Questions tagged [firewall]
A Firewall is an application or hardware device used to inspect and filter network traffic.
4,272
questions
0
votes
0
answers
145
views
First SSH connection reset by peer, subsequent ones work
I am facing a fairly odd issue on a new VPS:
Whenever I initiate an SSH connection to the server for the first time in a while, I get this:
➜ ~ ssh server
kex_exchange_identification: read: ...
- 101
0
votes
0
answers
41
views
Linux iptables/UFW - Exclude ONE host from nat
Currently I am using UFW to NAT two IPv4 Subnets to VPN Interfaces like this:
extract of /etc/ufw/before.rules:
# NAT table rules
*nat
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 192.168.1.0/24 -o ...
3
votes
4
answers
26k
views
VPN is working, except for DNS lookups. Firewall (Cisco ASA 5505) issue?
I've got the following set up:
LAN -> DHCP / DNS / VPN server (OSX 10.6) -> Cisco ASA 5505 -> WAN
Connecting to the LAN via VPN works fine. I get all the details properly and I can ping ...
CommunityBot
- 1
0
votes
0
answers
65
views
Azure SQL Datasync IP address
We have to sync 2 SQL servers located in different clouds under the different tenants.
One in Azure global cloud and another one is in Azure China.
I've created a sync group in global cloud, added ...
- 2,594
-1
votes
2
answers
7k
views
How to Permit/Deny Traffic based on Domain Name (FQDN) rather than ip address in AZURE? [closed]
I can add inbound/outbound rules in azure network security group for IP address , but how can i make that for domain name (URL) ?
- 80.3k
0
votes
0
answers
104
views
LTE Mikrotik NAT not works
I've and LTE Mikrotik HRBwAPGR-5HacD2HnD and QNAP NAS server.
My need was to route trafic to QNAP server (192.168.88.102) from internet(using DDNS and so on) but not able to perform it, maybe I'm ...
0
votes
1
answer
468
views
nftables fails on boot with "Error: Could not process rule: No such file or directory chain ingress" but same nft conf works with manual nft start
Over one year I have had a working nft configuration. After updating NVM of my network cards and "apt update & upgrade" I encounter the following error on boot. But nftables starts ...
- 36.8k
0
votes
1
answer
1k
views
Should I allow LDAP through firewallD?
Setting up firewallD on Centos 7 servers. They use LDAP for authentication over SSH login. Do I need to explicitly allow port 389 LDAP on the default zone on FirewallD or because iv allowed SSH and ...
- 101
2
votes
1
answer
2k
views
Allowing inbound IPv6 traffic to a host and port when the IPv6 prefix is dynamic?
With IPv4, you used to be able to give a host a static local IP address on the LAN, and use a firewall rule on the firewall/router to forward a port on the (possibly dynamic) Internet-facing IP used ...
- 172
-1
votes
1
answer
79
views
Locked server because of IP spoofing
I have hetzner server. Inside this server there is Docker service which inside creates a few containers. Inside this containers I create vpn connections with openvpn. After connection I make some ...
- 9,205
2
votes
1
answer
8k
views
ERR_CONNECTION_REFUSED I can not connect my Ubuntu Server
I have Ubuntu server that I am serving Django project. But I can not browse anything. I get ERR_CONNECTION_REFUSED error on all browsers.
Server host, OS, and applications:
Digital Ocean Ubuntu 18.04 ...
CommunityBot
- 1
0
votes
1
answer
91
views
Using two asymmetric uplinks
My current network topology is:
Fact Firewall (I tested with OPNsense and IPFire, but I'm open to further suggestions)
and the whole "ORANGE/DMZ" stuff are actually VMs/containers in a ...
- 296
0
votes
1
answer
37
views
Can iptables state miss some packets?
I tried to setup the iptable rules for MTA. As this MTA is meant only for receiving the emails I allowed INPUT packets from any to destination port 25 with state either new or established, and allowed ...
- 13.7k
0
votes
0
answers
158
views
Connection refused for http requests intermittently on multiple certain networks but not others, OPNSense Firewall, maximum confusion
I have been using an OPNSense firewall at my business for about a year now and its worked great. We use it to host some websites, an email server, and wireguard for remote connections. All on a ...
- 1
0
votes
0
answers
301
views
Rocky Linux 8.9 firewall blocks IPv6 mDNS packets from one specific host?
The local network is running IPv6 and have one server running DHCPv6 / DNS service. It also broadcast mDNS (_http._tcp) for some other services.
I've 3 computers connected to the local network, two ...
- 163
0
votes
1
answer
4k
views
How to find at which point is the port being being blocked
I have a remote server running listening on a particular port.
Occasionaly I get a scenario where suddenly a client cannot connect to the server on that port. It is a random issue where some other PC'...
