{"id":71,"date":"2008-09-15T12:29:49","date_gmt":"2008-09-15T11:29:49","guid":{"rendered":"http:\/\/soi57.net\/articles\/?p=71"},"modified":"2020-09-08T15:56:46","modified_gmt":"2020-09-08T14:56:46","slug":"iptables-para-limitar-el-numero-de-conexiones-entrantes","status":"publish","type":"post","link":"https:\/\/soi57.net\/blog\/iptables-para-limitar-el-numero-de-conexiones-entrantes\/","title":{"rendered":"Iptables para limitar el n\u00famero de conexiones entrantes."},"content":{"rendered":"

Iptables<\/strong> tiene m\u00f3dulos muy \u00fatiles que extienden sus funcionalidades .Uno de los m\u00e1s interesantes es el m\u00f3dulo recent<\/em><\/strong> que permite monitorizar las conexiones recientes y limitarlas a un n\u00famero que decidamos.<\/p>\n

Esto puede ser muy \u00fatil, si por ejemplo queremos evitar ataques de denegaci\u00f3n de servicio, ataques por fuerza bruta,…<\/p>\n

Si normalmente ves en \/var\/log\/auth.log registros de este tipo:<\/p>\n

sshd[x]: Illegal user admin from aa.bb.cc.dd
\nsshd[x]: Illegal user test from\u00a0 aa.bb.cc.dd
\nsshd[x]: Illegal user guest from aa.bb.cc.dd<\/p>\n

podr\u00edas usar algunas reglas del recent<\/strong><\/em> para denegar el acceso temporalmente a clientes remotos que est\u00e1n intentado conectarse demasiadas veces.<\/p>\n

La forma de funcionar del m\u00f3dulo recent<\/em><\/strong> es muy simple. B\u00e1sicamente es a\u00f1adir ips a una lista con la que posteriormente compararemos las ips de los nuevos intentos de conexi\u00f3n. Esto nos va a permitir limitar el n\u00famero de conexiones, por intervalo de tiempo o por n\u00famero de intentos.<\/p>\n

Vamos a utilizar un ejemplo para ilustrarlo. Las siguientes 2 reglas limitar\u00e1n las conexiones entrantes al puerto 22, a no m\u00e1s de 3 intentos en un minuto, y todo lo demas ser\u00e1 descartado por el firewall<\/strong>.<\/p>\n

iptables -I INPUT -p tcp –dport 22 -i eth0 -m state –state NEW -m recent \\
\n–set
\niptables -I INPUT -p tcp –dport 22 -i eth0 -m state –state NEW -m recent \\
\n–update –seconds 60 –hitcount 4 -j DROP<\/p>\n

El flag –state toma una lista de los posibles estados de una conexi\u00f3n tcp, en el ejemplo \u00ab–state NEW\u00bb, har\u00e1 que solo se monitoricen las conexiones con el flag de new activado.<\/p>\n

El flag –set en la primera l\u00ednea asegurar\u00e1 que la ip del host que est\u00e1 iniciando las conexiones se a\u00f1aadir\u00e1 a la ‘lista reciente<\/strong><\/em>‘, donde posteriormente se comparar\u00e1 con las ips que se detecten en la segunda regla de nuestro ejemplo.<\/p>\n

La segunda regla es donde el filtrado ocurrir\u00e1 realmente. El flag –update comparar\u00e1 si las ips de las nuevas conexiones al puerto 22 ya existen (el par\u00e1metro –set habr\u00e1 hecho que se incluyan en la lista reciente<\/strong><\/em>)<\/p>\n

El flag –seconds establece el intervalo de tiempo en segundos. El –hitcount es el n\u00famero de ocurrencias que deben haber de este tipo de paquetes, para aplicar el target de la regla.<\/p>\n

La segunda regla har\u00e1 un drop de una conexi\u00f3n entrante si:<\/p>\n

– la ip que inicia la conexi\u00f3n ya est\u00e1 en la lista reciente,
\n– la ip ha mandado alg\u00fan paquete en los \u00faltimos 60 segundos,
\n– esta ip ha mandado mas de 4 paquetes en total.<\/p>\n

