How to block attack 13000 port in Freebsd

want3d Member

Messages:: 13

Likes Received:: 0

Best Answers:: 0

Trophy Points:: 36

#1

Hello,
i am using ipfw, freebsd 7.2 32 bit

my ipfw.rules


IPF="ipfw -q add"
ipfw -q -f flush

#P2P FiXX
$IPF 4 allow all from 94.102.0.120 to any 12001
$IPF 5 allow all from 127.0.0.0/8 to any 12001
$IPF 6 deny all from any to me 12001
$IPF 7 allow all from 94.102.0.120 to any 14000
$IPF 8 allow all from 127.0.0.0/8 to any 14000
$IPF 9 deny all from any to me 14000
$IPF 10 allow all from 94.102.0.120 to any 14001
$IPF 11 allow all from 127.0.0.0/8 to any 14001
$IPF 12 deny all from any to me 14001
$IPF 13 allow all from 94.102.0.120 to any 14002
$IPF 14 allow all from 127.0.0.0/8 to any 14002
$IPF 15 deny all from any to me 14002
$IPF 16 allow all from 94.102.0.120 to any 14003
$IPF 17 allow all from 127.0.0.0/8 to any 14003
$IPF 18 deny all from any to me 14003
$IPF 19 allow all from 94.102.0.120 to any 14004
$IPF 20 allow all from 127.0.0.0/8 to any 14004
$IPF 21 deny all from any to me 14004
$IPF 22 allow all from 94.102.0.120 to any 14061
$IPF 23 allow all from 127.0.0.0/8 to any 14061
$IPF 24 deny all from any to me 14061
$IPF 25 allow all from 94.102.0.120 to any 14099
$IPF 26 allow all from 127.0.0.0/8 to any 14099
$IPF 27 deny all from any to me 14099
$IPF 28 allow all from 94.102.0.120 to any 17000
$IPF 29 allow all from 127.0.0.0/8 to any 17000
$IPF 30 deny all from any to me 17000
$IPF 31 allow all from 94.102.0.120 to any 17001
$IPF 32 allow all from 127.0.0.0/8 to any 17001
$IPF 33 deny all from any to me 17001
$IPF 34 allow all from 94.102.0.120 to any 17002
$IPF 35 allow all from 127.0.0.0/8 to any 17002
$IPF 36 deny all from any to me 17002
$IPF 37 allow all from 94.102.0.120 to any 17003
$IPF 38 allow all from 127.0.0.0/8 to any 17003
$IPF 39 deny all from any to me 17003
$IPF 40 allow all from 94.102.0.120 to any 17004
$IPF 41 allow all from 127.0.0.0/8 to any 17004
$IPF 42 deny all from any to me 17004
$IPF 43 allow all from 94.102.0.120 to any 17061
$IPF 44 allow all from 127.0.0.0/8 to any 17061
$IPF 45 deny all from any to me 17061
$IPF 46 allow all from 94.102.0.120 to any 17099
$IPF 47 allow all from 127.0.0.0/8 to any 17099
$IPF 48 deny all from any to me 17099
$IPF 49 allow all from 94.102.0.120 to any 19000
$IPF 50 allow all from 127.0.0.0/8 to any 19000
$IPF 51 deny all from any to me 19000
$IPF 52 allow all from 94.102.0.120 to any 19001
$IPF 53 allow all from 127.0.0.0/8 to any 19001
$IPF 54 deny all from any to me 19001
$IPF 55 allow all from 94.102.0.120 to any 19002
$IPF 56 allow all from 127.0.0.0/8 to any 19002
$IPF 57 deny all from any to me 19002
$IPF 58 allow all from 94.102.0.120 to any 19003
$IPF 59 allow all from 127.0.0.0/8 to any 19003
$IPF 60 deny all from any to me 19003
$IPF 61 allow all from 94.102.0.120 to any 19004
$IPF 62 allow all from 127.0.0.0/8 to any 19004
$IPF 63 deny all from any to me 19004
$IPF 64 allow all from 94.102.0.120 to any 19061
$IPF 65 allow all from 127.0.0.0/8 to any 19061
$IPF 66 deny all from any to me 19061
$IPF 67 allow all from 94.102.0.120 to any 19099
$IPF 68 allow all from 127.0.0.0/8 to any 19099
$IPF 69 deny all from any to me 19099
$IPF 70 allow all from 94.102.0.120 to any 21000
$IPF 71 allow all from 127.0.0.0/8 to any 21000
$IPF 72 deny all from any to me 21000
$IPF 73 allow all from 94.102.0.120 to any 21001
$IPF 74 allow all from 127.0.0.0/8 to any 21001
$IPF 75 deny all from any to me 21001
$IPF 76 allow all from 94.102.0.120 to any 21002
$IPF 77 allow all from 127.0.0.0/8 to any 21002
$IPF 78 deny all from any to me 21002
$IPF 79 allow all from 94.102.0.120 to any 21003
$IPF 80 allow all from 127.0.0.0/8 to any 21003
$IPF 81 deny all from any to me 21003
$IPF 82 allow all from 94.102.0.120 to any 21004
$IPF 83 allow all from 127.0.0.0/8 to any 21004
$IPF 84 deny all from any to me 21004
$IPF 85 allow all from 94.102.0.120 to any 21061
$IPF 86 allow all from 127.0.0.0/8 to any 21061
$IPF 87 deny all from any to me 21061
$IPF 88 allow all from 94.102.0.120 to any 21099
$IPF 89 allow all from 127.0.0.0/8 to any 21099
$IPF 90 deny all from any to me 21099
$IPF 91 allow all from 94.102.0.120 to any 15001
$IPF 92 allow all from 127.0.0.0/8 to any 15001
$IPF 93 deny all from any to me 15001
$IPF 200 allow tcp from any to any 11002 in
$IPF 210 allow tcp from any to any 11002 out
$IPF 200 allow udp from any to any 11002 in
$IPF 210 allow udp from any to any 11002 out
$IPF 200 allow tcp from any to any 13000 in
$IPF 210 allow tcp from any to any 13000 out
$IPF 200 allow tcp from any to any 13001 in
$IPF 210 allow tcp from any to any 13001 out
$IPF 200 allow tcp from any to any 13002 in
$IPF 210 allow tcp from any to any 13002 out
$IPF 200 allow tcp from any to any 13003 in
$IPF 210 allow tcp from any to any 13003 out
$IPF 200 allow tcp from any to any 13004 in
$IPF 210 allow tcp from any to any 13004 out
$IPF 200 allow tcp from any to any 13061 in
$IPF 210 allow tcp from any to any 13061 out
$IPF 200 allow tcp from any to any 13099 in
$IPF 210 allow tcp from any to any 13099 out


