Workaround for negated (exception) iptables rules with multiple sources or destinations

Written by Claudio Kuenzler - 0 comments

Published on January 30th 2023 - Listed in Network Linux Security

---

To protect a public DNS nameserver from massive DNS requests/attacks I created a rate limit (connlimit) rule a while ago:

root@dns:~# iptables -I INPUT -p tcp --dport 53 -m connlimit --connlimit-above 10 -j REJECT
root@dns:~# iptables -I INPUT -p udp --dport 53 -m connlimit --connlimit-above 10 -j REJECT

This connection limit rule is triggered as soon as a single source is using more than 10 connections. Connections 11 and more are then automatically rejected.

This results in the following rules shown in the INPUT chain:

root@dns:~# iptables -nvL
Chain INPUT (policy ACCEPT 24925 packets, 1951K bytes)
 pkts bytes target     prot opt in     out     source               destination         
  122  9068 REJECT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:53 #conn src/32 > 10 reject-with icmp-port-unreachable
    0     0 REJECT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:53 #conn src/32 > 10 reject-with icmp-port-unreachable 
[...]

Although this worked (and proofed to be great helper during attacks), this caused issues with internal DNS nameservers which required frequent mass queries for DNS replication. This means: The created rate limit rule needs an exception for a couple of sources.

iptables error on negate rule with multiple sources or destinations

To create a an exception to a rule the iptables command supports the exclamation mark (!) which can be used in combination with -s (source) or -d (destination). The goal would be to create the same rate limit rule as seen above, however not for requests coming from 192.168.100.53 and 192.168.200.53, hence create an exclusion.

However when using multiple sources (or destinations), the negated rule cannot be created:

root@dns:~# iptables -I INPUT -p tcp --dport 53 ! -s 192.168.100.53,192.168.200.53 -m connlimit --connlimit-above 10 -j REJECT
iptables v1.8.4 (legacy): ! not allowed with multiple source or destination IP addresses

Instead of trying to combine rate limit and exception rule into one, the rule can be split into a REJECT and an ACCEPT rule as a workaround.

Create separate ACCEPT and REJECT rules as workaround

First let's create the general rate limit rules which are applied on all sources:

root@dns:~# iptables -A INPUT -p tcp --dport 53 -m connlimit --connlimit-above 10 -j REJECT
root@dns:~# iptables -A INPUT -p udp --dport 53 -m connlimit --connlimit-above 10 -j REJECT

Then create the exception rule (with -j ACCEPT action) with the allowed sources BEFORE the general rate limit rule (using -I INPUT to insert this rule at the top of the INPUT chain):

root@dns:~# iptables -I INPUT -p tcp --dport 53 -s 192.168.100.53,192.168.200.53 -m connlimit --connlimit-above 10 -j ACCEPT
root@dns:~# iptables -I INPUT -p udp --dport 53 -s 192.168.100.53,192.168.200.53 -m connlimit --connlimit-above 10 -j ACCEPT

This results in the following rules in the INPUT chain:

root@dns:~# iptables -nvL
Chain INPUT (policy ACCEPT 120 packets, 11895 bytes)
 pkts bytes target     prot opt in     out     source               destination        
    0     0 ACCEPT     udp  --  *      *       192.168.200.53        0.0.0.0/0            udp dpt:53 #conn src/32 > 10
    0     0 ACCEPT     udp  --  *      *       192.168.100.53        0.0.0.0/0            udp dpt:53 #conn src/32 > 10
    0     0 ACCEPT     tcp  --  *      *       192.168.200.53        0.0.0.0/0            tcp dpt:53 #conn src/32 > 10
    0     0 ACCEPT     tcp  --  *      *       192.168.100.53        0.0.0.0/0            tcp dpt:53 #conn src/32 > 10
    0     0 REJECT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:53 #conn src/32 > 10 reject-with icmp-port-unreachable
    0     0 REJECT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:53 #conn src/32 > 10 reject-with icmp-port-unreachable
[...]

With this workaround, the rate limit is in place for all sources except the ones defined in the -j ACCEPT rules.

Note: Another potential workaround would be to use iptables ipset, but I did not follow up on that.

Add a comment

Show form to leave a comment

Comments (newest first)

No comments yet.