CommunityBot
- 1
5
votes
1
answer
24k
views
wireguard "destination address required" when trying to communicate from client-to-client rather than client-to-server
I have a simple wireguard network comprised of a single "server" (the only device with an externally routable ip address) and two clients. Communication between the server and the clients ...
- 12.8k
0
votes
0
answers
78
views
How to identify which process made dns query for a particular host?
I can get logs for dns query made to a particular nameserver by auditd, but how can I get process which made dns query for a host.
- 203
0
votes
0
answers
104
views
nginx open 443 port but can't access it
I have a server was running fine with port 443, but not it's not running.
server is:
Contabo VPS, Ubuntu 22.04
contain nginx, iRedMail
using command sof -i -P -n | grep LISTEN, i get:
nginx 3124 ...
- 21
0
votes
1
answer
382
views
WireGuard Hub and Spoke with subnet sharing
I'm a quite happy OpenVPN user who, for security and performance reasons, decided to switch everything to Wireguard.
The main target is to be able to access the office private lan from outside. Both ...
- 1
0
votes
2
answers
99
views
iptables - How do I restrict access to just local devices on the network?
I have asked this question on SuperUser but the only response was from someone who I was unable to understand
I have a WireGuard VPN Server running on a Debian 12 host with no problems, listening on a ...
- 44
0
votes
0
answers
250
views
How to allow access between network segments in Keenetic?
I have Keenetic Sprinter with default firmware (latest) in which I have configured 2 segments:
Home Segment 192.168.1.0, 255.255.255.0/24, DHCP enabled
IoT Segment 192.168.2.0, 255.255.255.0/24, DHCP ...
- 1
0
votes
0
answers
70
views
How to exclude dnsmasq used by libvirt from Mullvad VPN's "local network sharing" block
I don't use the local network except dnsmasq for libvirt. With blocking local network I have no DNS on my VM. For that reason I want to exclude dnsmasq from the local network sharing block with split ...
- 1
0
votes
2
answers
6k
views
Domain joined Windows Server 2019 - not connected to domain network
I have two Windows Server 2019 machines in my infrastructure which are connected on 'Guest or Public networks' and I have been unable to switch to domain network.
I have tried many solutions gathered ...
CommunityBot
- 1
0
votes
0
answers
25
views
Data from NF Tables to IP Tables
I have input data like below for NF Tables:
nft add rule filter input tcp flags != syn
nft add rule filter input tcp flags &syn!= syn
add rule filter output tcp flags & (syn | ack) == syn | ...
- 103
0
votes
0
answers
46
views
Parsing TCP flag Data for IP Tables
I have input file which has data like below
chain:VARIABLE_IN ip_version:v4 proto:tcp sport:5401 dst_ip:18.159.158.206 dport:5432 decision:a tcpflags:&syn!=syn
My code reads above data to form ...
- 103
0
votes
0
answers
66
views
How to set TCP flags "&syn!=syn" in iptables?
I have requirement where am getting parameters to set in iptables as below:
Rate Limit = 1/sec
Source port = 5432
Source IP = 203.0.113.0
Protocol = tcp
TCP flags = &syn!=syn
iptables -A PRIO_IN -...
- 103
1
vote
1
answer
172
views
Why is it advised to disable relayhost when hosting mail server behind firewall?
I am trying to setup an MTA. While reading documentation I came across "Standard Configuration" for Running Postfix behind a firewall.
I am confused on this part:
IMPORTANT: do not specify ...
- 49.8k
0
votes
0
answers
223
views
nftables : improve anti port scanning rules
I'm looking for ways to confuse port scanners. I do realize it is not that useful, but it is mostly to slow down attackers, and also to avoid ending up on websites like Shodan (or at least make the ...
- 111
1
vote
2
answers
933
views
nftables: Possible to block SYN packets with payload?
Is it possible to drop all TCP SYN packets with a payload using nftables?
The man pages mention various length options, but none that I could get to work for TCP packets without syntax errors.
I am ...
- 131
1
vote
2
answers
4k
views
UFW firewall rules for transmission-daemon on ubuntu 20.XX
I have got transmission running on ubuntu 20.XX VPS and i can log into the web interface with MYIP:9091/ to manage the files.
I am using ufw firewall. I have added these rules to allow the following ...
CommunityBot
- 1
0
votes
1
answer
64
views
What is the minimum and maximum value for --limit option in iptables?
I have below iptable rule
iptables -A PRIO_IN -p tcp -s 203.0.113.0 --sport 5432 -d 203.0.113.0 --dport 5432 -j ACCEPT -m limit --limit 100000/sec
When i run this rule, i get error as Rate too fast ...
- 25k
0
votes
0
answers
70
views
How to pass "Source UID" to iptables?
Through command line, am setting firewall rules using iptable binary like below:
iptables -I PRIO_IN -p tcp -s "10.0.0.25/24" -d "10.0.0.26/24" -j ACCEPT
For above rule, now I ...
