I've been working on a project that is nearly complete: to be able to kill my children's internet connections at the touch of a button. I've implemented part of the solution by basically calling:
ufw deny from IP
The threat of killing their internet works half the time, and the above works half of the remaining half. Where I run into issues are long youtube videos. It's sometimes convenient that existing connections continue, but I'd also like to have a button that would kill all existing traffic to/from the IP. This has proved much more difficult than expected.
I've tried cutter, which doesn't even seem to work on Ubuntu 14.04. I've tried tcpkill. It seems to run, but doesn't seem to do anything (I've supplied both Ethernet interfaces) and seems to want to continually run. Although my ufw is persistent, I'd rather the kill immediately is state-less and just drop all existing connections.
Conntrack sounded promising (http://conntrack-tools.netfilter.org/manual.html), and had the following:
Delete one entry, this can be used to block traffic if:
You have a stateful rule-set that blocks traffic in INVALID state.
You have set /proc/sys/net/ipv4/netfilter/ip_conntrack_tcp_loose or /proc/sys/net/netfilter/nf_conntrack_tcp_loose, depending on your kernel version, to zero.
The command
conntrack -D -s <IP>
seems to take and show deletions of something, but the youtube video keeps humming along and I see connections reforming when I do
conntrack -L
I've done
echo 0 > nf_conntrack_tcp_loose
and cat'ed it to make sure it stuck, but it doesn't seem to delete the connections.
I'm not 100% sure what "a stateful rule-set that blocks traffic in INVALID state" means, but I do see the follow rule
DROP all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID
when doing a "iptables -L -n", if that's what it references.
I've found the following:
iptables -A INPUT -s "$BLOCK_THIS_IP" -j DROP
It didn't work for me, but it's likely due to it being proceeded with a general rule to allow all traffic on the internal network, and with reordering it might work. I'd rather not mix iptables commands with ufw commands. Given that UFW has already setup the iptables to deny any new connections, setting up a drop in iptables seems redundant, and I really don't want to mix UFW with iptable commands if I can help it.
Can anyone tell me how I might use "conntrack -D" to end existing connections to/from a host, or some other way to this short of bringing the network or interface down and then back? Figuring out how to do this has been more elusive than imagined.
Thanks,
Mark
I did some more testing that I'd like to share.
First, started checking the kill with just a ssh connection. This actually turned out fairly easy. Both the tcpkill method and conntrack -D methods worked. (I also tried with nf_conntrack_tcp_loose=1 (default for my system) and confirmed that you do need to set it to 0 for the conntrack -D method to work).
I don't know how the youtube connections work, but they seem to be hard to kill. If I just call conntrack -D IP method once, it does not die. But if I setup the following loop
while sleep 1 ; do conntrack -D -s 10.42.43.25 ; done
it would eventually die.
The log was:
conntrack v1.4.1 (conntrack-tools): 17 flow entries have been deleted.
udp 17 10 src=___.___.43.25 dst=___.___.43.1 sport=57859 dport=53 src=___.___.43.1 dst=___.___.43.25 sport=53 dport=57859 mark=0 use=1
tcp 6 431980 ESTABLISHED src=___.___.43.25 dst=___.___.163.19 sport=59023 dport=80 src=___.___.163.19 dst=___.___.221.222 sport=80 dport=59023 [ASSURED] mark=0 use=1
tcp 6 431980 ESTABLISHED src=___.___.43.25 dst=___.___.218.3 sport=59033 dport=443 src=___.___.218.3 dst=___.___.221.222 sport=443 dport=59033 [ASSURED] mark=0 use=1
tcp 6 102 TIME_WAIT src=___.___.43.25 dst=___.___.242.247 sport=59044 dport=443 src=___.___.242.247 dst=___.___.221.222 sport=443 dport=59044 [ASSURED] mark=0 use=1
tcp 6 431980 ESTABLISHED src=___.___.43.25 dst=___.___.247.248 sport=59024 dport=443 src=___.___.247.248 dst=___.___.221.222 sport=443 dport=59024 [ASSURED] mark=0 use=1
tcp 6 299 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59042 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59042 [ASSURED] mark=0 use=1
udp 17 0 src=___.___.43.25 dst=___.___.43.1 sport=60775 dport=53 src=___.___.43.1 dst=___.___.43.25 sport=53 dport=60775 mark=0 use=1
tcp 6 431980 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.78 sport=59035 dport=443 src=sss.sss.sss.78 dst=___.___.221.222 sport=443 dport=59035 [ASSURED] mark=0 use=1
