A Firewall is an application or hardware device used to inspect and filter network traffic.

learn more… | top users | synonyms

38
votes
13answers
15k views

iptables Tips & Tricks

I'm sure Linux sysadmins are quite familiar with iptables, the userland interface to the netfilter packet-filtering framework. Now, this "Question" is meant to be a Community Wiki for collecting ...
34
votes
9answers
16k views

Why not block ICMP?

I think I almost have my iptables setup complete on my CentOS 5.3 system. Here is my script... # Establish a clean slate iptables -P INPUT ACCEPT iptables -P FORWARD ACCEPT iptables -P OUTPUT ACCEPT ...
73
votes
19answers
15k views

Why should I firewall servers?

PLEASE NOTE: I'm not interested in making this into a flame war! I understand that many people have strongly-held beliefs about this subject, in no small part because they've put a lot of effort into ...
47
votes
8answers
3k views

Why would I need a firewall if my server is well configured?

I admin a handful of cloud-based (VPS) servers for the company I work for. The servers are minimal ubuntu installs that run bits of LAMP stacks / inbound data collection (rsync). The data is large ...
26
votes
3answers
20k views

iptables port redirect not working for localhost

I want to redirect all traffic from port 443 to the internal port 8080. I'm using this config for iptables: iptables -t nat -I PREROUTING --source 0/0 --destination 0/0 -p tcp \ --dport 443 ...
1
vote
1answer
633 views

SMTP 25 closed even I allow everything in firewall, debian server running sendmail

I am running sendmail + dovecot in my debian server. I have enabled the firewall rules to allow everything iptables -P INPUT ACCEPT iptables -P OUTPUT ACCEPT iptables -P FORWARD ACCEPT ...
29
votes
4answers
17k views

REJECT vs DROP when using iptables

Is there any reason why I would want to have iptables -A INPUT -j REJECT instead of iptables -A INPUT -j DROP
7
votes
4answers
5k views

What to do with an out-of-warranty Barracuda Spam/Web filter?

I'm working with an organization that would like to start using a old Barracuda Spam Filter 300 unit. I've sold and configured plenty of these, but was surprised to see that this unit's warranty ...
17
votes
6answers
26k views

Enable Ping in Windows Server Firewall?

I've just installed Windows Server 2008 on a server and I'm able to connect through Remote Desktop but can't ping. Do I need to open an special port on the firewall to be able to ping a server?
10
votes
9answers
2k views

Why buy high end hardware firewalls?

There exist firewalls from Juniper and Cisco that cost more than a house. So I wonder: what does one get from a $10.000+ firewall compared to an 2U server with 4x 10Gbit network cards running e.g. ...
0
votes
1answer
1k views

Connecting to passive FTP over SSL (ftps)

I have setup an FTP service in Windows Azure using this guide http://www.itq.nl/blogs/post/Walkthrough-Hosting-FTP-on-IIS-75-in-Windows-Azure-VM.aspx The FTP Server works well when I connect without ...
16
votes
2answers
9k views

Why is our firewall (Ubuntu 8.04) rejecting the final packet (FIN, ACK, PSH) with a RST

Background, for a long time we have had problems with our firewall that sometimes keep HTTP requests hanging partially loaded until TCP times out. After tracing the traffic on the firewall I noticed ...
26
votes
6answers
4k views

Hardware Firewall Vs. Software Firewall (IP Tables, RHEL)

TL;DR My hosting company says IP Tables is useless and doesn't provide any protection. Is this BS? I have two, co-located servers. Yesterday my DC company contacted me to tell me that because I'm ...
3
votes
1answer
884 views

iptables preroute localhost

I would like to forward all incoming traffic from a certain port to another one using iptables. The problem is that prerouting doesn't work for traffic from localhost. This topic suggests a solution: ...
0
votes
1answer
291 views

how to Upgrade apache httd and openssh to the latest version on endian firewall(Endian Firewall Community is a “turn-key” linux security distribution)?

how to Upgrade apache httd and openssh to the latest version on endian firewall(Endian Firewall Community is a "turn-key" linux security distribution)? Can anyone help me?
52
votes
2answers
301k views

How to check if a port is blocked on a Windows machine?

