Firewall Rule Testing with BASH and TCPTraceRoute

I wanted to block the use of any DNS server except those that I select (google, openDNS and my router).

I also wanted to make sure that these DNS servers work and that others do not.

So I made a BASH script to verify my firewall rules.

#!/bin/bash

# only particular DNS servicer are allowed to be contacted. 

# this tests that this is so

LOCAL="the.IP.address.of.your.router"

ALLOW="8.8.8.8 8.8.4.4 208.67.220.220 208.67.222.222"

BLOCK="220.233.0.4 61.88.88.88 202.139.83.3 61.9.194.49 61.9.195.193 61.9.133.193 61.9.134.49 203.161.158.2"

echo "Testing DNS servers via UDP that are allowed to work..."

for d in $LOCAL $ALLOW; do

  dig @$d somename +time=1 +tries=1 +notcp > /dev/null

  [ $? -ne 0 ] && echo "FAIL: Failed to get response from $d via UDP." && exit 1

  echo "PASS: $d responded via UDP."

done

echo "Testing DNS servers via TCP that are allowed to work..."

for d in $LOCAL $ALLOW; do

  dig @$d somename +time=1 +tries=1 +tcp > /dev/null

  [ $? -ne 0 ] && echo "FAIL: Failed to get response from $d via TCP." && exit 1

  echo "PASS: $d responded via TCP."

done

echo "Testing DNS servers via UDP that are NOT allowed to work..."

for d in $BLOCK; do 

  dig @$d somename +time=1 +tries=1 +notcp > /dev/null 

  [ $? -eq 0 ] && echo "FAIL: Got response from blocked DNS server $d via UDP." && exit 1 

  echo "PASS: DNS server $d via UDP was correctly blocked." 

done 

echo "Testing DNS servers via TCP that are NOT allowed to work..." 

for d in $BLOCK; do 

  dig @$d somename +time=1 +tries=1 +tcp > /dev/null 

  [ $? -eq 0 ] && echo "FAIL: Got response from blocked DNS server $d via TCP." && exit 1 

  echo "PASS: DNS server $d via TCP was correctly blocked." 

done 

echo "" 

echo "Firewall PASSed."

Then I thought that I might be able to test other TCP blocking rules by setting the IP packet's time-to-live (TTL) to a small number and looking for ICMP time expired packets. To do this I needed to use tcptraceroute to get the core functionality. On the Mac I got this from fink.

If I get some response, the firewall is NOT blocking an outgoing port. If I get stars (* * *) then it probably is blocking the port.

#!/bin/bash

echo "Testing blocked outgoing port..."

# set TTL to 2 hops: host to ADSL router, ADSL router to ISP gateway

# if the ISP responds to TCP TTL timeouts then a blocked port should get '2  *'

# whereas an open outgoing port should get something more complicated like this:

# '2  37.1.233.220.static.exetel.com.au (220.233.1.37)  23.176 ms'

#sudo tcptraceroute -q 1 -w 1 -f 2 -m 2 www.google.com 79 | grep '2  *' && echo "blocked"

BLOCK="135 136 137 138 139 445 593 1863 110 9000 5190 23 1503 1720 53"

VICTIM="www.some.real.site.com"

# The victim should not get any packets if the firewall rules are right.

for p in $BLOCK; do

  sudo tcptraceroute -q 1 -w 1 -f 2 -m 2 $VICTIM $p | grep '2  \*'

  [ $? -ne 0 ] && echo "FAIL: Port $p is open for outgoing traffic." && exit 1

  echo "PASS: Port $p is blocked for outgoing traffic."

  echo ""

done

ALLOW="80 8080 443 25 21 119 22 123"

VICTIM="www.some.real.site.com"

# again, the victim should not get any packets since TTL is so small.

for p in $ALLOW; do

  sudo tcptraceroute -q 1 -w 1 -f 2 -m 2 $VICTIM $p | grep '2  \*'

  [ $? -eq 0 ] && echo "FAIL: Port $p is blocked for outgoing traffic." && exit 1

  echo "PASS: Port $p is open for outgoing traffic."

  echo ""

done

echo "" 

echo "Firewall PASSed."

You will need to modify the script to suit your firewall rules.

Google Go! on Mac OS-X

Google have just released a new programming language called Go.

I decided to install it and learn it.

This is what I did on Leopard 10.5.8. It took 5 easy steps (thanks to Kelvin Wong).

Step 1.

I installed mercurial (the Google instructions to use easy_install did not work for me)

Step 2.

I added these lines to ~/.profile (Kevin added his to ~/.bash_profile)

To determine what file to edit or create requires you to follow a procedure because bash only reads in the first one it finds:

If you have a ~/.bash_profile file, edit it.
Else if you have a ~/.bash_login file, edit it.
Else if you have a ~/.profile file, edit it.
Else if you have a ~/.bashrc file, edit it.
Else you may create one of the above.

I already had a ~/.profile file since I use fink and it creates one. Others have used ~/.bash_profile or ~/.bashrc.

export GOROOT=$HOME/go
export GOARCH=386
export GOOS=darwin
export GOBIN=$HOME/bin
export PATH=$GOBIN:$PATH

I then closed and re-opened the terminal session.

I checked that it worked with

env | grep '^GO'

Step 3.

I manually created ~/bin and followed Kelvin's recommendation to make it executable with

mkdir ~/bin
chmod 755 ~/bin

Step 4.

I downloaded the Go repository using mercurial.

hg clone -r release https://go.googlecode.com/hg/ $GOROOT

This printed the following:

requesting all changes
adding changesets
adding manifests
adding file changes
added 4016 changesets with 16888 changes to 2931 files
updating working directory
1640 files updated, 0 files merged, 0 files removed, 0 files unresolved

Step 5.

I built the Go compiler.

cd $GOROOT/src
./all.bash

During this step, OS-X asked me to allow in incoming connection to an application called 8g.

This didn't seem to work as I got this error:

FAIL: http.TestClient
Get http://www.google.com/robots.txt: dial tcp www.google.com:http: lookup www.google.com. on 10.x.x.x:53: no answer from server

This group discussion on the error suggests that Go is actually built but that the Go DNS resolver may not work on OS-X just yet.

It will work if 'Allow all incoming connections' is selected in the Firewall section of the Security preferences.