#Standart Regeln

$IPF 10000 allow all from any to any via lo0
$IPF 20000 deny all from any to 127.0.0.0/8
$IPF 30000 deny all from 127.0.0.0/8 to any
#$IPF 30000 deny all from ant to me 16000
$IPF 40000 allow all from any to any

Code (markup):

my netstat -an >

Active Internet connections (including servers)
Proto Recv-Q Send-Q  Local Address          Foreign Address        (state)
tcp4       0      0 94.102.0.120.13000     78.179.205.187.57011   SYN_RCVD
tcp4       0      0 94.102.0.120.13000     78.179.205.187.56995   SYN_RCVD
tcp4       0      0 94.102.0.120.13000     78.171.108.121.4817    SYN_RCVD
tcp4       0      0 94.102.0.120.13000     88.246.114.134.4721    SYN_RCVD
tcp4       0      0 94.102.0.120.13000     88.226.86.165.1342     SYN_RCVD
tcp4       0      0 94.102.0.120.13000     88.226.86.165.1318     SYN_RCVD
tcp4       0      0 94.102.0.120.13000     88.226.86.165.1314     SYN_RCVD
tcp4       0      0 94.102.0.120.13000     88.226.86.165.1308     SYN_RCVD
tcp4       0      0 94.102.0.120.13000     88.226.86.165.1302     SYN_RCVD
tcp4       0      0 94.102.0.120.13000     88.226.86.165.1238     SYN_RCVD
tcp4       0      0 94.102.0.120.13000     88.226.86.165.1138     SYN_RCVD
tcp4       0      0 94.102.0.120.13000     88.226.86.165.1080     SYN_RCVD
tcp4       0      0 94.102.0.120.13000     88.226.86.165.1058     SYN_RCVD
tcp4       0      0 94.102.0.120.13000     88.226.86.165.1044     SYN_RCVD
tcp4       0      0 94.102.0.120.13000     88.226.86.165.1038     SYN_RCVD
tcp4       0      0 94.102.0.120.13000     88.226.86.165.5000     SYN_RCVD
tcp4       0      0 94.102.0.120.13000     88.226.86.165.4962     SYN_RCVD
tcp4       0      0 94.102.0.120.13000     88.226.86.165.4956     SYN_RCVD
tcp4       0      0 94.102.0.120.13000     88.226.86.165.4910     SYN_RCVD
tcp4       0      0 94.102.0.120.13000     88.226.86.165.4906     SYN_RCVD
tcp4       0      0 94.102.0.120.13000     88.243.168.92.1150     SYN_RCVD
tcp4       0      0 94.102.0.120.13000     95.10.246.185.22212    SYN_RCVD
tcp4       0      0 94.102.0.120.13000     95.10.246.185.22210    SYN_RCVD
tcp4       0      0 94.102.0.120.13000     88.241.135.0.4034      SYN_RCVD
tcp4       0      0 94.102.0.120.13000     85.98.121.56.32937     SYN_RCVD
tcp4       0      0 94.102.0.120.13000     88.226.5.4.60363       SYN_RCVD
tcp4       0      0 94.102.0.120.13000     88.226.5.4.60353       SYN_RCVD
tcp4       0      0 94.102.0.120.13000     88.226.5.4.60349       SYN_RCVD
tcp4       0      0 94.102.0.120.13000     88.226.5.4.60347       SYN_RCVD
tcp4       0      0 94.102.0.120.13000     88.226.5.4.60343       SYN_RCVD
tcp4       0      0 94.102.0.120.13000     88.226.5.4.60341       SYN_RCVD
tcp4       0      0 94.102.0.120.13000     88.226.5.4.60741       SYN_RCVD
