-1
votes
1answer
49 views

How should I properly block outgoing http traffic with iptables

I'm experimenting with iptables, and I'm trying to allow all outgoing requests for HTTPS, but to block HTTP. I have the code below; Chain INPUT (policy ACCEPT) target prot opt source ...
1
vote
1answer
44 views

iptables connection limit does not work on debian

I'm trying to set up some basic DOS protection. The following iptables rule works on a CentOS box but NOT on debian (wheezy). #limit the parallel http requests to 50 per class C sized network ...
-2
votes
1answer
25 views

Allow outgoing connections for DNS [closed]

I'm new to IPtables, but I am trying to setup a secure server to host a website and allow SSH. This is what I have so far: #!/bin/sh i=/sbin/iptables # Flush all rules $i -F $i -X # Setup default ...
0
votes
2answers
33 views

IPtables - Sensible and non-contradictory rules?

This is my IPtable rules for my webserver with SSH installed, i've had help to get this far. My question is, are my rules contradictory. For example, I've been recommended to use these two lines: # ...
4
votes
3answers
186 views

IPtables locking down website allowing only SSH

I have written my first IPtables rule file to try and protect my server on all ports apart from SSH and the ports needed for the web. This is what I have come up with: i=/sbin/iptables # Flush all ...
1
vote
1answer
19 views

Disabling network access for a group of users but allowing smtp only

We have an environment where our users ssh into the system and their shell is set to simply launch Mutt on their $HOME/Maildir. We want to restrict our users to only be able to send/receive mail. We ...
2
votes
1answer
53 views

iptables: does a scanner knows if you DROP packets?

I know how REJECT and DROP chain works. But, as I read here REJECT vs DROP when using iptables, user Dagelf said that the server still replies with TCP SYN/ACK. Does the scanner knows that a packet ...
1
vote
0answers
98 views

Routing LDAP traffic from Application server to Proxy to internet

I've included a drawing so you get an idea how it would work. (Red = LDAP connections , Blue = HTTP / AJP in the backend) Problem: We want to connect our customer application server to an LDAP of ...
9
votes
2answers
833 views

linux command to prevent dos attack by using netstat and iptables

I want to DROP more than 200 requests per ip to prevent ddos attack. this is command that i used to detect requests count per ip : netstat -alpn | grep :80 | awk '{print $5}' |awk -F: '{print ...
1
vote
0answers
27 views

Do I need a firewall if the service doesn't listen on all interfaces? [duplicate]

Short version: I have a CentOS 6.5 with two NICs, one connected to the internet and one connected to the internal network. The services that shouldn't be accessible to the internet don't listen on ...
2
votes
2answers
114 views

What are the security issues in creating a firewall between two subnets?

As I understand it, the hosts on different subnets cannot communicate with each other unless there is a router somewhere on both subnets that forwards traffic between them. I have have two subnets ...
1
vote
1answer
50 views

Logging in iptables

I have created rules in iptables to log and edited the rsyslog.conf file to output any message which contains "iptables" to a different log file. It seems that it is logging to both places, the ...
1
vote
0answers
221 views

Firewall/iptables rules for GlusterFS

A great pleasure would be to know which exact iptables rules to use for securing GlusterFS 3.4.2 (with Debian Wheezy) in shared environment. I'm running some dedicated servers at ISP. There are two ...
0
votes
3answers
55 views

Limiting the connection source in firewall

I'm new at server management, and wrote an IPTables script for firewall. I'm very concerned about the security of my server, and thus I'm wondering about something that I read often from people using ...
0
votes
1answer
69 views

Allow access to certain ports on the server, via only one of the server IP addresses

I'm trying to allow access to certain ports on the server, via only one of the server IP addresses. So for example if the server has two IP addresses: 1.1.1.1 1.1.1.2 I only want for example ports ...
0
votes
1answer
128 views

iptables DROP all access except my dynamic IP, is it possible and how/workaround?

If not possible, is there any workaround without affecting CPU performance? iptables -A INPUT -p tcp --dport 80 -j DROP
-1
votes
2answers
63 views

How to detect and restrict frequent query from the same IP using iptables?