On the Windows platform, what native options to I have to check if a port (3306, for example) on my local machine (as in localhost), is being blocked?
18
votes
6answers
96k views

What firewall ports do I need to open when using FTPS?

I need to access an ftps server (vsftpd) on a vendor's site. The vendor has a firewall in front of the ftps server and I have a firewall in front of my ftps client. I understand that ports 990, 991 ...
12
votes
1answer
12k views

iptables: difference between NEW, ESTABLISHED and RELATED packets

Part of a firewall on a server : iptables -A INPUT -p tcp --dport 22 -m state NEW --state -m recent --set iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 100 ...
4
votes
2answers
6k views

Should I rate-limit packets with iptables?

I'm using iptables on Ubuntu Server. It's a web server on a VPS. I'd like to know if I should rate-limit packets. If so, what should I rate-limit? And should I do so globally or per IP address? ...
4
votes
11answers
3k views

Small business firewall/VPN device [closed]

What's a good small business (<50 users at a location) firewall and VPN device? Wireless would be a nice addition, and I'm thinking of something in the $1,000 range. This would be for businesses ...
13
votes
4answers
7k views

Hardware firewall vs VMware firewall appliance

We have a debate in our office going on whether it's necessary to get a hardware firewall or set up a virtual one on our VMWare cluster. Our environment consists of 3 server nodes (16 cores w/ 64 GB ...
6
votes
9answers
21k views

block Torrent through firewall

is there a way to block users on firewall level from using torrents?
4
votes
3answers
2k views

SSH from A through B to C, using private key on B

I'm looking for a simple way to SSH from my local machine, A, through a proxy, B, to a destination host, C. The private key that goes with the public key on C is on B, and I can't put that key on my ...
3
votes
3answers
1k views

Open Source XML Firewalls? [closed]

Does anyone know of any open source XML firewalls that provide equivalent functionality to DataPower, Vordel, etc?
2
votes
1answer
1k views

How to Deploy an ASP.NET Web API- and Browser-based Application to a Production Environment [closed]

(Please forgive if this is posted in an incorrect forum. We didn’t know exactly where to post it.) We have an ASP.NET Web API single page application - a browser-based app running in IIS to serve up ...
1
vote
3answers
506 views

Server Firewall preventing sending of email [on hold]

The firewall on my VPS appears to be preventing my site from sending email. It was working fine until the end of last month. My hosting provider (Webfusion) has been next to useless. I am able to ...
5
votes
3answers
2k views

iptables — OK, **now** am I doing it right?

This is a follow up to a previous question where I asked whether my iptables config is correct. CentOS 5.3 system. Intended result: block everything except ping, ssh, Apache, and SSL. Based on ...
5
votes
5answers
8k views

iptables port forwarding on debian

I'm trying to setup a simple port forwarding firewall and I can't make the basic non-firewall configuration to work. I have setup the iptables script as follows #!/bin/sh # interfaces LAN="eth1" ...
2
votes
1answer
953 views

How do I allow only certain IPSet set's to access a certain port with iptables?

I'm using IPSet to build IP ranges for different countries as follows : # Canada ipset -F ca.zone ipset -N ca.zone nethash for IP in $(wget -O - http://www.ipdeny.com/ipblocks/data/countries/ca.zone) ...
1
vote
6answers
23k views

Active FTP client blocked by Windows Firewall on Windows 7

I have an application that runs as a service and contains an FTP client. It needs to connect to an FTP server that only supports Active FTP. When I attempt to get a list of files or download a file, ...
1
vote
3answers
844 views

SSH connection keeps crashing

although this is not a real programming question perhaps anyone has any idea regarding my problem. It's pretty weird. When I remotely connect one of our ubuntu servers per ssh the connection can be ...
1
vote
2answers
3k views

Open Source Unified Threat Management Software Options

Does anyone have experience or could recommend an open source Unified Threat Management (UTM) package that we could install on our network using hardware we already own? Looking for something that ...
0
votes
2answers
611 views

Running NFS with iptables, change firewall?

I have a number of web servers on which I've set up iptables as the firewall, this is working great. However, I also have a dedicated file server running NFS and I need to firewall this machine as ...
0
votes
1answer
378 views

One workstation gets slow access to the server, but others are fast

I've just setup a machine with Windows Server 2008. It hosts various services, like IIS, POP3, SMTP, Music for Squeezeboxes, VNC. All was working well for the first week or so. One day I needed to ...
5
votes
3answers
1k views

Firewall still blocking port 53 despite listing otherwise?

