A Firewall is an application or hardware device used to inspect and filter network traffic.

learn more… | top users | synonyms

196
votes
22answers
57k views

Is it normal to get hundreds of break-in attempts per day?

I just checked my server's /var/log/auth.log and found that I'm getting over 500 failed password/break-in attempt notifications per day! My site is small, and its URL is obscure. Is this normal? ...
48
votes
8answers
4k views

Why would I need a firewall if my server is well configured?

I admin a handful of cloud-based (VPS) servers for the company I work for. The servers are minimal ubuntu installs that run bits of LAMP stacks / inbound data collection (rsync). The data is large ...
45
votes
15answers
20k views

iptables Tips & Tricks

I'm sure Linux sysadmins are quite familiar with iptables, the userland interface to the netfilter packet-filtering framework. Now, this "Question" is meant to be a Community Wiki for collecting ...
91
votes
21answers
19k views

Why should I firewall servers?

PLEASE NOTE: I'm not interested in making this into a flame war! I understand that many people have strongly-held beliefs about this subject, in no small part because they've put a lot of effort into ...
36
votes
9answers
24k views

Why not block ICMP?

I think I almost have my iptables setup complete on my CentOS 5.3 system. Here is my script... # Establish a clean slate iptables -P INPUT ACCEPT iptables -P FORWARD ACCEPT iptables -P OUTPUT ACCEPT ...
32
votes
3answers
34k views

iptables port redirect not working for localhost

I want to redirect all traffic from port 443 to the internal port 8080. I'm using this config for iptables: iptables -t nat -I PREROUTING --source 0/0 --destination 0/0 -p tcp \ --dport 443 -...
66
votes
8answers
46k views

What steps do you take to secure a Debian server? [closed]

I am installing a Debian server which is connected directly to the Internet. Obviously I want to make it as secure as possible. I would like you guys/gals to add your ideas to secure it and what ...
48
votes
5answers
40k views

REJECT vs DROP when using iptables

Is there any reason why I would want to have iptables -A INPUT -j REJECT instead of iptables -A INPUT -j DROP
1
vote
1answer
891 views

SMTP 25 closed even I allow everything in firewall, debian server running sendmail

I am running sendmail + dovecot in my debian server. I have enabled the firewall rules to allow everything iptables -P INPUT ACCEPT iptables -P OUTPUT ACCEPT iptables -P FORWARD ACCEPT ...
16
votes
1answer
21k views

Can I use ufw to setup a port forward?

Im currently using ufw to enforce some basic firewall rules. Is it possible to also use ufw to do port forwarding? Specifically im wanting to forward incoming traffic to my server (same machine ...
7
votes
4answers
8k views

What to do with an out-of-warranty Barracuda Spam/Web filter?

I'm working with an organization that would like to start using a old Barracuda Spam Filter 300 unit. I've sold and configured plenty of these, but was surprised to see that this unit's warranty ...
11
votes
9answers
3k views

Why buy high end hardware firewalls?

There exist firewalls from Juniper and Cisco that cost more than a house. So I wonder: what does one get from a $10.000+ firewall compared to an 2U server with 4x 10Gbit network cards running e.g. ...
22
votes
7answers
154k views

What firewall ports do I need to open when using FTPS?

I need to access an ftps server (vsftpd) on a vendor's site. The vendor has a firewall in front of the ftps server and I have a firewall in front of my ftps client. I understand that ports 990, 991 ...
17
votes
2answers
12k views

Why is our firewall (Ubuntu 8.04) rejecting the final packet (FIN, ACK, PSH) with a RST

Background, for a long time we have had problems with our firewall that sometimes keep HTTP requests hanging partially loaded until TCP times out. After tracing the traffic on the firewall I noticed ...
29
votes
6answers
7k views

Hardware Firewall Vs. Software Firewall (IP Tables, RHEL)

TL;DR My hosting company says IP Tables is useless and doesn't provide any protection. Is this BS? I have two, co-located servers. Yesterday my DC company contacted me to tell me that because I'm ...
9
votes
2answers
20k views

How to open port for a specific IP address with firewall-cmd on CentOS?

I would like to open port 4567 for the IP address 1.2.3.4 with the firewall-cmd command on a CentOS 7.1 server. How can I achieve this, as the documentation I could find was too specific on this?
18
votes
7answers
39k views

Enable Ping in Windows Server Firewall?

