struggling with iptables on 16.04

Wed Nov 16 23:29:45 UTC 2016

Hi,

i hope someone can help me because i have the impression that on one of my hosts i have an uninvited guest.

I'm trying to understand Ubuntu 16.04 (kernel 4.4.0-45-generic) firewall rules. See the rules for the chain INPUT:

Chain INPUT (policy DROP 20 packets, 800 bytes)
 pkts bytes target     prot opt in     out     source               destination
  880  134K ufw-before-logging-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0
  880  134K ufw-before-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0
  481 86297 ufw-after-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0
   20   800 ufw-after-logging-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0
   20   800 ufw-reject-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0
   20   800 ufw-track-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain ufw-before-logging-input does nothing, so evaluating the rules continues with ufw-before-input:

Chain ufw-before-input (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
  317 22568 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 ufw-logging-deny  all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate INVALID
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 3
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 4
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 11
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 12
    4   112 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8
   72 23616 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp spt:67 dpt:68
  487 87216 ufw-not-local  all  --  *      *       0.0.0.0/0            0.0.0.0/0
    6   919 ACCEPT     udp  --  *      *       0.0.0.0/0            224.0.0.251          udp dpt:5353
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            239.255.255.250      udp dpt:1900
  481 86297 ufw-user-input  all  --  *      *       0.0.0.0/0            0.0.0.0/0

First question: 
second rule: is that the rule for responses from outgoing packets ? E.g. i start a browser and open a web page. First my host does a TCP SYN to the web server, and this one answers with a tcp SYN ACK.
Because man iptables-extensions says:

ESTABLISHED: The packet is associated with a connection which has seen packets in both directions.
RELATED: The packet is starting a new connection, but is associated with an existing connection, such as an FTP data transfer or an ICMP error.

Because ESTABLISHED must have seen packets in BOTH directions. When i open a web page and the first packet comes back from the webserver (SYN ACK, this connection does not have seen packets in both directions.
And RELATED, as i understand, is e.g. for ftp, which uses in one session different destination ports (i think one for control and one for data ?).

But if this is not the rule for the first packet coming back, where is this rule ?

This chain also accepts packets for icmp, dhcp, upnp and mDNS. Right ?

OK. Evaluating continues with ufw-user-input, which are e.g. the services opened by the admin for some services, like httpd ...

Evaluating continues with ufw-after-input, which drops e.g. some packtes for windows services (file sharing ...).

And THEN comes ufw-after-logging-input, which logs all the packets which survived all the previous rules.

So ufw-after-logging-input comes into play when there is a packet which has no previous packet in any direction, is not for the allowed services nor for the denied services.
E.g. i do a port scan to 12345 on that host. Right ? It should be logged by that rule. Because i don't have a service running on port 12345.

The reason i'm asking is that i have some logging from this rule with ip addresses not from our network, and i'd like to know when this rule comes into play.

I'd appreciate any help, if you want to know more please ask me.

Thanks.

Bernd

-- 
Bernd Lentes 

Systemadministration 
institute of developmental genetics 
Gebäude 35.34 - Raum 208 
HelmholtzZentrum München 
bernd.lentes at helmholtz-muenchen.de 
phone: +49 (0)89 3187 1241 
fax: +49 (0)89 3187 2294 

Erst wenn man sich auf etwas festlegt kann man Unrecht haben 
Scott Adams

Helmholtz Zentrum Muenchen
Deutsches Forschungszentrum fuer Gesundheit und Umwelt (GmbH)
Ingolstaedter Landstr. 1
85764 Neuherberg
www.helmholtz-muenchen.de
Aufsichtsratsvorsitzende: MinDir'in Baerbel Brumme-Bothe
Geschaeftsfuehrer: Prof. Dr. Guenther Wess, Dr. Alfons Enhsen
Registergericht: Amtsgericht Muenchen HRB 6466
USt-IdNr: DE 129521671