0
votes
0answers
23 views

Configure firewalld for OpenVPN (server-bridge) in Fedora 20

I've installed an OpenVPN server (server-bridge) on Fedora 20, but I cannot get it to work. I'm almost sure that It's a firewall issue. I'm trying to connect from an OSX client, but I can connect ...
1
vote
1answer
32 views

IPTABLES command that end with ACCEPT or DROP fail on service firewall restart

I have a CENTOS Linux VPS. I have the following in my IPTABLES script to run when my VPN restarts, but I get errors when I do a service firewall restart I've ran each of the commands below manually ...
-1
votes
1answer
35 views

Why does this IPTables command create 4 entries?

When I executed this IPTables command: iptables -A INPUT -p tcp -m tcp --dport 9080 -s localhost -d localhost -j ACCEPT iptables -L shows: ACCEPT tcp -- localhost localhost ...
0
votes
1answer
64 views

How do I block all access to machine except port 3389 using Open vSwitch

I can allow access to the machine and block everything else using: ovs-ofctl add-flow xenbr0 "dl_src={mac-address} priority=39000 dl_type=0x0800 nw_dst={ip-address} idle_timeout=65000 action=normal" ...
3
votes
2answers
54 views

How do I find out where my IPTables rules are being stored?

I working on a Debian server and I'm trying to figure out where my IPTable rules are being stored. From looking around on the internet I've found there is generally two locations were these are ...
0
votes
0answers
25 views

OpenWRT firewall redirect punch through

I am using an OpenWRT based firmware on a Netgear router as part of a research project that links the router to an existing broadband router to allow members of the public to access the internet via a ...
0
votes
1answer
36 views

Iptables -j REJECT unavailable [duplicate]

I am somewhat new to Linux networking and running in to a issue with iptables I am just not making any headway on. Two notes before I get in too it. iptables is version 1.4.14, and it is a custom ...
-1
votes
1answer
143 views

Opening port 587 on Debian running on Google Compute Engine

I'm attempting to use port 587 for my server mailing purposes. However, I can't seem to be able to unblock the port even after trying the following : Adding port 587 to the Google Cloud network ...
0
votes
2answers
41 views

Assign IPs to programs/processes

I need to assign different IP addresses to different processes (mostly PHP & Ruby programs) running on my Linux server. They will be making queries to various servers, including the situation ...
0
votes
0answers
17 views

how to use --rdest flag in recent table

Here is why I try to accomplish: When receiving a UDP packet, put IP address of the source address in recent table. sudo iptables -A INPUT -p udp --dport xxxxx -m recent --set -j ACCEPT When send ...
-1
votes
1answer
64 views

How should I properly block outgoing http traffic with iptables

I'm experimenting with iptables, and I'm trying to allow all outgoing requests for HTTPS, but to block HTTP. I have the code below; Chain INPUT (policy ACCEPT) target prot opt source ...
3
votes
1answer
68 views

Linux NFLOG - documentation, configuration from C

Several different places (e.g. http://wiki.wireshark.org/CaptureSetup/NFLOG) recommend using Linux's "NFLOG" firewall module to capture packets generated by a particular UID, like this: # iptables -A ...
0
votes
2answers
77 views

Forward SSH request to an External Server to an Internal Server

I have a VM config currently where I have 1 external IP pointing to a VM with an Nginx HTTP Reverse proxy serving HTTP Web Pages from several internal VMs without external IPs. I need a similar setup ...
1
vote
1answer
27 views

NIDS on bridged firewall

I have a firewall (Debian Stable 7.5) which works in bridged mode. The interfaces eth0 (WAN) and eth1 (LAN) are linked with the bridge interface br0. Can I deploy a NIDS (eg. Snort) on this server? ...
0
votes
1answer
24 views

Block an outbound destination IP to prevent connections waiting timeout duration [duplicate]

It seems like with the basic "DROP" iptables rule, an outbound attempt will still wait the duration of its timeout. For instance, if I block an IP address outbound, then attempt to connect to it via ...
-2
votes
1answer
27 views

Allow outgoing connections for DNS [closed]

I'm new to IPtables, but I am trying to setup a secure server to host a website and allow SSH. This is what I have so far: #!/bin/sh i=/sbin/iptables # Flush all rules $i -F $i -X # Setup default ...
1
vote
0answers
168 views

ClearOS Proxy - Block all traffic but two sites and 3 DMZ ips

I've been trying to two days now to get ClearOS to do a proxy setup for my network. This is what I need to do: I need to block all outgoing traffic no matter what it is, all ports and HTTPS as well ...
0
votes
2answers
91 views

Hardware firewall for Linux web (and mail) server allows UDP connections to any local port from remote ports 53 and 123 — is this safe?

