7:11 a.m.
Hi all, quick question to see if anybody has done any port knocking in a firewalld
compatible way?
I've set up a proof of concept directly in nftables:
table inet knock {
set set1 {
type ipv4_addr
size 65535
timeout 5s
}
set set2 {
type ipv4_addr
size 65535
timeout 5s
}
set set3 {
type ipv4_addr
size 65535
timeout 5s
}
chain knock {
type filter hook input priority raw; policy accept;
ip saddr @set2 tcp dport 789 log prefix "KNOCK3 " level info add
@set3 { ip saddr } return
ip saddr @set1 tcp dport 456 log prefix "KNOCK2 " level info add
@set2 { ip saddr } return
tcp dport 123 log prefix "KNOCK1 " level info add @set1 { ip
saddr } return
ip saddr @set3 tcp dport 22 log prefix "ALLOWED " level info
accept
}
}
To do the same thing in a firewalld compatible way, I was thinking that the firewalld ssh
allow rule (in nft table inet firewalld chain filter_IN_public_allow) could refer to @set3
but then I would also need to have the add @set3 (and @set3 itself) be defined in the same
inet firewalld table. I can define that by hand with nft adding the chain to table inet
firewalld, but the problem with doing that is any firewall-cmd --reload will clear out my
"knock" chain.
Doing firewall-cmd to define sets with timeouts also seems a bit problematic (I'm in
CentOS 8 BTW) as I can define a set with a timeout:
firewall-cmd --permanent --new-ipset set3 --type=hash:ip --family=inet --option=timeout=5
firewall-cmd --reload
however listing the set shows it doesn't have a timeout:
nft list table inet firewalld|grep -A4 set
set set3 {
type ipv4_addr
flags interval
}
and in fact when I add something to the running set it doesn't disappear after 5
seconds:
# firewall-cmd --ipset=set3 --add-entry=1.2.3.4
success
# nft list table inet firewalld|grep -A4 set
set set3 {
type ipv4_addr
flags interval
elements = { 1.2.3.4 }
}
firewalld documentation is clear that you can't list the set members for a set with
timeouts since that's all handled by the kernel, which is fine but strange I guess,
however it doesn't seem to be that the timeout is actually getting set into the
nftables set. (And actually, firewall-cmd could just do "nft list set inet firewalld
set4" and extract the elements = {} list so possibly that's a future
enhancement.)
But I digress. Has anybody done any port knocking sort of thing in a firewalld compatible
way here? I'm interested in hearing some ideas or what has worked for people.
Thanks.
-nik