Ya s\u00f3lo tienes que jugar con los par\u00e1metros para ajustarlo al servicio que quieras proteger, ya sea ssh, ftp, web,…
\nCon netcat puedes simular intentos de conexi\u00f3n. Aqu\u00ed va un ejemplo:<\/p>\n

#!\/bin\/bash<\/p>\n

for i in `seq 1 5` ; do
\necho ‘exit’ | nc 192.168.1.1 22 ;
\ndone<\/p>\n

Si vas a hacer pruebas deberias flushear reglas y tablas:<\/p>\n

iptables -F
\niptables -X<\/p>\n

Y por \u00faltimo, si no estamos seguros de los par\u00e1metros que tenemos que definir para filtrar el tr\u00e1fico, loguear los paquetes y analizarlos,y asi no interferir en el funcionamiento de los clientes del servicio.<\/p>\n

<\/div>","protected":false},"excerpt":{"rendered":"

Iptables tiene m\u00f3dulos muy \u00fatiles que extienden sus funcionalidades .Uno de los m\u00e1s interesantes es el m\u00f3dulo recent que permite monitorizar las conexiones recientes y limitarlas a un n\u00famero que … <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"yasr_overall_rating":0,"yasr_post_is_review":"","yasr_auto_insert_disabled":"","yasr_review_type":"","footnotes":""},"categories":[85,97],"tags":[62,60,606,61],"class_list":["post-71","post","type-post","status-publish","format-standard","hentry","category-internet","category-tecnologia","tag-dos","tag-filtrado-paquetes","tag-iptables","tag-recent"],"yoast_head":"\nIptables para limitar el n\u00famero de conexiones entrantes.<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/soi57.net\/blog\/iptables-para-limitar-el-numero-de-conexiones-entrantes\/\" \/>\n<meta property=\"og:locale\" content=\"es_ES\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Iptables para limitar el n\u00famero de conexiones entrantes.\" \/>\n<meta property=\"og:description\" content=\"Iptables tiene m\u00f3dulos muy \u00fatiles que extienden sus funcionalidades .Uno de los m\u00e1s interesantes es el m\u00f3dulo recent que permite monitorizar las conexiones recientes y limitarlas a un n\u00famero que …\" \/>\n<meta property=\"og:url\" content=\"https:\/\/soi57.net\/blog\/iptables-para-limitar-el-numero-de-conexiones-entrantes\/\" \/>\n<meta property=\"og:site_name\" content=\"Android, administracion de sistemas y seo\" \/>\n<meta property=\"article:published_time\" content=\"2008-09-15T11:29:49+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2020-09-08T14:56:46+00:00\" \/>\n<meta name=\"author\" content=\"root\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/soi57.net\/blog\/iptables-para-limitar-el-numero-de-conexiones-entrantes\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/soi57.net\/blog\/iptables-para-limitar-el-numero-de-conexiones-entrantes\/\"},\"author\":{\"name\":\"root\",\"@id\":\"https:\/\/soi57.net\/blog\/#\/schema\/person\/9410e0a8d6f61a74f9f82f2229ab79d7\"},\"headline\":\"Iptables para limitar el n\u00famero de conexiones entrantes.\",\"datePublished\":\"2008-09-15T11:29:49+00:00\",\"dateModified\":\"2020-09-08T14:56:46+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/soi57.net\/blog\/iptables-para-limitar-el-numero-de-conexiones-entrantes\/\"},\"wordCount\":542,\"commentCount\":1,\"publisher\":{\"@id\":\"https:\/\/soi57.net\/blog\/#organization\"},\"keywords\":[\"dos\",\"filtrado paquetes\",\"iptables\",\"recent\"],\"articleSection\":[\"internet\",\"tecnologia\"],\"inLanguage\":\"es\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/soi57.net\/blog\/iptables-para-limitar-el-numero-de-conexiones-entrantes\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/soi57.net\/blog\/iptables-para-limitar-el-numero-de-conexiones-entrantes\/\",\"url\":\"https:\/\/soi57.net\/blog\/iptables-para-limitar-el-numero-de-conexiones-entrantes\/\",\"name\":\"Iptables para limitar el n\u00famero de conexiones entrantes.