NetFilter
Overview
Netfilter is a framework provided by the Linux kernel that offers various functions and operations for packet filtering, network address translation, and port translation.
The firewall ruleset might be configured by using several user-space
tools such as Iptables or Nftables or even with high level
configuration tools such as firewalld, UFW or ferm. The framework also
provides several ways to log events (LOG, NFLOG, ULOG, etc.).
The only requirement from SEKOIA.IO’s perspective is that your
logs uses the following prefix: IPTABLES: XXX (XXX is user
configurable and represents the action, could be dropped or accept for
example).
Related Built-in Rules
Benefit from SEKOIA.IO built-in rules and upgrade Netfilter with the following detection capabilities out-of-the-box.
SEKOIA.IO x Netfilter on ATT&CK Navigator
SEKOIA.IO Intelligence Feed
Detect threats based on indicators of compromise (IOCs) collected by SEKOIA's Threat and Detection Research team.
- Effort: elementary
Event Categories
The following table lists the data source offered by this integration.
| Data Source | Description |
|---|---|
Network device logs |
Traffic events flowing through are recorded by netfilter |
Network protocol analysis |
Netfilter does traffic analysis at physical/data/transport layers |
Event Samples
Find below few samples of events and how they are normalized by SEKOIA.IO.
{
"message": "DA->FEDERATEUR ACCEPT IN=enp4s0f0.82 OUT=enp4s0f1 MAC=14:58:d0:b4:65:b8:02:01:c0:a8:e0:26:08:00 SRC=192.168.224.43 DST=192.168.100.230 LEN=52 TOS=08 PREC=0x00 TTL=126 ID=0 DF PROTO=TCP SPT=44606 DPT=80 SEQ=2504400626 ACK=0 WINDOW=64612 SYN URGP=0 MARK=0",
"destination": {
"mac": "14:58:d0:b4:65:b8",
"port": 80,
"address": "192.168.100.230",
"ip": "192.168.100.230"
},
"source": {
"mac": "02:01:c0:a8:e0:26",
"port": 44606,
"address": "192.168.224.43",
"ip": "192.168.224.43",
"bytes": 52
},
"network": {
"transport": "tcp"
},
"action": {
"name": "accept",
"outcome": "success"
},
"related": {
"ip": [
"192.168.100.230",
"192.168.224.43"
]
}
}
{
"message": "INPUT DFLT DROP IN=enp4s0f0.82 OUT=enp4s0f1 MAC=14:58:d0:b4:65:b8:02:01:c0:a8:e0:26:08:00 SRC=192.168.224.43 DST=192.168.100.230 LEN=52 TOS=08 PREC=0x00 TTL=126 ID=0 DF PROTO=TCP SPT=44606 DPT=80 SEQ=2504400626 ACK=0 WINDOW=64612 SYN URGP=0 MARK=0",
"destination": {
"mac": "14:58:d0:b4:65:b8",
"port": 80,
"address": "192.168.100.230",
"ip": "192.168.100.230"
},
"source": {
"mac": "02:01:c0:a8:e0:26",
"port": 44606,
"address": "192.168.224.43",
"ip": "192.168.224.43",
"bytes": 52
},
"network": {
"transport": "tcp"
},
"action": {
"name": "drop",
"outcome": "success"
},
"related": {
"ip": [
"192.168.100.230",
"192.168.224.43"
]
}
}
{
"message": "INTERNET SPOOFING DROP IN=enp4s0f1 OUT=enp5s0f1 MAC=14:58:d0:b4:65:bc:d8:67:d9:0f:85:41:08:00 SRC=10.16.123.245 DST=192.168.1.47 LEN=132 TOS=00 PREC=0x00 TTL=126 ID=26580 PROTO=UDP SPT=61829 DPT=65267 LEN=112 MARK=0",
"destination": {
"mac": "14:58:d0:b4:65:bc",
"port": 65267,
"address": "192.168.1.47",
"ip": "192.168.1.47"
},
"source": {
"mac": "d8:67:d9:0f:85:41",
"port": 61829,
"address": "10.16.123.245",
"ip": "10.16.123.245",
"bytes": 132
},
"network": {
"transport": "udp"
},
"action": {
"name": "drop",
"outcome": "success"
},
"related": {
"ip": [
"10.16.123.245",
"192.168.1.47"
]
}
}
{
"message": "IPTABLES IN=net0 OUT=docker0 MAC=00:e0:4c:68:00:64:70:df:2f:d0:8c:a7:08:00 SRC=172.217.22.142 DST=172.17.0.2 LEN=84 TOS=0x00 PREC=0x00 TTL=54 ID=0 PROTO=ICMP TYPE=0 CODE=0 ID=20 SEQ=",
"destination": {
"mac": "00:e0:4c:68:00:64",
"address": "172.17.0.2",
"ip": "172.17.0.2"
},
"source": {
