0

Assume I have iptables configured to block inbound accesses, except 22 and small number of other ports. Assume also that I wish for iptables to "snitch" on any naughty software that phones home, with a rule like:

iptables -A OUTPUT -p all -s $THIS_SERVER -m conntrack --state NEW -j LOG --log-prefix "OUTBOUND "

That is all well and good, but if I also have SSH tunneled traffic, how would I use iptables to treat that traffic differently? Here is my specific example. Let's say forwarding is allowed by sshd so that a client could do something like:

ssh -D127.0.0.1:12345 uid@myserver -N

They then have a SOCKS proxy on their end and can make outbound requests through $THIS_SERVER. This is a behaviour that I want to allow, but I would like to log it as different traffic than the above originating on the server itself (or perhaps, not log this forwarded traffic at all).

Do you think this can be done and if so, please explain. what I have attempted to do is to capture the second category by the FORWARD chain, but that did not work. Both categories of traffic seem to be selected by the same criteria, so I can't distinguish them. Is there a way to associate those SSH tunneled packets?

For avoidance of doubt, here are the log entries associated with setting up such a SOCKS proxy through my server, and then opening up Firefox. The UID=980 is the Linux resolver user, and UID=1000 is the remote user who established the tunnel via ssh.

[15719.755667] OUTPUT:LOG,ACCEPT IN= OUT=eth0 SRC=$THIS_SERVER DST=$NAMESERVER LEN=73 TOS=0x00 PREC=0x00 TTL=64 ID=62202 DF PROTO=UDP SPT=35744 DPT=53 LEN=53 UID=980 GID=980 
[15719.755771] OUTPUT:LOG,ACCEPT IN= OUT=eth0 SRC=$THIS_SERVER DST=$NAMESERVER LEN=73 TOS=0x00 PREC=0x00 TTL=64 ID=62203 DF PROTO=UDP SPT=32777 DPT=53 LEN=53 UID=980 GID=980 
[15720.046668] OUTPUT:LOG,ACCEPT IN= OUT=eth0 SRC=$THIS_SERVER DST=$NAMESERVER LEN=95 TOS=0x00 PREC=0x00 TTL=64 ID=62256 DF PROTO=UDP SPT=33118 DPT=53 LEN=75 UID=980 GID=980 
[15720.047446] OUTPUT:LOG,ACCEPT IN= OUT=eth0 SRC=$THIS_SERVER DST=34.210.48.174 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=520 DF PROTO=TCP SPT=34758 DPT=443 WINDOW=29200 RES=0x00 SYN URGP=0 UID=1000 GID=1000 
[15720.049736] OUTPUT:LOG,ACCEPT IN= OUT=eth0 SRC=$THIS_SERVER DST=34.210.48.174 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=1938 DF PROTO=TCP SPT=34760 DPT=443 WINDOW=29200 RES=0x00 SYN URGP=0 UID=1000 GID=1000 
[15720.614489] OUTPUT:LOG,ACCEPT IN= OUT=eth0 SRC=$THIS_SERVER DST=$NAMESERVER LEN=74 TOS=0x00 PREC=0x00 TTL=64 ID=62296 DF PROTO=UDP SPT=43834 DPT=53 LEN=54 UID=980 GID=980 
[15720.614573] OUTPUT:LOG,ACCEPT IN= OUT=eth0 SRC=$THIS_SERVER DST=$NAMESERVER LEN=74 TOS=0x00 PREC=0x00 TTL=64 ID=62297 DF PROTO=UDP SPT=55510 DPT=53 LEN=54 UID=980 GID=980 
[15720.615559] OUTPUT:LOG,ACCEPT IN= OUT=eth0 SRC=$THIS_SERVER DST=$NAMESERVER LEN=75 TOS=0x00 PREC=0x00 TTL=64 ID=62298 DF PROTO=UDP SPT=40906 DPT=53 LEN=55 UID=980 GID=980  
[15728.039642] OUTPUT:LOG,ACCEPT IN= OUT=eth0 SRC=$THIS_SERVER DST=$NAMESERVER LEN=72 TOS=0x00 PREC=0x00 TTL=64 ID=63174 DF PROTO=UDP SPT=39308 DPT=53 LEN=52 UID=980 GID=980 
[15728.039723] OUTPUT:LOG,ACCEPT IN= OUT=eth0 SRC=$THIS_SERVER DST=$NAMESERVER LEN=72 TOS=0x00 PREC=0x00 TTL=64 ID=63175 DF PROTO=UDP SPT=53907 DPT=53 LEN=52 UID=980 GID=980 
[15729.529947] OUTPUT:LOG,ACCEPT IN= OUT=eth0 SRC=$THIS_SERVER DST=$NAMESERVER LEN=81 TOS=0x00 PREC=0x00 TTL=64 ID=63315 DF PROTO=UDP SPT=45694 DPT=53 LEN=61 UID=980 GID=980 
[15729.530068] OUTPUT:LOG,ACCEPT IN= OUT=eth0 SRC=$THIS_SERVER DST=$NAMESERVER LEN=81 TOS=0x00 PREC=0x00 TTL=64 ID=63316 DF PROTO=UDP SPT=52263 DPT=53 LEN=61 UID=980 GID=980 
