Firewall Failover with CARP,PF and PFSYNC in OpenBSD 4.2 under VMWare ESX3

CARP Setup
----------

Reference
http://www.openbsd.org/faq/pf/carp.html


CARP Master
-----------
# cat /etc/hostname.pcn1
# ifconfig carp0 create
# ifconfig pcn1 up

# ifconfig carp0 vhid 2 pass mysecretpassword carpdev pcn1 advbase 1 advskew 1 state master PUB.LIC.IPA.DDR netmask 255.255.255.0 broadcast PUB.LIC.IPA.DDR

# echo "inet PUB.LIC.IPA.DDR 255.255.255.0 PUB.LIC.IPA.DDR vhid 2 pass mysecretpassword carpdev pcn1 advbase 1 advskew 1 state master" > /etc/hostname.carp0

Note : Enable Promiscuous Mode for Virtual Switch related with pcn1

# ifconfig carp1 create

# ifconfig carp1 vhid 1 pass mysecretpassword carpdev pcn0 advbase 1 advskew 1 state master 192.168.0.254 netmask 255.255.255.0 broadcast 192.168.0.255

Note : Enable Promiscuous Mode for Virtual Switch related with pcn0

# vi /etc/pf.conf

pass out on $lan_if proto carp keep state

# pfctl -f /etc/pf.conf

# sysctl -w net.inet.carp.allow=1
# vi /etc/sysctl.conf
net.inet.carp.allow=1

# echo "inet 192.168.0.254 255.255.255.0 192.168.0.255 vhid 1 pass mysecretpassword carpdev pcn0 advbase 1 advskew 1 state master" > /etc/hostname.carp1

# reboot

CARP Backup
-----------

# cat /etc/hostname.pcn1
# ifconfig carp0 create
# ifconfig pcn1 up

# ifconfig carp0 vhid 2 pass mysecretpassword carpdev pcn1 advbase 1 advskew 1 state backup PUB.LIC.IPA.DDR netmask 255.255.255.0 broadcast PUB.LIC.IPA.DDR

# echo "inet PUB.LIC.IPA.DDR 255.255.255.0 PUB.LIC.IPA.DDR vhid 2 pass mysecretpassword carpdev pcn1 advbase 1 advskew 1 state backup" > /etc/hostname.carp0

Note : Enable Promiscuous Mode for Virtual Switch related with pcn1

# ifconfig carp1 create

# ifconfig carp1 vhid 1 pass mysecretpassword carpdev pcn0 advbase 1 advskew 1 state backup 192.168.0.254 netmask 255.255.255.0 broadcast 192.168.0.255

# vi /etc/pf.conf
pass out on $lan_if proto carp keep state

# pfctl -f /etc/pf.conf

# sysctl -w net.inet.carp.allow=1
# vi /etc/sysctl.conf
net.inet.carp.allow=1

Note : Enable Promiscuous Mode for Virtual Switch related with pcn0

# echo "inet 192.168.0.254 255.255.255.0 192.168.0.255 vhid 1 pass mysecretpassword carpdev pcn0 advbase 1 advskew 1 state backup" > /etc/hostname.carp1

# reboot

But VMWare will not allow CARP device to be used. It will not accept any request to a real hardware unless it is
addresed to it. As a solution we have to recompile VMWare Kernel OR We have to enable Promiscuous Mode for virtual NIC and Virtual Switch.

Reference
---------
http://www.ogris.de/docs/vmware-server-vrrp.html
http://paul.ouderkirk.ca/2006/10/11/network-experiments-with-vmware-server
http://paul.ouderkirk.ca/2006/10/11/network-experiments-with-vmware-server

When using a vswitch, both the virtual adapter and vswitch must have promiscuous mode enabled
So here I enabled the Promiscuous Mode.