tcp4       0      0 94.102.0.120.13000     88.226.5.4.60739       SYN_RCVD
tcp4       0      0 94.102.0.120.13000     88.226.5.4.60737       SYN_RCVD
tcp4       0      0 94.102.0.120.13000     88.226.5.4.60725       SYN_RCVD
tcp4       0      0 94.102.0.120.13000     88.226.5.4.60721       SYN_RCVD
tcp4       0      0 94.102.0.120.13000     95.10.222.91.1786      SYN_RCVD
tcp4       0      0 94.102.0.120.13000     95.10.222.91.1904      SYN_RCVD
tcp4       0      0 94.102.0.120.13000     95.10.222.91.1886      SYN_RCVD
tcp4       0      0 94.102.0.120.13000     78.184.192.60.1517     SYN_RCVD
tcp4       0      0 94.102.0.120.13000     78.179.205.187.57012   SYN_RCVD
tcp4       0      0 94.102.0.120.13000     78.189.17.248.1093     SYN_RCVD
tcp4       0      0 94.102.0.120.13000     78.189.17.248.1091     SYN_RCVD
tcp4       0      0 94.102.0.120.13000     78.189.17.248.1089     SYN_RCVD
more...
...
...
..

Code (markup):

View attachment 13000_netstat.zip

Please help me.

want3d, Dec 26, 2010 IP

Sys Admin Active Member

Messages:: 20

Likes Received:: 0

Best Answers:: 0

Trophy Points:: 66

#2

Add the following to your /etc/ipfw.rules :

$IPF 220 deny tcp from any to any 13000 in
$IPF 230 deny udp from any to any 13000 in

Make sure your firewall is enabled :

firewall_enable="YES"

& Enable logging:

firewall_logging="YES"

Save your rules, Then run:

sh /etc/ipfw.rules

& list your firewall rules by:

ipfw list

I hope that helps.

Sys Admin, Dec 26, 2010 IP

want3d Member

Messages:: 13

Likes Received:: 0

Best Answers:: 0

Trophy Points:: 36

#3

Sorry i forget say this:

i have game in my freebsd server if i block 13000 port with ipfw , that time users cant join the game

so we cant block port. we need limit ip or ban.

want3d, Dec 26, 2010 IP

want3d Member

Messages:: 13

Likes Received:: 0

Best Answers:: 0

Trophy Points:: 36

#4

any bady can help me about this problem?

netstat -na | awk '{print $5}' | cut -f1,2,3,4 -d '.' | sort | uniq -c | sort -n

112 78.168.244.6
112 88.229.72.34
133 85.101.38.177
162 85.101.87.14
163 78.172.54.207
178 95.8.152.32
194 212.253.136.94
292 88.249.248.3
296 95.65.153.70
943 78.180.215.195
Click to expand...

want3d, Dec 27, 2010 IP

jarrodw Peon

Messages:: 31

Likes Received:: 0

Best Answers:: 0

Trophy Points:: 0

#5

for i `in netstat -na | awk '{print $5}' | cut -f1,2,3,4 -d '.' | sort | uniq -c | sort -n | awk -F" " '{print $2}'`; do echo $IPF 83 drop all from $ to any >> /etc/ipfw.rules ; done

Check the syntax on that and verify the output of the echo in the loop by removing the append redirection part.

jarrodw, Dec 30, 2010 IP

raffo77 Active Member

Messages:: 234

Likes Received:: 0

Best Answers:: 0

Trophy Points:: 51

#6

My Rules..