[15729.896039] OUTPUT:LOG,ACCEPT IN= OUT=eth0 SRC=$THIS_SERVER DST=$NAMESERVER LEN=70 TOS=0x00 PREC=0x00 TTL=64 ID=63355 DF PROTO=UDP SPT=40457 DPT=53 LEN=50 UID=980 GID=980 
[15729.896132] OUTPUT:LOG,ACCEPT IN= OUT=eth0 SRC=$THIS_SERVER DST=$NAMESERVER LEN=70 TOS=0x00 PREC=0x00 TTL=64 ID=63356 DF PROTO=UDP SPT=38307 DPT=53 LEN=50 UID=980 GID=980 
[15730.189743] OUTPUT:LOG,ACCEPT IN= OUT=eth0 SRC=$THIS_SERVER DST=$NAMESERVER LEN=82 TOS=0x00 PREC=0x00 TTL=64 ID=63442 DF PROTO=UDP SPT=40521 DPT=53 LEN=62 UID=980 GID=980 
[15730.189870] OUTPUT:LOG,ACCEPT IN= OUT=eth0 SRC=$THIS_SERVER DST=$NAMESERVER LEN=82 TOS=0x00 PREC=0x00 TTL=64 ID=63443 DF PROTO=UDP SPT=34444 DPT=53 LEN=62 UID=980 GID=980 
[15730.190707] OUTPUT:LOG,ACCEPT IN= OUT=eth0 SRC=$THIS_SERVER DST=$NAMESERVER LEN=81 TOS=0x00 PREC=0x00 TTL=64 ID=63444 DF PROTO=UDP SPT=55549 DPT=53 LEN=61 UID=980 GID=980 
[15730.192361] OUTPUT:LOG,ACCEPT IN= OUT=eth0 SRC=$THIS_SERVER DST=52.43.38.51 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=22080 DF PROTO=TCP SPT=60876 DPT=443 WINDOW=29200 RES=0x00 SYN URGP=0 UID=1000 GID=1000 
[15730.641766] OUTPUT:LOG,ACCEPT IN= OUT=eth0 SRC=$THIS_SERVER DST=$NAMESERVER LEN=81 TOS=0x00 PREC=0x00 TTL=64 ID=63507 DF PROTO=UDP SPT=54359 DPT=53 LEN=61 UID=980 GID=980 
[15730.641890] OUTPUT:LOG,ACCEPT IN= OUT=eth0 SRC=$THIS_SERVER DST=$NAMESERVER LEN=81 TOS=0x00 PREC=0x00 TTL=64 ID=63508 DF PROTO=UDP SPT=52250 DPT=53 LEN=61 UID=980 GID=980 
[15749.499230] OUTPUT:LOG,ACCEPT IN= OUT=eth0 SRC=$THIS_SERVER DST=$NAMESERVER LEN=87 TOS=0x00 PREC=0x00 TTL=64 ID=198 DF PROTO=UDP SPT=57205 DPT=53 LEN=67 UID=980 GID=980 
[15749.499394] OUTPUT:LOG,ACCEPT IN= OUT=eth0 SRC=$THIS_SERVER DST=$NAMESERVER LEN=87 TOS=0x00 PREC=0x00 TTL=64 ID=199 DF PROTO=UDP SPT=45791 DPT=53 LEN=67 UID=980 GID=980 
[15749.500301] OUTPUT:LOG,ACCEPT IN= OUT=eth0 SRC=$THIS_SERVER DST=$NAMESERVER LEN=116 TOS=0x00 PREC=0x00 TTL=64 ID=200 DF PROTO=UDP SPT=37022 DPT=53 LEN=96 UID=980 GID=980 
[15749.500917] OUTPUT:LOG,ACCEPT IN= OUT=eth0 SRC=$THIS_SERVER DST=54.68.157.14 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=64708 DF PROTO=TCP SPT=43082 DPT=443 WINDOW=29200 RES=0x00 SYN URGP=0 UID=1000 GID=1000 
[15752.028535] OUTPUT:LOG,ACCEPT IN= OUT=eth0 SRC=$THIS_SERVER DST=$NAMESERVER LEN=81 TOS=0x00 PREC=0x00 TTL=64 ID=585 DF PROTO=UDP SPT=59245 DPT=53 LEN=61 UID=980 GID=980 
[15752.028624] OUTPUT:LOG,ACCEPT IN= OUT=eth0 SRC=$THIS_SERVER DST=$NAMESERVER LEN=81 TOS=0x00 PREC=0x00 TTL=64 ID=586 DF PROTO=UDP SPT=55551 DPT=53 LEN=61 UID=980 GID=980 
[15752.029484] OUTPUT:LOG,ACCEPT IN= OUT=eth0 SRC=$THIS_SERVER DST=$NAMESERVER LEN=75 TOS=0x00 PREC=0x00 TTL=64 ID=587 DF PROTO=UDP SPT=34032 DPT=53 LEN=55 UID=980 GID=980
  • 1
    I suspect your only option is going to be to match by owner. e.g. -m owner --uid-owner 1000-1999 – Patrick Mar 25 '18 at 18:33
0

SSH tunnels probably have destination port 22 so you just have to make your rule ignore this port:

iptables -A OUTPUT -p tcp --dport 22 -s $THIS_SERVER -m conntrack --state NEW -j ACCEPT
iptables -A OUTPUT -p all -s $THIS_SERVER -m conntrack --state NEW -j LOG --log-prefix "OUTBOUND "
  • Thank you @Hauke. Untrue, however. I will add some log entries to my question to demonstrate this is not the case. – Douglas Held Mar 25 '18 at 21:04
0

One way to achieve your result would be to run sshd in a separate network namespace, and then provide DNAT tunneling for the incoming ssh connections, and NAT for the outbound traffic out from that namespace. In that set up, you'll have the sshd traffic on a separate (virtual) interface.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.