1. Login to the Virtual Infrastructure Client
2. Then Right Click on the Virtual Switch listed in the right bottom of the Main Window.
3. Thereby we will get the "PropertiesWindow"
4. Go to the Security Tab -> Edit Promiscuous mode to "Accept"
Thats all. The CARP Interface should work now

References
----------
http://pubs.vmware.com/vi35/server_config/wwhelp/wwhimpl/common/html/wwhelp.htm?context=server_config&file=sc_adv_netwk.6.4.html
http://communities.vmware.com/thread/33241
http://www.virtualscoop.org/?q=comment/reply/9

Packet Filter (PF)
------------------
# vi /etc/rc.conf.local
# pf=YES

# pfctl -e

Enabled IP forwarding

# sysctl -w sysctl net.inet.ip.forwarding=1
# echo "sysctl net.inet.ip.forwarding=1" >> /etc/sysctl.conf
# sysctl -p /etc/sysctl.conf


PFSYNC Setup
------------

Master PF Server
----------------
# ifconfig pfsync0 syncdev pcn0 [ syncpeer 192.168.0.221 ]
# ifconfig pfsync0 up
# echo "up syncdev pcn0" > /etc/hostname.pfsync0
# vi /etc/pf.conf
sync_if=$lan_if
pass on $sync_if proto pfsync
pfctl -f /etc/pf.conf

# sysctl -w net.inet.carp.preempt=1
# vi /etc/sysctl.conf
net.inet.carp.preempt=1

# reboot

Backup PF Server
----------------
# ifconfig pfsync0 syncdev pcn0 [ syncpeer 192.168.0.220 ]
# ifconfig pfsync0 up
# echo "up syncdev pcn0" > /etc/hostname.pfsync0
# vi /etc/pf.conf
sync_if=$lan_if
pass on $sync_if proto pfsync
pfctl -f /etc/pf.conf

# sysctl -w net.inet.carp.preempt=1
# vi /etc/sysctl.conf
net.inet.carp.preempt=1
# reboot


##################################
/etc/pf.conf
##################################

# $OpenBSD: pf.conf,v 1.31 2006/01/30 12:20:31 camield Exp $
#
# See pf.conf(5) and /usr/share/pf for syntax and examples.
# Remember to set net.inet.ip.forwarding=1 and/or net.inet6.ip6.forwarding=1
# in /etc/sysctl.conf if packets are to be forwarded between interfaces.

############# OPTIONS,LISTS #######################

lan_if="pcn0"
wan_if ="pcn1"
int_carp_if="carp1"
ext_carp_if="carp0"
sync_if=$lan_if

INT_CARP_IP=192.168.0.254
EXT_CARP_IP=PUB.LIC.IPA.DDR
#PUBLIC_IP=$INT_CARP_IP
#PUBLIC_IP=192.168.0.254
REAL_SERVER=192.168.0.50

LAN_NODES = "{ 192.168.0.1, 192.168.0.2, 192.168.0.3, 192.168.0.4, 192.168.0.5 }"

scrub in all

########### NAT #########################################
############ Redirect HTTP,MySQL,SMTP,IMAP and FTP connections to REAL SERVER
rdr on $wan_if proto tcp from any to $EXT_CARP_IP port {80,3306,25,143,21} -> $REAL_SERVER
rdr on $lan_if proto tcp from any to $INT_CARP_IP port {80,3306,25,143,21} -> $REAL_SERVER

### SNAT Outgoing FTP,HTTP,SMTP,IMAP and MySQL traffic through LAN Interface
nat on $lan_if proto tcp from any to $REAL_SERVER port { 21,80,25,143,3306 } -> $lan_if
nat on $lan_if proto tcp from $REAL_SERVER to any port { 21,80,25,143,3306 } -> $lan_if

nat on $wan_if proto tcp from any to $INT_CARP_IP port { 21,80,25,143,3306 } -> $int_carp_if
nat on $wan_if proto tcp from $INT_CARP_IP to any port { 21,80,25,143,3306 } -> $int_carp_if

### Internet sharing for CLUSTERNODES
nat on $wan_if proto tcp from $LAN_NODES to any -> $wan_if
nat on $wan_if proto udp from $LAN_NODES to any -> $wan_if

