Skip to content

Commit 72aa29f

Browse files
github-actions[bot]github-actions[bot]
committed
Deployed 9813908 to docs-develop with MkDocs 1.6.0 and mike 1.1.2
1 parent d293fe0 commit 72aa29f

File tree

4 files changed

+198
-198
lines changed

4 files changed

+198
-198
lines changed

‎docs-develop/gateway-configuration/network-threat-manager/index.html‎

Lines changed: 49 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -4656,67 +4656,67 @@
46564656

46574657

46584658
<h1 id="network-threat-manager">Network Threat Manager</h1>
4659-
<p>Eclipse Kura provides a set of features to detect and prevent network attacks. The Security section in the Gateway Administration Console shows the Network Threat Manager tab where is it possible to activate these functions.</p>
4659+
<p>Eclipse Kura provides a set of features to detect and prevent network attacks. The Network Threat Manager tab in the Security section of the Gateway Administration Console allows the user to activate these functions.</p>
46604660
<div class="admonition warning">
46614661
<p class="admonition-title">Warning</p>
46624662
<p>The Network Threat Manager tab is not available for the <a href="../../getting-started/install-kura/#installer-types">No Network version of Eclipse Kura</a>.</p>
46634663
</div>
46644664
<p><img alt="Network Threat Manager" src="../images/network-threat-manager.png" /></p>
46654665
<h2 id="flooding-protection">Flooding protection</h2>
4666-
<p>The flooding protection function is used to prevent DDos (Distributed Denial-of-Service) attacks using the firewall. When enabled, the feature adds a set of firewall rules to the <strong>mangle</strong> table.</p>
4666+
<p>The flooding protection function is used to prevent DDos (Distributed Denial-of-Service) attacks using specific firewall rules. When enabled, the feature modifies the <strong>filter</strong> and <strong>mangle</strong> tables in the <em>iptables</em> firewall to close or limit common attacks.</p>
46674667
<h3 id="flooding-protection-for-ipv4">Flooding protection for IPv4</h3>
4668-
<p>The following rules are added to the <strong>mangle</strong> table and they are implemented to block invalid or malicious network packets:</p>
4669-
<div class="highlight"><pre><span></span><code><a id="__codelineno-0-1" name="__codelineno-0-1" href="#__codelineno-0-1"></a>iptables -A prerouting-kura -m conntrack --ctstate INVALID -j DROP
4670-
<a id="__codelineno-0-2" name="__codelineno-0-2" href="#__codelineno-0-2"></a>iptables -A prerouting-kura -p tcp ! --syn -m conntrack --ctstate NEW -j DROP
4671-
<a id="__codelineno-0-3" name="__codelineno-0-3" href="#__codelineno-0-3"></a>iptables -A prerouting-kura -p tcp -m conntrack --ctstate NEW -m tcpmss ! --mss 536:65535 -j DROP
4672-
<a id="__codelineno-0-4" name="__codelineno-0-4" href="#__codelineno-0-4"></a>iptables -A prerouting-kura -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
4673-
<a id="__codelineno-0-5" name="__codelineno-0-5" href="#__codelineno-0-5"></a>iptables -A prerouting-kura -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
4674-
<a id="__codelineno-0-6" name="__codelineno-0-6" href="#__codelineno-0-6"></a>iptables -A prerouting-kura -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
4675-
<a id="__codelineno-0-7" name="__codelineno-0-7" href="#__codelineno-0-7"></a>iptables -A prerouting-kura -p tcp --tcp-flags FIN,ACK FIN -j DROP
4676-
<a id="__codelineno-0-8" name="__codelineno-0-8" href="#__codelineno-0-8"></a>iptables -A prerouting-kura -p tcp --tcp-flags ACK,URG URG -j DROP
4677-
