Questions tagged [firewall]
A Firewall is an application or hardware device used to inspect and filter network traffic.
4,270
questions
0
votes
1
answer
133
views
1 Interface with 2 IP's. How can I make UFW or Firewall-Cmd make different rulesets per IP
So I have a server with 1 interface "Eth0" and that interface has 2 IP's
192.168.0.10 -> Apache2
192.168.0.20 -> NginX
They share the same default gateway.
How can I make Firewall ...
0
votes
2
answers
1k
views
Best way o allow only 2 countries IP acces server
i have a VPS with apache2 and 3 virtual hosts, i see a lot of ips trying to accees resources that does not exist, i also see a lot of ssh incorrect users and password tying access he server, so I need ...
5
votes
0
answers
262
views
firewall-cmd to drop existing connections
I want to use firewall-cmd to temporarily block mysql port 3306, including existing connections.
However after I remove MySQL service, only new connections are blocked. The existing connections are ...
0
votes
1
answer
73
views
When deleting repeated iptables rules, in what order are they deleted?
Let's suppose I have some repeated iptables rules:
$ iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A FORWARD -j DROP
-A FORWARD -j DROP
-A FORWARD -j DROP
-A FORWARD -j DROP
-A ...
1
vote
2
answers
728
views
why we need different types of base chain in nftables?
I know how hooks work in netfilter but I can't understand why there are different types of chains as described here: base chain types I have two questions
first : why there are different types of ...
0
votes
1
answer
586
views
AWS EC2 CentOS 7 Port 80 blocked despite correct rules
I have a web server instance running apache on aws, It stopped working suddenly. I've checked port in the security group and both port 80 and 443 are open both for ip4 and ip6. I have no firewall ...
4
votes
2
answers
4k
views
Redis cannot bind a specific ip address?
I'm new to redis, but I want to set one up on my Raspberry Pi 4 (RP) for using it in a Django application (with celery).
On my RP I have installed a firewall, ufw, and allowed incomming traffic from ...
2
votes
3
answers
2k
views
Assert if a port is open to host, LAN, or the Internet
I can check if a port is open using the following command, though this does not tell me if this port is reachable on the running machine only (host), from the LAN only, or open to the Internet.
...
0
votes
0
answers
540
views
1:1 NAT or MultiIP for WAN implementation on OpenWRT NFTABLES (fw4)
I would like to configure 1:1 NAT for my ISP modem connected to my OpenWRT WAN interface.
The modem IP address is 10.70.70.1 and I want to map it on my OpenWRT LAN bridge (192.168.64.0/24) with IP ...
1
vote
0
answers
436
views
Host unreachable from a specific host
I'm encountering a weird issue where connections from one VM (A) to another VM (B) systematically time out, in both ways. Symptoms:
ping A from B hangs (as well as anything else I have tried such as ...
2
votes
1
answer
782
views
How can I restrict SSH access to a hostname rather than an IP address without additional software? [debian-server]
I am currently in the process of setting up and hardening a small VPS running Debian 11. I have already followed this guide, which involves some basic security measures. However, I would additionally ...
6
votes
1
answer
3k
views
iptables - use service name or port number, IP-address or hostname?
iptables (and/or the successor tool nftables) is the user-space utility program that allows a system administrator to configure the IP packet filter rules of the Linux kernel firewall, which is ...
0
votes
0
answers
42
views
My GCP compute instance isn't receiving any port traffic
const express = require('express') const app = express() const port =
9093
app.get('/', (req, res) => { res.send('Hello World!') })
app.listen(port, () => { console.log(Example app listening ...
5
votes
2
answers
701
views
Why add "keep state" to pf firewall rules
If pf is a stateful firewall and keeps state by default, why do so many rulesets explicitly mention keep state?
1
vote
0
answers
139
views
access local application server from internet and locally
I did set up a few applications on a local server using pihole for local DNS and Traefik for providing SSL certificates. It all runs behind OPNsense firewall. Internet connection is DSL provided by ...
0
votes
2
answers
2k
views
iptables to secure nginx server
Does anyone know iptables well? I have a task and I got a little confused with it because I have a quite poor understanding of networking :)
i need to limit access to the server for all outgoing ...
0
votes
0
answers
387
views
Is is possible to use OpenVPN client as default network gateway (OpenWRT)?
Usually, when using a VPN, you can route all client traffic(s) through a VPN tunnel with a exit point on the VPN server.
