Linux – how to prevent any service to bind to a given interface

linuxlinux-networkingnetworking

I need to set up a server (preferably RedHat/CentOS/Fedora but the Debian family would work out as well) with no services available on a given interface.

I cannot use iptables (which would be the simplest solution).

I could check which ones are enabled and either disable them by hand or force a bind to another interface but there is a risk that after an update/upgrade/additional soft installation the changes would be reverted or an extra service deployed.

Is there a way to configure a network interface so that it does not allow any service to bind to it, so that there is no port listening on it?

Best Answer

I think I finally understand the problem. Main misunderstanding of me (and I suppose some others) was I suggested that a scanner is somewhere outside.

If you plan to use this host as a scanner than iptables may be really overwhelmed.

If so, you need some setup protecting host applications but not creating session records for the scanner traffic.

The solution is simple: create a container (LXC or OpenVZ) and hide your scanner staff there. Use a bridged connection setup of your container to the real network.

Thus your scanner will have a dedicated IP address and host applications will never bind It. In basic setup container's traffic will skip iptables.

If you want to additionally protect the container, turn on iptable lookup for the bridge (net.bridge.bridge-nf-call-iptables = 1 in sysctl.conf) and add the rules as follow:

-I FORWARD -p ip -s <rogue_network> -d <scanner_ip>    -j ACCEPT
-I FORWARD -p ip -s <scanner_ip>    -d <rogue_network> -j ACCEPT
-I FORWARD -j REJECT --reject-with icmp-host-unreachable

UPD:
Previous is not working properly - forget to disable connection tracking:

-t raw -I PREROUTING -p ip -s <rogue_network> -d <scanner_ip>    -j NOTRACK
-t raw -I PREROUTING -p ip -s <scanner_ip>    -d <rogue_network> -j NOTRACK
-t raw -I PREROUTING -j REJECT --reject-with icmp-host-unreachable
Related Topic