Iptables

Denial-of-Service (DoS) is a network security problem that constitutes a serious challenge to reliability of services deployed on the servers. The aim of DoS attacks is to exhaust a resource in the target system, reducing or completely subverting the availability of the service provided. Threat of DoS attacks has become even more severe with DDoS (Distributed Denial-of-Service) attack. It is an attempt by malicious users to carry out DoS attack indirectly with the help of many compromised computers on the Internet. Service providers are under mounting pressure to prevent, monitor and mitigate DoS/DDoS attacks directed toward their customers and their infrastructure. Defending against those types of attacks is not a trivial job, mainly due to the use of IP spoofing and the destination-based routing of the Internet, though there are many proposed methods which aim to alleviate the problem like Firewalls, Intrusion Detection Systems, Ingress filtering, IP Traceback, SYN Proxy etc. This paper discusses the efficient packet filtering technique using firewall to defend against DoS/DDoS attacks. Firewall scripts are written using command-line tool iptables in Linux to deny the suspicious traffic. Packet analyzer tool used to showcase the effectiveness of the scripts in mitigating the various kinds of DoS/DDoS attacks.

Secure Shell (SSH) is a secure remote login program which can be used in place of regular telnet. It has become the default remote access method for administration of UNIX systems. It is very common for public Internet facing servers to experience attacks that attempt to brute force username and password combinations via SSH to gain access. This paper examines these attacks depending on SSH log file to find unsuccessful logins then blocks IP addresses of unsuccessful logins for a period of time that is decided by administrator and then send an e-mail to administrator to consider whether the addresses blocked belong to users failed to access or by an attacker, finally the administrator will block attacker's IP address forever. Some attackers highly skilled and just used trusted IP address as a user name then the software will block the IP address of attacker as well as the victim IP address that is used by attacker. In this paper, an adaptive mechanism was built-in to distinguish between attacker IP address and victim IP address which may be used by an attacker, and then the program will block just attacker IP address.

Curso ESPECIALISTA LINUX e Segurança em Redes preparatório para as certificações LPI. Administração de Sistemas, Redes e Servidores Linux, Debian, Fedora, Ubuntu, CentOS e FreeBSD. Apache, Samba, NIS, NFS, DHCP, PROXY, SQUID, IPTABLES, FIREWALL, Postfix, LDAP, NMAP, TCPDUMP. Rio de Janeiro -rj

Firewall adalah barikade awal yang berfungsi untuk melindungi jaringan internal dan sumber daya didalamnya. Performa  firewall dapat mempengaruhi performa keseluruhan jaringan, karena firewall mengatur semua trafik masuk dan keluar. Internet tumbuh semakin besar saat ini dan membutuhkan firewall yang dapat bekerja secara maksimal. Performa rule based firewall utamanya dipengaruhi oleh ruleset (kumpulan rule). Serangan DDoS mengakibatkan operator firewall cenderung menambahkan rule baru untuk menghentikan serangan DDoS. Bila hal ini dilanjutkan, ukuran ruleset akan semakin besar dan semakin sulit untuk dipelihara. Hal ini akan meningkatkan waktu interogasi dan menurunkan performa firewall. Reorientasi firewall adalah solusi untuk menyelesaikan masalah itu. Modified ARM adalah modifikasi sederhana dari teknik ARM, sebuah metode untuk sorting ruleset berbasis pada laju penambahan hit. MARM mampu meningkatkan kemampuan adaptasi terhadap perubahan trafik yang sedang terjadi. Bila dibandingkan dengan ARM, kemampuan adaptasi MARM lebih baik karena lebih cepat beradaptasi. Dasar logika yang digunakan cukup sederhana dengan harapan dapat segera diaplikasikan ke lingkungan produksi.

http://dwikristianto.blogspot.co.id/2015/10/peningkatan-performa-rule-based.html

Administrator suatu firewall ditantang untuk menyeimbangkan fleksibilitas dan keamanan saat merancang seperangkat aturan yang komprehensif. Firewall harus memberikan perlindungan terhadap malfeasants, sementara memungkinkan pengguna yang dipercaya untuk dapat terhubung. Sayangnya, tidak selalu mungkin untuk menyaring orang-orang jahat, karena penyaringan berdasarkan alamat IP dan port tidak membedakan pengguna yang terhubung. Orang-orang yang berniat jahat dapat berasal dari alamat IP terpercaya. Port terbuka tetap menjadi kerentanan: mereka mengizinkan koneksi untuk aplikasi tetapi juga dapat berubah menjadi pintu terbuka untuk serangan. Penelitian ini menyajikan suatu sistem keamanan baru, disebut port knocking, di mana pengguna terpercaya memanipulasi aturan firewall dengan mengirimkan informasi di seluruh port yang tertutup.

Network security is very important in a company. Iptables firewall is one type of firewall that has the innate advantages of linux can filter incoming data packets into a firewall and Analysis Console for Intrusioan Database (ACID) can serve as a database for storing and all types of attacks that go into the firewall. So with the iptables firewall and Analysis Console for Intrusioan Database (ACID) Batamindo industrial park batam company can be maintained network security. The purpose of this research is intended to obtain data and information on the effect of iptables firewall and Analysis Console for Instrusion Databases (ACID) to the Company's network security in the region Batamindo Indusrial Park Batam

Testing in real life conditions is not as easy as it first seems, because often it is costly and difficult to reproduce Internet behavior in controlled environment. WAN Emulator (WANE) proposed herein is a software tool that helps controlling the IP traffic parameters of a network, like delay, packet loss or packet duplication. The advantage of this software is that is using free tools implemented in Linux kernels but offers a friendly graphical interface, so that the researcher does not have to bother with time consuming operations like creating the tc tree, marking the specific traffic and filtering it.