# iptables: 本番サーバの実践的設定
# ============================================
 
# ルールの初期化
iptables -F
iptables -X
iptables -Z
 
# デフォルトポリシー: すべて拒否
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
 
# ループバックを許可
iptables -A INPUT -i lo -j ACCEPT
 
# 確立済みコネクションを許可 (ステートフル)
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
 
# 不正なパケットを拒否 (INVALID状態)
iptables -A INPUT -m conntrack --ctstate INVALID -j DROP
 
# SSH (22) を管理ネットワークからのみ許可 + レート制限
iptables -A INPUT -p tcp --dport 22 -s 10.0.0.0/8 \
  -m conntrack --ctstate NEW \
  -m recent --set --name SSH
iptables -A INPUT -p tcp --dport 22 -s 10.0.0.0/8 \
  -m conntrack --ctstate NEW \
  -m recent --update --seconds 60 --hitcount 4 --name SSH \
  -j DROP
iptables -A INPUT -p tcp --dport 22 -s 10.0.0.0/8 -j ACCEPT
 
# HTTP (80), HTTPS (443) を許可
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
 
# ICMP (ping) をレート制限付きで許可
iptables -A INPUT -p icmp --icmp-type echo-request \
  -m limit --limit 1/s --limit-burst 4 -j ACCEPT
 
# SYN flood 対策
iptables -A INPUT -p tcp --syn \
  -m limit --limit 25/s --limit-burst 50 -j ACCEPT
iptables -A INPUT -p tcp --syn -j DROP
 
# ポートスキャン検知 (NULL スキャン)
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j LOG --log-prefix "NULL_SCAN: "
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
 
# Xmas スキャン検知
iptables -A INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j LOG --log-prefix "XMAS_SCAN: "
iptables -A INPUT -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP
 
# ログ記録後に拒否 (最終ルール)
iptables -A INPUT -j LOG --log-prefix "IPT_DROP: " --log-level 4
iptables -A INPUT -j DROP

#!/usr/sbin/nft -f
flush ruleset
 
# テーブルとチェインの定義
table inet filter {
    # IP セット定義 (動的にブロック対象を管理)
    set blocklist {
        type ipv4_addr
        flags timeout
        timeout 1h
    }
 
    set ratelimit_ssh {
        type ipv4_addr
        flags dynamic, timeout
        timeout 5m
    }
 
    # 入力チェイン
    chain input {
        type filter hook input priority 0; policy drop;
 
        # ブロックリスト
        ip saddr @blocklist counter drop
 
        # 確立済みコネクション
        ct state established,related accept
 
        # 不正パケット
        ct state invalid counter drop
 
        # ループバック
        iif lo accept
 
        # ICMP (レート制限)
        icmp type echo-request limit rate 2/second burst 5 packets accept
        icmpv6 type { echo-request, nd-neighbor-solicit, nd-router-advert } accept
 
        # SSH (管理ネットワーク + レート制限)
        tcp dport 22 ip saddr 10.0.0.0/8 ct state new \
            add @ratelimit_ssh { ip saddr limit rate 3/minute } accept
 
        # Web サービス
        tcp dport { 80, 443 } accept
 
        # SYN flood 対策
        tcp flags syn limit rate 25/second burst 50 accept
        tcp flags syn counter drop
 
        # ログ & ドロップ (最終ルール)
        log prefix "nft_drop: " counter drop
    }
 
    # 転送チェイン
    chain forward {
        type filter hook forward priority 0; policy drop;
 
        # Docker / コンテナ用の転送ルール
        iifname "docker0" oifname "eth0" accept
        iifname "eth0" oifname "docker0" ct state established,related accept
    }
 
    # 出力チェイン
    chain output {
        type filter hook output priority 0; policy accept;
 
        # 外向き DNS の制限 (DNS トンネリング対策)
        udp dport 53 ip daddr != { 10.0.0.2, 8.8.8.8 } counter drop
    }
}

import boto3
import gzip
import json
from datetime import datetime, timedelta
 
# VPC フローログの有効化 (Terraform)
"""
resource "aws_flow_log" "vpc_flow" {
  vpc_id          = aws_vpc.main.id
  traffic_type    = "ALL"
  iam_role_arn    = aws_iam_role.flow_log.arn
  log_destination = aws_cloudwatch_log_group.flow_log.arn
 