Here is the scenario: I intend to protect my server from being queried with high frequency from the same IP, say, the upperbound is 60 times per minute. I don't know how to do that via iptables, Is ...
0
votes
1answer
141 views

Retrieve malicious IP addresses from Apache logs and block them with iptables

Im trying to keep away some attackers that try to exploit XSS vulnerabilities from my website, I have found that most of the malicious attempts start with a classic "alert(document.cookie);\" test. ...
0
votes
1answer
41 views

Allow HTTP packet from specific hosts on an ec2 instance strictly

I have an ec2 instance (proxy) which is being used as http proxy server. There are some other hosts (hostA, hostB, hostC), I want the proxy server will only allow connection from those hosts. For ...
2
votes
3answers
154 views

MySQL Injection Attacks? Random URL's Causing Errors

We just started running our own web server a few months ago on Rackspace (they are great). I use NewRelic (also pretty cool) to monitor server usage and I am getting error alerts that appear to me to ...
0
votes
1answer
70 views

How open ports in INPUT chain, only for a target IP, with iptables?

I have a server Debian 7 Wheezy, with 2 assigned IPs. I have different service on different port assigned to the IPs. How can i set iptables rule, to work only with one of IP? Example: I Have 2 IPs: ...
0
votes
1answer
95 views

Securing database server with IPTables

I have my app (WordPress) and database (MySQL) on separate servers; they are connected on a private network provided by the hosting service provider, and I've taken all the preliminary steps (that I ...
0
votes
2answers
47 views

making sure that iptables is running

Is there a tool for monitoring that iptables (or shorewall or similar) is up and running with a core set of important rules? I need something which alerts me either if the firewall goes donw ...
1
vote
1answer
57 views

Does an ip catch all exist?

I'm trying to block specific ip address traffic using this: sudo iptables -A INPUT -s 192.148.10.209 -j DROP Does an ip address catch all exist where I could block all addresses on 192.148.10.* ...
0
votes
1answer
65 views

Export iptables logs to network storage in a limited storage dd-wrt router

Because some routers have very limited storage space; security logs are disabled in the micro version of dd-wrt. Is it possible to export the (iptables) logs to an external storage?
0
votes
1answer
84 views

Iptables to lock down compromised server to a single ip [duplicate]

I have a Linux server which is compromised, I can see nasty looking perl scripts executing with root privileges. I want to get some data off it before I wipe it. How can I block all inbound and ...
0
votes
1answer
62 views

why iptables giving error when using with --src-range

I am using iptables v 1.4.8 and used following command but getting one error message on terminal # iptables -A INPUT -m iprange --src-range 10.0.4.92-10.0.4.99 -j DROP modprobe: module 'ip_tables' ...
0
votes
1answer
145 views

How can I allow traffic only from my load balancer, if the private IP of the load balancer changes all the time?

I'd like to limit (via iptables or otherwise) inbound traffic on 80/443 to traffic coming from my load balancer. I have the public IP (which doesn't change, of course), but the only private IP info I ...
2
votes
2answers
90 views

If I use iptables to allow TCP connections only from a specific IP, can it be faked?

An iptables rule on my database server is: -A INPUT -p tcp --dport 6432 -s 10.115.0.150 -j ACCEPT I have other rules (loopback, etc.), but I'm wondering if that specific rule can be "hacked". Can ...
0
votes
3answers
159 views

VPS security considerations when only accessing from one IP [duplicate]

I'm running an VPS where I have deployed some projects. As I am the only person who accesses the server and I furthermore have a fixed IP i decided to configure iptables so that server access is only ...
1
vote
1answer
91 views

Weird iptables patterns of closed ports

Scratching my head over this one...I'm using Shields Up while proxied into a server I just setup with Rackspace. Here's my iptables config: *filter # Allow all loopback (lo0) traffic and drop all ...
0
votes
3answers
698 views

iptables rule to stop DDOS [duplicate]

My server is undergoing a ddos attack with the traffic in my apache logs appearing like: ip address - - [11/Apr/2013:01:01:04 -0600] "POST / HTTP/1.1" 416 31 "-" "Microsoft Internet Explorer" ip ...
0
votes
1answer
142 views

Allowing port 22 on localhost VPN only

I rent a remote server, and run an OpenVPN service on this server. I am trying to secure my firewall (iptables) so the only person who can access SSH is somebody connected to the VPN (localhost). ...
-1
votes
1answer
92 views

Server is unable to make outgoing ftp requests. How to open this?