\",\"isPartOf\":{\"@id\":\"https:\/\/soi57.net\/blog\/#website\"},\"datePublished\":\"2008-09-15T11:29:49+00:00\",\"dateModified\":\"2020-09-08T14:56:46+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/soi57.net\/blog\/iptables-para-limitar-el-numero-de-conexiones-entrantes\/#breadcrumb\"},\"inLanguage\":\"es\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/soi57.net\/blog\/iptables-para-limitar-el-numero-de-conexiones-entrantes\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/soi57.net\/blog\/iptables-para-limitar-el-numero-de-conexiones-entrantes\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Portada\",\"item\":\"https:\/\/soi57.net\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Iptables para limitar el n\u00famero de conexiones entrantes.\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/soi57.net\/blog\/#website\",\"url\":\"https:\/\/soi57.net\/blog\/\",\"name\":\"Android, administracion de sistemas y seo\",\"description\":\"soi57.net\/blog\",\"publisher\":{\"@id\":\"https:\/\/soi57.net\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/soi57.net\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"es\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/soi57.net\/blog\/#organization\",\"name\":\"Soi57.Net\",\"url\":\"https:\/\/soi57.net\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"es\",\"@id\":\"https:\/\/soi57.net\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/soi57.net\/blog\/wp-content\/logo_soi57.net_half.jpg\",\"contentUrl\":\"https:\/\/soi57.net\/blog\/wp-content\/logo_soi57.net_half.jpg\",\"width\":342,\"height\":77,\"caption\":\"Soi57.Net\"},\"image\":{\"@id\":\"https:\/\/soi57.net\/blog\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/soi57.net\/blog\/#\/schema\/person\/9410e0a8d6f61a74f9f82f2229ab79d7\",\"name\":\"root\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"es\",\"@id\":\"https:\/\/soi57.net\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/6e87f10096d6c8f82a9bc2ddc0f3a223?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/6e87f10096d6c8f82a9bc2ddc0f3a223?s=96&d=mm&r=g\",\"caption\":\"root\"},\"sameAs\":[\"http:\/\/soi57.net\"]},false]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Iptables para limitar el n\u00famero de conexiones entrantes.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/soi57.net\/blog\/iptables-para-limitar-el-numero-de-conexiones-entrantes\/","og_locale":"es_ES","og_type":"article","og_title":"Iptables para limitar el n\u00famero de conexiones entrantes.","og_description":"Iptables tiene m\u00f3dulos muy \u00fatiles que extienden sus funcionalidades .Uno de los m\u00e1s interesantes es el m\u00f3dulo recent que permite monitorizar las conexiones recientes y limitarlas a un n\u00famero que …","og_url":"https:\/\/soi57.net\/blog\/iptables-para-limitar-el-numero-de-conexiones-entrantes\/","og_site_name":"Android, administracion de sistemas y seo","article_published_time":"2008-09-15T11:29:49+00:00","article_modified_time":"2020-09-08T14:56:46+00:00","author":"root","twitter_card":"summary_large_image","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/soi57.net\/blog\/iptables-para-limitar-el-numero-de-conexiones-entrantes\/#article","isPartOf":{"@id":"https:\/\/soi57.net\/blog\/iptables-para-limitar-el-numero-de-conexiones-entrantes\/"},"author":{"name":"root","@id":"https:\/\/soi57.net\/blog\/#\/schema\/person\/9410e0a8d6f61a74f9f82f2229ab79d7"},"headline":"Iptables para limitar el n\u00famero de conexiones entrantes.","datePublished":"2008-09-15T11:29:49+00:00","dateModified":"2020-09-08T14:56:46+00:00","mainEntityOfPage":{"@id":"https:\/\/soi57.net\/blog\/iptables-para-limitar-el-numero-de-conexiones-entrantes\/"},"wordCount":542,"commentCount":1,"publisher":{"@id":"https:\/\/soi57.net\/blog\/#organization"},"keywords":["dos","filtrado