## No NAT for others in LAN
no nat on $wan_if proto tcp from $lan_if:network to any

################### FILTER ################################
pass in quick on carp1
pass on $sync_if proto pfsync
pass in quick on $lan_if proto tcp to port 22
pass in quick on $lan_if from $REAL_SERVER
pass in quick on $lan_if to $REAL_SERVER
pass in quick on $lan_if proto tcp from $LAN_NODES to $lan_if
pass in quick on $lan_if proto udp from $LAN_NODES to $lan_if

### Prevent SYNFLOOD Attack
pass in quick on $wan_if proto tcp from any to $EXT_CARP_IP port {80,443,21,3306,25,143} flags S/SA synproxy state
pass in quick on $lan_if all allow-opts

###### pass out quick on $lan_if proto carp
pass out quick on carp1
pass out on $lan_if proto carp keep state
pass out on $lan_if all
pass out on $lan_if proto tcp from $INT_CARP_IP to any port {21,53,80,443}

## Possible Spoofing
block in quick from urpf-failed label uRPF
pass in quick from $lan_if
pass in quick on $lan_if from $lan_if
block in all

################# ATTACK Preventions ##################
set skip on lo0
antispoof for $ext_carp_if inet
antispoof for $lan_if inet

######################################################################
# block in on $lan_if from any to any

## table { 192.168.0.0/24 }
## table const { 192.168.0.0/16, 172.16.0.0/12,10.0.0.0/8 }

## table persist

## block in on $int_if from { , } to any
## table { 192.168.0.24/8 !192.0.0.0/24 }
## pass in on $int_if from to any
## block in on $int_if from to any

Squid dead but subsys locked

# /etc/init.d/squid status
squid dead but subsys locked

# df -h
# rm -rf /var/run/squid.pid
# rm -rf /var/lock/subsys/squid

# tail -f /var/log/messages
# tail -f /var/log/squid/cache.log
# /etc/init.d/squid start

2007/12/28 09:57:16| Starting Squid Cache version 2.5.STABLE6 for i386-redhat-linux-gnu...
2007/12/28 09:57:16| Process ID 26701
2007/12/28 09:57:16| With 1024 file descriptors available
2007/12/28 09:57:16| DNS Socket created at 0.0.0.0, port 33056, FD 4
2007/12/28 09:57:16| Adding nameserver 202.XX.XX.XXX from /etc/resolv.conf
2007/12/28 09:57:16| Adding nameserver 202.XX.XX.XXX from /etc/resolv.conf
2007/12/28 09:57:16| Adding nameserver 192.168.0.254 from /etc/resolv.conf
2007/12/28 09:57:16| User-Agent logging is disabled.
2007/12/28 09:57:16| Referer logging is disabled.
2007/12/28 09:57:16| Unlinkd pipe opened on FD 9
2007/12/28 09:57:16| Swap maxSize 102400 KB, estimated 7876 objects
2007/12/28 09:57:16| Target number of buckets: 393
2007/12/28 09:57:16| Using 8192 Store buckets
2007/12/28 09:57:16| Max Mem size: 51200 KB
2007/12/28 09:57:16| Max Swap size: 102400 KB
2007/12/28 09:57:16| /var/spool/squid/swap.state.new: (13) Permission denied
FATAL: storeDirOpenTmpSwapLog: Failed to open swap log.
Squid Cache (Version 2.5.STABLE6): Terminated abnormally.
CPU Usage: 0.013 seconds = 0.006 user + 0.007 sys
Maximum Resident Size: 0 KB
Page faults with physical i/o: 0

# ll /var/spool/squid/swap.state*
-rw-r--r-- 1 squid squid 497088 Dec 28 10:02 swap.state
-rw-r--r-- 1 squid squid 0 Dec 27 23:20 swap.state.new

# chmod 777 /var/spool/squid/swap.state
# /etc/init.d/squid start
FAILED

# chmod 644 /var/spool/squid/swap.state*
# /etc/init.d/squid start
FAILED

# mv /var/spool/squid/swap.state.new /var/spool/squid/swap.state.new.bak
# /etc/init.d/squid start
OK...

Multiple Network connectivity issue in OpenBSD within VMWware

Only the first NIC of each Virtual machine will work .None of the rest won't.
So added a Virtual Network Resource for that Virtual machine in VMWare Control Panel
But it didn't work this time.Only the first NIC will work
So logged into the VMWare Virtual Console and checked the Virtual Switches and VLAN Settings
It was clear that there is a Virtual Switch named "vSwitch0"
And this switch contains only one NIC as its member which is "vmnic0" in our case.

