Questions tagged [firewall]

A Firewall is an application or hardware device used to inspect and filter network traffic.

Filter by
Sorted by
Tagged with
-1 votes
0 answers
10 views

How to prevent a remote WireGuard server establishing new connections to on-premises computers?

Goals: I want to allow all my local traffic to go through a WireGuard tunnel, so I set my allowed IPs to 0.0.0.0/0. I want to prevent my VPN provider's server from initiating any connections to my ...
4 votes
1 answer
7k views

What options do I have if I need a firewall behind AWS network load balancer?

Today we're using WAF for Application Load Balancer and it's great, but WAF not support Network Load balancer. So we need a solution that will protect us behind or after the NLB. For example: 1. ...
0 votes
1 answer
5k views

Mikrotik - Using bridge for WAN/DMZ

I'm not sure I'm going about this the right way.... I have 3 static IP's from my ISP that are all in the same subnet with the same gateway. One address is used for the router (RB3011 - 6.43.8) on a ...
-1 votes
0 answers
27 views

Traffic not passing through Opnsense firewall in Hyper V

I'm configuring Opnsense in Hyper-V. It is connected to the DMZ on one interface, and the internal network on the other, with internal switches for the VMs. There are VLANs setup and working fine. The ...
0 votes
1 answer
4k views

how to block incoming DHCP DISCOVERY messages

I'm running ISC DHCP deamon on centOS and want to block unwanted(by clients MAC address) discovery messages before they reach dhcpd. how can I do this with iptables or anything else?
1 vote
1 answer
53 views

Bypass nftables drop rule

tldr; bridge (see below) doesn't work if there is a matching drop in another table (like the default rules of firewalld). Hello, I'm building my own VM lib (kind of quickemu). I have a problem with ...
0 votes
0 answers
8 views

What configuration is blocking local ssh connections to my server? [migrated]

So I recently bought a Raspberry Pi to work on a small passion project with the RetroPie Debian-based image. I am now at the stage where I want to completely shield the server only allowing specific ...
304 votes
17 answers
733k views

How to Unban an IP properly with Fail2Ban

I'm using Fail2Ban on a server and I'm wondering how to unban an IP properly. I know I can work with IPTables directly: iptables -D fail2ban-ssh <number> But is there not a way to do it with ...
-1 votes
1 answer
671 views

Can't block outbound traffic on port 80 using Windows 10 firewall

I'm trying to block port 80 using Windows 10's firewall however it seems like no matter what I try I can still access HTTP sites. I've been testing weather the port using the following powershell ...
1 vote
1 answer
36 views

network unreachable for gcloud compute engine instance

I've just configured my first google cloud server with an ipv6 address. When I try to run wget to the address it fails: wget -6 https://[2600:1900:4180:bfa7:0:0:0:0] --2024-03-04 18:20:39-- https://[...
0 votes
1 answer
45 views

Suspicious process running under user postfix

I have a VPS on which I have installed ConfigServer Firewall for about a year now. This morning I started to receive this kind of emails from CFS. I've checked mail.log and auth.log and everything ...
4 votes
2 answers
6k views

Create group of ip ranges for network security groups in Azure?

Is there a way for to group several ip address ranges in Azure? Usage example: I have a list of IP ranges from Salesforce that I want to whitelist for a bunch of NetworkSecurityGroups. Let's say ...
1 vote
1 answer
61 views

Change Cisco Management VLAN

I currently have the following configuration. A Checkpoint firewall (which is the router) and 12 Cisco 9200 switches. SW1 is connected to the firewall. I need to change the MGMT VLAN from VLAN20 to ...
-1 votes
2 answers
358 views

pfSense in disable all packet filtering mode allows web admin on WAN IP [closed]

A while back, I had a fiber internet connection installed at my business with a number of public IPv4 addresses. The ISP provided two blocks of IP addresses: a "P2P" block which contains a ...
0 votes
0 answers
3k views

Firewall - nftables blocks outbound traffic

I've got a VM at a hosting service and installed a basic firewall with nftables. However, when it is active, all outbound traffic seems to get blocked. For example, when trying to ping google.com, I ...
0 votes
0 answers
14 views

OpenVPN Allow clients to acess more machines

Currently, my OpenVPN Windows Server (192.168.15.56) only allows connection to itself and Firewall is disabled entirely for now. In my ISP Router I have a rule that allows remote connections for all ...
0 votes
0 answers
30 views

Debian Firewall will not forward traffic from interface x to tun0

I want to have a debian system working as a router with openvpn traffic, where all traffic on interface x should be forwarded to openvpn interface y. Following pic shows my network setup, more or less ...
1 vote
2 answers
372 views