tcp 6 97 TIME_WAIT src=___.___.43.25 dst=___.___.234.25 sport=59039 dport=443 src=___.___.234.25 dst=___.___.221.222 sport=443 dport=59039 [ASSURED] mark=0 use=1
udp 17 11 src=___.___.43.25 dst=___.___.43.1 sport=56527 dport=53 src=___.___.43.1 dst=___.___.43.25 sport=53 dport=56527 mark=0 use=1
tcp 6 431980 ESTABLISHED src=___.___.43.25 dst=___.___.218.110 sport=59020 dport=443 src=___.___.218.110 dst=___.___.221.222 sport=443 dport=59020 [ASSURED] mark=0 use=1
tcp 6 431999 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59043 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59043 [ASSURED] mark=0 use=1
tcp 6 431948 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.97 sport=59025 dport=443 src=sss.sss.sss.97 dst=___.___.221.222 sport=443 dport=59025 [ASSURED] mark=0 use=1
udp 17 6 src=___.___.43.25 dst=___.___.43.1 sport=53498 dport=53 src=___.___.43.1 dst=___.___.43.25 sport=53 dport=53498 mark=0 use=1
tcp 6 431988 ESTABLISHED src=___.___.43.25 dst=___.___.10.188 sport=58987 dport=5228 src=___.___.10.188 dst=___.___.221.222 sport=5228 dport=58987 [ASSURED] mark=0 use=1
tcp 6 431999 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.138 sport=59021 dport=443 src=sss.sss.sss.138 dst=___.___.221.222 sport=443 dport=59021 [ASSURED] mark=0 use=1
tcp 6 431979 ESTABLISHED src=___.___.43.25 dst=___.___.103.74 sport=59038 dport=443 src=___.___.103.74 dst=___.___.221.222 sport=443 dport=59038 [ASSURED] mark=0 use=1
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 2 flow entries have been deleted.
tcp 6 299 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59049 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59049 [ASSURED] mark=0 use=1
tcp 6 299 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59050 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59050 [ASSURED] mark=0 use=1
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 1 flow entries have been deleted.
tcp 6 299 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59052 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59052 [ASSURED] mark=0 use=1
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 1 flow entries have been deleted.
tcp 6 299 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59053 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59053 [ASSURED] mark=0 use=1
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 1 flow entries have been deleted.
tcp 6 431999 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59055 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59055 [ASSURED] mark=0 use=1
...
tcp 6 299 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59089 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59089 [ASSURED] mark=0 use=1
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 1 flow entries have been deleted.
tcp 6 300 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59090 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59090 [ASSURED] mark=0 use=1
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 1 flow entries have been deleted.
tcp 6 299 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59092 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59092 [ASSURED] mark=0 use=2
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 1 flow entries have been deleted.
tcp 6 300 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.138 sport=59094 dport=443 src=sss.sss.sss.138 dst=___.___.221.222 sport=443 dport=59094 [ASSURED] mark=0 use=1
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 1 flow entries have been deleted.
tcp 6 299 ESTABLISHED src=___.___.43.25 dst=sss.sss.sss.177 sport=59095 dport=443 src=sss.sss.sss.177 dst=___.___.221.222 sport=443 dport=59095 [ASSURED] mark=0 use=1
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
conntrack v1.4.1 (conntrack-tools): 0 flow entries have been deleted.
... (finally dead)
So the question now is what is happening here? How are flow entries being established after I've initially deleted all the flows? What am I missing? Is there something on how this all works where I can't simply close this down with a one-shot command?
Just some more information. I've convinced myself that local buffering isn't affecting my perception what is happening. After I've done a single delete I can see amount of data in the buffer continue to grow. Also, I can take a long video and drag the youtube frame time greatly into the future well beyond the buffer water-mark and the video works at the much later date.