So I decided to add the second NIC "vmnic3" to this switch. I tried

# esxcfg-vswitch -L vmnic3 vSwitch0

But it created problems.
After this I was unable to access the Local Network,ie the the network connected through the "vmnic0"

So I removed it from the switch and added to the same switch specifying the Portgroup also

# esxcfg-vswitch -U vmnic3 vSwitch0
# esxcfg-vswitch -p VM\ Network -L vmnic3 vSwitch0

But didn't work
So removed it

# esxcfg-vswitch -p VM\ Network -U vmnic3 vSwitch0

Created a new switch

# esxcfg-vswitch -a NewSwicth

Then added the Portgroup named "VM Network_VSNL" that is to be used by the Virtual machines.

# esxcfg-vswitch -A VM\ Network_New NewSwitch

Then brought up the "vmnic3" as the Physical UPLINK

# esxcfg-vswitch -L vmnic3 NewSwitch

Then logged into Virtual Infrastructure Client 3

Powered Off OpenBSD
Edit Settings -> Network Adapter 2
Change Switch from "VM Network" to "VM Network_New"

Power On
Then configure the second NIC(pcn1 in my case) in OpenBSD
# vi /etc/hostname.pcn1
inet 192.168.0.222 255.255.255.0 192.168.0.255

Configure gateway and DNS Servers if required
# vi /etc/mygate
192.168.0.254
# vi /etc/resolv.conf
192.168.0.254

Then restart the network service
# sh /etc/netstart

Thats all

Auto Responder plugin in SquirrelMail

1.Download the compatibility plugin and Local Auto Responder plugin from http://squirrelmail.org
2.Extract it to the Squirrelmail - plugins directory
# pwd
/var/www/html/squirrelmail/plugins
# tar xzf compatibility-2.0.9-1.0.tar.gz
# cd compatibility
3.Patch it to your squirrelmail version
# patch -p0 < patches/compatibility_patch-1.4.11.diff
patching file ../../functions/strings.php
4.Configure the Squirrelmail to include the plugin
# cd ../../config
# ./conf.pl
5.Extract Local Auto Responder Plugin
# cd ../plugins/
# tar xzf local_autorespond_forward-3.0-1.4.0.tar.gz
# cd local_autorespond_forward
6.Compile suid_backend module
# cd suid_backend/
# ./configure --enable-webuser=nobody
Here my Apache is running as user "nobody".That user should have the permission to play
with the directories under this.
# make
# make install
7.Copy the sample config.php
# cd ..
# cp config.sample.php config.php
8.Edit the config.php to use "suid" instead of "ftp" for Maildir and ".forward" files
# vi config.php
$laf_backend = 'suid';
9.Configure the Squirrelmail to include the plugin
# cd ../../config
# ./conf.pl
10.Verify the Squirrelmail's ATTACHMENT DIR and DATA DIR. Verify the permission also
# vi /var/www/html/squirrelmail/config/config.php
$attachment_dir = '/var/local/squirrelmail/attach/';
11.Create it if doesn't exist
# mkdir /var/local/squirrelmail/attach
# chown nobody.nobody /var/local/squirrelmail/attach
# chmod 755 /var/local/squirrelmail/attach

Database Clustering with Sequoia

Sequoia Installation in RHEL 5 with MyOsotis

Tunnel TCP connections over ICMP echo-reply/echo-request

You can tunnel TCP connections over ICMP echo-reply/echo-request packets.
You need a PingTunnel Server(called proxy) and a client both with the application PingTunnel installed on it .
It is useful behind firewall.