AWS Network Firewall + Windows EC2 Instance - google.com is not blocked in browser but is blocked in the command line

I'm using AWS Network Firewall along with a Windows EC2 instance to test. The goal is to allow access to only allowed URLs, which are: example.com .amazon.com .amazonaws.com This generally works. ...
0 votes
0 answers
151 views

Cannot reach DNS server on vm (guest) through Sophos XG 310

I have a vm running Windows Server 2k19 hosted on ESXi that basically acts as a DC for authentication (AD). The host is connected to a pSwitch (Dell s4128f-on) that is in turn connected to my Sophos ...
62 votes
7 answers
71k views

Where does UFW (uncomplicated firewall) save command-line rules to?

You add a rule like this: ufw allow 22/tcp The rule is saved, and is applied even after reboot. But it's not written anywhere in /etc/ufw. Where is it saved to? (Ubuntu, using ufw as pre-installed.)
-1 votes
0 answers
120 views

Redirect all HTTP/HTTPS traffic through WireGuard to external HTTP Proxy

I have set up a Wireguard VPN whereby all of my devices connect to a Wireguard peer running on a computer with a public IP address (host). My Wireguard is set up so that clients connect to the host on ...
0 votes
0 answers
52 views

IP6tables does not apply ACCEPT rules

My server is an IPv6 only server, I'm trying to write firewall rules using ip6tables and it looks something like this Chain INPUT (policy ACCEPT) num target prot opt source ...
2 votes
2 answers
138 views

nftables rules can't ping to other server

So I have a quick and dirty firewall that I plan to use on my vps using nftables. Here's the initial rule table inet filter { chain input { type filter hook input priority 0; # ...
2 votes
1 answer
310 views

How to set iptables to block incoming requests to the server but still have internet connectivity

I have multiple services that are running on my server. But I do not want them to be exposed to internet. My input chain rules look something like this -P INPUT ACCEPT -P FORWARD DROP -P OUTPUT ACCEPT ...
5 votes
2 answers
14k views

What is the purpose of TPROXY, how should you use it and what happens internally?

After reading a bit about TPROXY (e.g at https://www.kernel.org/doc/html/latest/networking/tproxy.html ) I now have more questions then answers. I actually don't even know what TPROXY should do... ...
2 votes
1 answer
6k views

Watchguard config, drop-in or mixed-routing mode?

I have a Watchguard XTM 2 that is currently acting as a firewall and a router for my business network, I currently have the WG setup in mixed-routing mode and am happy with the current configuration. ...
0 votes
1 answer
119 views

Digital Ocean Firewall Prevent VPN Client Connectivity

Info: I have the below setup, connecting my digital ocean environment to my local network. Using strongswan on the Network A gateway I've made a site to site VPN connection with my meraki on Network B....
1 vote
0 answers
69 views

SSL / TLS Errors on only some wifi networks

I am having problems with the SSL handshake not completing when I am on some public wifi networks. This is a problem when accessing all of the endpoints for my app, and so from some of those networks, ...
0 votes
1 answer
144 views

NAT between 2 LAN interfaces in Opnsense?

I'm not a network pro so some of my terminology may be off. I've tried to explain what I'm trying to achieve in different ways to hopefully make my request more understandable. I have Opnsense running ...
0 votes
1 answer
115 views

Can't stop attack on nginx server

I'm currently struggling with my Digitalocean droplet (Ubuntu 22.10) which is under some sort of attack (maybe DDOS). The server hosts a containerized application that runs on nginx. Every time I ...
0 votes
1 answer
49 views

One computer cannot access port from another on the same same network

I have two servers with relatively fresh installs of CentOS 9 Stream on the same network. I can ping and ssh between them so can prove basic connectivity. serverA AFAIK has port 1883 (mqtt) open and ...
4 votes
6 answers
15k views

Stealthed vs Closed Port

I was reading a website about the difference between stealthed and closed ports. http://www.grc.com/faq-shieldsup.htm A closed port will echo a packet if closed. However, a stealthed port will not ...
4 votes
2 answers
8k views

Packets marked INVALID in FORWARD rule

I have a firewall that has 3 IP aliases on 1 physical interface. Packets get dropped between these 3 interfaces (either ICMP, HTTP, or anything else). We tracked it down to these packets being marked ...
0 votes
3 answers
3k views

How to specify multiple rules in iptables?

