Archive for May, 2018

Debian 9: permanent iptables rules

Tuesday, May 29th, 2018

Just an example for Debian 9.

1. Install ‘iptables-persistent’ package. Agree during installation the rules to be saved to /etc/iptables/rules.v4 .

2. Add rules (e.g. from console):

iptables -P OUTPUDT DROP
iptables -A OUTPUT -d -j ACCEPT

3. Save rules:

netfilter-persistent save

4. Reboot and enjoy.

5. If you need to add/delete/edit rules, edit /etc/iptables/rules.v4 and then run ‘netfilter-persistent start’ to re-read the file.

SIP flood vs OpenSIPS armed with,, ipset and iptables

Wednesday, May 23rd, 2018

Preface: the PIKE module itself blocks SIP requests (just stops sending any replies) in case of flood. This article is about going on – adding flooding IP addresses to ipset for further rejecting any traffic to the OpenSIPS server using iptables.

1. Create an ipset with auto removing addresses after 120 seconds and ability to add comments.

ipset create SIPFLOOD hash:ip timeout 120 comment

2. An iptables rule, which will drop incoming traffic from src IP addresses from created ipset table:

iptables -A INPUT -m set --match-set SIPFLOOD src -j DROP

3. Allow OpenSIPS’ run-user (usually ‘opensips’) executing ‘ipset’ command without a password (add this line to /etc/sudoers using ‘visudo’ command):

opensips ALL= NOPASSWD: /sbin/ipset

4. OpenSIPS configuration.

Part of modules section of config:

#### exec
loadmodule ""

#### antiflood module
loadmodule ""
modparam("pike", "sampling_time_unit", 2)
modparam("pike", "reqs_density_per_unit", 10)
modparam("pike", "remove_latency", 120)

Part of OpenSIPS script, assuming that somebody sends us too much OPTIONS requests:

if(is_method("OPTIONS")) {

    switch($retcode) {
        case -2:    # detected once - simply drop the request
        case -1:    # detected again - ban the IP and drop request
            exec("/usr/bin/sudo ipset -exist add SIPFLOOD $si");

    sl_send_reply("200", "OK");

5. You may test all this with ‘sipp’ tool.

This is for generating 10 requests (-r) in 2 seconds (-rp 2000) and exiting sipp after sending 10 requests (-m):

sipp -r 10 -rp 2000 -m 10 -sf OPTIONS.xml

This – for generating 70 requests (-r) in 2 seconds (-rp 2000) and exiting sipp after sending 70 requests (-m):

sipp -r 70 -rp 2000 -m 70 -sf OPTIONS.xml

The OPTIONS.xml is as follows:

UPD 2019-july-30: pike writes log messages (at least in automatic mode, but I’m sure that also in the manual ):

 Jul 30 06:59:05 ... /opensips[15531]: PIKE - BLOCKing ip, node=0x7f6dec201c08
Jul 30 06:59:05 ... /opensips[15533]: PIKE - UNBLOCKing node 0x7f6dec201b38
Jul 30 06:59:07 ... /opensips[15531]: PIKE - BLOCKing ip, node=0x7f6dec201d40

If you do not need all these messages (in case of SIP flood it may be too many), just set the log_level for module:

modparam("pike", "pike_log_level", 3)

And then set the log_level for your OpenSIPS to be not so verbose (pike’s log_level must be greater than global):

opensips-cli -x mi log_level 2

… or/and in config file:


iptables: a rule with expiration

Tuesday, May 22nd, 2018

If you need an automated way of deleting iptables rules after some time, use this:

iptables -A INPUT -s -j DROP && { echo "iptables -D INPUT -s -j DROP" | at now + 1 min; }

This rule will be deleted in a 1 minute.