I have setup a new server on rackspace & have used these exact rules in iptables http://articles.slicehost.com/assets/2007/9/4/iptables.txt I don't want server to act as a ftp server but when I ...
1
vote
1answer
244 views

How to drop all network input on IP with IPTABLES

With IPTABLES, Is it possible to DROP all network INPUT based on the host or the IP requested? I want my server reject all incoming transmission if it is the IP who is called E.G.: Dropped: ssh ...
-1
votes
2answers
125 views

Allowing outbound traffic, but not inbound to network

I have network A (remote) and network B (local). Network B needs to be able to access network A, but nobody should be able to access network B. How would I go about putting an IPTABLES rule in the ...
1
vote
3answers
150 views

IPTables allow then block with active connection

I have a backup server and I was wondering if I set a cron job to allow connection from a server in IPTables then once it connects with rsync, can I use IPTables to then shut off the port to prevent ...
0
votes
1answer
2k views

iptables - Block incoming on Eth1 and Allow All from eth0

I am a bit stuck with iptables to do deal with two Ethernet ports. eth0 port for LAN use (192.168.1.50 Private IP). eth1 port is connected to the internet via cable modem (80.0.xxx.xxx public IP). ...
5
votes
1answer
1k views

iptables: building a rule set against abuse for DNS amplification attacks

I have been working on building a rule set to detect and block a DNS amplification attack. I got stuck and am hoping to find help here. I'll post here what I have (bash scripting, the portions that ...
-1
votes
1answer
87 views

Database connection to another server

I have 2 Servers - one for PHP, and one for MySQL Both servers are hardened - and now my question is, what's the correct way to set up a connection to the Database Server, from PHP? Probably over ...
2
votes
1answer
93 views

How does iptables determine which packets are multicast?

Are packets assumed to be multicast solely based on their ip address? I've been looking at the RFC 1112 and a quick scan doesn't appear to indicate any other flags on the ip packet.
2
votes
1answer
111 views

How can I implement an ip whitelist to protect my server?

I'm going to start running a gameserver soon and I want a way to reduce the the damage of a denial of service attack. I want to make it so when someone joins the game their ip adress is added to a ...
1
vote
0answers
117 views

CSF: Changing portflood settings to deny IP longer than second interval?

I've recently been under attack and I'm configuring CSF firewall for my Ubuntu server (latest). I found out portflood settings only block the ip for the specified second count, but I would like ...
1
vote
1answer
251 views

Meaning of number inside iptable rules' brackets? [duplicate]

Possible Duplicate: Don’t understand [0:0] iptable syntax E.g. The command iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080, lead to the configs *nat :PREROUTING ...
3
votes
4answers
222 views

Is this iptables NAT exploitable from the external side?

Could you please have a short look on this simple iptables/NAT-Setup, I believe it has a fairly serious security issue (due to being too simple). On this network there is one internet-connected ...
0
votes
1answer
353 views

find common string to block IPs

Currently I have all these IPs coming in. Is there a way to find a common string in the content of the packets and then block the attack via IPTables? Oct 24 16:28:52 host kernel: [ 823.255566] ...
3
votes
3answers
617 views

In Linux, does using route to blackhole an IP result in better performance than dropping in iptables? [duplicate]

During a DDOS attack, if we are finding IPs we want to block will we see better performance using a null route as opposed to iptables? Null routing we would do something like: ip route add blackhole ...
2
votes
1answer
2k views

What is the right iptables rule to allow apt-get to download programs?

When I type something like sudo apt-get install firefox, everything work until it asks me: After this operation, 77 MB of additional disk space will be used. Do you want to continue [Y/n]? Y Then ...
2
votes
2answers
408 views

Block brute-force attack using lastb and iptables

Using linux lastb command, I found that my server is brute-force attacked from many different IPs around the world! I have developed an script to detect brute-force attackers by lastb and block them ...
1
vote
1answer
104 views

Iptables hops count filtering

The question is pretty simple: Does it make sense to filter packets inside a small sized LAN, so the DMZ machines can access the internal ones based on the TTL? I can control that no tunnel will be ...