I'm trying to tighten security on a linux web server. It has a hardware firewall with a default rule set and I noticed two rules that concern me: remote port: 123; local port: ANY; protocol: UDP; ...
0
votes
1answer
81 views

Can't connect to remote server. Socket error = #2000

I don't know what went wrong, but I get a Timeout after logging in to the proftpd server. STATUS:> [12.05.2014 16:30:24] Getting listing ""... STATUS:> [12.05.2014 16:30:24] Resolving ...
0
votes
1answer
107 views

Block ip forwarding for specific remote ip address

I use ubuntu as gateway for several hosts. I need advise how to block ip forwarding for specific ip address or specific ip range? I tried to block ip via ufw deny rules, but it looks like ip ...
0
votes
1answer
96 views

iptables dual stack - ipv6 not working

I have problem with my iptables setup. I want to have completely dual stacked server so I use same rules for IPv4 and IPv6. However all IPv6 connections are just being dropped while IPv4 are working ...
0
votes
0answers
68 views

Multiple gateways with linux on same subnet using single NIC

I have the following configuration; Firewall 1 (site 1); x.x.x.x/26 subnet on external 10.0.0.0/8 on internal (internal IP 10.0.0.10) Firewall 2 (site 2); x.x.x.y/26 subnet on external 10.0.0.0/8 ...
2
votes
1answer
58 views

iptables: does a scanner knows if you DROP packets?

I know how REJECT and DROP chain works. But, as I read here REJECT vs DROP when using iptables, user Dagelf said that the server still replies with TCP SYN/ACK. Does the scanner knows that a packet ...
0
votes
0answers
77 views

Force all traffic through VPN

I am using PfSense as a firewall, with its VPN functionality. The client I use is Shrew Soft VPN client. As it is a split tunnel, is there a way I can force all traffic through the VPN connection, ...
0
votes
2answers
334 views

IpTables Configuration Not Working to block ports (Centos 6.2)

I am trying to only allow certain IPs to access port 8209. I have tried a few different methods that I read on ServerFault. This method is the most recent one I have tried. I manually edited my ...
0
votes
1answer
54 views

Forward a port to another server using iptables

I have a server that is configured to block any port, and exceptions are configured like this (for mongo): iptables -A INPUT -p tcp --dport 27017 -s 10.20.1.0/8 -j ACCEPT ...
0
votes
1answer
36 views

change timeout for dropped ip traffic

I am behind a corporate firewall, which simply drops (swallows) all ip-traffic to unknown ip-addresses. It takes a lot of time for Linux (Ubuntu 13.10) to abort my erroneous connection-attempts, ...
0
votes
1answer
63 views

Turn IPTables Flush off CentOS

I made some changes to my iptables in a centOS machine. I noticed once I shut the server off it flushes all my iptables and goes back to the default. Is there a way to turn that off?
4
votes
3answers
258 views

connected to Centos openvpn but no outside internet access

I am using Windows 7 to connect to a VPS server running CentOS 6.4 First off, I have read every single post and just cant find the solution to my problem I configured my VPN server with openvpn, and ...
0
votes
1answer
93 views

Ubuntu 10.04LTS Server under attack, random reboots UNTIL I blocked China

What could have been sent to my server to cause it to reboot? Details: I have a for-internal-use LAMP server running Ubuntu 10.04LTS (upgrade is scheduled for that nebulous "when I have time"). It ...
0
votes
1answer
120 views

Configure atftp server to reply on port 69

Problem : I'm facing to a problem with TFTP server and Cisco 79XX IP phones. When on a local network, everything is working fine, but when the TFTP server is on a public server (and phones inside a ...
-1
votes
1answer
40 views

Firewall Connections fail to open under load

Problem : During High load , our applications are encountering errors : java.net.connection Time out. After some investigation , we found out that it was Firewall the root cause, but still don't know ...
4
votes
4answers
333 views

Why on linux machines, any packets do not pass except icmp, but correctly pass on windows

There is a cluster on proxmox. In a cluster have vm - configured router (pfsense). In the our net have Windows and Linux machines. There is the problem: Windows-machines have access to the internet, ...
0
votes
1answer
228 views

Point fail2ban to new log, without losing current bans?