  # カスタムフォーマット (追加フィールド)
  log_format = "$${version} $${account-id} $${interface-id} $${srcaddr} $${dstaddr} $${srcport} $${dstport} $${protocol} $${packets} $${bytes} $${start} $${end} $${action} $${log-status} $${tcp-flags} $${flow-direction}"
}
"""
 
# Athena でフローログを分析: 不審なトラフィックパターン
SUSPICIOUS_TRAFFIC_QUERY = """
-- 大量の REJECT されたトラフィック (ポートスキャンの兆候)
SELECT
    srcaddr,
    dstport,
    COUNT(*) as reject_count,
    SUM(bytes) as total_bytes
FROM vpc_flow_logs
WHERE action = 'REJECT'
  AND start > to_unixtime(now() - interval '1' hour)
GROUP BY srcaddr, dstport
HAVING COUNT(*) > 100
ORDER BY reject_count DESC
LIMIT 50;
"""
 
# 異常な外向きトラフィック検知 (データ流出の兆候)
DATA_EXFIL_QUERY = """
SELECT
    srcaddr,
    dstaddr,
    dstport,
    SUM(bytes) as total_bytes,
    COUNT(*) as flow_count
FROM vpc_flow_logs
WHERE flow_direction = 'egress'
  AND dstaddr NOT LIKE '10.%'
  AND dstaddr NOT LIKE '172.16.%'
  AND start > to_unixtime(now() - interval '1' hour)
GROUP BY srcaddr, dstaddr, dstport
HAVING SUM(bytes) > 1073741824  -- 1GB超
ORDER BY total_bytes DESC;
"""

# /etc/suricata/suricata.yaml (本番環境向け設定)
%YAML 1.1
---
 
# ネットワーク定義
vars:
  address-groups:
    HOME_NET: "[10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16]"
    EXTERNAL_NET: "!$HOME_NET"
    DNS_SERVERS: "[10.0.0.2/32]"
    HTTP_SERVERS: "[10.0.1.0/24]"
    SQL_SERVERS: "[10.0.3.0/24]"
 
  port-groups:
    HTTP_PORTS: "[80, 8080, 8443]"
    HTTPS_PORTS: "443"
    DNS_PORTS: "53"
    SSH_PORTS: "22"
 
# パフォーマンスチューニング
threading:
  set-cpu-affinity: yes
  detect-thread-ratio: 1.5
 
# 検知エンジン
detect:
  profile: high      # high / medium / low
  custom-values:
    toclient-groups: 50
    toserver-groups: 50
  sgh-mpm-context: auto
  inspection-recursion-limit: 3000
 
# EVE JSON ログ (SIEM 連携)
outputs:
  - eve-log:
      enabled: yes
      filetype: regular
      filename: /var/log/suricata/eve.json
      types:
        - alert:
            tagged-packets: yes
            metadata: yes
        - http:
            extended: yes
        - dns:
            query: yes
            answer: yes
        - tls:
            extended: yes
            session-resumption: yes
        - flow
        - stats:
            totals: yes
            threads: yes
 
# ルールファイル
default-rule-path: /etc/suricata/rules
rule-files:
  - suricata.rules          # ET Open ルール
  - local.rules             # カスタムルール
  - emerging-exploit.rules  # エクスプロイト検知
  - emerging-malware.rules  # マルウェア検知
 
# IPS モード設定 (AF_PACKET インラインモード)
af-packet:
  - interface: eth0
    cluster-id: 99
    cluster-type: cluster_flow
    defrag: yes
    use-mmap: yes
    ring-size: 200000
    block-size: 262144
    copy-mode: ips           # IPS モード
    copy-iface: eth1         # 出力インターフェース

# /etc/suricata/rules/local.rules
# ============================================
 
# --- SQL インジェクション検知 (高精度) ---
alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (
    msg:"SQL Injection - UNION SELECT";
    flow:to_server,established;
    http.uri;
    content:"UNION"; nocase;
    content:"SELECT"; nocase; distance:0;
    pcre:"/UNION\s+(ALL\s+)?SELECT/Ui";
    classtype:web-application-attack;
    sid:1000001; rev:2;
    metadata:attack_target web_server, deployment perimeter;
)
 
