Questions tagged [firewall]

A Firewall is an application or hardware device used to inspect and filter network traffic.

Filter by
Sorted by
Tagged with
0 votes
1 answer
133 views

1 Interface with 2 IP's. How can I make UFW or Firewall-Cmd make different rulesets per IP

So I have a server with 1 interface "Eth0" and that interface has 2 IP's 192.168.0.10 -> Apache2 192.168.0.20 -> NginX They share the same default gateway. How can I make Firewall ...
Definity's user avatar
  • 137
0 votes
2 answers
1k views

Best way o allow only 2 countries IP acces server

i have a VPS with apache2 and 3 virtual hosts, i see a lot of ips trying to accees resources that does not exist, i also see a lot of ssh incorrect users and password tying access he server, so I need ...
Diego's user avatar
  • 1
5 votes
0 answers
262 views

firewall-cmd to drop existing connections

I want to use firewall-cmd to temporarily block mysql port 3306, including existing connections. However after I remove MySQL service, only new connections are blocked. The existing connections are ...
GoYun.Info's user avatar
0 votes
1 answer
73 views

When deleting repeated iptables rules, in what order are they deleted?

Let's suppose I have some repeated iptables rules: $ iptables -S -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -A FORWARD -j DROP -A FORWARD -j DROP -A FORWARD -j DROP -A FORWARD -j DROP -A ...
phantomcraft's user avatar
1 vote
2 answers
728 views

why we need different types of base chain in nftables?

I know how hooks work in netfilter but I can't understand why there are different types of chains as described here: base chain types I have two questions first : why there are different types of ...
H. Far's user avatar
  • 21
0 votes
1 answer
586 views

AWS EC2 CentOS 7 Port 80 blocked despite correct rules

I have a web server instance running apache on aws, It stopped working suddenly. I've checked port in the security group and both port 80 and 443 are open both for ip4 and ip6. I have no firewall ...
Breezer's user avatar
  • 101
4 votes
2 answers
4k views

Redis cannot bind a specific ip address?

I'm new to redis, but I want to set one up on my Raspberry Pi 4 (RP) for using it in a Django application (with celery). On my RP I have installed a firewall, ufw, and allowed incomming traffic from ...
CutePoison's user avatar
2 votes
3 answers
2k views

Assert if a port is open to host, LAN, or the Internet

I can check if a port is open using the following command, though this does not tell me if this port is reachable on the running machine only (host), from the LAN only, or open to the Internet. ...
Dr. Strangelove's user avatar
0 votes
0 answers
540 views

1:1 NAT or MultiIP for WAN implementation on OpenWRT NFTABLES (fw4)

I would like to configure 1:1 NAT for my ISP modem connected to my OpenWRT WAN interface. The modem IP address is 10.70.70.1 and I want to map it on my OpenWRT LAN bridge (192.168.64.0/24) with IP ...
Sina S.'s user avatar
  • 11
1 vote
0 answers
436 views

Host unreachable from a specific host

I'm encountering a weird issue where connections from one VM (A) to another VM (B) systematically time out, in both ways. Symptoms: ping A from B hangs (as well as anything else I have tried such as ...
Agate's user avatar
  • 111
2 votes
1 answer
782 views

How can I restrict SSH access to a hostname rather than an IP address without additional software? [debian-server]

I am currently in the process of setting up and hardening a small VPS running Debian 11. I have already followed this guide, which involves some basic security measures. However, I would additionally ...
Collin's user avatar
  • 165
6 votes
1 answer
3k views

iptables - use service name or port number, IP-address or hostname?

iptables (and/or the successor tool nftables) is the user-space utility program that allows a system administrator to configure the IP packet filter rules of the Linux kernel firewall, which is ...
HBruijn's user avatar
  • 80.2k
0 votes
0 answers
42 views

My GCP compute instance isn't receiving any port traffic

const express = require('express') const app = express() const port = 9093 app.get('/', (req, res) => { res.send('Hello World!') }) app.listen(port, () => { console.log(Example app listening ...
swapnil kakulate's user avatar
5 votes
2 answers
701 views

Why add "keep state" to pf firewall rules

If pf is a stateful firewall and keeps state by default, why do so many rulesets explicitly mention keep state?
ahron's user avatar
  • 375
1 vote
0 answers
139 views

access local application server from internet and locally

I did set up a few applications on a local server using pihole for local DNS and Traefik for providing SSL certificates. It all runs behind OPNsense firewall. Internet connection is DSL provided by ...
LeonardoCA's user avatar
0 votes
2 answers
2k views

iptables to secure nginx server

Does anyone know iptables well? I have a task and I got a little confused with it because I have a quite poor understanding of networking :) i need to limit access to the server for all outgoing ...
Taras Paslavskyi's user avatar
0 votes
0 answers
387 views

Is is possible to use OpenVPN client as default network gateway (OpenWRT)?