Follow this URL. Its all there
PingTunnel

SecureServer.sh

#!/bin/bash
########### SysCTL Hardening #########
# Disable ICMP routing redirects. Otherwise, your system could have its routing table misadjusted by an attacker
sysctl -w net.ipv4.conf.all.accept_redirects=0
#sysctl -w net.ipv6.conf.all.accept_redirects=0
sysctl -w net.ipv4.conf.all.send_redirects=0
#sysctl -w net.ipv6.conf.all.send_redirects=0

#Disable IP source routing. The only use of IP source routing these days is by attackers trying to spoof IP addresses that you would trust as internal hosts.
sysctl -w net.ipv4.conf.all.accept_source_route=0
sysctl -w net.ipv4.conf.all.forwarding=0
# sysctl -w net.ipv4.conf.all.mc_forwarding=0

#Enforce sanity checking, also called ingress filtering or egress filtering. The point is to drop a packet if the source and destination IP addresses in the IP header do not make sense when considered in light of the physical interface on which it arrived.
sysctl -w net.ipv4.conf.all.rp_filter=1

#Log and drop "Martian" packets. A "Martian" packet is one for which the host does not have a route back to the source IP address (it apparently dropped in from Mars). These days most hosts have a default route, meaning that there would be no such thing as a Martian packet, but to be safe and complete...
sysctl -w net.ipv4.conf.all.log_martians=1
sysctl -w net.ipv4.tcp_max_syn_backlog=1280

# Enable TCP_SYNCOOKIES to prevent SYN Flood Attack
#A SYN flood is a form of denial-of-service attack in which an attacker sends a succession of SYN requests to a target’s system. This is a well known type of attack and is generally not effective against modern networks. It works if a server allocates resources after receiving a SYN, but before it has received the ACK.
sysctl -w net.ipv4.tcp_syncookies=1
#########################################

INET_IF=eth0
LAN_IF=eth1
LAN=192.168.0.0/24
INTERNET=NET.WRK.RAN.GE/SUB.NET.MAS.KKK

# Flush all the Existing rules
iptables -F
iptables -t nat -F

#Log and DROP SYN Flood Attack Attempts and Related
#Block IP Spoofed-Sequence Number Prediction Attack.Referhttp://www.linuxtopia.org/Linux_Firewall_iptables/x6231.html
iptables -A INPUT -p tcp -m tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j LOG --log-prefix "SYN Flood Attempt:"
iptables -A INPUT -p tcp -m tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j REJECT --reject-with tcp-reset

# NEW but not SYN
iptables -A INPUT -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j LOG --log-prefix "New not SYN:"
iptables -A INPUT -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j DROP

# Block SYN Flood
iptables -A INPUT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j LOG --log-prefix "SYNFlood Attempt:"
iptables -A INPUT -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j DROP

iptables -A INPUT -p tcp -m state --state NEW -m tcp --tcp-flags SYN,RST,ACK SYN -m recent --set --name synflood --rsource
iptables -A INPUT -p tcp -m state --state NEW -m tcp --tcp-flags SYN,RST,ACK SYN -m recent --update --seconds 1 --hitcount 60 --name synflood --rsource -j LOG --log-prefix "SYNFLOOD"
iptables -A INPUT -p tcp -m state --state NEW -m tcp --tcp-flags SYN,RST,ACK SYN -m recent --update --seconds 1 --hitcount 60 --name synflood --rsource -j DROP

# Accept RESET Flagged Packets
iptables -A INPUT -p tcp -m tcp --tcp-flags RST RST -m limit --limit 2/sec --limit-burst 2 -j ACCEPT

# Drop FIN packets that is not accompanied with any ACK
iptables -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
iptables -A INPUT -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP

########iptables -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG,FIN,SYN,RST,PSH,ACK,URG -m state --state NEW-j DROP
iptables -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP

#Block NetBIOS and Samba Broadcast Floods
iptables -A INPUT -d 122.167.53.54 -i $INET_IF -p tcp -m tcp --dport 135:139 -j DROP
iptables -A INPUT -d 122.167.53.54 -i $INET_IF -p tcp -m tcp --dport 67:68 -j DROP