- 103
0
votes
0
answers
157
views
In Windows firewall, what is the different between the two same default ICMP-ping rules?
In the Windows firewall, 2 default rules are identical:
File and Printer Sharing (Echo Request - ICMPv4-In) (technical name is FPS-ICMP4-ERQ-In)
Networking - Echo Request (ICMPv4-In) (technical name ...
- 1,761
2
votes
2
answers
192
views
Can you create a domain record that could be used as an inbound IP allow list?
Is there a way to create a domain record that would function as an inbound IP allow list, to be used in firewalls? Essentially creating a HTTPS ingress proxy.
Example:
FQDN
IP Range
allowlist.bob....
- 80.3k
0
votes
1
answer
412
views
Force Azure Outbound Traffic via a Single Public IP
Question
Is there a way, when using an Azure VWan with outbound traffic directed via the VWan's firewall, to ensure all outbound traffic breaks out via the same, single public IP address. Note: I'm ...
- 1,312
0
votes
0
answers
120
views
UFW IP does not block nginx
I have the following problem. I have an Alpine Linux system, not in a container. An Nginx web server and the UFW firewall run on it. If an Error 400 or 404 is triggered, UFW blocks the IP. This works ...
- 111
0
votes
0
answers
32
views
How can I feed (Fortinet FortiGate 40F) Firewall log data to LimaCharlie without using a collector server that runs a LimaCharlie Adapter
I want to foward firewall logs from my Fortinet FortiGate 40F Firewall to LimaCharlie without using a collector server (VM) in Azure that runs LimaCharlie Adapter.
How can this be done?
- 113
2
votes
2
answers
4k
views
Smoothwall Express interface issues
I have a SmoothWall Express box that is currently configured with a Green and Purple interface. Both interfaces are in the same /24 subnet (which seems odd to me). The green interface (address of ....
CommunityBot
- 1
0
votes
0
answers
47
views
Ports open only on specific event
I've recently opened some ports (8080, 2223, 2224) to open a sftp server and a webserver-type fileserver. However I've been running into issues and haven't found a single solution since.
The problem ...
- 1
0
votes
1
answer
493
views
Converting iptables ruleset to Firewalld
Does anyone have a good resource or suggestion of how to convert an iptables rule set to firewalld? I'm migrating Centos 6 to Centos 7 (actually Oracle Linux 9 but let's pretend Centos 6). I could ...
- 48
0
votes
1
answer
139
views
iptables not accepting my rule
I am trying to add a rule to my iptables, so that traffic trying to connect on port 9091 is forwarded to a different IP address. When searching I found this answer, which seems to fit my exact use ...
- 17
2
votes
3
answers
2k
views
Assert if a port is open to host, LAN, or the Internet
I can check if a port is open using the following command, though this does not tell me if this port is reachable on the running machine only (host), from the LAN only, or open to the Internet.
...
- 80.3k
0
votes
0
answers
127
views
Host A in VLAN is not responding to ping from host B, but host A can ping host B
Overview: I have a issue where one host A in VLAN is not responding to ping from host B, but host A can ping host B .
A= Windows and B=Linux, VLAN=10.
A IP address = 192.168.10.100,
B IP address = 192....
- 36.8k
2
votes
2
answers
2k
views
fail2ban txt list creation of banned IP
using fail2ban for years, working nice, would like to automate and harden the security for my router.
So I would like that fail2ban created a local file, example, list.txt file with a list of banned ...
- 1
0
votes
0
answers
458
views
How to find HA interface mac address in Fortigate?
We have two Fortinet and HA them. In "primary" I can see the Mac address for all interfaces easily in Network -> Interfaces -> Edit Interface. but I can't find the Mac address for &...
1
vote
2
answers
779
views
why we need different types of base chain in nftables?
I know how hooks work in netfilter but I can't understand why there are different types of chains as described here: base chain types I have two questions
first : why there are different types of ...
- 23
0
votes
0
answers
398
views
Firewalld: restrict ssh access to specific IP and allow that IP to access services in the interface zone
The target setup is the following: I want to restrict ssh access to the server to a specific IP, and allow the http service to all. Now, to start from "scratch" I defined a new zone which I ...
- 736
0
votes
0
answers
247
views
Internet Traffic blocked when trying to surf in Edge Sandbox Mode (Windows Defender Application Guard)
I have successfully activated Windows Defender Application Guard but it seems surfing in Edge Sandbox Mode has been impossible. All required gpos and addition requirements as described on here:
https:/...
- 51
0
votes
1
answer
1k
views
Firewall Ports Domain Controller to Clients
I am working on the segmentation of a network. Domain controllers and clients are located in different VLANs and are separated by a hardware firewall. Many ports must be opened for communication in ...
