On Wed, 2011-03-30 at 15:45 +0530, Partha Chowdhury wrote:

So it seems my ISP is running squid version 3.2.0.4-20110203 in transparent mode , just like you said.

Interestingly when connecting to random ip addresses on port 80, the error page returned is quite different from normal ones.

http://www.freeimagehosting.net/image.php?280f0ef980.png

Does this transparent proxy pose any threat and what can I do to stop that ?

The threat here is that your ISP will log every page visit you do and also has the ability to block certain websites. The only thing you can do is setting up a tunnel or using a different proxyserver that you trust.

On 30/03/11 15:58, Jan de Groot wrote:

The threat here is that your ISP will log every page visit you do and also has the ability to block certain websites.

The only thing you can do is setting up a tunnel or using a different proxyserver that you trust.

Doesn't every ISP keeps logs of what sites its customers are visiting for a certain amount of time ? Can you give me some pointers where I can find more information about setting up tunnel ? On 30/03/11 16:02, Simon Perry wrote:

I give up trying to understand this.

Initially you were complaining about port 80 being open on your host, you gave us a list of open ports - not an nmap of another host.

So now a transparent proxy is the concern?

initially I wanted to know why port 80 is shown open on my machine and i gave the lsof output to show that no service was listening to port 80 on my machine. The nmap output of the ip - that is my public ip at the moment ( got that by visiting whatismyip.com) shows port 80 as open when it should be blocked according to my iptables configuration. Basically i was afraid some rootkit/malware was running web server on my machine by making it invisible !

Am 30.03.2011 12:48, schrieb Partha Chowdhury:

...

The threat here is that your ISP will log every page visit you do and also has the ability to block certain websites.

Doesn't every ISP keeps logs of what sites its customers are visiting for a certain amount of time ?

If you live in China, yes. In a free country, I would hope not. I am pretty sure my provider does not log such information and I think it is even forbidden by law. I am also pretty sure that I do not sit behind a transparent proxy (I do at work, but not at home).

On 30/03/11 16:25, Thomas Bächler wrote:

This comes with our iptables package:

$ cat /etc/iptables/simple_firewall.rules *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [0:0] -A INPUT -p icmp -j ACCEPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -p tcp -j REJECT --reject-with tcp-reset -A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable -A INPUT -j REJECT --reject-with icmp-proto-unreachable COMMIT

According to the source from where i got the iptables configuration , the approach is "Block all incoming connections except for established connections, then open only specific ports which you want outside world to connect to".About blocking icmp ping, i quote one website as-is:

Your system REPLIED to our Ping (ICMP Echo) requests, making it visible on the Internet. Most personal firewalls can be configured to block, drop, and ignore such ping requests in order to better hide systems from hackers. This is highly recommended since "Ping" is among the oldest and most common methods used to locate systems prior to further exploitation is what they say is true ?

-A INPUT -j REJECT --reject-with icmp-proto-unreachable

isn't this seem redundant ? I mean icmp is allowed, then except for established and related connections, a tcp rst packet is sent for all unwanted tcp traffic and icmp-port-unreachable message is sent for every unwanted udp packets, right ? Then what packets that rule match ?

What is a "malicious port scanner" and how can you stay "secure" from it?

I meant to avoid random packets coming from random machines at random times: for example: one random packet from sys.log

IN=eth0 OUT= MAC=20:cf:30:5a:ea:aa:00:00:cd:27:e5:03:08:00 SRC=182.177.140.45 DST=172.16.37.164 LEN=48 TOS=0x00 PREC=0x00 TTL=103 ID=32623 DF PROTO=TCP SPT=17511 DPT=39384 WINDOW=8192 RES=0x00 SYN URGP=0

On 30/03/11 16:40, Richard Schütz wrote:

The output of "ip addr show" would be interesting.

here is the output:

ip addr show 1: lo: mtu 16436 qdisc noqueue state UNKNOWN link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo 2: eth0: mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 20:cf:30:5a:ea:aa brd ff:ff:ff:ff:ff:ff inet 172.16.37.164/26 brd 172.16.37.191 scope global eth0 3: vboxnet0: mtu 1500 qdisc noop state DOWN qlen 1000 link/ether 0a:00:27:00:00:00 brd ff:ff:ff:ff:ff:ff

On 30/03/11 16:44, Simon Perry wrote:

So your machine is 172.16.37.164, which you have to configure and tell your ISP because they NAT externally from 115.187.45.97 to many internal 172.16.37.* users?