# --- SQL インジェクション (Time-based Blind) ---
alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (
    msg:"SQL Injection - Time-based Blind (SLEEP/BENCHMARK)";
    flow:to_server,established;
    http.uri;
    pcre:"/(?:SLEEP|BENCHMARK|WAITFOR\s+DELAY|pg_sleep)\s*\(/Ui";
    classtype:web-application-attack;
    sid:1000010; rev:1;
)
 
# --- SSH ブルートフォース検知 ---
alert ssh $EXTERNAL_NET any -> $HOME_NET $SSH_PORTS (
    msg:"SSH Brute Force Attempt";
    flow:to_server;
    threshold: type both, track by_src, count 5, seconds 60;
    classtype:attempted-admin;
    sid:1000002; rev:1;
)
 
# --- C2 通信の検知 (DNS トンネリング) ---
alert dns $HOME_NET any -> any $DNS_PORTS (
    msg:"Possible DNS Tunneling - Long Query";
    dns.query;
    pcre:"/^.{50,}\./";     # 50文字以上のサブドメイン
    threshold: type both, track by_src, count 10, seconds 60;
    classtype:trojan-activity;
    sid:1000003; rev:2;
)
 
# --- DNS トンネリング (高エントロピー) ---
alert dns $HOME_NET any -> any $DNS_PORTS (
    msg:"Possible DNS Tunneling - High Entropy Subdomain";
    dns.query;
    # Base64/Hex エンコードされた長いサブドメイン
    pcre:"/^[a-zA-Z0-9+\/=]{30,}\./";
    threshold: type both, track by_src, count 5, seconds 120;
    classtype:trojan-activity;
    sid:1000004; rev:1;
)
 
# --- 暗号通貨マイニング通信検知 ---
alert tls $HOME_NET any -> $EXTERNAL_NET any (
    msg:"Cryptomining - Stratum Protocol over TLS";
    flow:to_server,established;
    tls.sni; content:"pool"; nocase;
    pcre:"/(?:mining|pool|stratum|xmr|monero|coinhive)/i";
    classtype:trojan-activity;
    sid:1000005; rev:1;
)
 
# --- 不審なユーザエージェント ---
alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"Suspicious User-Agent - Possible Bot/Scanner";
    flow:to_server,established;
    http.user_agent;
    pcre:"/^(?:python-requests|curl|wget|nikto|sqlmap|nmap)/i";
    classtype:web-application-attack;
    sid:1000006; rev:1;
)
 
# --- ICMP トンネリング検知 ---
alert icmp $HOME_NET any -> $EXTERNAL_NET any (
    msg:"Possible ICMP Tunneling - Large Payload";
    icode:0;
    itype:8;
    dsize:>800;    # 通常のpingは64バイト
    threshold: type both, track by_src, count 5, seconds 60;
    classtype:trojan-activity;
    sid:1000007; rev:1;
)
 
# --- Lateral Movement: SMB/RPC ---
alert tcp $HOME_NET any -> $HOME_NET [139,445] (
    msg:"Possible Lateral Movement - Internal SMB";
    flow:to_server,established;
    content:"|FF|SMB"; offset:4; depth:4;
    classtype:attempted-admin;
    sid:1000008; rev:1;
)

import json
import subprocess
from datetime import datetime
from collections import defaultdict
from pathlib import Path
 
class SuricataAlertAnalyzer:
    """Suricata の EVE JSON ログを分析し自動対応を行う"""
 
    def __init__(self, eve_log_path: str = "/var/log/suricata/eve.json"):
        self.eve_log_path = Path(eve_log_path)
        self.alert_counts = defaultdict(int)
        self.blocked_ips = set()
 
    def parse_alerts(self, minutes: int = 5) -> list[dict]:
        """直近N分のアラートを解析"""
        alerts = []
        cutoff = datetime.utcnow().timestamp() - (minutes * 60)
 
        with open(self.eve_log_path) as f:
            for line in f:
                try:
                    event = json.loads(line)
                    if event.get("event_type") != "alert":
                        continue
                    ts = datetime.fromisoformat(
                        event["timestamp"].replace("Z", "+00:00")
                    ).timestamp()
                    if ts >= cutoff:
                        alerts.append(event)
                except (json.JSONDecodeError, KeyError):
                    continue
        return alerts
 
