ConfigServer Community Forum

Greetings, CSF Team.

In its current form, CSF (when configured to also block outgoing connections) will add IP blocks as a "DROP" rule for outgoing conncetions. Outgoing connections should never be dropped. This can lead to a myriad of issues in the right environment, and at least a few issues in most environments.

A "DROP" rule in iptables does not send an error/rejection packet back to the listening socket. Doing this for incoming connections is fine, even preferred. But doing this for outgoing connections is very unnecessary, and even problematic.

For example, SSHD on a default installation of a RHEL distro will not have TCPKeepAlive configured by default, which for SSH, can be ideal. One of the most commonly brute forced services on a public facing server is SSH. The result? The IP, which has an established connection with an sshd startup process, is "DROP"ed for both incoming and outgoing connections. Since the outgoing packets are simply dropped as well, SSHD has absolutely no idea that the connection has been terminated.

Fast forward a few days (or hours, if you're getting hit a lot) and you've already saturated your SSHD maxstartups, and are unable to easily login via SSH. You'll need to continually make connection attempts until SSHD has killed enough stale startup processes that it's now below the maxstartups threshold and you can login.

Ever seen an ssh_exchange_identification error, where attempting to login repeatedly has resolved the issue? Well, this is the root cause.

Furthermore, services like Apache/Nginx/LiteSpeed, MySQL, FTP etc will eventually timeout, but during that time they're wasting precious resources on sending useless dropped packets to that now blocked IP.

Solution? If you must block outgoing connections, "REJECT" should be used. Never "DROP".

Thanks for your time.

Thank you for the suggestion. We will look into this and probably make REJECT the default on outgoing blocks. However, from experience, we do have to be careful of some odd monolithic kernels out there that don't have all modules available to them when making such a fundamental change.

Greetings!

That is certainly a valid concern. Hopefully there aren't too many out there in such a situation. I'm not familiar with the exact scope of *nix flavors CSF covers, but perhaps some checks could be put in place at install time.

Any RPM-based distro should be compatible with the following:
Either way, thank you for your time.

We've added REJECT as the default target for outgoing blocks in v10.09:
https://blog.configserver.com/

Very happy to see this change. Thanks for taking the time to read and react upon my request!