Therefore more than one person could have an external address of 115.187.45.97 mapping back to their 172.16.37.* IP?

Even though only one person could have 115.187.45.97:80 mapped back to them?

Are you sure about how this works?

With my previous dsl provider , an address in the range 59.93.x.x was assigned to ppp0 interface by authenticating with rp-pppoe software.But now i have to provide the private ip to eth0, authenticate and then visit any website to know my public ip.

Am 30.03.2011 15:00, schrieb Partha Chowdhury:

According to the source from where i got the iptables configuration , the approach is "Block all incoming connections except for established connections, then open only specific ports which you want outside world to connect to".

Exactly my philosophy.

About blocking icmp ping, i quote one website as-is:

...

Your system REPLIED to our Ping (ICMP Echo) requests, making it visible on the Internet. Most personal firewalls can be configured to block, drop, and ignore such ping requests in order to better hide systems from hackers. This is highly recommended since "Ping" is among the oldest and most common methods used to locate systems prior to further exploitation is what they say is true ?

You cannot "hide" yourself on the internet. If you were offline, the next router would reply that your machine is unreachable. By not answering, you not only tell the "attacker" that you are online, you also tell him that you don't know shit about networking. Google it.

...

-A INPUT -j REJECT --reject-with icmp-proto-unreachable

isn't this seem redundant ? I mean icmp is allowed, then except for established and related connections, a tcp rst packet is sent for all unwanted tcp traffic and icmp-port-unreachable message is sent for every unwanted udp packets, right ? Then what packets that rule match ?

This properly rejects packets to your IP that are neither ICMP nor TCP nor UDP.

...

What is a "malicious port scanner" and how can you stay "secure" from it?

I meant to avoid random packets coming from random machines at random times:

for example: one random packet from sys.log

...

IN=eth0 OUT= MAC=20:cf:30:5a:ea:aa:00:00:cd:27:e5:03:08:00 SRC=182.177.140.45 DST=172.16.37.164 LEN=48 TOS=0x00 PREC=0x00 TTL=103 ID=32623 DF PROTO=TCP SPT=17511 DPT=39384 WINDOW=8192 RES=0x00 SYN URGP=0

And how does that harm you? It is rejected, and the sender now knows that he is sending to the wrong destination (instead of continuously retrying, which he would probably if you DROPped it).

On Wed, 2011-03-30 at 17:27 +0200, Philipp Überbacher wrote:

If you live in a civilized country in Europe data retention either is already in place or will be rather soon. The US might have a different approach but I doubt the net result is much different.

Those regulations are about email only. Providers have to store recipient and sender for every mail that passes their network and they have to store it for a long time, depending on what country implemented the rules.

Excerpts from Jan de Groot's message of 2011-03-30 17:52:00 +0200:

On Wed, 2011-03-30 at 17:27 +0200, Philipp Überbacher wrote:

...

If you live in a civilized country in Europe data retention either is already in place or will be rather soon. The US might have a different approach but I doubt the net result is much different.

Those regulations are about email only. Providers have to store recipient and sender for every mail that passes their network and they have to store it for a long time, depending on what country implemented the rules.

I doubt that: "The Directive as adopted covers fixed telephony, mobile telephony, Internet access, Internet email and Internet telephony." http://en.wikipedia.org/wiki/Telecommunications_data_retention#European_Unio...