webserver.ferm

# -*- shell-script -*-
#
# Ferm example script
#
# Firewall configuration for a web and SMTP server.
#
# Author: Max Kellermann <[email protected]>
#

@def $NET_TRUSTED = 195.135.144.144/28;

table filter {
    chain INPUT {
        policy DROP;

        # connection tracking
        mod state state INVALID DROP;
        mod state state (ESTABLISHED RELATED) ACCEPT;

        # allow local connections
        interface lo ACCEPT;

        # respond to ping
        proto icmp icmp-type echo-request ACCEPT;

        # remote administration from the company network
        saddr $NET_TRUSTED proto tcp dport ssh ACCEPT;

        # our services to the world
        proto tcp dport (http https smtp) ACCEPT;

        # the rest is dropped by the above policy
    }

    # outgoing connections are not limited
    chain OUTPUT policy ACCEPT;

    # this is not a router
    chain FORWARD policy DROP;
}

antiddos.ferm

# -*- shell-script -*-
#
# Ferm example script
#
# Firewall configuration to prevent basic tcp DoS/DDoS attacks
#
# Authors: Vlad Glagolev <[email protected]>, Stepan Rogov <[email protected]>
#

@def &ANTIDDOS($ports, $seconds, $hits, $time, $exceptions) = {
        proto tcp dport $ports @subchain "ddos_check" {
                # allow every exception as-is
                saddr $exceptions ACCEPT;

                # connection tracking
                mod conntrack ctstate (ESTABLISHED RELATED) ACCEPT;

                # check for IPs overloading $hits/$seconds rate and block them
                mod recent name "ddos_check" rcheck seconds $seconds hitcount $hits @subchain "ddos" {
                        mod recent set name "ddos" NOP;

                        DROP;
                }

                # register a packet in "ddos_check" list
                mod recent set name "ddos_check" NOP;

                # check IP in "ddos" list
                # if it exists and had been registered in the last $time seconds -- drop it
                mod recent name "ddos" rcheck seconds $time DROP;

                # remove packet from "ddos" list
                mod recent name "ddos" remove NOP;

                # allow ONLY new connections
                mod conntrack ctstate NEW ACCEPT;

                DROP;
        }
}

table filter {
        chain INPUT {
                policy DROP;

                # connection tracking
                mod state state INVALID REJECT;
                mod state state (ESTABLISHED RELATED) ACCEPT;

                # allow local connections
                interface lo ACCEPT;

                # ban ip addresses for 1 day which connect more than 50 times in 3 seconds,
                # exception is IP: 94.29.90.101
                &ANTIDDOS((80, 443), 50, 3, 86400, 94.29.90.101);

                # the rest is dropped by the above policy
        }

        # outgoing connections are not limited
        chain OUTPUT policy ACCEPT;

        # this is not a router
        chain FORWARD policy DROP;
}

ipv6.ferm

# -*- shell-script -*-
#
# Ferm example script
#
# IPv6 demo.
#
# Author: Max Kellermann <[email protected]>
#

domain ip6 table filter {
    chain INPUT {
        policy DROP;

        # connection tracking
        mod state state INVALID DROP;
        mod state state (ESTABLISHED RELATED) ACCEPT;

        # allow local connections
        interface lo ACCEPT;

        # allow ICMP (for neighbor solicitation, like ARP for IPv4)
        proto ipv6-icmp ACCEPT;

        # allow SSH connections
        proto tcp dport ssh ACCEPT;

        # ident connections are also allowed
        proto tcp dport auth ACCEPT;

        # the rest is dropped by the above policy
    }

    # outgoing connections are not limited
    chain OUTPUT policy ACCEPT;

    # this is not a router
    chain FORWARD policy DROP;
}

The filter Table

We’ll write to the default table filter:

table filter {

And we’ll start with the INPUT chain:

chain INPUT {

Seems like you start with a your catch-all, in this case I want to DROP anything that isn’t explicitly allowed, hopefully this will prevent some attacks just by not advertising this server exists.

policy DROP;

I am still not entirely sure what “connection tracking” is or means, but this rules controls this and here is a brief synopsis of the idea.

mod state state INVALID DROP;
mod state state (ESTABLISHED RELATED) ACCEPT;

This is rather self-explanatory, we allow local connections through the firewall, it probably is safe to say this won’t hurt, if an attacker is coming from local we got bigger fish to fry…

interface lo ACCEPT;

Contrary to the default settings, I do not want to respond to ICMP:

proto icmp icmp-type echo-request DROP;

Now for the things that this server needs to have open. The use of dport refers to the intended destination of the request.

proto tcp dport (http https) ACCEPT;

We also want to accept SSH connections. I might change this in the future to be over a port other than the default, but for now 22 is good enough!

proto tcp dport ssh ACCEPT;

Everything else is dropped. We also want to allow all outgoing connections, though I might look into changing this eventually and would like to log all outgoing connections at the very least. And since we’re a web server and are not in the business of routing for other machines, we will drop all FOWARD requests.

    }
    chain OUTPUT policy ACCEPT;
    chain FORWARD policy DROP;
}

Anti-DDoS logic

To mitigate DDoS attacks, we can define a function to track requests over time for a specfic IP address and if it exceeds a given threshold, we block that address for some length of time. This comes right from the examples document, except I removed the IP address exceptions logic because I don’t have a static address and the address I do get is sometimes shared with other Starlink customers.

@def &ANTIDDOS($ports, $seconds, $hits, $time) = {
        proto tcp dport $ports @subchain "ddos_check" {
                mod conntrack ctstate (ESTABLISHED RELATED) ACCEPT;
                mod recent name "ddos_check" rcheck seconds $seconds hitcount $hits @subchain "ddos" {
                        mod recent set name "ddos" NOP;
                        DROP;
                }
                mod recent set name "ddos_check" NOP;
                mod recent name "ddos" rcheck seconds $time DROP;
                mod recent name "ddos" remove NOP;
                mod conntrack ctstate NEW ACCEPT;
                DROP;
        }
}

To use this we want to do two things, first we need to define this before our filter table declaration and in that table we want to replace the line(s) that declare ports we accept with the following which says “check requests to ports 22, 88, and 443 to see if the requester has made more than 50 requests in the last three seconds, and if so, drop their request and ban them for 86400 seconds.” The docs say to do (22, 80, 443) however if you try to do that ferm will give a warning and rejects the configuration file. According to the error, arrays should not be comma separated but should just have spaces. I have opened an issue for this and hopefully it’ll be resolved before anyone else gets confused.

&ANTIDDOS((22 80 443), 50, 3, 86400);

IPv6

My ipv6 filter table is also right from the docs, except I am dropping ICMP and I’m routing traffic through the anti-DDoS logic.

domain ip6 table filter {
    chain INPUT {
        policy DROP;
        mod state state INVALID DROP;
        mod state state (ESTABLISHED RELATED) ACCEPT;

        interface lo ACCEPT;
        proto ipv6-icmp DROP;

        &ANTIDDOS((22 80 443), 50, 3, 86400);
    }
    chain OUTPUT policy ACCEPT;
    chain FORWARD policy DROP;
}