The manpage says (emphasis mine): -A, --append chain rule-specification Append one *or more* rules to the end of the selected chain. [...] -D, --delete chain rule-specification Delete ...
0 votes
2 answers
134 views

Is it safe to expose monitd http server to the world

I'd like to use monitd for monitoring my webserver. I read it has built in http server. By default it is set to run on 2812 port. Is safe to open the port on firewall and view it via a browser?
0 votes
1 answer
4k views

IIS 10 (MS Server 2016) FTPs - failed to retrieve directory listing

I'm trying to get Microsoft Server 2016's IIS 10 to run FTPS. I have it working internally (need to change the External IP Address of Firewall to match internal IP (for LAN) and external IP (for WAN), ...
-2 votes
2 answers
88 views

Ip routing two subnets

I've got two subnets A: 192.168.2.0/24. Within A we have got a firewall and a connection to the internet. B: 172.16.12.0/24. They are connected with each other via a switch and both subnets are ...
0 votes
3 answers
6k views

How to update an ipset name-based entry

I need to handle on my firewall (Firehol, which is then transformed into iptables) a few dynamic entries. In an ideal world I would use a name (instead of an IP address) which always points to the ...
0 votes
1 answer
48 views

I keep receiving login attempt to my server until it gets down

I have a Centos7 server and after years of correctly working, yesterday it started to being unreachable (The server apps I have there were not rechable, the SSH connection gave timeout, etc but the ...
0 votes
1 answer
73 views

How to SSH to different Virtual Machines attached to same Azure Firewall using same port?

We have host-Windows, proxy-Linux(same VNET, different subnets) and sftp-Linux(different VNET and subnet) machines in which SSH is enabled in port 815(SSH is done to domain set to each machines). Now ...
0 votes
2 answers
224 views

firewalld config for OpenVPN

I am trying to setup an OpenVPN server on a VPS running Fedora Server 35. I got the VPN setup and working, but am running into issues with the firewall setup. This is my first experience administering ...
4 votes
1 answer
9k views

Port 443 appears to be closed in Nmap scans even when there's no firewall

I was trying to diagnose a problem where any HTTPS request to my VPS returns with ERR_CONNECTION_CLOSED. I'm using Let's Encrypt implemented on NGINX while the web server itself is a Node.js app. The ...
0 votes
0 answers
130 views

First SSH connection reset by peer, subsequent ones work

I am facing a fairly odd issue on a new VPS: Whenever I initiate an SSH connection to the server for the first time in a while, I get this: ➜ ~ ssh server kex_exchange_identification: read: ...
0 votes
0 answers
33 views

Linux iptables/UFW - Exclude ONE host from nat

Currently I am using UFW to NAT two IPv4 Subnets to VPN Interfaces like this: extract of /etc/ufw/before.rules: # NAT table rules *nat :POSTROUTING ACCEPT [0:0] -A POSTROUTING -s 192.168.1.0/24 -o ...
3 votes
4 answers
25k views

VPN is working, except for DNS lookups. Firewall (Cisco ASA 5505) issue?

I've got the following set up: LAN -> DHCP / DNS / VPN server (OSX 10.6) -> Cisco ASA 5505 -> WAN Connecting to the LAN via VPN works fine. I get all the details properly and I can ping ...
0 votes
0 answers
60 views

Azure SQL Datasync IP address

We have to sync 2 SQL servers located in different clouds under the different tenants. One in Azure global cloud and another one is in Azure China. I've created a sync group in global cloud, added ...
-1 votes
2 answers
7k views

How to Permit/Deny Traffic based on Domain Name (FQDN) rather than ip address in AZURE? [closed]

I can add inbound/outbound rules in azure network security group for IP address , but how can i make that for domain name (URL) ?
0 votes
0 answers
77 views

LTE Mikrotik NAT not works

I've and LTE Mikrotik HRBwAPGR-5HacD2HnD and QNAP NAS server. My need was to route trafic to QNAP server (192.168.88.102) from internet(using DDNS and so on) but not able to perform it, maybe I'm ...
0 votes
1 answer
349 views

nftables fails on boot with "Error: Could not process rule: No such file or directory chain ingress" but same nft conf works with manual nft start

Over one year I have had a working nft configuration. After updating NVM of my network cards and "apt update & upgrade" I encounter the following error on boot. But nftables starts ...
0 votes
1 answer
1k views

Should I allow LDAP through firewallD?

Setting up firewallD on Centos 7 servers. They use LDAP for authentication over SSH login. Do I need to explicitly allow port 389 LDAP on the default zone on FirewallD or because iv allowed SSH and ...

1
2 3 4 5
86