<a id="__codelineno-0-9" name="__codelineno-0-9" href="#__codelineno-0-9"></a>iptables -A prerouting-kura -p tcp --tcp-flags ACK,FIN FIN -j DROP
4678-
<a id="__codelineno-0-10" name="__codelineno-0-10" href="#__codelineno-0-10"></a>iptables -A prerouting-kura -p tcp --tcp-flags ACK,PSH PSH -j DROP
4679-
<a id="__codelineno-0-11" name="__codelineno-0-11" href="#__codelineno-0-11"></a>iptables -A prerouting-kura -p tcp --tcp-flags ALL ALL -j DROP
4680-
<a id="__codelineno-0-12" name="__codelineno-0-12" href="#__codelineno-0-12"></a>iptables -A prerouting-kura -p tcp --tcp-flags ALL NONE -j DROP
4681-
<a id="__codelineno-0-13" name="__codelineno-0-13" href="#__codelineno-0-13"></a>iptables -A prerouting-kura -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP
4682-
<a id="__codelineno-0-14" name="__codelineno-0-14" href="#__codelineno-0-14"></a>iptables -A prerouting-kura -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j DROP
4683-
<a id="__codelineno-0-15" name="__codelineno-0-15" href="#__codelineno-0-15"></a>iptables -A prerouting-kura -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
4684-
<a id="__codelineno-0-16" name="__codelineno-0-16" href="#__codelineno-0-16"></a>iptables -A prerouting-kura -p icmp -j DROP
4685-
<a id="__codelineno-0-17" name="__codelineno-0-17" href="#__codelineno-0-17"></a>iptables -A prerouting-kura -f -j DROP
4668+
<p>The <strong>flooding.protection.enabled</strong> property is used to enable the feature.
4669+
The following rules are added to the <strong>mangle</strong> table and they are implemented to block invalid or malicious network packets:</p>
4670+
<div class="highlight"><pre><span></span><code><a id="__codelineno-0-1" name="__codelineno-0-1" href="#__codelineno-0-1"></a>-A prerouting-kura -m conntrack --ctstate INVALID -j DROP
4671+
<a id="__codelineno-0-2" name="__codelineno-0-2" href="#__codelineno-0-2"></a>-A prerouting-kura -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW -j DROP
4672+
<a id="__codelineno-0-3" name="__codelineno-0-3" href="#__codelineno-0-3"></a>-A prerouting-kura -p tcp -m conntrack --ctstate NEW -m tcpmss ! --mss 536:65535 -j DROP
4673+
<a id="__codelineno-0-4" name="__codelineno-0-4" href="#__codelineno-0-4"></a>-A prerouting-kura -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
4674+
<a id="__codelineno-0-5" name="__codelineno-0-5" href="#__codelineno-0-5"></a>-A prerouting-kura -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
4675+
<a id="__codelineno-0-6" name="__codelineno-0-6" href="#__codelineno-0-6"></a>-A prerouting-kura -p tcp -m tcp --tcp-flags FIN,RST FIN,RST -j DROP
4676+
<a id="__codelineno-0-7" name="__codelineno-0-7" href="#__codelineno-0-7"></a>-A prerouting-kura -p tcp -m tcp --tcp-flags FIN,ACK FIN -j DROP
4677+
<a id="__codelineno-0-8" name="__codelineno-0-8" href="#__codelineno-0-8"></a>-A prerouting-kura -p tcp -m tcp --tcp-flags ACK,URG URG -j DROP
4678+
<a id="__codelineno-0-9" name="__codelineno-0-9" href="#__codelineno-0-9"></a>-A prerouting-kura -p tcp -m tcp --tcp-flags FIN,ACK FIN -j DROP
4679+
<a id="__codelineno-0-10" name="__codelineno-0-10" href="#__codelineno-0-10"></a>-A prerouting-kura -p tcp -m tcp --tcp-flags PSH,ACK PSH -j DROP
4680+
<a id="__codelineno-0-11" name="__codelineno-0-11" href="#__codelineno-0-11"></a>-A prerouting-kura -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP
4681+
<a id="__codelineno-0-12" name="__codelineno-0-12" href="#__codelineno-0-12"></a>-A prerouting-kura -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
4682+
<a id="__codelineno-0-13" name="__codelineno-0-13" href="#__codelineno-0-13"></a>-A prerouting-kura -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP
4683+
<a id="__codelineno-0-14" name="__codelineno-0-14" href="#__codelineno-0-14"></a>-A prerouting-kura -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,PSH,URG -j DROP
4684+
<a id="__codelineno-0-15" name="__codelineno-0-15" href="#__codelineno-0-15"></a>-A prerouting-kura -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j DROP
4685+
<a id="__codelineno-0-16" name="__codelineno-0-16" href="#__codelineno-0-16"></a>-A prerouting-kura -p icmp -m icmp --icmp-type 8 -m state --state NEW,RELATED,ESTABLISHED -j DROP
4686+
<a id="__codelineno-0-17" name="__codelineno-0-17" href="#__codelineno-0-17"></a>-A prerouting-kura -f -j DROP
46864687
</code></pre></div>
46874688
<p>To further filter the incoming TCP fragmented packets, specific system configuration files are configured.
4688-
The <strong>flooding.protection.enabled</strong> property is used to enable the feature.</p>
4689+
When enabled, the device will not respond to ping requests.</p>
46894690
<h3 id="flooding-protection-for-ipv6">Flooding protection for IPv6</h3>
4690-
<p>The same rules applied to the IPv4 are used for preventing attack on IPv6. In addition, some rules are implemented to drop specific IPv6 headers and limit the incoming ICMPv6 packets. Moreover, the incoming TCP fragmented packets are dropped configuring specific system files.</p>
4691+
<p>The same rules applied to the IPv4 are used for preventing attack on IPv6. In addition, some of them are implemented to drop specific IPv6 headers and limit the incoming ICMPv6 packets. Moreover, the incoming TCP fragmented packets are dropped configuring specific system files.</p>
46914692
<p>The following rules are applied to the <strong>mangle</strong> table:</p>
4692-
<div class="highlight"><pre><span></span><code><a id="__codelineno-1-1" name="__codelineno-1-1" href="#__codelineno-1-1"></a>ip6tables -A prerouting-kura -m conntrack --ctstate INVALID -j DROP
4693-
<a id="__codelineno-1-2" name="__codelineno-1-2" href="#__codelineno-1-2"></a>ip6tables -A prerouting-kura -p tcp ! --syn -m conntrack --ctstate NEW -j DROP
4694-
<a id="__codelineno-1-3" name="__codelineno-1-3" href="#__codelineno-1-3"></a>ip6tables -A prerouting-kura -p tcp -m conntrack --ctstate NEW -m tcpmss ! --mss 536:65535 -j DROP
4695-
<a id="__codelineno-1-4" name="__codelineno-1-4" href="#__codelineno-1-4"></a>ip6tables -A prerouting-kura -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
4696-
<a id="__codelineno-1-5" name="__codelineno-1-5" href="#__codelineno-1-5"></a>ip6tables -A prerouting-kura -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
4697-
<a id="__codelineno-1-6" name="__codelineno-1-6" href="#__codelineno-1-6"></a>ip6tables -A prerouting-kura -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
4698-
<a id="__codelineno-1-7" name="__codelineno-1-7" href="#__codelineno-1-7"></a>ip6tables -A prerouting-kura -p tcp --tcp-flags FIN,ACK FIN -j DROP
4699-
<a id="__codelineno-1-8" name="__codelineno-1-8" href="#__codelineno-1-8"></a>ip6tables -A prerouting-kura -p tcp --tcp-flags ACK,URG URG -j DROP
4700-
<a id="__codelineno-1-9" name="__codelineno-1-9" href="#__codelineno-1-9"></a>ip6tables -A prerouting-kura -p tcp --tcp-flags ACK,FIN FIN -j DROP
4701-
<a id="__codelineno-1-10" name="__codelineno-1-10" href="#__codelineno-1-10"></a>ip6tables -A prerouting-kura -p tcp --tcp-flags ACK,PSH PSH -j DROP
4702-
<a id="__codelineno-1-11" name="__codelineno-1-11" href="#__codelineno-1-11"></a>ip6tables -A prerouting-kura -p tcp --tcp-flags ALL ALL -j DROP
4703-
