2
votes
1answer
22 views

iptables: does a scanner knows if you DROP packets?

I know how REJECT and DROP chain works. But, as I read here REJECT vs DROP when using iptables, user Dagelf said that the server still replies with TCP SYN/ACK. Does the scanner knows that a packet ...
1
vote
0answers
41 views

Routing LDAP traffic from Application server to Proxy to internet

I've included a drawing so you get an idea how it would work. (Red = LDAP connections , Blue = HTTP / AJP in the backend) Problem: We want to connect our customer application server to an LDAP of ...
9
votes
2answers
610 views

linux command to prevent dos attack by using netstat and iptables

I want to DROP more than 200 requests per ip to prevent ddos attack. this is command that i used to detect requests count per ip : netstat -alpn | grep :80 | awk '{print $5}' |awk -F: '{print ...
1
vote
0answers
24 views

Do I need a firewall if the service doesn't listen on all interfaces? [duplicate]

Short version: I have a CentOS 6.5 with two NICs, one connected to the internet and one connected to the internal network. The services that shouldn't be accessible to the internet don't listen on ...
2
votes
2answers
68 views

What are the security issues in creating a firewall between two subnets?

As I understand it, the hosts on different subnets cannot communicate with each other unless there is a router somewhere on both subnets that forwards traffic between them. I have have two subnets ...
1
vote
1answer
46 views

Logging in iptables

I have created rules in iptables to log and edited the rsyslog.conf file to output any message which contains "iptables" to a different log file. It seems that it is logging to both places, the ...
1
vote
0answers
95 views

Firewall/iptables rules for GlusterFS

A great pleasure would be to know which exact iptables rules to use for securing GlusterFS 3.4.2 (with Debian Wheezy) in shared environment. I'm running some dedicated servers at ISP. There are two ...
0
votes
3answers
48 views

Limiting the connection source in firewall

I'm new at server management, and wrote an IPTables script for firewall. I'm very concerned about the security of my server, and thus I'm wondering about something that I read often from people using ...
0
votes
1answer
41 views

Allow access to certain ports on the server, via only one of the server IP addresses

I'm trying to allow access to certain ports on the server, via only one of the server IP addresses. So for example if the server has two IP addresses: 1.1.1.1 1.1.1.2 I only want for example ports ...
0
votes
1answer
116 views

iptables DROP all access except my dynamic IP, is it possible and how/workaround?

If not possible, is there any workaround without affecting CPU performance? iptables -A INPUT -p tcp --dport 80 -j DROP
-1
votes
2answers
49 views

How to detect and restrict frequent query from the same IP using iptables?

Here is the scenario: I intend to protect my server from being queried with high frequency from the same IP, say, the upperbound is 60 times per minute. I don't know how to do that via iptables, Is ...
0
votes
1answer
112 views

Retrieve malicious IP addresses from Apache logs and block them with iptables

Im trying to keep away some attackers that try to exploit XSS vulnerabilities from my website, I have found that most of the malicious attempts start with a classic "alert(document.cookie);\" test. ...
0
votes
1answer
40 views

Allow HTTP packet from specific hosts on an ec2 instance strictly

I have an ec2 instance (proxy) which is being used as http proxy server. There are some other hosts (hostA, hostB, hostC), I want the proxy server will only allow connection from those hosts. For ...
2
votes
3answers
118 views

MySQL Injection Attacks? Random URL's Causing Errors

We just started running our own web server a few months ago on Rackspace (they are great). I use NewRelic (also pretty cool) to monitor server usage and I am getting error alerts that appear to me to ...
0
votes
1answer
56 views

How open ports in INPUT chain, only for a target IP, with iptables?

I have a server Debian 7 Wheezy, with 2 assigned IPs. I have different service on different port assigned to the IPs. How can i set iptables rule, to work only with one of IP? Example: I Have 2 IPs: ...
0
votes
1answer
75 views

Securing database server with IPTables

I have my app (WordPress) and database (MySQL) on separate servers; they are connected on a private network provided by the hosting service provider, and I've taken all the preliminary steps (that I ...
0
votes
2answers
46 views

making sure that iptables is running

Is there a tool for monitoring that iptables (or shorewall or similar) is up and running with a core set of important rules? I need something which alerts me either if the firewall goes donw ...
1
vote
1answer
55 views

Does an ip catch all exist?

