Recommended Posts

I want to create a game server in debian linux and control it through an ssh session. I run my current server on windows 7 and it sometimes stops responding and eats up too much ram so I decided to opt for something stable and way more secure. One other problem that I found is that with windows 7 I cannot set up different mount points for /var or /var/log this is a problem because bots may enter the server, spam, fill the disk and crash the system. (I only have one disk :D so symbolic links have no use here)

I have some set of rules in comodo firewall that work pretty well for my game server and ssh but I have no clue about how to adapt them to iptables.

Game server


Allow udp in: source address any; destination address any; source address any; destination port 27015
The following rules are needed for authentication, anti-cheat and updates. I analysed the packets and set up these rules.
Allow udp out: source address any; destination address any; source address 26900; destination port any
Allow tcp out: source address any; destination address any; source address any; destination port 27030-27039
Allow udp in: source address any; destination address any; source address any; destination port 26900
Allow tco out:source address any; destination address any; source address any; destination port 80
[/CODE]

[u][i][b]ssh server[/b][/i][/u]

For the ssh I need to accept incoming tcp connections to port 22 and outgoing tcp connection from port 22 right ?

If none of those rules are triggered I want to have the packets dropped. For instance, if the incoming packet is a response to a certain request from my computer it should be accepted.

I would also like to run my game server as a daemon, set the game server with high priority so that its (cpu) requests have precedence (just like a priority queue), and maybe chroot/sandbox so that if the application, that has priviliges, gets compromised hackers can not inject code and damage the system. Is there anything else that I should consider?

I do this on windows 7 with comodo which comes with a sandbox and packet filtering, and the task manager. So command line environment is a bit hard for me.

Thanks.

Link to comment
https://www.neowin.net/forum/topic/1093025-iptables-rules/
Share on other sites

What is this suppose to mean?

source address 26900;

Is that support to be the source port? Very strange to see source port rules. Most applications don't use a fixed source port. Only thing I can think of sometimes do is active ftp session server uses source port 20, and dns can sometimes be setup to use 53 as source as well as destination.

Other than those rules are pretty straight forward. As to your game server - is this server directly exposed to the public net? Are you not behind a nat router? You would setup those rules at the router than, not the firewall on the host.

As to ssh, yes 22 is standard port - does not have to be that port, you can use whatever port you want. As to outbound - that would be the source port of who connected, that is going to be random.

the outbound connections would be handled by the state table, if you allow inbound 22 - then it would automatic allow the return connection.

There are quite a few iptables frontends to choose from, you don't have to do it from the command line if your lacking in that skill set. I would prob suggest shorewall as get started one - here is info http://wiki.debian.org/HowTo/shorewall

You could also go with webmin, makes for a nice gui to control your linux box from. http://www.webmin.com/ and has firewall control features.

I am confused about your mount points comment for windows 7?? You can mount disks to whatever folder you want? So yes it would be quite possible to have disk/partition mounted as var folder.

Again -- how is this game server connected to the internet? It has a public IP? Or is its ip 10.x.x.x, 192.168.x.x, 172.16-31.x.x ?

It has a public IP. ye its supposed to be the source port ( is there a way to change it xD i can't edit it now ). It is a half life dedicated server, I don't really know why they need all those connections maybe its to validate a server as a valid steam server ( because there exists cracked versions of it), vac anti-cheat update, masterserver update to show my ip in the internet server list in the game, and server update port 80. I used whois on several ip addresses that the firewall logged and it was from valve so it must be needed. I don't really know why this is needed:

Allow udp in: source address any;  destination address any; source port any; destination port 26900[/CODE]

I did whois on the ip that requested that connection and it was a valve registered one, so I added it to firewall.

I don't really know why they fixed the 26900 port. I remember it had something to do with, vac - connection to steam servers. I say this cause whenever I remove that rule it printed out that it could not connect to steam servers.

the outbound connections would be handled by the state table, if you allow inbound 22 - then it would automatic allow the return connection.
Didn't understand this part. I know there are many tables in iptables like: filter, mangle, nat, raw. All those tables are read when a packet is received to determine its faith. Is there a tutorial online or book I can buy so that I can learn that stuff? Didn't find anything good on google.

Is there a way to sandbox hlds ? Thanks, budman you're always very helpful. I already have the 26900, 22 and 27015 ports opened on my router.

By the way is there a way to add filtering rules to a specific application rather than to the whole system ( Global rules vs Application rules ) and is it possible for the game server to have precendence over other software in regards to the cpu priority queue, in windows there is a thing called priority.

AH I think I know why they have this rule:

Allow udp in: source address any;  destination address any; source port any; destination port 26900[/CODE]

There is something called rcon, which is basically something like ssh that enables admins to mess with the half life dedicated server commands remotely, like change map, etc.

My point about windows 7 was that, as far as I know, there is not something like var which can be mounted in a separate partition where all variable data is stored ( files are scattered all over the system); if a bot attacked my server and created many logs the disk would get full and consequently crash the OS. I think it would be stupid to create symbolic links for every server software in windows for hlds, ssh, etc and store the logs in another partition. (lots of work)

'I already have the 26900, 22 and 27015 ports opened on my router."