I have logs in /var/log/syslog/YYYY-MM-DD/file.log files. New directories are created automatically by rsyslog, and logs are automatically put to new locations. Every day, I archive previous day of ...
1
vote
1answer
244 views

Is IGMP multicast traffic to a Xen VM host legitimate?

I run two Xen/CentOS 6.5 based VMs, both hosted by the same company, but connected to different networks (basic /24s w/ a single gateway at .1) in different physical locations. I developed an iptables ...
2
votes
3answers
970 views

iptables error: unknown option --dport

The command iptables no longer recognizes one of the most commonly used options when defining rules: --dport. I get this error: [root@dragonweyr /home/calyodelphi]# iptables -A INPUT --dport 7777 -j ...
1
vote
0answers
195 views

Vyatta Remote Access VPN firewall (PPTP)

I am using Vyatta Remote Access VPN (PPTP) and NAT for proxy. When pc-A and pc-B are connected to VPN, pc-A ipaddress is 192.168.10.10 and pc-B is 192.168.10.11. ...
3
votes
1answer
84 views

Smart solution for XenServer firewall?

I've been searching for a smart solution for a XenServer firewall for about a month now. The documentation for the new default networking backend "openvswitch" is not that detailed and I can barely ...
0
votes
1answer
122 views

iptables alternative for nat in windows

When setting up a comms server I usually use iptables in linux to forward any incoming connections on a particular port to another server, e.g. Chain PREROUTING (policy ACCEPT) target prot opt ...
0
votes
0answers
154 views

Dropping packets with Open Vswitch and OpenFlowControl

I am trying to setup some Flows with ovs-ofctl to block all unwanted incoming packets for a VM. The commands I use are: ovs-ofctl add-flow xenbr0 "priority=65000, table=0, tcp, dl_src=*, nw_src=*, ...
1
vote
1answer
128 views

Firewall rules using iptables using conditional statement

I have firewall rule that should accept all the connections, but drop connections from a ssh brute force attack (except 10.0.0.0/8 range). This rule will block an IP if it attempts more than 24 ...
0
votes
1answer
131 views

iptables DROP all access except my dynamic IP, is it possible and how/workaround?

If not possible, is there any workaround without affecting CPU performance? iptables -A INPUT -p tcp --dport 80 -j DROP
-1
votes
1answer
47 views

How to proxy to a web server on a node that can make outgoing connections but has no accessible IP, without root?

Not sure if this is the right StackExchange site to ask (I mainly frequent SO), but since you guys are server admin experts hopefully you'll find it relevant! Some context: I'm currently trying to ...
0
votes
1answer
74 views

Tool to allow Kerberos Authenticated users to modify Firewall settings

I run a firewall on a central router. Recently, several users want to use Skype. Since firewalling Skype virtually means to switch the firewall off, I consider to allow users to temporarily punch ...
0
votes
3answers
68 views

How do I stop someone from saturating my line & wasting CPU cycles

My web host shows inbound & outbound traffic with mrtg. I have a steady 3.5mbps inbound traffic from Nigeria. Even assuming the source IPs & destination ports are blocked with Iptables & ...
1
vote
1answer
471 views

How do I allow only certain IPSet set's to access a certain port with iptables?

I'm using IPSet to build IP ranges for different countries as follows : # Canada ipset -F ca.zone ipset -N ca.zone nethash for IP in $(wget -O - http://www.ipdeny.com/ipblocks/data/countries/ca.zone) ...
1
vote
0answers
187 views

Bypassing a transparent proxy using squid [closed]

I'm in a network where I can reach only one website for example exemple.com. Other requested web sites like google.com will be redirected to exemple.com, all other ports are work this way too ( in ...
1
vote
2answers
876 views

force LAN hosts to go through proxy

I have an IPTables firewall on a Debian server, with a bunch of hosts behind it with masquerading. In the upstream network I don't have direct access to the internet, and I need to go through a proxy ...
-3
votes
1answer
50 views

iptables allow A -> B:22 , B -> everywhere:22

I want iptables rules that let a server allow incoming ssh from a specific host and at the same time this server can connect ssh on any destination, then block any other in/out traffic Thanks in ...
0
votes
1answer
413 views

iptables Port Forwarding not working

I'm facing the problem, that my iptables rules aren't working anymore after I changed OS from Ubuntu 8.04 to Debian Squeeze. I'm trying to do a Port Forwarding by iptables -t nat -A PREROUTING -d ...