I'm trying to block specific ip address traffic using this: sudo iptables -A INPUT -s 192.148.10.209 -j DROP Does an ip address catch all exist where I could block all addresses on 192.148.10.* ...
0
votes
1answer
52 views

Export iptables logs to network storage in a limited storage dd-wrt router

Because some routers have very limited storage space; security logs are disabled in the micro version of dd-wrt. Is it possible to export the (iptables) logs to an external storage?
0
votes
1answer
71 views

Iptables to lock down compromised server to a single ip [duplicate]

I have a Linux server which is compromised, I can see nasty looking perl scripts executing with root privileges. I want to get some data off it before I wipe it. How can I block all inbound and ...
0
votes
1answer
50 views

why iptables giving error when using with --src-range

I am using iptables v 1.4.8 and used following command but getting one error message on terminal # iptables -A INPUT -m iprange --src-range 10.0.4.92-10.0.4.99 -j DROP modprobe: module 'ip_tables' ...
0
votes
1answer
118 views

How can I allow traffic only from my load balancer, if the private IP of the load balancer changes all the time?

I'd like to limit (via iptables or otherwise) inbound traffic on 80/443 to traffic coming from my load balancer. I have the public IP (which doesn't change, of course), but the only private IP info I ...
2
votes
2answers
77 views

If I use iptables to allow TCP connections only from a specific IP, can it be faked?

An iptables rule on my database server is: -A INPUT -p tcp --dport 6432 -s 10.115.0.150 -j ACCEPT I have other rules (loopback, etc.), but I'm wondering if that specific rule can be "hacked". Can ...
0
votes
3answers
127 views

VPS security considerations when only accessing from one IP [duplicate]

I'm running an VPS where I have deployed some projects. As I am the only person who accesses the server and I furthermore have a fixed IP i decided to configure iptables so that server access is only ...
1
vote
1answer
84 views

Weird iptables patterns of closed ports

Scratching my head over this one...I'm using Shields Up while proxied into a server I just setup with Rackspace. Here's my iptables config: *filter # Allow all loopback (lo0) traffic and drop all ...
0
votes
3answers
632 views

iptables rule to stop DDOS [duplicate]

My server is undergoing a ddos attack with the traffic in my apache logs appearing like: ip address - - [11/Apr/2013:01:01:04 -0600] "POST / HTTP/1.1" 416 31 "-" "Microsoft Internet Explorer" ip ...
0
votes
1answer
120 views

Allowing port 22 on localhost VPN only

I rent a remote server, and run an OpenVPN service on this server. I am trying to secure my firewall (iptables) so the only person who can access SSH is somebody connected to the VPN (localhost). ...
-1
votes
1answer
86 views

Server is unable to make outgoing ftp requests. How to open this?

I have setup a new server on rackspace & have used these exact rules in iptables http://articles.slicehost.com/assets/2007/9/4/iptables.txt I don't want server to act as a ftp server but when I ...
1
vote
1answer
231 views

How to drop all network input on IP with IPTABLES

With IPTABLES, Is it possible to DROP all network INPUT based on the host or the IP requested? I want my server reject all incoming transmission if it is the IP who is called E.G.: Dropped: ssh ...
-1
votes
2answers
114 views

Allowing outbound traffic, but not inbound to network

I have network A (remote) and network B (local). Network B needs to be able to access network A, but nobody should be able to access network B. How would I go about putting an IPTABLES rule in the ...
1
vote
3answers
128 views