Is there a reverse possibility: to organize an exit point to the WWW on the ...
0
votes
1
answer
408
views
Firewall threat protection rules for SSH/SFTP
Can a firewall improve the security of an SFTP service through inspecting incoming requests (e.g. to block any SSH commands which aren't required when only using SFTP?
Context
I recently found a VM in ...
0
votes
0
answers
33
views
How to avoid port duplication when using iptable for DNAT
I configure the iptable output chain DNAT conversion by the following command.
iptables -t nat -A OUTPUT -p tcp --dport 5000 -j DNAT --to 10.100.1.10:2048
When I link 10.100.20.4:5000 on the client ...
0
votes
0
answers
149
views
Windows server 2016 can't connect to remote port other than 80
I have a remote linux server running an HTTP service on a port 5000. I can use this service from my personal Windows computer with no problem, even connecting other remote servers is OK. However, my ...
0
votes
1
answer
1k
views
Firewall Ports Domain Controller to Clients
I am working on the segmentation of a network. Domain controllers and clients are located in different VLANs and are separated by a hardware firewall. Many ports must be opened for communication in ...
0
votes
0
answers
280
views
nftables or fw4 issue with timebased traffic rules
Since the OpenWRT ver > 22.3 does use NFTABLES instead of IPTABLES I got issue with some firewall (fw4) time based traffic rules that I have no idea how to solve them.
The firewall rule is as ...
0
votes
1
answer
34
views
Why do I need extra rules that are the same as the default behavior in the iptables?
I am trying to understand the below iptables config file:
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
# Allow WiFi AP traffic over 80 & 8080
-A INPUT -i p2p0 -p tcp --...
0
votes
0
answers
400
views
how to disable public ip and make the external traffic flow through the private ip of the firewall
So, our requirement is to disable public ip of the node and then route the traffic through the private ip of the fortigate firewall.
NOTE:
eth1= public ip
eth0= private ip
so, I am following the below ...
1
vote
0
answers
176
views
After iptables to nftables conversion, unable to connect to http nextcloud server and apt doesn't connect
I want to enable access to my nextcloud server and be able to use apt update. I used to be able to before my iptables to nftables conversion. However, after the conversion, its no longer possible. ...
-1
votes
1
answer
218
views
Access ASP.NET website deployed on IIS Windows Server from outside network
I have an ASP.NET website deployed on IIS in Windows Server. It works fine in LAN. All PC in the network can access the website using the IP of server and port. Now I want to be able to access the ...
-2
votes
1
answer
458
views
Can I use Laptop with one WiFi and one Ethernet Port interface to setup firewall - OPNSense?
I am trying to setup OPNsense Firewall at my residence using a spare laptop which has one WiFI and one Ethernet interface. I was able to install OPNsense and configure the interfaces to LAN and WAN. ...
1
vote
1
answer
1k
views
Route all traffic through a WireGuard Hub and Spoke VPS (Nftables)
As mentioned in the title, I am using a WireGuard Hub and Spoke configuration to connect my network at home to RoadWarrior peers. Unfortunately I have no public IPv4 and v6 address at home and on the ...
0
votes
1
answer
2k
views
Google Cloud Serverless VPC Access Not Working in Both Directions
I have a Cloud Run service which I would like to connect to my default VPC network through a Serverless VPC connector. The final goal with this is to allow my Cloud Run instances to access an on-prem ...
0
votes
1
answer
146
views
How to correctly set limits ports?
So im currently working on setting a simpel server up with a game server using port 30110 and 30120, but i clearly getting dossed like crazy, how is the best way to protect against this, like i have ...
0
votes
1
answer
407
views
With Ansible, should I limit SSH connections by IP?
I'm familiar with the standard Ansible best practices for secure connections (disabling root access for hosts and configuring key-based SSH authentication). Should I also use hosts.allow or iptables ...
0
votes
1
answer
357
views
Allow port forwarding through vpn iptables killswitch
I have a debian virtual machine thats connect to a openvpn server. Right now i have a kill switch working well on iptable, and the vpn connection works whithout any trouble. Let's share this ...
1
vote
2
answers
265
views
Firewall use-case on a server with no open ports?
I know a firewall is a must on any machine connected to the Internet, no matter what.
I was wondering though what would be a firewall use-case on a server with absolutely no open ports. For example, a ...
