Firewall Linux cu IP reputation + monitoring NetFlow

Un firewall Linux modern e mai mult decat iptables cu reguli statice. E un sistem care invata din amenintarile globale si raporteaza detaliat ce se intampla.

Componente esentiale

nftables / iptables ruleset — default DROP, conntrack, stateful inspection, marcare pachete pe categorii
GeoIP filtering — blocaj tari fara trafic legitim (CN, RU, KP, IR)
IP reputation lists — CrowdSec community blocklist (actualizat zilnic), AbuseIPDB, Spamhaus DROP, Tor exit nodes
fail2ban — ban automat pentru SSH brute force, HTTP scan, exploit attempts
Rate limiting — protectie anti-DDoS L3/L4 de baza pe porturi expuse
Port knocking — pentru servicii sensibile, mascarea porturilor de la scanere

Vizibilitate cu NetFlow / sFlow / IPFIX

Firewall fara vizibilitate = black box. Configuram export NetFlow v9 sau IPFIX catre colector. Recomandam nfdump + ntopng sau Elastic Stack pentru analiza.

Top talkers (cine consuma banda)
Conexiuni anormale (porturi rare, IP-uri suspecte outbound)
Pattern-uri de exfiltrare (traffic dincolo de normal in mid-night)
Atacuri in desfasurare (port scanning, brute force)
Compliance reporting (cine acceseaza ce resurse)

De ce nu doar FortiGate

FortiGate e excelent pentru enterprise, dar costa. Pentru SMB sau hybrid, un Linux cu nftables + CrowdSec + Suricata IDS ofera acelasi nivel de protectie la 1/10 din pret, fara vendor lock-in.

Ce livram

Firewall configurat cu hardening complet, blocklist actualizat automat zilnic, dashboard Grafana cu trafic in timp real, alerting pe Telegram/email cand apar tipare suspecte, documentatie clara cu fiecare regula explicata.

Exemplu: ruleset + NetFlow

Blocare pe set de reputatie si export NetFlow catre un colector:

# nftables: default drop + GeoIP set + export NetFlow
nft add rule inet filter input ip saddr @blocklist drop
# NetFlow catre colector (softflowd -> nfdump/ntopng):
sudo apt -y install softflowd
sudo softflowd -i eth0 -n 10.0.0.50:2055

nftables: incarcarea unei liste de blocare

Asa incarci o lista de IP-uri dintr-un fisier intr-un set nftables si o aplici:

# 1. tabel + set de tip interval (accepta IP-uri si CIDR)
nft add table inet filter
nft add set inet filter blocklist '{ type ipv4_addr; flags interval; }'

# 2. incarci lista dintr-un fisier (un IP/CIDR pe linie: /etc/nft/blocklist.txt)
while read ip; do [ -n "$ip" ] && nft add element inet filter blocklist "{ $ip }"; done < /etc/nft/blocklist.txt

# 3. regula care pica orice sursa din set + verificare
nft add rule inet filter input ip saddr @blocklist drop
nft list set inet filter blocklist

Actualizare automata din feed (cron)

Reimprospatezi setul zilnic dintr-un feed de reputatie (ex. Spamhaus DROP):

cat >/usr/local/bin/nft-refresh.sh <<'EOF'
#!/bin/bash
nft flush set inet filter blocklist
curl -s https://www.spamhaus.org/drop/drop.txt \
  | grep -oE '^[0-9.]+/[0-9]+' \
  | while read c; do nft add element inet filter blocklist "{ $c }"; done
EOF
chmod +x /usr/local/bin/nft-refresh.sh
echo '0 4 * * * root /usr/local/bin/nft-refresh.sh' > /etc/cron.d/nft-refresh

Analiza NetFlow: top talkers si conexiuni suspecte

Cu softflowd care exporta si nfdump care colecteaza, vezi cine consuma banda si ce e anormal:

# colectorul primeste NetFlow-ul exportat de softflowd
nfcapd -w -D -l /var/cache/nfdump -p 2055
# top 10 consumatori de banda
nfdump -R /var/cache/nfdump -s ip/bytes -n 10
# conexiuni suspecte (porturi tipice de C2/backdoor)
nfdump -R /var/cache/nfdump 'dst port 4444 or dst port 6667'

Protectie anti-DDoS de baza

Limitezi conexiunile noi pe port si te apuci de SYN flood cu conntrack:

# max 25 conexiuni noi/sec pe 443, restul drop
nft add rule inet filter input tcp dport 443 ct state new \
  limit rate 25/second burst 50 packets accept
nft add rule inet filter input tcp dport 443 ct state new drop
# throttling pe IP (o singura sursa nu poate inunda)
nft add rule inet filter input ct state new \
  meter flood '{ ip saddr limit rate 50/second }' accept

Vizibilitate live + port knocking

Vezi in timp real ce se blocheaza si ascunzi SSH-ul in spatele unei secvente:

nft monitor trace            # urmaresti pachetele live
conntrack -L | wc -l         # cate conexiuni active
# port knocking (knockd) — SSH invizibil la scanari
apt -y install knockd
# /etc/knockd.conf: openSSH seq 7000,8000,9000 -> deschide 22 pt IP-ul care 'bate'
systemctl enable --now knockd