Usually, when using a VPN, you can route all client traffic(s) through a VPN tunnel with a exit point on the VPN server. Is there a reverse possibility: to organize an exit point to the WWW on the ...
Alex A.'s user avatar
  • 101
0 votes
1 answer
408 views

Firewall threat protection rules for SSH/SFTP

Can a firewall improve the security of an SFTP service through inspecting incoming requests (e.g. to block any SSH commands which aren't required when only using SFTP? Context I recently found a VM in ...
JohnLBevan's user avatar
  • 1,310
0 votes
0 answers
33 views

How to avoid port duplication when using iptable for DNAT

I configure the iptable output chain DNAT conversion by the following command. iptables -t nat -A OUTPUT -p tcp --dport 5000 -j DNAT --to 10.100.1.10:2048 When I link 10.100.20.4:5000 on the client ...
HK S's user avatar
  • 1
0 votes
0 answers
149 views

Windows server 2016 can't connect to remote port other than 80

I have a remote linux server running an HTTP service on a port 5000. I can use this service from my personal Windows computer with no problem, even connecting other remote servers is OK. However, my ...
Dominik Horvath's user avatar
0 votes
1 answer
1k views

Firewall Ports Domain Controller to Clients

I am working on the segmentation of a network. Domain controllers and clients are located in different VLANs and are separated by a hardware firewall. Many ports must be opened for communication in ...
Mia's user avatar
  • 3
0 votes
0 answers
280 views

nftables or fw4 issue with timebased traffic rules

Since the OpenWRT ver > 22.3 does use NFTABLES instead of IPTABLES I got issue with some firewall (fw4) time based traffic rules that I have no idea how to solve them. The firewall rule is as ...
Sina S.'s user avatar
  • 11
0 votes
1 answer
34 views

Why do I need extra rules that are the same as the default behavior in the iptables?

I am trying to understand the below iptables config file: *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] # Allow WiFi AP traffic over 80 & 8080 -A INPUT -i p2p0 -p tcp --...
Yosef's user avatar
  • 3
0 votes
0 answers
400 views

how to disable public ip and make the external traffic flow through the private ip of the firewall

So, our requirement is to disable public ip of the node and then route the traffic through the private ip of the fortigate firewall. NOTE: eth1= public ip eth0= private ip so, I am following the below ...
Ravi Teja RVN's user avatar
1 vote
0 answers
176 views

After iptables to nftables conversion, unable to connect to http nextcloud server and apt doesn't connect

I want to enable access to my nextcloud server and be able to use apt update. I used to be able to before my iptables to nftables conversion. However, after the conversion, its no longer possible. ...
LtMuffin's user avatar
  • 121
-1 votes
1 answer
218 views

Access ASP.NET website deployed on IIS Windows Server from outside network

I have an ASP.NET website deployed on IIS in Windows Server. It works fine in LAN. All PC in the network can access the website using the IP of server and port. Now I want to be able to access the ...
Humayun Ahmed's user avatar
-2 votes
1 answer
458 views

Can I use Laptop with one WiFi and one Ethernet Port interface to setup firewall - OPNSense?

I am trying to setup OPNsense Firewall at my residence using a spare laptop which has one WiFI and one Ethernet interface. I was able to install OPNsense and configure the interfaces to LAN and WAN. ...
VMN's user avatar
  • 1
1 vote
1 answer
1k views

Route all traffic through a WireGuard Hub and Spoke VPS (Nftables)

As mentioned in the title, I am using a WireGuard Hub and Spoke configuration to connect my network at home to RoadWarrior peers. Unfortunately I have no public IPv4 and v6 address at home and on the ...
Jonathan's user avatar
0 votes
1 answer
2k views

Google Cloud Serverless VPC Access Not Working in Both Directions

I have a Cloud Run service which I would like to connect to my default VPC network through a Serverless VPC connector. The final goal with this is to allow my Cloud Run instances to access an on-prem ...
Conor Strejcek's user avatar
0 votes
1 answer
146 views

How to correctly set limits ports?

So im currently working on setting a simpel server up with a game server using port 30110 and 30120, but i clearly getting dossed like crazy, how is the best way to protect against this, like i have ...
Melonendk's user avatar
0 votes
1 answer
407 views

With Ansible, should I limit SSH connections by IP?

I'm familiar with the standard Ansible best practices for secure connections (disabling root access for hosts and configuring key-based SSH authentication). Should I also use hosts.allow or iptables ...
Matthew's user avatar
0 votes
1 answer
357 views

Allow port forwarding through vpn iptables killswitch

I have a debian virtual machine thats connect to a openvpn server. Right now i have a kill switch working well on iptable, and the vpn connection works whithout any trouble. Let's share this ...
Zebrowski's user avatar
1 vote
2 answers
265 views

Firewall use-case on a server with no open ports?