    def aggregate_by_source(self, alerts: list[dict]) -> dict:
        """送信元IPごとにアラートを集約"""
        by_src = defaultdict(lambda: {"count": 0, "signatures": set(), "severity": 0})
        for alert in alerts:
            src = alert.get("src_ip", "unknown")
            sig = alert["alert"]["signature"]
            severity = alert["alert"].get("severity", 3)
            by_src[src]["count"] += 1
            by_src[src]["signatures"].add(sig)
            by_src[src]["severity"] = max(by_src[src]["severity"], severity)
        return dict(by_src)
 
    def auto_block(self, ip: str, duration_hours: int = 1):
        """nftables で IP を動的ブロック"""
        if ip in self.blocked_ips:
            return
        subprocess.run([
            "nft", "add", "element", "inet", "filter",
            "blocklist", f"{{ {ip} timeout {duration_hours}h }}"
        ], check=True)
        self.blocked_ips.add(ip)
        print(f"[BLOCK] {ip} を {duration_hours}時間ブロック")
 
    def respond_to_alerts(self):
        """アラートに基づく自動対応"""
        alerts = self.parse_alerts(minutes=5)
        by_src = self.aggregate_by_source(alerts)
 
        for ip, info in by_src.items():
            # 高重大度 or 大量アラート → 自動ブロック
            if info["severity"] <= 1 or info["count"] >= 20:
                self.auto_block(ip, duration_hours=4)
            elif info["count"] >= 10:
                self.auto_block(ip, duration_hours=1)
 
 
# 使用例
if __name__ == "__main__":
    analyzer = SuricataAlertAnalyzer()
    analyzer.respond_to_alerts()

# 鍵生成
wg genkey | tee /etc/wireguard/server_private.key | wg pubkey > /etc/wireguard/server_public.key
chmod 600 /etc/wireguard/server_private.key
 
# サーバ側の設定 (/etc/wireguard/wg0.conf)
[Interface]
PrivateKey = SERVER_PRIVATE_KEY
Address = 10.200.0.1/24
ListenPort = 51820
 
# IP フォワーディングとNAT
PostUp = sysctl -w net.ipv4.ip_forward=1
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT
PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostUp = iptables -A INPUT -p udp --dport 51820 -j ACCEPT
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT
PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D INPUT -p udp --dport 51820 -j ACCEPT
 
# DNS (Unbound をローカルDNSとして使用)
# PostUp = systemctl start unbound
 
[Peer]
# クライアント A (開発者)
PublicKey = CLIENT_A_PUBLIC_KEY
AllowedIPs = 10.200.0.2/32
# PresharedKey = PSK_A  # 量子耐性のための追加層
 
[Peer]
# クライアント B (運用チーム)
PublicKey = CLIENT_B_PUBLIC_KEY
AllowedIPs = 10.200.0.3/32

# クライアント側の設定
[Interface]
PrivateKey = CLIENT_PRIVATE_KEY
Address = 10.200.0.2/24
DNS = 10.200.0.1
 
# Kill Switch (VPN切断時に全通信を遮断)
PostUp = iptables -I OUTPUT ! -o wg0 -m mark ! --mark $(wg show wg0 fwmark) -m addrtype ! --dst-type LOCAL -j REJECT
PreDown = iptables -D OUTPUT ! -o wg0 -m mark ! --mark $(wg show wg0 fwmark) -m addrtype ! --dst-type LOCAL -j REJECT
 
[Peer]
PublicKey = SERVER_PUBLIC_KEY
Endpoint = vpn.example.com:51820
AllowedIPs = 0.0.0.0/0, ::/0   # 全トラフィックをVPN経由
PersistentKeepalive = 25

import subprocess
import ipaddress
from dataclasses import dataclass
from pathlib import Path
 
@dataclass
class WireGuardPeer:
    name: str
    public_key: str
    allowed_ips: str
    preshared_key: str | None = None
 
class WireGuardManager:
    """WireGuard ピアの追加・削除・一覧を管理"""
 
    def __init__(self, interface: str = "wg0"):
        self.interface = interface
        self.config_path = Path(f"/etc/wireguard/{interface}.conf")
        self.next_ip = ipaddress.IPv4Address("10.200.0.10")
 
    def generate_peer_config(self, peer_name: str) -> tuple[str, str]:
        """新しいピアの鍵ペアとクライアント設定を生成"""
        # 鍵生成
        private_key = subprocess.run(
            ["wg", "genkey"], capture_output=True, text=True
        ).stdout.strip()
        public_key = subprocess.run(
            ["wg", "pubkey"], input=private_key,
            capture_output=True, text=True
        ).stdout.strip()
 