<a id="__codelineno-1-12" name="__codelineno-1-12" href="#__codelineno-1-12"></a>ip6tables -A prerouting-kura -p tcp --tcp-flags ALL NONE -j DROP
4704-
<a id="__codelineno-1-13" name="__codelineno-1-13" href="#__codelineno-1-13"></a>ip6tables -A prerouting-kura -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP
4705-
<a id="__codelineno-1-14" name="__codelineno-1-14" href="#__codelineno-1-14"></a>ip6tables -A prerouting-kura -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j DROP
4706-
<a id="__codelineno-1-15" name="__codelineno-1-15" href="#__codelineno-1-15"></a>ip6tables -A prerouting-kura -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
4707-
<a id="__codelineno-1-16" name="__codelineno-1-16" href="#__codelineno-1-16"></a>ip6tables -A prerouting-kura -p ipv6-icmp -m ipv6-icmp --icmpv6-type 128 -j DROP
4708-
<a id="__codelineno-1-17" name="__codelineno-1-17" href="#__codelineno-1-17"></a>ip6tables -A prerouting-kura -p ipv6-icmp -m ipv6-icmp --icmpv6-type 129 -j DROP
4709-
<a id="__codelineno-1-18" name="__codelineno-1-18" href="#__codelineno-1-18"></a>ip6tables -A prerouting-kura -m ipv6header --header dst --soft -j DROP
4710-
<a id="__codelineno-1-19" name="__codelineno-1-19" href="#__codelineno-1-19"></a>ip6tables -A prerouting-kura -m ipv6header --header hop --soft -j DROP
4711-
<a id="__codelineno-1-20" name="__codelineno-1-20" href="#__codelineno-1-20"></a>ip6tables -A prerouting-kura -m ipv6header --header route --soft -j DROP
4712-
<a id="__codelineno-1-21" name="__codelineno-1-21" href="#__codelineno-1-21"></a>ip6tables -A prerouting-kura -m ipv6header --header frag --soft -j DROP
4713-
<a id="__codelineno-1-22" name="__codelineno-1-22" href="#__codelineno-1-22"></a>ip6tables -A prerouting-kura -m ipv6header --header auth --soft -j DROP
4714-
<a id="__codelineno-1-23" name="__codelineno-1-23" href="#__codelineno-1-23"></a>ip6tables -A prerouting-kura -m ipv6header --header esp --soft -j DROP
4715-
<a id="__codelineno-1-24" name="__codelineno-1-24" href="#__codelineno-1-24"></a>ip6tables -A prerouting-kura -m ipv6header --header none --soft -j DROP
4716-
<a id="__codelineno-1-25" name="__codelineno-1-25" href="#__codelineno-1-25"></a>ip6tables -A prerouting-kura -m rt --rt-type 0 -j DROP
4717-
<a id="__codelineno-1-26" name="__codelineno-1-26" href="#__codelineno-1-26"></a>ip6tables -A output-kura -m rt --rt-type 0 -j DROP
4693+
<div class="highlight"><pre><span></span><code><a id="__codelineno-1-1" name="__codelineno-1-1" href="#__codelineno-1-1"></a>-A prerouting-kura -m conntrack --ctstate INVALID -j DROP
4694+
<a id="__codelineno-1-2" name="__codelineno-1-2" href="#__codelineno-1-2"></a>-A prerouting-kura -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW -j DROP
4695+
<a id="__codelineno-1-3" name="__codelineno-1-3" href="#__codelineno-1-3"></a>-A prerouting-kura -p tcp -m conntrack --ctstate NEW -m tcpmss ! --mss 536:65535 -j DROP
4696+
<a id="__codelineno-1-4" name="__codelineno-1-4" href="#__codelineno-1-4"></a>-A prerouting-kura -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
4697+
<a id="__codelineno-1-5" name="__codelineno-1-5" href="#__codelineno-1-5"></a>-A prerouting-kura -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
4698+
<a id="__codelineno-1-6" name="__codelineno-1-6" href="#__codelineno-1-6"></a>-A prerouting-kura -p tcp -m tcp --tcp-flags FIN,RST FIN,RST -j DROP
4699+
<a id="__codelineno-1-7" name="__codelineno-1-7" href="#__codelineno-1-7"></a>-A prerouting-kura -p tcp -m tcp --tcp-flags FIN,ACK FIN -j DROP
4700+
<a id="__codelineno-1-8" name="__codelineno-1-8" href="#__codelineno-1-8"></a>-A prerouting-kura -p tcp -m tcp --tcp-flags ACK,URG URG -j DROP