# Control over ICMP requests
# Allow time-exceeded
iptables -A INPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT
# Allow echo Request
#iptables -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
# Limit PING to 3 times/Minute .But burstable to a maximum of 10 Pings/Minute
iptables -A INPUT -p icmp -m limit --limit 3/min --limit-burst 10 -j ACCEPT

# Log PING Traffic Analysis details 10 times/minute
iptables -A INPUT -p icmp -m limit --limit 10/min --limit-burst 1 -j LOG --log-prefix "Ping DROP:"

# DROP Address mask request(ICMP Type 17)
iptables -A INPUT -p icmp -m icmp --icmp-type 17 -j DROP
#DROP Timestamp request(ICMP Type 13)
iptables -A INPUT -p icmp -m icmp --icmp-type 13 -j DROP
#Disable ICMP router solicitations and advertisements, and ICMP subnet mask requests and replies. An attacker might be able to use unsolicited advertisements and replies to misadjust host routing tables. An attack also might be able to use solicitations and requests to reverse engineer some details of your network infrastructure. It appears that you will have to do this with packet-filtering rules on the host.
# Router Advertisement (ICMP Type 9)
iptables -A INPUT -p icmp -m icmp --icmp-type 9 -j DROP
# Router Solicitation(ICMP Type 10)
iptables -A INPUT -p icmp -m icmp --icmp-type 10 -j DROP
#Drop all ICMP
#iptables -A INPUT -p icmp -j DROP

# Accept all ESTABLISHED and RELATED connections.Don't do a double check
iptables -A INPUT -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT

# Custom ACCEPT Rules for specific ports
iptables -A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
iptables -A INPUT -p tcp -m tcp -m multiport --dports 80,443,3306,25,143,110 -j ACCEPT
# iptables -A INPUT -p tcp -m tcp --dport 80 -m limit --limit 10/sec -j ACCEPT

# IP Spoofing preventions
#iptables -A INPUT -s $LAN -i $LAN_IF -j ACCEPT
#iptables -A INPUT -s 127.0.0.1 -i lo -j ACCEPT
#iptables -A INPUT -s $LAN -i lo -j ACCEPT
# Drop packets from Internet/LAN arriving at Loopback
iptables -A INPUT -s $INTERNET -i lo -j DROP
iptables -A INPUT -s $LAN -i lo -j DROP
# Drop packets arriving at Internet Interface that are not from Internet
iptables -A INPUT -s $LAN -i $INET_IF -j DROP
iptables -A INPUT -s ! $INTERNET -i $INET_IF -j DROP
# Drop packets at LAN Interface if they are not from LAN
iptables -A INPUT -s ! $LAN -i $LAN_IF -j DROP
iptables -A INPUT -s $INTERNET -i $LAN_IF -j DROP

# Drop DHCP requests
iptables -A INPUT -p udp -m udp --sport 68 --dport 67 -j DROP

#If you have a Microsoft Network on the outside of your firewall, you may also get flooded by Multicasts. We drop them so we do not get flooded by logs
iptables -A INPUT -i $INET_IF -d 224.0.0.0/8 -j DROP

# Log weird packets that don't match the above.
iptables -A INPUT -m limit --limit 3/min --limit-burst 3 -j LOG --log-prefix "IPT INPUT packet died: " --log-level 7

#Drop Packets in INVALID State
iptables -A INPUT -m state --state INVALID -j DROP

# Anyone who tried to portscan us is locked out for an entire day.

iptables -A INPUT -m recent --name portscan --rcheck --seconds 86400 -j DROP
iptables -A FORWARD -m recent --name portscan --rcheck --seconds 86400 -j DROP

# Once the day has passed, remove them from the portscan list
#iptables -A INPUT -m recent --name portscan --remove
#iptables -A FORWARD -m recent --name portscan --remove