I've just installed Windows Server 2008 on a server and I'm able to connect through Remote Desktop but can't ping. Do I need to open an special port on the firewall to be able to ping a server?
5
votes
5answers
8k views

iptables port forwarding on debian

I'm trying to setup a simple port forwarding firewall and I can't make the basic non-firewall configuration to work. I have setup the iptables script as follows #!/bin/sh # interfaces LAN="eth1" ...
61
votes
3answers
434k views

How to check if a port is blocked on a Windows machine?

On the Windows platform, what native options to I have to check if a port (3306, for example) on my local machine (as in localhost), is being blocked?
16
votes
1answer
29k views

iptables: difference between NEW, ESTABLISHED and RELATED packets

Part of a firewall on a server : iptables -A INPUT -p tcp --dport 22 -m state NEW --state -m recent --set iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 100 --...
56
votes
5answers
7k views

I accidentaly forbid SSH connection to a remote server… What's next?

Let's say it again, we all make mistakes, and I have just made one. A brief history: I was doing some stuff on a VPS (Debian) I'm renting, when I noticed some strange behaviour. Using the netstat ...
12
votes
23answers
19k views

Best practices to block social sites

In our company we have around 100 workstations with Internet access, and the day-to-day situation is getting worse and worse from the perspective of using Internet access for the purpose of doing ...
25
votes
4answers
26k views

How do you PREPEND an iptables rather than APPEND?

Pretty basic question.. How do you PREPEND an iptables rather than APPEND? I have DROP statements at the bottom of my rules. I have software to add new rules but adding rules after DROP statements ...
14
votes
3answers
31k views

Windows Advanced Firewall: What does “Edge Traversal” mean?

this should be a really simple one: In Advanced Windows Firewall on Windows Server 2008+, Properties > Advanced, what does "Edge Traversal" mean? I Googled it, of course, and was unable to come up ...
13
votes
4answers
13k views

Hardware firewall vs VMware firewall appliance

We have a debate in our office going on whether it's necessary to get a hardware firewall or set up a virtual one on our VMWare cluster. Our environment consists of 3 server nodes (16 cores w/ 64 GB ...
2
votes
1answer
2k views

How to Deploy an ASP.NET Web API- and Browser-based Application to a Production Environment [closed]

(Please forgive if this is posted in an incorrect forum. We didn’t know exactly where to post it.) We have an ASP.NET Web API single page application - a browser-based app running in IIS to serve up ...
2
votes
8answers
41k views

Active FTP client blocked by Windows Firewall on Windows 7

I have an application that runs as a service and contains an FTP client. It needs to connect to an FTP server that only supports Active FTP. When I attempt to get a list of files or download a file, ...
5
votes
3answers
2k views

iptables — OK, **now** am I doing it right?

This is a follow up to a previous question where I asked whether my iptables config is correct. CentOS 5.3 system. Intended result: block everything except ping, ssh, Apache, and SSL. Based on ...
3
votes
2answers
224 views

ipTables: How to improve the current set-up?

It took a lot of time and digging to get my ipTables working fairly well. Current status: 'Works' w/ a noticeable, reproducible (almost unacceptable) delay on SSH connections. This delay goes away as ...
3
votes
3answers
224 views

Iptables rules with ! character

I have entered iptables rules to log a specific connection on our server, but it doesn't seem to be working as I want it to. Here are the rules: 1 LOG tcp -- !10.51.0.0/16 0.0.0.0/...
3
votes
3answers
6k views

How to log the ip addresses trying to connect to a port?

Is it possible to log all ip addresses that trying to connect or connected to port "5901" in linux debian? how can i do that? Regards
1
vote
2answers
4k views

Open Source Unified Threat Management Software Options

Does anyone have experience or could recommend an open source Unified Threat Management (UTM) package that we could install on our network using hardware we already own? Looking for something that ...
0
votes
1answer
579 views

One workstation gets slow access to the server, but others are fast

I've just setup a machine with Windows Server 2008. It hosts various services, like IIS, POP3, SMTP, Music for Squeezeboxes, VNC. All was working well for the first week or so. One day I needed to ...
0
votes
2answers
699 views

Running NFS with iptables, change firewall?