4701+
<a id="__codelineno-1-9" name="__codelineno-1-9" href="#__codelineno-1-9"></a>-A prerouting-kura -p tcp -m tcp --tcp-flags FIN,ACK FIN -j DROP
4702+
<a id="__codelineno-1-10" name="__codelineno-1-10" href="#__codelineno-1-10"></a>-A prerouting-kura -p tcp -m tcp --tcp-flags PSH,ACK PSH -j DROP
4703+
<a id="__codelineno-1-11" name="__codelineno-1-11" href="#__codelineno-1-11"></a>-A prerouting-kura -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP
4704+
<a id="__codelineno-1-12" name="__codelineno-1-12" href="#__codelineno-1-12"></a>-A prerouting-kura -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
4705+
<a id="__codelineno-1-13" name="__codelineno-1-13" href="#__codelineno-1-13"></a>-A prerouting-kura -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP
4706+
<a id="__codelineno-1-14" name="__codelineno-1-14" href="#__codelineno-1-14"></a>-A prerouting-kura -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,PSH,URG -j DROP
4707+
<a id="__codelineno-1-15" name="__codelineno-1-15" href="#__codelineno-1-15"></a>-A prerouting-kura -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j DROP
4708+
<a id="__codelineno-1-16" name="__codelineno-1-16" href="#__codelineno-1-16"></a>-A prerouting-kura -p ipv6-icmp -m icmp6 --icmpv6-type 128 -j DROP
4709+
<a id="__codelineno-1-17" name="__codelineno-1-17" href="#__codelineno-1-17"></a>-A prerouting-kura -m ipv6header --header ipv6-opts --soft -j DROP
4710+
<a id="__codelineno-1-18" name="__codelineno-1-18" href="#__codelineno-1-18"></a>-A prerouting-kura -m ipv6header --header hop-by-hop --soft -j DROP
4711+
<a id="__codelineno-1-19" name="__codelineno-1-19" href="#__codelineno-1-19"></a>-A prerouting-kura -m ipv6header --header ipv6-route --soft -j DROP
4712+
<a id="__codelineno-1-20" name="__codelineno-1-20" href="#__codelineno-1-20"></a>-A prerouting-kura -m ipv6header --header ipv6-frag --soft -j DROP
4713+
<a id="__codelineno-1-21" name="__codelineno-1-21" href="#__codelineno-1-21"></a>-A prerouting-kura -m ipv6header --header ah --soft -j DROP
4714+
<a id="__codelineno-1-22" name="__codelineno-1-22" href="#__codelineno-1-22"></a>-A prerouting-kura -m ipv6header --header esp --soft -j DROP
4715+
<a id="__codelineno-1-23" name="__codelineno-1-23" href="#__codelineno-1-23"></a>-A prerouting-kura -m ipv6header --header ipv6-nonxt --soft -j DROP
4716+
<a id="__codelineno-1-24" name="__codelineno-1-24" href="#__codelineno-1-24"></a>-A prerouting-kura -m rt --rt-type 0 -j DROP
47184717
</code></pre></div>
4719-
<p>Also in this case, to enable the feature and add the rules to the firewall, the <strong>flooding.protection.enabled.ipv6</strong> property has to be set to true. If the device doesn't support IPv6, this property is ignored.</p>
4718+
<p>Also in this case, to enable the feature and add the rules to the firewall, the <strong>flooding.protection.enabled.ipv6</strong> property has to be set to true. If the device doesn't support IPv6, this property is ignored.
4719+
When enabled, the device will not respond to ping requests.</p>
47204720
<div class="admonition warning">
47214721
<p class="admonition-title">Warning</p>
47224722
<p>To recover the device state when the IPv6 flooding protection feature is disabled, a reboot is required. So, to disable the feature, set the <strong>flooding.protection.enabled.ipv6</strong> property to false tha reboot the device.</p>

‎docs-develop/search/search_index.json‎

Lines changed: 1 addition & 1 deletion
Large diffs are not rendered by default.

0 commit comments

Comments
 (0)