paquetes","iptables","recent"],"articleSection":["internet","tecnologia"],"inLanguage":"es","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/soi57.net\/blog\/iptables-para-limitar-el-numero-de-conexiones-entrantes\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/soi57.net\/blog\/iptables-para-limitar-el-numero-de-conexiones-entrantes\/","url":"https:\/\/soi57.net\/blog\/iptables-para-limitar-el-numero-de-conexiones-entrantes\/","name":"Iptables para limitar el n\u00famero de conexiones entrantes.","isPartOf":{"@id":"https:\/\/soi57.net\/blog\/#website"},"datePublished":"2008-09-15T11:29:49+00:00","dateModified":"2020-09-08T14:56:46+00:00","breadcrumb":{"@id":"https:\/\/soi57.net\/blog\/iptables-para-limitar-el-numero-de-conexiones-entrantes\/#breadcrumb"},"inLanguage":"es","potentialAction":[{"@type":"ReadAction","target":["https:\/\/soi57.net\/blog\/iptables-para-limitar-el-numero-de-conexiones-entrantes\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/soi57.net\/blog\/iptables-para-limitar-el-numero-de-conexiones-entrantes\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Portada","item":"https:\/\/soi57.net\/blog\/"},{"@type":"ListItem","position":2,"name":"Iptables para limitar el n\u00famero de conexiones entrantes."}]},{"@type":"WebSite","@id":"https:\/\/soi57.net\/blog\/#website","url":"https:\/\/soi57.net\/blog\/","name":"Android, administracion de sistemas y seo","description":"soi57.net\/blog","publisher":{"@id":"https:\/\/soi57.net\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/soi57.net\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"es"},{"@type":"Organization","@id":"https:\/\/soi57.net\/blog\/#organization","name":"Soi57.Net","url":"https:\/\/soi57.net\/blog\/","logo":{"@type":"ImageObject","inLanguage":"es","@id":"https:\/\/soi57.net\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/soi57.net\/blog\/wp-content\/logo_soi57.net_half.jpg","contentUrl":"https:\/\/soi57.net\/blog\/wp-content\/logo_soi57.net_half.jpg","width":342,"height":77,"caption":"Soi57.Net"},"image":{"@id":"https:\/\/soi57.net\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/soi57.net\/blog\/#\/schema\/person\/9410e0a8d6f61a74f9f82f2229ab79d7","name":"root","image":{"@type":"ImageObject","inLanguage":"es","@id":"https:\/\/soi57.net\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/6e87f10096d6c8f82a9bc2ddc0f3a223?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/6e87f10096d6c8f82a9bc2ddc0f3a223?s=96&d=mm&r=g","caption":"root"},"sameAs":["http:\/\/soi57.net"]},false]}},"yasr_visitor_votes":{"stars_attributes":{"read_only":false,"span_bottom":false},"number_of_votes":0,"sum_votes":0},"_links":{"self":[{"href":"https:\/\/soi57.net\/blog\/wp-json\/wp\/v2\/posts\/71","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/soi57.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/soi57.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/soi57.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/soi57.net\/blog\/wp-json\/wp\/v2\/comments?post=71"}],"version-history":[{"count":4,"href":"https:\/\/soi57.net\/blog\/wp-json\/wp\/v2\/posts\/71\/revisions"}],"predecessor-version":[{"id":2286,"href":"https:\/\/soi57.net\/blog\/wp-json\/wp\/v2\/posts\/71\/revisions\/2286"}],"wp:attachment":[{"href":"https:\/\/soi57.net\/blog\/wp-json\/wp\/v2\/media?parent=71"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/soi57.net\/blog\/wp-json\/wp\/v2\/categories?post=71"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/soi57.net\/blog\/wp-json\/wp\/v2\/tags?post=71"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}