"mac": "70:df:2f:d0:8c:a7",
"address": "172.217.22.142",
"ip": "172.217.22.142",
"bytes": 84
},
"network": {
"transport": "icmp"
},
"related": {
"ip": [
"172.17.0.2",
"172.217.22.142"
]
}
}
{
"message": "IPTABLES IN=net0 OUT=docker0 MAC=00:e0:4c:68:00:64:70:df:2f:d0:8c:a7:08:00 SRC=216.58.213.163 DST=172.17.0.2 LEN=60 TOS=0x00 PREC=0x00 TTL=120 ID=51233 PROTO=TCP SPT=80 DPT=51212 WINDOW=60192 RES=0x00 ACK SYN URGP=0",
"destination": {
"mac": "00:e0:4c:68:00:64",
"port": 51212,
"address": "172.17.0.2",
"ip": "172.17.0.2"
},
"source": {
"mac": "70:df:2f:d0:8c:a7",
"port": 80,
"address": "216.58.213.163",
"ip": "216.58.213.163",
"bytes": 60
},
"network": {
"transport": "tcp"
},
"related": {
"ip": [
"172.17.0.2",
"216.58.213.163"
]
}
}
Extracted Fields
The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.
| Name | Type | Description |
|---|---|---|
destination.address |
keyword |
Destination network address. |
destination.ip |
ip |
IP address of the destination. |
destination.mac |
keyword |
MAC address of the destination. |
destination.port |
long |
Port of the destination. |
network.transport |
keyword |
Protocol Name corresponding to the field iana_number. |
source.address |
keyword |
Source network address. |
source.bytes |
long |
Bytes sent from the source to the destination. |
source.ip |
ip |
IP address of the source. |
source.mac |
keyword |
MAC address of the source. |
source.port |
long |
Port of the source. |
Configure
As of now, the main solution to send Netfilter events to SEKOIA.IO is to use a Rsyslog concentrator. Please share your experiences with other recipes by editing this documentation.
Rsyslog
Please consult the Rsyslog Transport documentation to forward these logs to SEKOIA.IO
Configure Netfilter using Iptables
The first step is to configure Netfilter to log the awaited
trafic. For example, if you want to only allow HTTP and HTTPS trafic
and log everything else, you could use the following iptables
commands:
# Create a chain that logs packets and then drops them.
$ iptables -N DROP_LOGGING
$ iptables -A DROP_LOGGING -m limit --limit 60/min -j LOG --log-prefix "IPTables: Dropped: " --log-level 4
$ iptables -A DROP_LOGGING -j DROP
# Allow established communications.
$ iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
# Allow HTTP communications.
$ iptables -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
# Log and drop everything else.
$ iptables -A INPUT -j DROP_LOGGING
Configure Netfilter using Nftables
Nftables is often installed by default as a replacement for iptables on the latest linux distributions. To log events with Nftables the first step is to install ulogd2. Use the following command to install it :
sudo apt install ulogd2
You can then verify that the service is running with that command :
sudo systemctl status ulogd2.service
You can now configure the file /etc/nftables.conf to log what you want.
For instance, if you want to log all the new UDP and TCP traffic that go outside your network,
you can use this configuration :
#!/usr/sbin/nft -f
flush ruleset
table inet filter {
chain input {
type filter hook input priority 0;
}
chain forward {
type filter hook forward priority 0;
}
chain output {
type filter hook output priority 0; policy accept;
# Log all the new TCP connections
ct state new tcp dport 0-65535 log prefix "IPTABLES: ACCEPT " level info accept;
# Log all the new UDP traffic
ct state new udp dport 0-65535 log prefix "IPTABLES: ACCEPT " level info accept;
}
}
Finally, ensure that Nftables is running and the service is enabled :
sudo systemctl start nftables && sudo systemctl enable nftables