So your forwarding ports on your router, so I have to ask how this box is on public IP? "It has a public IP" <--- do you mean your router has a pubic IP and you forward traffic to this game server?

If your having to forward/allow ports on the router - I have to assume its natting, so your box would not actually have a public IP?

So this server your running has NO Private IP address?

If your game server is behind a NAT router - then you have little need of setting up firewall rules on the box itself. Unless its connected to some hostile local network?

Please layout how you have this server your running connected to the network/internet.

so for example - here is my ubuntu server, that I ssh too all the time from the public internet, as you can see it has no IPv4 public IP on it..

budman@ubuntu:~$ ifconfig
eth0	  Link encap:Ethernet  HWaddr 00:0c:29:97:69:07
		  inet addr:192.168.1.7  Bcast:192.168.1.255  Mask:255.255.255.0
		  inet6 addr: fe80::20c:29ff:fe97:6907/64 Scope:Link
		  inet6 addr: 2001:470:snipped:snipped::777/64 Scope:Global
		  UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
		  RX packets:59076 errors:0 dropped:70 overruns:0 frame:0
		  TX packets:10007 errors:0 dropped:0 overruns:0 carrier:0
		  collisions:0 txqueuelen:1000
		  RX bytes:71881060 (71.8 MB)  TX bytes:956773 (956.7 KB)

Could you please post the output of your ifconfig

As you can see I am not doing any special anything with its host firewall. I can access its http server, etc. from my local lan - but not the internet, I run inbound traffic (input) through sshguard chain is all, this will block bruteforce attacks on my ssh server to keep my logs cleaner to look at. They never going to get past the public key auth only. But they do fill up the logs if you don't block them after a few hits.

iptables -L
Chain INPUT (policy ACCEPT)
target	 prot opt source			   destination
sshguard   all  --  anywhere			 anywhere

Chain FORWARD (policy ACCEPT)
target	 prot opt source			   destination

Chain OUTPUT (policy ACCEPT)
target	 prot opt source			   destination

Chain sshguard (1 references)
target	 prot opt source			   destination

These are all the ports that are open/listening on the box, but only ssh is open from the public internet.

Starting Nmap 6.01 ( http://nmap.org ) at 2012-07-22 09:50 Central Daylight Time
Nmap scan report for ubuntu.local.lan (192.168.1.7)
Host is up (0.00063s latency).
Not shown: 95 closed ports

PORT	  STATE SERVICE
22/tcp	open  ssh
53/tcp	open  domain
80/tcp	open  http
443/tcp   open  https
10000/tcp open  snet-sensor-mgmt

MAC Address: 00:0C:29:97:69:07 (VMware)
Nmap done: 1 IP address (1 host up) scanned in 0.20 seconds

Yeah that's exactly it,

router has a pubic IP and you forward traffic to this game server
. My nat router is forwarding the "server stuff" to my server box which has a local/lan ip. The mask is 255.255.255.0, the router's ip address is 192.168.1.1 . The box has the following local ip 192.168.1.70. I edited the two last posts while you were writing yours can you please have a look at them? Sorry.

So your behind a NAT, so are there machines on your local machines that are hostile?? If not then you don't need any specific firewall rules on your game server. The rules for inbound are created on your router.

"Didn't understand this part."

So you don't understand what a state is? Yeah I would highly suggest you turn off the firewall on your game server, you clearly have no need of it! Just forward the ports you need to run your game server on your router and you will be fine.

As in the state of the tcp connection. You don't know what a stateful firewall is? These have been the norm since early early 90's

Here is the thing, if you do not understand how to use a firewall, its only going to cause you grief - highly unlikely it will actually be configured in such a way that do anything more than what your nat router is already doing for you.

If you have no trust issues with the machines on your local network, if this machine does not leave this trusted local network - you have little need of a host firewall. Be it a windows machine, linux, bsd, os x, no matter what the OS is.

Your nat router currently blocks all unsolicited traffic to any box on your network. Your game server included. If you need to access specific ports from the public net without that connection being an answer to something you requested. For example me creating a session to your ssh server, this would be unsolicited traffic and unless you forward that on your router to your ssh server, I would never get to any machine on your network.

I would suggest if you want to run a game server, then read what ports you need to open up on your firewall on their website and set those up in your router. Turn off the local firewall on the game server, or set it to any any and setup sshguard if your going to be running ssh server on it. If your going to run ssh server to public net, I would HIGHLY suggest you turn off password auth and only allow public key! And depending on where you need access from, you might want to change the port to remove hits so your logs stay cleaner. A ssh server on the public net is like a buglight on your front porch -- your going to see traffic!

