length 1228
14:01:47.569446 00:08:54:23:fa:93 (oui Unknown) > 00:60:dd:44:85:43 (oui Unknown), ethertype IPv4 (0x0800), length 1464: edge-star-shv-01-sjc2.facebook.com.https > 172.31.235.114.50452: Flags [.], seq 4545:5955, ack 1181, win 78, length 1410
14:01:47.569562 00:08:54:23:fa:93 (oui Unknown) > 00:60:dd:44:85:43 (oui Unknown), ethertype IPv4 (0x0800), length 1464: edge-star-shv-01-sjc2.facebook.com.https > 172.31.235.114.50452: Flags [.], seq 5955:7365, ack 1181, win 78, length 1410
14:01:47.569682 00:08:54:23:fa:93 (oui Unknown) > 00:60:dd:44:85:43 (oui Unknown), ethertype IPv4 (0x0800), length 1464: edge-star-shv-01-sjc2.facebook.com.https > 172.31.235.114.50452: Flags [.], seq 7365:8775, ack 1181, win 78, length 1410

@Matt

# Generated by iptables-save v1.4.7 on Tue May 12 14:44:35 2015
*filter
:INPUT ACCEPT [53:6397]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [822:337604]
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT 
-A INPUT -i lo -j ACCEPT 
-A INPUT -p icmp -j ACCEPT 
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -p tcp -m state --state NEW -m tcp --dport 5667 -j ACCEPT 
-A INPUT -p tcp -m state --state NEW -m tcp --dport 5666 -j ACCEPT 
-A INPUT -p udp -m udp --dport 161 -j ACCEPT 
-A INPUT -p udp -m udp --dport 162 -j ACCEPT 
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A FORWARD -i tun0 -m state --state NEW -j ACCEPT 
-A FORWARD -i eth1.10 -o eth0 -j ACCEPT 
-A FORWARD -i eth1.10 -p tcp -m tcp --dport 443 -m mac --mac-source 00:60:DD:44:85:43 -j DROP 
COMMIT
# Completed on Tue May 12 14:44:35 2015
# Generated by iptables-save v1.4.7 on Tue May 12 14:44:35 2015
*nat
:PREROUTING ACCEPT [325:31771]
:POSTROUTING ACCEPT [16:1474]
:OUTPUT ACCEPT [308:20843]
-A PREROUTING -i eth1.10 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128 
-A POSTROUTING -o eth0 -j MASQUERADE 
COMMIT
# Completed on Tue May 12 14:44:35 2015

Detalhes da interface

eth0 - 192.168.2.22 (/24) (public/outside/NAT) 
eth1.10 - 172.31.235.19 (/24) (private/inside/vlan10)

iptables squid webfilter

por Dru 12.05.2015 / 21:21

2 respostas

Tags iptables squid webfilter

DNS spoofing com bind9 [duplicado] servidor awstats na infraestrutura dinâmica

score 1 · Answer 1

O problema é que a regra de filtro MAC é processada depois de aceitá-la. Então nunca é alcançado.

O que você precisa fazer é alterar a ordem dessas duas linhas:

  -A FORWARD -i eth1.10 -o eth0 -j ACCEPT 
  -A FORWARD -i eth1.10 -p tcp -m tcp --dport 443 -m mac --mac-source 00:60:DD:44:85:43 -j DROP

Então eles se tornam:

-A FORWARD -i eth1.10 -p tcp -m tcp --dport 443 -m mac --mac-source 00:60:DD:44:85:43 -j DROP
-A FORWARD -i eth1.10 -o eth0 -j ACCEPT

Se você usar o formato iptables-save você apenas editaria a saída do iptables-save e executaria o iptables-restore passando o arquivo. ou seja,

sudo iptables-save > rules

... edit 'rules'

sudo iptables-restore < rules

Ou, como alternativa, basta editar qualquer script / gerador que você esteja usando para criar as regras.

Note: Since you're filtering internal addresses, I'd use REJECT rather than DROP or otherwise the user may not realise they have been blocked and be wondering why their browser just sits there for a very long time.

score 0 · Answer 2

Eu acredito que você realmente precisa colocar o filtro MAC na cadeia PREROUTING por causa da maneira como o iptables reescreve alguns campos internamente.

De Travessia em cadeia para roteamento, quando o código bridge e netfilter é compilado no kernel

The side effect explained here occurs when the netfilter code is enabled in the kernel, the IP packet is routed and the out device for that packet is a logical bridge device. The side effect is encountered when filtering on the MAC source in the iptables FORWARD chains. As should be clear from earlier sections, the traversal of the iptables FORWARD chains is postponed until the packet is in the bridge code. This is done so we can filter on the bridge port out device. This has a side effect on the MAC source address, because the IP code will have changed the MAC source address to the MAC address of the bridge device.