        # PSK 生成 (量子耐性)
        psk = subprocess.run(
            ["wg", "genpsk"], capture_output=True, text=True
        ).stdout.strip()
 
        peer_ip = str(self.next_ip)
        self.next_ip += 1
 
        # サーバ設定に追加
        server_peer_config = f"""
[Peer]
# {peer_name}
PublicKey = {public_key}
PresharedKey = {psk}
AllowedIPs = {peer_ip}/32
"""
 
        # クライアント設定を生成
        server_pub = self._get_server_public_key()
        client_config = f"""[Interface]
PrivateKey = {private_key}
Address = {peer_ip}/24
DNS = 10.200.0.1
 
[Peer]
PublicKey = {server_pub}
PresharedKey = {psk}
Endpoint = vpn.example.com:51820
AllowedIPs = 10.0.0.0/8
PersistentKeepalive = 25
"""
        # サーバにピアを動的追加
        subprocess.run([
            "wg", "set", self.interface,
            "peer", public_key,
            "preshared-key", "/dev/stdin",
            "allowed-ips", f"{peer_ip}/32",
        ], input=psk, text=True, check=True)
 
        return server_peer_config, client_config
 
    def revoke_peer(self, public_key: str):
        """ピアを無効化"""
        subprocess.run([
            "wg", "set", self.interface,
            "peer", public_key, "remove",
        ], check=True)
 
    def list_peers(self) -> list[dict]:
        """接続中のピア一覧"""
        result = subprocess.run(
            ["wg", "show", self.interface, "dump"],
            capture_output=True, text=True,
        )
        peers = []
        for line in result.stdout.strip().split("\n")[1:]:  # ヘッダスキップ
            parts = line.split("\t")
            if len(parts) >= 7:
                peers.append({
                    "public_key": parts[0],
                    "endpoint": parts[2],
                    "allowed_ips": parts[3],
                    "latest_handshake": parts[4],
                    "transfer_rx": parts[5],
                    "transfer_tx": parts[6],
                })
        return peers
 
    def _get_server_public_key(self) -> str:
        result = subprocess.run(
            ["wg", "show", self.interface, "public-key"],
            capture_output=True, text=True,
        )
        return result.stdout.strip()

# /etc/swanctl/swanctl.conf (strongSwan 5.x+)
connections {
    site-to-site {
        version = 2           # IKEv2
        local_addrs = 203.0.113.1
        remote_addrs = 198.51.100.1
 
        local {
            auth = pubkey
            certs = server.cert.pem
            id = vpn.example.com
        }
        remote {
            auth = pubkey
            id = remote.example.com
        }
 
        children {
            net-net {
                local_ts = 10.0.0.0/16     # ローカルネットワーク
                remote_ts = 172.16.0.0/16   # リモートネットワーク
                esp_proposals = aes256gcm128-x25519
                dpd_action = restart
                start_action = trap   # オンデマンド接続
            }
        }
 
        proposals = aes256-sha256-x25519
        rekey_time = 4h
        dpd_delay = 30s
    }
}

# Web → App のみ許可 (App Pod の NetworkPolicy)
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: app-server-policy
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: app-server
  policyTypes:
    - Ingress
    - Egress
  ingress:
    # Web サーバからの 8080 のみ許可
    - from:
        - podSelector:
            matchLabels:
              app: web-server
      ports:
        - protocol: TCP
          port: 8080
  egress:
    # DB への 5432 のみ許可
    - to:
        - podSelector:
            matchLabels:
              app: database
      ports:
        - protocol: TCP
          port: 5432
    # DNS を許可 (必須)
    - to:
        - namespaceSelector: {}
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - protocol: UDP
          port: 53

