From 560ee66b079abc7f765573252a622a034aec1ec8 Mon Sep 17 00:00:00 2001 From: Christoph Date: Mon, 26 Oct 2026 23:30:18 +0100 Subject: [PATCH] ip6t-firewall-server: Clamp the advertised MSS of incoming HTTPS SYN packets to 1360. ip6t-firewall-server,ipt-firewall-server: add some restrictions on HTTP connections to counteract attacks. --- ip6t-firewall-server | 88 ++++++++++++++++++++++++++++++++++++++++++++ ipt-firewall-server | 68 ++++++++++++++++++++++++++++++++++ 2 files changed, 156 insertions(+) diff --git a/ip6t-firewall-server b/ip6t-firewall-server index a9d9b7c..70902cb 100755 --- a/ip6t-firewall-server +++ b/ip6t-firewall-server @@ -644,6 +644,26 @@ echo_skipped #echo_done +# --- +# - IPv6 TCP MSS adjustment for incoming HTTPS connections +# --- +# The IPv6 path MTU can be smaller than the interface MTU. +# Clamp the advertised MSS of incoming HTTPS SYN packets to 1360. +# This prevents oversized TCP segments in server responses. +# +# Tested on oolm-shop on 2026-10-26. +# --- + +echononl "\tAdjust IPv6 TCP MSS for HTTPS connections" + +$ip6t -t mangle -A PREROUTING -i eth0 \ + -p tcp --dport 443 \ + --tcp-flags SYN,RST SYN \ + -j TCPMSS --set-mss 1360 + +echo_done + + # --- # Drop TCP packets that are new and are not SYN # --- @@ -2057,6 +2077,74 @@ echo_done # - HTTP(S) (local) Webserver # --- +echo "" +echononl "\t\tA maximum of 30 new connections per second per IP" + +if $log_rejected || $log_all ; then + $ip6t -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW \ + -m hashlimit --hashlimit-name http_v6 --hashlimit-mode srcip \ + --hashlimit-above 30/second --hashlimit-burst 60 \ + --hashlimit-htable-expire 600000 \ + -m limit --limit 10/second --limit-burst 20 \ + -j $LOG_TARGET $tag_log_prefix "$log_prefix more then 30 new connections" +fi + +# HTTP/HTTPS: neue Verbindungen pro Quell-IP begrenzen +# Über 30 neue Verbindungen/s pro IP werden gedroppt +# Eintrag wird nach 600000 ms = 10 Minuten gelöscht (--hashlimit-htable-expire 600000). +$ip6t -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW \ + -m hashlimit --hashlimit-name http_v6 --hashlimit-mode srcip \ + --hashlimit-above 30/second --hashlimit-burst 60 \ + --hashlimit-htable-expire 600000 -j DROP + +echo_done + + +echononl "\t\tA maximum of 50 concurrent TCP connections per IP" + +if $log_rejected || $log_all ; then + $ip6t -A INPUT -p tcp -m multiport --dports 80,443 --syn \ + -m connlimit --connlimit-above 50 --connlimit-mask 128 \ + -m limit --limit 10/second --limit-burst 20 \ + -j $LOG_TARGET $tag_log_prefix "$log_prefix more then 50 concurrent connections." +fi + +# HTTP/HTTPS: gleichzeitige Verbindungen pro IP begrenzen +# Mehr als 50 parallele TCP-Verbindungen pro IP ablehnen +# +# Limit gilt pro einzelner IPv4-Adresse (--connlimit-mask 128) (z.bsp. 2a01:599:108:40b0:e1a9:170b:ba18:fd58/128) +$ip6t -A INPUT -p tcp -m multiport --dports 80,443 --syn \ + -m connlimit --connlimit-above 50 --connlimit-mask 128 \ + -j REJECT --reject-with tcp-reset + +echo_done + + +echononl "\t\tA maximum of 200 new TCP handshakes per second." + +# SYN-Rate begrenzen +# +# Kurzfristig auch bis zu 400 syn pakete erlaubt. --limit-burst 400 - Danach greift das Limit." +$ip6t -A INPUT -p