I have a number of web servers on which I've set up iptables as the firewall, this is working great. However, I also have a dedicated file server running NFS and I need to firewall this machine as ...
2
votes
1answer
9k views

How can a block IP addresses using Windows Server 2008 firewall?

I have started to get various login attempts from different IP addresses. How can I block these IP addresses in the Windows Server 2008 Firewall?
2
votes
5answers
3k views

Advantage of hardware firewalls over software firewalls?

There are a lot of hardware firewalls out there, but what is their advantage / use over software firewalls, as I can also easily set those up without having to buy pricy hardware firewalls? Are there ...
1
vote
2answers
4k views

Splitting up multiple WAN's on Sonicwall

I have a cable connection running to our FW. We are supplanting that connection with another fiber connection to be used on a separate LAN. The cable connection and LAN is running fine. If I ...
1
vote
3answers
194 views

IP tables - changes not persisting

I've tried to open port 8605 on my server (used for socket connections) using: iptables -I INPUT 2 -s 0/0 -p tcp --dport 8605 -j ACCEPT However the change is not persisting, the port closes itself ...
0
votes
2answers
2k views

Forward SSH request to an External Server to an Internal Server [duplicate]

I have a VM config currently where I have 1 external IP pointing to a VM with an Nginx HTTP Reverse proxy serving HTTP Web Pages from several internal VMs without external IPs. I need a similar setup ...
0
votes
1answer
1k views

NAT / Port Forwarding with iptables firewall [duplicate]

I've got the following setup: firewall (iptables) eth0 internal interface, 192.168.2.10 ppp0 external interface, public_ip (IP masquerading) server1 (192.168.2.11), service 1 (port 443) server2 (...
0
votes
1answer
2k views

Connecting to passive FTP over SSL (ftps)

I have setup an FTP service in Windows Azure using this guide http://www.itq.nl/blogs/post/Walkthrough-Hosting-FTP-on-IIS-75-in-Windows-Azure-VM.aspx The FTP Server works well when I connect without ...
-1
votes
2answers
339 views

how to ssh to the machine behind the firewall? [duplicate]

Possible Duplicate: SSH to a computer that will then SSH to another computer I have 3 Linux machines A, B and C. I can ssh from A to B; B to C but not from A to C directly because C is behind ...
66
votes
8answers
120k views

How to Unban an IP properly with Fail2Ban

I'm using Fail2Ban on a server and I'm wondering how to unban an IP properly. I know I can work with IPTables directly: iptables -D fail2ban-ssh <number> But is there not a way to do it with ...
37
votes
6answers
46k views

How can I prevent a DDOS attack on Amazon EC2?

One of the servers I use is hosted on the Amazon EC2 cloud. Every few months we appear to have a DDOS attack on this sever. This slows the server down incredibly. After around 30 minutes, and ...
14
votes
5answers
4k views

iptables management tools for large scale environment

The environment I'm operating in is a large-scale web hosting operation (several hundred servers under management, almost-all-public addressing, etc -- so anything that talks about managing ADSL links ...
27
votes
1answer
56k views

What is the difference between a Source NAT, Destination NAT and Masquerading?

What is the difference between a Source NAT, Destination NAT and Masquerading? For example, I thought IP Masqurading was what they used to call it in Linux? But what confuses me is that in our Astaro ...
37
votes
4answers
57k views

Windows equivalent of iptables?

Dumb question: Is there an equivalent of iptables on Windows? Could I install one via cygwin? The real question: how can I accomplish on Windows what I can accomplish via iptables? Just looking for ...
54
votes
4answers
55k views

What firewall ports need to be open to allow access to external git repositories?

What firewall port(s) need to be open to allow access to external git repositories?
11
votes
4answers
5k views

Good 1U Rack Firewall [closed]

I'm trying to find a good 1U rack firewall at a reasonable price. Most pricing is completely out of space (thousands of dollars? Why?). I don't want to list all features I need/want (there are too ...
8
votes
3answers
34k views

What does “incoming” and “outgoing” traffic mean?

I've seen many resources explaining how to set up a server's firewall to allow incoming and outgoing traffic on HTTP standard ports (80 and 443), but I can't figure out why I would need either of them....