Preventing Brute Force Attacks

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 15:07, 1 October 2008 (edit)
SirSilentBob (Talk | contribs)
(New page: == Preventing Brute Force Attacks == * Please, corrections, and improvements to this WIKI article are welcomed and requested, as this WIKI article is currently a work in progress....... ...)
← Previous diff
Revision as of 16:29, 1 October 2008 (edit) (undo)
Switch (Talk | contribs)
(Preventing Brute Force Attacks)
Next diff →
Line 1: Line 1:
== Preventing Brute Force Attacks == == Preventing Brute Force Attacks ==
-* Please, corrections, and improvements to this WIKI article are welcomed and requested, as this WIKI article is currently a work in progress.......+''Please, corrections, and improvements to this WIKI article are welcomed and requested, as this WIKI article is currently a work in progress.......''
 + 
 +=== Introduction ===
Thanks to the suggestion by JoFa, and the legwork, testing and code from jbarbieri, you can now rest easy in having SSH, as well as other service ports open on the WAN portion of your router for ease of use, while severely hampering the attempts of a brute force hack attempt. Remember, always use unique and long passwords! Thanks to the suggestion by JoFa, and the legwork, testing and code from jbarbieri, you can now rest easy in having SSH, as well as other service ports open on the WAN portion of your router for ease of use, while severely hampering the attempts of a brute force hack attempt. Remember, always use unique and long passwords!
 +=== Prerequisites ===
 +* ''''Version'''': theoretically any DD-WRT; tested on v24sp1+
 +* ''''Builds'''':
 +** '''Works on''': Standard, Mega
 +** '''Doesn't work on''': Micro, Micro+
 +** '''Untested on''': VoIP, VPN, custom builds
 +
 +=== Implementing the protection ===
 +
 +Note that this protection ''example'' is designed to prevent connections on port 22 (SSH). It will not cover telnet (it's better to disable that anyway), nor VPN (PPTP/OpenVPN). It will not work on Micro(+) builds (as of SVN 10431).
 +
 +Go to the Administration -> Commands page of your router's GUI. Paste the following code in the script box the click Save Firewall:
 +
 + <code>iptables -I INPUT -p tcp --dport 22 -m state --state RELATED,ESTABLISHED -j ACCEPT
 + iptables -I INPUT 2 -p tcp --dport 22 -m state --state NEW -m limit --limit 3/min --limit-burst 3 -j ACCEPT
 + iptables -I INPUT 3 -p tcp --dport 22 -j logreject</code>
This code shown here was made for limiting connection attempts to port 22 (SSH) to only 3 per minute. You can adapt this code to implement other ports, change the amount of attempts before timeout, change the length of the timeout, etc. This code shown here was made for limiting connection attempts to port 22 (SSH) to only 3 per minute. You can adapt this code to implement other ports, change the amount of attempts before timeout, change the length of the timeout, etc.
-Place the following code in your firewall script box in the web gui of your router:+=== Extending the protection to telnet & VPN ===
-<pre>+The above code can be extended to protect against multiple connections on various other ports. For instance, assuming you want to protect your SSH and TELNET enabled router, you could use the following code:
-Chain INPUT (policy ACCEPT 0 packets, 0 bytes)+
-pkts bytes target prot opt in out source destination+
-117 11216 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 state RELATED,ESTABLISHED+
-0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 state NEW limit: avg 3/min burst 3+
-0 0 logreject tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22+
-</pre>+
-The following commands will need to be manually ran from the command line:+ <code>iptables -I INPUT -p tcp --dport 22 -m state --state RELATED,ESTABLISHED -j ACCEPT
 +iptables -I INPUT 2 -p tcp --dport 23 -m state --state RELATED,ESTABLISHED -j ACCEPT
 +iptables -I INPUT 3 -p tcp --dport 22 -m state --state NEW -m limit --limit 3/min --limit-burst 3 -j ACCEPT
 +iptables -I INPUT 4 -p tcp --dport 23 -m state --state NEW -m limit --limit 3/min --limit-burst 3 -j ACCEPT
 +iptables -I INPUT 5 -p tcp --dport 22 -j logreject
 +iptables -I INPUT 6 -p tcp --dport 23 -j logreject</code>
- iptables -I INPUT -p tcp --dport 22 -m state --state RELATED,ESTABLISHED -j ACCEPT+As you can see, extending the script is not difficult; all that you must do is make sure the lines containing RELATED are first, then the ones containing NEW then the logreject lines.
- iptables -I INPUT 2 -p tcp --dport 22 -m state --state NEW -m limit --limit 3/min --limit-burst 3 -j ACCEPT+
- iptables -I INPUT 3 -p tcp --dport 22 -j logreject+

Revision as of 16:29, 1 October 2008

Contents

Preventing Brute Force Attacks

Please, corrections, and improvements to this WIKI article are welcomed and requested, as this WIKI article is currently a work in progress.......

Introduction

Thanks to the suggestion by JoFa, and the legwork, testing and code from jbarbieri, you can now rest easy in having SSH, as well as other service ports open on the WAN portion of your router for ease of use, while severely hampering the attempts of a brute force hack attempt. Remember, always use unique and long passwords!

Prerequisites

  • 'Version': theoretically any DD-WRT; tested on v24sp1+
  • 'Builds':
    • Works on: Standard, Mega
    • Doesn't work on: Micro, Micro+
    • Untested on: VoIP, VPN, custom builds

Implementing the protection

Note that this protection example is designed to prevent connections on port 22 (SSH). It will not cover telnet (it's better to disable that anyway), nor VPN (PPTP/OpenVPN). It will not work on Micro(+) builds (as of SVN 10431).

Go to the Administration -> Commands page of your router's GUI. Paste the following code in the script box the click Save Firewall:

iptables -I INPUT -p tcp --dport 22 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -I INPUT 2 -p tcp --dport 22 -m state --state NEW -m limit --limit 3/min --limit-burst 3 -j ACCEPT
iptables -I INPUT 3 -p tcp --dport 22 -j logreject

This code shown here was made for limiting connection attempts to port 22 (SSH) to only 3 per minute. You can adapt this code to implement other ports, change the amount of attempts before timeout, change the length of the timeout, etc.

Extending the protection to telnet & VPN

The above code can be extended to protect against multiple connections on various other ports. For instance, assuming you want to protect your SSH and TELNET enabled router, you could use the following code:

iptables -I INPUT -p tcp --dport 22 -m state --state RELATED,ESTABLISHED -j ACCEPT

iptables -I INPUT 2 -p tcp --dport 23 -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -I INPUT 3 -p tcp --dport 22 -m state --state NEW -m limit --limit 3/min --limit-burst 3 -j ACCEPT iptables -I INPUT 4 -p tcp --dport 23 -m state --state NEW -m limit --limit 3/min --limit-burst 3 -j ACCEPT iptables -I INPUT 5 -p tcp --dport 22 -j logreject iptables -I INPUT 6 -p tcp --dport 23 -j logreject

As you can see, extending the script is not difficult; all that you must do is make sure the lines containing RELATED are first, then the ones containing NEW then the logreject lines.