# API パス単位の認可制御
apiVersion: security.istio.io/v1
kind: AuthorizationPolicy
metadata:
  name: app-server-authz
  namespace: production
spec:
  selector:
    matchLabels:
      app: app-server
  rules:
    # Web サーバからの GET/POST のみ許可
    - from:
        - source:
            principals: ["cluster.local/ns/production/sa/web-server"]
      to:
        - operation:
            methods: ["GET", "POST"]
            paths: ["/api/v1/*"]
    # 管理APIは管理サービスのみ
    - from:
        - source:
            principals: ["cluster.local/ns/admin/sa/admin-service"]
      to:
        - operation:
            methods: ["GET", "POST", "DELETE"]
            paths: ["/admin/*"]
  # 上記以外は暗黙的に拒否

# SYN Cookie の有効化 (Linux)
sysctl -w net.ipv4.tcp_syncookies=1
sysctl -w net.ipv4.tcp_max_syn_backlog=65536
sysctl -w net.ipv4.tcp_synack_retries=2
 
# 永続化
echo "net.ipv4.tcp_syncookies = 1" >> /etc/sysctl.d/99-security.conf
echo "net.ipv4.tcp_max_syn_backlog = 65536" >> /etc/sysctl.d/99-security.conf

# NG: 全通信を許可 (テスト時に設定して本番に残る)
iptables -A INPUT -j ACCEPT
 
# NG: 広すぎるセキュリティグループ
aws ec2 authorize-security-group-ingress \
  --group-id sg-xxx \
  --protocol -1 --port -1 \
  --cidr 0.0.0.0/0
 
# NG: SSH を全世界に開放
aws ec2 authorize-security-group-ingress \
  --group-id sg-xxx \
  --protocol tcp --port 22 \
  --cidr 0.0.0.0/0
 
# OK: 必要最小限のポート・送信元のみ許可
aws ec2 authorize-security-group-ingress \
  --group-id sg-xxx \
  --protocol tcp --port 443 \
  --cidr 0.0.0.0/0
 
# OK: SSH は VPN/踏み台経由のみ
aws ec2 authorize-security-group-ingress \
  --group-id sg-xxx \
  --protocol tcp --port 22 \
  --source-group sg-bastion

# iptables: パケットカウンタの確認
iptables -L -v -n --line-numbers
 
# nftables: ルールごとのカウンタ
nft list ruleset -a
 
# conntrack: コネクション追跡テーブル
conntrack -L
conntrack -E   # リアルタイムイベント
 
# tcpdump: パケットキャプチャ
tcpdump -i eth0 -n 'port 443 and host 10.0.1.100'
tcpdump -i eth0 -n 'tcp[tcpflags] & (tcp-syn) != 0'  # SYN パケットのみ
 
# ss: ソケット統計
ss -tlnp         # TCP リスニングポート
ss -s            # ソケット統計サマリ

# WireGuard: ステータス確認
wg show wg0
 
# WireGuard: ハンドシェイク確認
wg show wg0 latest-handshakes
# 0 = ハンドシェイク未完了 (鍵不一致、FW、ルーティング問題)
 
# WireGuard: デバッグログ有効化
echo module wireguard +p > /sys/kernel/debug/dynamic_debug/control
dmesg | grep wireguard
 
# MTU 問題の診断 (VPN 越しのパケット断片化)
ping -M do -s 1400 10.200.0.1
# → "Frag needed" → MTU を下げる (1280-1420)
 
# IPsec: 接続ステータス
swanctl --list-sas
swanctl --log   # リアルタイムログ

# Suricata: 処理統計
suricatasc -c "dump-counters" | grep -E "drop|bypass"
 
# パケットドロップの確認
cat /proc/net/dev | grep eth0
# → RX dropped が増加 → AF_PACKET のリングバッファを拡大
 
# CPU バインディングの確認
suricatasc -c "iface-stat eth0"
 
# ルールプロファイリング
suricata --engine-analysis
# → 負荷の高いルールを特定して最適化

# conntrack テーブルのチューニング
sysctl -w net.nf_conntrack_max=1048576
sysctl -w net.netfilter.nf_conntrack_tcp_timeout_established=3600
sysctl -w net.netfilter.nf_conntrack_tcp_timeout_time_wait=30
 
# nftables: セットによる高速ルックアップ
# O(n) の線形評価 → O(1) のハッシュルックアップ
table inet filter {
    set allowed_ips {
        type ipv4_addr
        flags interval
        elements = { 10.0.0.0/8, 172.16.0.0/12 }
    }
    chain input {
        ip saddr @allowed_ips tcp dport 22 accept
    }
}