Jul 21 18:35:39 ubuntu sshguard[1117]: Blocking 37.123.96.242:4 for &gt;630secs: 40 danger in 4 attacks over 4 seconds (all: 40d in 1 abuses over 4s).
Jul 22 03:12:55 ubuntu sshguard[1117]: Blocking 59.175.218.166:4 for &gt;630secs: 40 danger in 4 attacks over 3 seconds (all: 40d in 1 abuses over 3s).
Jul 22 06:49:47 ubuntu sshguard[1117]: Blocking 201.17.51.69:4 for &gt;630secs: 40 danger in 4 attacks over 158 seconds (all: 40d in 1 abuses over 158s)

This topic is now closed to further replies.
  • Posts

    • YouTube has finally brought back its DMs feature, but only in these countries by David Uzondu Late last year, YouTube started testing a "new" way to share videos directly with friends, without having to leave the app. Now, the video giant has announced that is now rolling out a revamped direct messaging inbox, which lets you share videos, Shorts, and live streams and have conversations about them, directly on YouTube. The platform limits this feature to 18+ users who are signed in to a verified channel and use the latest mobile app version. Direct messaging on YouTube first became a thing back in 2017 inside the mobile app (later renamed to "Messages"), where users could chat one-on-one and share clips directly, but all that came to an end on September 18, 2019, when Google decided to shut it down after giving users a month to download a .zip file archive of their past chats. No one really knows why YouTube killed the feature, but users were encouraged to migrate to the public Comments section, on Community tab posts, and via YouTube Stories. The previous incarnation suffered from moderation challenges, prompting Google to implement stricter safety guidelines and age verifications for this new iteration. Here's a list of the countries where the re-launched feature is currently available, though note that Brand Accounts do not have access to it, at least for now: Countries American Samoa Austria Belgium Brazil Bulgaria Croatia Cyprus Czech Republic Denmark Estonia Finland France Germany Greece Guam Hungary Iceland Ireland Italy Latvia Liechtenstein Lithuania Luxembourg Malta Netherlands Northern Mariana Islands Norway Poland Portugal Puerto Rico Romania Singapore Slovakia Slovenia Spain Sweden Switzerland U.S. Virgin Islands United Kingdom United States Before you can use the feature, you first have to send an invite link to your contact. Invite links expire exactly seven days after you create them. If the person on the other end accepts the invite, you can exchange videos directly and text back and forth inside the app. To delete a message, just long-press on the message and tap unsend to remove it for both users. You can also delete entire conversations by long-pressing the thread and selecting delete, but the other person will continue to see the chat history on their end. To make sure everything remains safe, YouTube monitors these messages to ensure they follow Community Guidelines.
    • The problem of course is simply that government does not always know best. My point is that agency is taken away from the EU consumer in these cases. I'm sorry, but I do not believe that governments (politicians) are inherently good, and "looking out for me." Primarily they look to themselves and their own personal desires first, foremost, and always. When the EU or the DOJ fines these companies, claiming to "represent the welfare of the consumer," how much of these billion-dollar judgments are handed to the consumers they claim to represent? Not even a dollar, as I've seen. Yet the EUC lawyers who are paid to sit around and dream up these suits make huge commissions on the fines the EUC adjudicates, which is an ironclad fact I hope everyone is aware of. It's also rank corruption, of course, but that's another topic. Last, when the EU inflicts these judgments, or the DOJ, take your pick, the costs are bundled right along in the cost of the goods and services these companies provide the consumers they are "looking out for." If you are someone who believes his government is his savior then you have my condolences. I think Apple is right here, because the whole scheme of consumer choice is that consumers pick and choose among the products companies offer. Microsoft Windows is more compatible with third party software and hardware than any desktop OS on Earth, which is my sole reason for choosing it. Just because the EUC forces companies do certain things it knows the companies do not want to do, "or else", has no bearing on consumer benefit. This Siri thing is almost idiotic it's so infantile. But this is what the EUC does when the EU in Brussels becomes cash-strapped and needs a big infusion of cash. Some people get upset by "big companies" but it's the opposite when governments dwarf the size and scope of these companies, which is so obvious it hurts.... I mean you can't honestly believe that forcing Apple to do things with Siri it has its own reasons to decline is something that "opens up" Apple, do you? Say it aint' so...
    • Looks like many years since the request was made, a directory tree view finally may be added. https://github.com/files-community/Files/pull/18537
    • Is it still super slow or has it improved on that area?
    • There's this from last year https://gist.github.com/threat...364659a8887841aa43deca4efd9 but nothing about a buffer overflow that MS somehow can't code against. No matter what, it makes sense to take a "protected by default" approach.
  • Recent Achievements

    • One Month Later
      sjbousquet earned a badge
      One Month Later
    • Week One Done
      sjbousquet earned a badge
      Week One Done
    • First Post
      DragonOfMercy earned a badge
      First Post
    • First Post
      bella52 earned a badge
      First Post
    • Reacting Well
      Techinmay earned a badge
      Reacting Well
  • Popular Contributors

    1. 1
      +primortal
      501
    2. 2
      PsYcHoKiLLa
      213
    3. 3
      +Edouard
      156
    4. 4
      Steven P.
      84
    5. 5
      FloatingFatMan
      72
  • Tell a friend

    Love Neowin? Tell a friend!