Chain INPUT (policy DROP)
target prot opt source destination
fail2ban-ssh tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 22
ufw-before-logging-input all -- 0.0.0.0/0 0.0.0.0/0
ufw-before-input all -- 0.0.0.0/0 0.0.0.0/0
ufw-after-input all -- 0.0.0.0/0 0.0.0.0/0
ufw-after-logging-input all -- 0.0.0.0/0 0.0.0.0/0
ufw-reject-input all -- 0.0.0.0/0 0.0.0.0/0
ufw-track-input all -- 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ufw-before-logging-forward all -- 0.0.0.0/0 0.0.0.0/0
ufw-before-forward all -- 0.0.0.0/0 0.0.0.0/0
ufw-after-forward all -- 0.0.0.0/0 0.0.0.0/0
ufw-after-logging-forward all -- 0.0.0.0/0 0.0.0.0/0
ufw-reject-forward all -- 0.0.0.0/0 0.0.0.0/0
ufw-track-forward all -- 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ufw-before-logging-output all -- 0.0.0.0/0 0.0.0.0/0
ufw-before-output all -- 0.0.0.0/0 0.0.0.0/0
ufw-after-output all -- 0.0.0.0/0 0.0.0.0/0
ufw-after-logging-output all -- 0.0.0.0/0 0.0.0.0/0
ufw-reject-output all -- 0.0.0.0/0 0.0.0.0/0
ufw-track-output all -- 0.0.0.0/0 0.0.0.0/0
Chain fail2ban-ssh (1 references)
target prot opt source destination
REJECT all -- 116.31.116.41 0.0.0.0/0 reject-with icmp-port-unreachable
RETURN all -- 0.0.0.0/0 0.0.0.0/0
Chain ufw-after-forward (1 references)
target prot opt source destination
Chain ufw-after-input (1 references)
target prot opt source destination
ufw-skip-to-policy-input udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:137
ufw-skip-to-policy-input udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:138
ufw-skip-to-policy-input tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:139
ufw-skip-to-policy-input tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:445
ufw-skip-to-policy-input udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:67
ufw-skip-to-policy-input udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:68
ufw-skip-to-policy-input all -- 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match dst-type BROADCAST
Chain ufw-after-logging-forward (1 references)
target prot opt source destination
Chain ufw-after-logging-input (1 references)
target prot opt source destination
LOG all -- 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "
Chain ufw-after-logging-output (1 references)
target prot opt source destination
Chain ufw-after-output (1 references)
target prot opt source destination
Chain ufw-before-forward (1 references)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 3
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 4
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 11
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 12
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 8
ufw-user-forward all -- 0.0.0.0/0 0.0.0.0/0
Chain ufw-before-input (1 references)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
ufw-logging-deny all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID
DROP all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 3
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 4
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 11
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 12
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 8
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp spt:67 dpt:68
ufw-not-local all -- 0.0.0.0/0 0.0.0.0/0
ACCEPT udp -- 0.0.0.0/0 224.0.0.251 udp dpt:5353
ACCEPT udp -- 0.0.0.0/0 239.255.255.250 udp dpt:1900
ufw-user-input all -- 0.0.0.0/0 0.0.0.0/0
Chain ufw-before-logging-forward (1 references)
target prot opt source destination
Chain ufw-before-logging-input (1 references)
target prot opt source destination
Chain ufw-before-logging-output (1 references)
target prot opt source destination
Chain ufw-before-output (1 references)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
ufw-user-output all -- 0.0.0.0/0 0.0.0.0/0
Chain ufw-logging-allow (0 references)
target prot opt source destination
LOG all -- 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW ALLOW] "
Chain ufw-logging-deny (2 references)
target prot opt source destination
RETURN all -- 0.0.0.0/0 0.0.0.0/0 ctstate INVALID limit: avg 3/min burst 10
LOG all -- 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 10 LOG flags 0 level 4 prefix "[UFW BLOCK] "
Chain ufw-not-local (1 references)
target prot opt source destination
RETURN all -- 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match dst-type LOCAL
RETURN all -- 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match dst-type MULTICAST
RETURN all -- 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match dst-type BROADCAST
ufw-logging-deny all -- 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 10
DROP all -- 0.0.0.0/0 0.0.0.0/0
Chain ufw-reject-forward (1 references)
target prot opt source destination
Chain ufw-reject-input (1 references)
target prot opt source destination
Chain ufw-reject-output (1 references)
target prot opt source destination
Chain ufw-skip-to-policy-forward (0 references)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
Chain ufw-skip-to-policy-input (7 references)
target prot opt source destination
DROP all -- 0.0.0.0/0 0.0.0.0/0
Chain ufw-skip-to-policy-output (0 references)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
Chain ufw-track-forward (1 references)
target prot opt source destination
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 ctstate NEW
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 ctstate NEW
Chain ufw-track-input (1 references)
target prot opt source destination
Chain ufw-track-output (1 references)
target prot opt source destination
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 ctstate NEW
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 ctstate NEW
Chain ufw-user-forward (1 references)
target prot opt source destination
Chain ufw-user-input (1 references)
target prot opt source destination
ACCEPT all -- 10.42.43.25 0.0.0.0/0
ACCEPT all -- 10.42.43.0/24 0.0.0.0/0
Chain ufw-user-limit (0 references)
target prot opt source destination
LOG all -- 0.0.0.0/0 0.0.0.0/0 limit: avg 3/min burst 5 LOG flags 0 level 4 prefix "[UFW LIMIT BLOCK] "
REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
Chain ufw-user-limit-accept (0 references)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
Chain ufw-user-logging-forward (0 references)
target prot opt source destination
Chain ufw-user-logging-input (0 references)
target prot opt source destination
Chain ufw-user-logging-output (0 references)
target prot opt source destination
Chain ufw-user-output (1 references)
target prot opt source destination
When I change the state to turn-off a particular machine, the log change is represented in the following diff:
158c157
< ACCEPT all -- 10.42.43.25 0.0.0.0/0
---
> DROP all -- 10.42.43.25 0.0.0.0/0
iptables -Ito insert at the top of the chainTo Action From -- ------ ---- Anywhere DENY 10.42.43.25 Anywhere ALLOW 10.42.43.0/24