Edit

Suricata & Iptables cheatsheet

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

Iptables

Chains

In iptables, lists of rules known as chains are processed sequentially. Among these, three primary chains are universally present, with additional ones like NAT being potentially supported depending on the system's capabilities.

  • Input Chain: Utilized for managing the behavior of incoming connections.

  • Forward Chain: Employed for handling incoming connections that are not destined for the local system. This is typical for devices acting as routers, where the data received is meant to be forwarded to another destination. This chain is relevant primarily when the system is involved in routing, NATing, or similar activities.

  • Output Chain: Dedicated to the regulation of outgoing connections.

These chains ensure the orderly processing of network traffic, allowing for the specification of detailed rules governing the flow of data into, through, and out of a system.

# Delete all rules
iptables -F

# List all rules
iptables -L
iptables -S

# Block IP addresses & ports
iptables -I INPUT -s ip1,ip2,ip3 -j DROP
iptables -I INPUT -p tcp --dport 443 -j DROP
iptables -I INPUT -s ip1,ip2 -p tcp --dport 443 -j DROP

# String based drop
## Strings are case sensitive (pretty easy to bypass if you want to check an SQLi for example)
iptables -I INPUT -p tcp --dport <port_listening> -m string --algo bm --string '<payload>' -j DROP
iptables -I OUTPUT -p tcp --sport <port_listening> -m string --algo bm --string 'CTF{' -j DROP
## You can also check for the hex, base64 and double base64 of the expected CTF flag chars

# Drop every input port except some
iptables -P INPUT DROP # Default to drop
iptables -I INPUT -p tcp --dport 8000 -j ACCEPT
iptables -I INPUT -p tcp --dport 443 -j ACCEPT


# Persist Iptables
## Debian/Ubuntu:
apt-get install iptables-persistent
iptables-save > /etc/iptables/rules.v4
ip6tables-save > /etc/iptables/rules.v6
iptables-restore < /etc/iptables/rules.v4
##RHEL/CentOS:
iptables-save > /etc/sysconfig/iptables
ip6tables-save > /etc/sysconfig/ip6tables
iptables-restore < /etc/sysconfig/iptables

Suricata

Install & Config

Rules Definitions

From the docs: A rule/signature consists of the following:

  • The action, determines what happens when the signature matches.

  • The header, defines the protocol, IP addresses, ports and direction of the rule.

  • The rule options, define the specifics of the rule.

Valid actions are

  • alert - generate an alert

  • pass - stop further inspection of the packet

  • drop - drop packet and generate alert

  • reject - send RST/ICMP unreachable error to the sender of the matching packet.

  • rejectsrc - same as just reject

  • rejectdst - send RST/ICMP error packet to the receiver of the matching packet.

  • rejectboth - send RST/ICMP error packets to both sides of the conversation.

Protocols

  • tcp (for tcp-traffic)

  • udp

  • icmp

  • ip (ip stands for ‘all’ or ‘any’)

  • layer7 protocols: http, ftp, tls, smb, dns, ssh... (more in the docs)

Source and Destination Addresses

It supports IP ranges, negations and a list of addresses:

Example
Meaning

! 1.1.1.1

Every IP address but 1.1.1.1

![1.1.1.1, 1.1.1.2]

Every IP address but 1.1.1.1 and 1.1.1.2

$HOME_NET

Your setting of HOME_NET in yaml

[$EXTERNAL_NET, !$HOME_NET]

EXTERNAL_NET and not HOME_NET

[10.0.0.0/24, !10.0.0.5]

10.0.0.0/24 except for 10.0.0.5

Source and Destination Ports

It supports port ranges, negations and lists of ports

Example
Meaning

any

any address

[80, 81, 82]

port 80, 81 and 82

[80: 82]

Range from 80 till 82

[1024: ]

From 1024 till the highest port-number

!80

Every port but 80

[80:100,!99]

Range from 80 till 100 but 99 excluded

[1:80,![2,4]]

Range from 1-80, except ports 2 and 4

Direction

It's possible to indicate the direction of the communication rule being applied:

Keywords

There are hundreds of options available in Suricata to search for the specific packet you are looking for, here it will be mentioned if something interesting is found. Check the documentation for more!

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks
PreviousDNSCat pcap analysisNextUSB Keystrokes

Last updated