I have 3 nodes with virtually the same iptables rules loaded from a bash script, but one particular node is blocking traffic on port 53 despite listing it's accepting it: $ iptables --list -v Chain ...
3
votes
3answers
701 views

Is NAT based on URL possible with port 80?

I only have 1 IP address, but I would like to host 2 websites: www.example1.com and www.example2.com on the same IP. So I was wondering if there is a router/firewall feature that let's me do that?
2
votes
5answers
2k views

Advantage of hardware firewalls over software firewalls?

There are a lot of hardware firewalls out there, but what is their advantage / use over software firewalls, as I can also easily set those up without having to buy pricy hardware firewalls? Are there ...
2
votes
1answer
8k views

How can a block IP addresses using Windows Server 2008 firewall?

I have started to get various login attempts from different IP addresses. How can I block these IP addresses in the Windows Server 2008 Firewall?
1
vote
1answer
558 views

Inside Users can´t reach the DMZ, as well as outside from my cisco ASA 5520 v.7

I'm configuring my Cisco ASA 5520 version 7 and below is the show run of the machine: ASA2> ASA2> en Password: ASA2# sh run : Saved : ASA Version 7.0(8) ! hostname xxxxxxxxxx domain-name ...
1
vote
1answer
451 views

Why did my new iptables rules screw up outbound traffic?

I recently set up Tomcat on Port 80 using instructions provided by Werner Puschitz. In essence, I had to execute these two iptables commands: iptables -t nat -I PREROUTING -p tcp --dport 80 -j ...
1
vote
2answers
2k views

Splitting up multiple WAN's on Sonicwall

I have a cable connection running to our FW. We are supplanting that connection with another fiber connection to be used on a separate LAN. The cable connection and LAN is running fine. If I ...
1
vote
3answers
156 views

IP tables - changes not persisting

I've tried to open port 8605 on my server (used for socket connections) using: iptables -I INPUT 2 -s 0/0 -p tcp --dport 8605 -j ACCEPT However the change is not persisting, the port closes itself ...
0
votes
2answers
435 views

Forward SSH request to an External Server to an Internal Server

I have a VM config currently where I have 1 external IP pointing to a VM with an Nginx HTTP Reverse proxy serving HTTP Web Pages from several internal VMs without external IPs. I need a similar setup ...
0
votes
1answer
603 views

NAT / Port Forwarding with iptables firewall [duplicate]

I've got the following setup: firewall (iptables) eth0 internal interface, 192.168.2.10 ppp0 external interface, public_ip (IP masquerading) server1 (192.168.2.11), service 1 (port 443) server2 ...
0
votes
1answer
610 views

Outside or Internet users canot reach my dmz

Hi everyone out there. I have configured my aa 5520 v7. and so far im facing a problem in my connection and therefore i wish someone here can help me to sort it out. wright now Internal network can ...
0
votes
2answers
931 views

Can A layer-4 firewall block TCP traffic from a specific user on a multi-user system?

Layer 4 firewall is a device that can look at all protocol headers up to the transport layer and not the headers above that layer.
-1
votes
2answers
271 views

how to ssh to the machine behind the firewall? [duplicate]

Possible Duplicate: SSH to a computer that will then SSH to another computer I have 3 Linux machines A, B and C. I can ssh from A to B; B to C but not from A to C directly because C is ...
-3
votes
1answer
41 views

iptables rules for blocking specific packets [on hold]

Im using the following iptables rule: iptables -A INPUT -p tcp -m tcp --tcp-flags PSH,ACK PSH,ACK -m length --length 52 -m state --state ESTABLISHED -j DROP It does it's job for blocking the ...
-8
votes
2answers
823 views

How strong is parallels plesk 11 inbuilt firewall for linux os? from an newbie [closed]

I am new to Linux Dedicated server hosting and plesk panel 11 and i would like to know about inbuilt plesk 11 firewall security features and how harden it is?
14
votes
4answers
3k views

iptables management tools for large scale environment

The environment I'm operating in is a large-scale web hosting operation (several hundred servers under management, almost-all-public addressing, etc -- so anything that talks about managing ADSL links ...