I know a firewall is a must on any machine connected to the Internet, no matter what. I was wondering though what would be a firewall use-case on a server with absolutely no open ports. For example, a ...
gsl's user avatar
  • 143
0 votes
1 answer
507 views

Connect multiple azure resource groups via route-based vpn to same on-site firewall

We are developing an app in Azure, made dev/test/prod ressource groups and want to connect these via Site-to-Site VPN to our On-Prem environment. Connecting one of these ressource groups isn't a ...
sz1337's user avatar
  • 1
1 vote
0 answers
730 views

Blocking forwarded traffic with OpenWrt fw3 firewall

I can't find out how to create a fw3 rule which does what I want (block all traffic from 192.168.1.119). I have this in /etc/config/firewall config rule option ...
owrtbro's user avatar
  • 31
0 votes
0 answers
143 views

Can send email with Postfix, but cannot receive emails

I am moving my email server from one server to another. I have tried everything, but can't get the email to receive any emails. I think I have found the problem. It is is the firewall. I am using ...
Charlie's user avatar
1 vote
1 answer
5k views

Nginx not serving from port 80 and 443, but works on other ports

After rebooting my VPS, I noticed that all nginx hosts that were bound to ports 80 and 443 started returning ERR_CONNECTION_TIMED_OUT and no new entries were being outputted to access.log I simplified ...
user3757605's user avatar
0 votes
1 answer
181 views

UFW on debian vps not working as expected

I have a Debian 11 VPS server with ufw installed and running with some rules working and others don't, I have tried resetting, disabling, reloading and even uninstalling but all in vain. Here is my ...
joshua Franklin's user avatar
0 votes
1 answer
241 views

Firewall throughput and LAN Speed

A quick question, I'm considering to buy a firewall which offers throughput up to 450 Mbps and has fast Ethernet ports, my understanding is that the firewall limits the internet speed but not LAN ...
mechanize's user avatar
0 votes
2 answers
2k views

Iptables : restrict access to container

I'd like to restrict access to a docker container to only a few ip adresses. There are two interfaces on the server : the public (eth0) and the private (eth1 : 192.168.0.1). I only want the IPs on the ...
Ror's user avatar
  • 323
0 votes
1 answer
824 views

Firewall rule for IAP traffic added but ssh for GCP server still not working

I am running a .dev website on GCP. The website is running but whenever I try to access the vm via ssh, it returns "Connection via Cloud Identity-Aware Proxy Failed" Code 1006. I am not too ...
Marky's user avatar
  • 51
0 votes
0 answers
390 views

How to alter firewall (iptables) log rules such that they stop flooding the primary console on AlmaLinux 8?

I have a constant deluge of firewall blocks showing up on my console in AlmaLinux 8: How do you modify iptables rules / settings so as to disable these from showing up on the primary console and to ...
ylluminate's user avatar
  • 1,197
1 vote
1 answer
527 views

what is the use of "remote(client) port" for inbound firewall rule?

In firewall settings, local port for inbound rule is pretty obvious: that is the port you want to listen. However, remote port sounds nonsense: In typical protocol, client uses arbitrary port so ...
user811729's user avatar
0 votes
1 answer
219 views

Shorewall: IPSet from blrules not applying

We're hoping to make use of IPSet to manage temporary IP blocking from sources (CSF+LFD, fail2ban, wherever relevant). The purpose would be that routers using Shorewall at the edges would make use of ...
Adambean's user avatar
  • 154
-1 votes
2 answers
236 views

Firewall not keeping relay attempts from reaching postfix

I have a centos-based vps managed with webmin and every once in a while I get a few hundred emails like this one: From: MAILER-DAEMON@mail.<redacted>.com To: postmaster@<redacted>.com ...
alex_223's user avatar
  • 120
1 vote
1 answer
2k views

How to stop rejection of DNS queries?

Although service dns is allowed through firewalld, DNS queries received through an internal interface are denied. Here is the network: PC ------------- SERVER ---------------- DNS Server > nslookup ...
Christine VACHER's user avatar
0 votes
1 answer
315 views

Checkmk behind NAT can't reach agent in dmz

I have checkmk running in our lan. I want to monitor a linux vm in the dmz. So i installed the agent on the linux vm, enabled ipv4 for it, but checkmk can not find any services since the agent was not ...
DonCanalie's user avatar
0 votes
1 answer
640 views

Firewalld without interfaces on public zone

On my Oracle Cloud server, the public zone has no interfaces attached, neither does any of the other zones. But still if I allow a port in the public zone, it does allow the traffic through. So why is ...
Maestro's user avatar
  • 315
0 votes
1 answer
129 views

Does blocking all outgoing traffic on cloud instance lock me out?

I have to test an app which first downloads data, but then, can not communicate with the world for the duration of the test (so it doesn't gossip stuff). There are ways to enforce this on the app, but ...
unsafe_where_true's user avatar
1 vote
0 answers
637 views

Cannot connect to a on-premise VM via Cloud VPN from Google Cloud Run

I am trying to reach an on-premise machine (let's call it exovie) from Google Cloud Run via the Serverless VPC Connector. Simplified network configuration This is how the network is configured: The ...
Mathieu Bour's user avatar

1
3 4
5
6 7
86