# Block all aother know Attacks
# These rules add scanners to the portscan list, and log the attempt.
iptables -A INPUT -p tcp -m tcp -m recent --name portscan --set -j LOG --log-prefix "Portscan:"
iptables -A INPUT -p tcp -m tcp -m recent --name portscan --set -j DROP
iptables -A FORWARD -p tcp -m tcp -m recent --name portscan --set -j LOG --log-prefix "Portscan:"
iptables -A FORWARD -p tcp -m tcp -m recent --name portscan --set -j DROP
iptables -A INPUT -m recent --rcheck --seconds 86400 --name portscan --rsource -j DROP

iptables -A INPUT -p tcp -m tcp --dport 6670 -m limit --limit 3/hour -j LOG --log-prefix "Deepthroat scan"
iptables -A INPUT -p tcp -m tcp --dport 6670 -j DROP
iptables -A INPUT -p tcp -m tcp --dport 6711 -m limit --limit 3/hour -j LOG --log-prefix "Subseven scan"
iptables -A INPUT -p tcp -m tcp --dport 6711 -j DROP
iptables -A INPUT -p tcp -m tcp --dport 6712 -m limit --limit 3/hour -j LOG --log-prefix "Subseven scan"
iptables -A INPUT -p tcp -m tcp --dport 6712 -j DROP
iptables -A INPUT -p tcp -m tcp --dport 6713 -m limit --limit 3/hour -j LOG --log-prefix "Subseven scan"
iptables -A INPUT -p tcp -m tcp --dport 6713 -j DROP
iptables -A INPUT -p tcp -m tcp --dport 12345 -m limit --limit 3/hour -j LOG
iptables -A INPUT -p tcp -m tcp --dport 12345 -m limit --limit 3/hour -j LOG --log-prefix "Netbus scan"

iptables -A INPUT -p tcp -m tcp --dport 12345 -j DROP
iptables -A INPUT -p tcp -m tcp --dport 12346 -m limit --limit 3/hour -j LOG --log-prefix "Netbus scan"
iptables -A INPUT -p tcp -m tcp --dport 12346 -j DROP
iptables -A INPUT -p tcp -m tcp --dport 20034 -m limit --limit 3/hour -j LOG --log-prefix "Netbus scan"
iptables -A INPUT -p tcp -m tcp --dport 20034 -j DROP

iptables -A INPUT -p tcp -m tcp --dport 31337 -m limit --limit 3/hour -j LOG --log-prefix "Back orifice scan"
iptables -A INPUT -p tcp -m tcp --dport 31337 -j DROP
iptables -A INPUT -p tcp -m tcp --dport 6000 -m limit --limit 3/hour -j LOG --log-prefix "X-Windows Port"
iptables -A INPUT -p tcp -m tcp --dport 6000 -j DROP
iptables -A INPUT -p udp -m udp --dport 33434:33523 -j DROP
iptables -A INPUT -p tcp -m tcp --dport 113 -j REJECT --reject-with icmp-port-unreachable

iptables -A OUTPUT -p icmp -j ACCEPT
iptables -A OUTPUT -m limit --limit 3/min --limit-burst 3 -j LOG --log-prefix "IPT OUTPUT packet died: " --log-level 7
iptables -A OUTPUT -m state --state INVALID -j DROP
#iptables -A INPUT -p tcp --dport 1024:65535 -j ACCEPT
#iptables -A INPUT -j DROP
#iptables -A INPUT -p tcp -j DROP
# iptables -A INPUT -p udp -j DROP

##### Stop IP Spoofing ##########
SERVER_IP=122.167.53.54
# Add your IP range/IPs here,
#SPOOF_IPS="0.0.0.0/8 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 224.0.0.0/3"
SPOOF_IPS="0.0.0.0/8 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 224.0.0.0/3"
#SPOOF_IPS="127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 224.0.0.0/3"
iptables -A INPUT -s $SERVER_IP -j DROP
for ip in $SPOOF_IPS
do
iptables -A INPUT -s $ip -j DROP
done
## Now add net.ipv4.conf.all.rp_filter = 1 to sysctl.conf
sysctl -w net.ipv4.conf.all.rp_filter=1

References
Cromwell-intl.com
iptables-tutorial.frozentux.net
iptables-tutorial.frozentux.net/other/ip-sysctl.txt
cyberciti.biz
cyberciti.biz
faqs.org
newartisans.com