################ Start of IPFW rules file ###############################
# Flush out the list before we begin.
#ipfw -q -f flush

# Set rules command prefix
cmd="ipfw -q add"
pif="vr0" # public interface name of NIC
# facing the public Internet

ME="xx.xx.76.16"
SSH_PORT="22"
CMD="ipfw -q add"

$cmd 010 allow all from any to any via lo0
$cmd 010 allow all from any to any via vr0
#$cmd 014 divert natd ip from any to any in via $pif
$cmd 015 check-state

#$cmd 00310 deny icmp from any to any in via $pif
$cmd 00200 allow tcp from any to any 80 out via $pif setup keep-state

$cmd 00330 deny all from any to any frag in via $pif
$cmd 00400 allow tcp from any to me 80 in via $pif setup limit src-addr 2

ipfw pipe 1 config bw 100kbit/s delay 100ms
ipfw pipe 500 config bw 50Kbit/s queue 5
#ipfw add 500 pipe 500 tcp from any to any in setup

ipfw -q add allow tcp from any to me dst-port 80 out setup limit dst-port 5
#ipfw -q add 171 allow tcp from any to me 80 in via $pif setup limit src-addr 2

# Deny all inbound traffic from non-routable reserved address spaces
$cmd 300 deny all from 192.168.0.0/16 to any in via $pif #RFC 1918 private IP
$cmd 301 deny all from 172.16.0.0/12 to any in via $pif #RFC 1918 private IP
$cmd 302 deny all from 10.0.0.0/8 to any in via $pif #RFC 1918 private IP
$cmd 303 deny all from 127.0.0.0/8 to any in via $pif #loopback
$cmd 304 deny all from 0.0.0.0/8 to any in via $pif #loopback
$cmd 305 deny all from 169.254.0.0/16 to any in via $pif #DHCP auto-config
$cmd 306 deny all from 192.0.2.0/24 to any in via $pif #reserved for docs
$cmd 307 deny all from 204.152.64.0/23 to any in via $pif #Sun cluster
$cmd 308 deny all from 224.0.0.0/3 to any in via $pif #Class D & E multicast

# blocking illegal routing
$CMD deny ip from any to any ipoptions rr
$CMD deny ip from any to any ipoptions ts
$CMD deny ip from any to any ipoptions lsrr
$CMD deny ip from any to any ipoptions ssrr

# blocking operating system type sniffing by Nmap
$CMD deny tcp from any to any tcpflags syn,fin
$CMD deny tcp from any to any tcpflags syn,rst

# blocking others miscellaneous attack
$CMD deny tcp from any 0 to any
$CMD deny tcp from any to any 0
$CMD deny udp from any 0 to any
$CMD deny udp from any to any 0

# egress filtering

# no comment
$CMD allow ip from $ME to any keep-state

# no comment
$CMD deny ip from $ME to any

# ingress filtering

# SSH access granted
$CMD allow tcp from any to $ME 22
$CMD allow tcp from any to $ME 80

# ICMP types 3,5,8,11,0,30 allowed
$CMD allow icmp from any to $ME icmptypes 3,5,8,11,0,30

# deny all others
$CMD deny log ip from any to $ME

#$cmd 00332 deny tcp from any to any established in via $pif
Click to expand...

ipfw -q add allow tcp from any to me dst-port 80 out setup limit dst-port 5
This limit max 5 connections at the same time for port 80.

raffo77, Jan 12, 2011 IP

Log in or Sign up

Advertising (learn more)

How to block attack 13000 port in Freebsd

want3d Member

Sys Admin Active Member

want3d Member

want3d Member

jarrodw Peon

raffo77 Active Member

Log in or Sign up

Advertising (learn more)

How to block attack 13000 port in Freebsd

want3d Member

Sys Admin Active Member

want3d Member

want3d Member

jarrodw Peon

raffo77 Active Member

Useful Searches