0
votes
1
answer
507
views
Connect multiple azure resource groups via route-based vpn to same on-site firewall
We are developing an app in Azure, made dev/test/prod ressource groups and want to connect these via Site-to-Site VPN to our On-Prem environment.
Connecting one of these ressource groups isn't a ...
1
vote
0
answers
730
views
Blocking forwarded traffic with OpenWrt fw3 firewall
I can't find out how to create a fw3 rule which does what I want (block all traffic from 192.168.1.119). I have this in /etc/config/firewall
config rule
option ...
0
votes
0
answers
143
views
Can send email with Postfix, but cannot receive emails
I am moving my email server from one server to another. I have tried everything, but can't get the email to receive any emails.
I think I have found the problem. It is is the firewall. I am using ...
1
vote
1
answer
5k
views
Nginx not serving from port 80 and 443, but works on other ports
After rebooting my VPS, I noticed that all nginx hosts that were bound to ports 80 and 443 started returning ERR_CONNECTION_TIMED_OUT and no new entries were being outputted to access.log
I simplified ...
0
votes
1
answer
181
views
UFW on debian vps not working as expected
I have a Debian 11 VPS server with ufw installed and running with some rules working and others don't, I have tried resetting, disabling, reloading and even uninstalling but all in vain.
Here is my ...
0
votes
1
answer
241
views
Firewall throughput and LAN Speed
A quick question, I'm considering to buy a firewall which offers throughput up to 450 Mbps and has fast Ethernet ports, my understanding is that the firewall limits the internet speed but not LAN ...
0
votes
2
answers
2k
views
Iptables : restrict access to container
I'd like to restrict access to a docker container to only a few ip adresses. There are two interfaces on the server : the public (eth0) and the private (eth1 : 192.168.0.1). I only want the IPs on the ...
0
votes
1
answer
824
views
Firewall rule for IAP traffic added but ssh for GCP server still not working
I am running a .dev website on GCP. The website is running but whenever I try to access the vm via ssh, it returns "Connection via Cloud Identity-Aware Proxy Failed" Code 1006.
I am not too ...
0
votes
0
answers
390
views
How to alter firewall (iptables) log rules such that they stop flooding the primary console on AlmaLinux 8?
I have a constant deluge of firewall blocks showing up on my console in AlmaLinux 8:
How do you modify iptables rules / settings so as to disable these from showing up on the primary console and to ...
1
vote
1
answer
527
views
what is the use of "remote(client) port" for inbound firewall rule?
In firewall settings, local port for inbound rule is pretty obvious: that is the port you want to listen.
However, remote port sounds nonsense: In typical protocol, client uses arbitrary port so ...
0
votes
1
answer
219
views
Shorewall: IPSet from blrules not applying
We're hoping to make use of IPSet to manage temporary IP blocking from sources (CSF+LFD, fail2ban, wherever relevant). The purpose would be that routers using Shorewall at the edges would make use of ...
-1
votes
2
answers
236
views
Firewall not keeping relay attempts from reaching postfix
I have a centos-based vps managed with webmin and every once in a while I get a few hundred emails like this one:
From: MAILER-DAEMON@mail.<redacted>.com
To: postmaster@<redacted>.com
...
1
vote
1
answer
2k
views
How to stop rejection of DNS queries?
Although service dns is allowed through firewalld, DNS queries received through an internal interface are denied.
Here is the network:
PC ------------- SERVER ---------------- DNS Server
> nslookup ...
0
votes
1
answer
315
views
Checkmk behind NAT can't reach agent in dmz
I have checkmk running in our lan. I want to monitor a linux vm in the dmz. So i installed the agent on the linux vm, enabled ipv4 for it, but checkmk can not find any services since the agent was not ...
0
votes
1
answer
640
views
Firewalld without interfaces on public zone
On my Oracle Cloud server, the public zone has no interfaces attached, neither does any of the other zones.
But still if I allow a port in the public zone, it does allow the traffic through.
So why is ...
0
votes
1
answer
129
views
Does blocking all outgoing traffic on cloud instance lock me out?
I have to test an app which first downloads data, but then, can not communicate with the world for the duration of the test (so it doesn't gossip stuff).
There are ways to enforce this on the app, but ...
1
vote
0
answers
637
views
Cannot connect to a on-premise VM via Cloud VPN from Google Cloud Run
I am trying to reach an on-premise machine (let's call it exovie) from Google Cloud Run via the Serverless VPC Connector.
Simplified network configuration
This is how the network is configured:
The ...