tcp -m multiport --dports 80,443 \ + --syn \ + -m limit --limit 200/second --limit-burst 400 \ + -j ACCEPT + +if $log_rejected || $log_all ; then + $ip6t -A INPUT -p tcp -m multiport --dports 80,443 \ + --syn \ + -m limit --limit 10/second --limit-burst 20 \ + -j $LOG_TARGET $tag_log_prefix "$log_prefix SYN-Overflow." +fi + +$ip6t -A INPUT -p tcp -m multiport --dports 80,443 \ + --syn \ + -j DROP + +echo_done +echo "" + + echononl "\t\tHTTP(S) (local) Webserver" if [[ ${#http_server_ip_arr[@]} -gt 0 ]] || [[ ${#forward_http_server_ip_arr[@]} -gt 0 ]] ; then diff --git a/ipt-firewall-server b/ipt-firewall-server index c9dbbbe..c1b379e 100755 --- a/ipt-firewall-server +++ b/ipt-firewall-server @@ -2241,6 +2241,74 @@ echo_done # - HTTP(S) (local) Webserver # --- +echo "" +echononl "\t\tA maximum of 30 new connections per second per IP" + +if $log_rejected || $log_all ; then + $ipt -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW \ + -m hashlimit --hashlimit-name http_v6 --hashlimit-mode srcip \ + --hashlimit-above 30/second --hashlimit-burst 60 \ + --hashlimit-htable-expire 600000 \ + -m limit --limit 10/second --limit-burst 20 \ + -j $LOG_TARGET $tag_log_prefix "$log_prefix more then 30 new connections" +fi + +# HTTP/HTTPS: neue Verbindungen pro Quell-IP begrenzen +# Über 30 neue Verbindungen/s pro IP werden gedroppt +# Eintrag wird nach 600000 ms = 10 Minuten gelöscht (--hashlimit-htable-expire 600000). +$ipt -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW \ + -m hashlimit --hashlimit-name http_v6 --hashlimit-mode srcip \ + --hashlimit-above 30/second --hashlimit-burst 60 \ + --hashlimit-htable-expire 600000 -j DROP + +echo_done + + +echononl "\t\tA maximum of 50 concurrent TCP connections per IP" + +if $log_rejected || $log_all ; then + $ipt -A INPUT -p tcp -m multiport --dports 80,443 --syn \ + -m connlimit --connlimit-above 50 --connlimit-mask 128 \ + -m limit --limit 10/second --limit-burst 20 \ + -j $LOG_TARGET $tag_log_prefix "$log_prefix more then 50 concurrent connections." +fi + +# HTTP/HTTPS: gleichzeitige Verbindungen pro IP begrenzen +# Mehr als 50 parallele TCP-Verbindungen pro IP ablehnen +# +# Limit gilt pro einzelner IPv4-Adresse (--connlimit-mask 128) (z.bsp. 2a01:599:108:40b0:e1a9:170b:ba18:fd58/128) +$ipt -A INPUT -p tcp -m multiport --dports 80,443 --syn \ + -m connlimit --connlimit-above 50 --connlimit-mask 128 \ + -j REJECT --reject-with tcp-reset + +echo_done + + +echononl "\t\tA maximum of 200 new TCP handshakes per second." + +# SYN-Rate begrenzen +# +# Kurzfristig auch bis zu 400 syn pakete erlaubt. --limit-burst 400 - Danach greift das Limit." +$ipt -A INPUT -p tcp -m multiport --dports 80,443 \ + --syn \ + -m limit --limit 200/second --limit-burst 400 \ + -j ACCEPT + +if $log_rejected || $log_all ; then + $ipt -A INPUT -p tcp -m multiport --dports 80,443 \ + --syn \ + -m limit --limit 10/second --limit-burst 20 \ + -j $LOG_TARGET $tag_log_prefix "$log_prefix SYN-Overflow." +fi + +$ipt -A INPUT -p tcp -m multiport --dports 80,443 \ + --syn \ + -j DROP + +echo_done +echo "" + + echononl "\t\tHTTP(S) (local) Webserver" if [[ ${#http_server_ip_arr[@]} -gt 0 ]] || [[ ${#forward_http_server_ip_arr[@]} -gt 0 ]] ; then