IPTables allow then block with active connection

I have a backup server and I was wondering if I set a cron job to allow connection from a server in IPTables then once it connects with rsync, can I use IPTables to then shut off the port to prevent ...
0
votes
1answer
1k views

iptables - Block incoming on Eth1 and Allow All from eth0

I am a bit stuck with iptables to do deal with two Ethernet ports. eth0 port for LAN use (192.168.1.50 Private IP). eth1 port is connected to the internet via cable modem (80.0.xxx.xxx public IP). ...
5
votes
1answer
1k views

iptables: building a rule set against abuse for DNS amplification attacks

I have been working on building a rule set to detect and block a DNS amplification attack. I got stuck and am hoping to find help here. I'll post here what I have (bash scripting, the portions that ...
-1
votes
1answer
81 views

Database connection to another server

I have 2 Servers - one for PHP, and one for MySQL Both servers are hardened - and now my question is, what's the correct way to set up a connection to the Database Server, from PHP? Probably over ...
2
votes
1answer
92 views

How does iptables determine which packets are multicast?

Are packets assumed to be multicast solely based on their ip address? I've been looking at the RFC 1112 and a quick scan doesn't appear to indicate any other flags on the ip packet.
2
votes
1answer
92 views

How can I implement an ip whitelist to protect my server?

I'm going to start running a gameserver soon and I want a way to reduce the the damage of a denial of service attack. I want to make it so when someone joins the game their ip adress is added to a ...
1
vote
0answers
104 views

CSF: Changing portflood settings to deny IP longer than second interval?

I've recently been under attack and I'm configuring CSF firewall for my Ubuntu server (latest). I found out portflood settings only block the ip for the specified second count, but I would like ...
1
vote
1answer
234 views

Meaning of number inside iptable rules' brackets? [duplicate]

Possible Duplicate: Don’t understand [0:0] iptable syntax E.g. The command iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080, lead to the configs *nat :PREROUTING ...
3
votes
4answers
214 views

Is this iptables NAT exploitable from the external side?

Could you please have a short look on this simple iptables/NAT-Setup, I believe it has a fairly serious security issue (due to being too simple). On this network there is one internet-connected ...
0
votes
1answer
338 views

find common string to block IPs

Currently I have all these IPs coming in. Is there a way to find a common string in the content of the packets and then block the attack via IPTables? Oct 24 16:28:52 host kernel: [ 823.255566] ...
2
votes
3answers
531 views

In Linux, does using route to blackhole an IP result in better performance than dropping in iptables? [duplicate]

During a DDOS attack, if we are finding IPs we want to block will we see better performance using a null route as opposed to iptables? Null routing we would do something like: ip route add blackhole ...
2
votes
1answer
1k views

What is the right iptables rule to allow apt-get to download programs?

When I type something like sudo apt-get install firefox, everything work until it asks me: After this operation, 77 MB of additional disk space will be used. Do you want to continue [Y/n]? Y Then ...
2
votes
2answers
364 views

Block brute-force attack using lastb and iptables

Using linux lastb command, I found that my server is brute-force attacked from many different IPs around the world! I have developed an script to detect brute-force attackers by lastb and block them ...
1
vote
1answer
95 views

Iptables hops count filtering

The question is pretty simple: Does it make sense to filter packets inside a small sized LAN, so the DMZ machines can access the internal ones based on the TTL? I can control that no tunnel will be ...
0
votes
1answer
240 views

How secure is a subnet?

I have an unfortunate complication in my network - some users/computers are attached to a completely private and firewalled office network that we administer (10.n.n.x/24 intranet), but others are ...
0
votes
2answers
356 views

Can I use an IP-list include file for iptable blacklisting?

I would like to block all countries except mine in iptables, that is a list with about 100.000 Entries. How can I define this blacklist file in a script, so iptables blocks all those IP ranges? ...
0
votes
2answers
1k views

How To Set iptables log rules for PSAD with UFW?

For PSAD to work, I need to add the following iptables rules and enable packet logging : iptables -A INPUT -j LOG iptables -A FORWARD -j LOG ip6tables -A INPUT -j LOG ip6tables -A FORWARD -j LOG I ...
0
votes
2answers
813 views

IPTABLES for block sync flood over udp

I'm a victim of a sync flood attack over UDP port. This came from a lot of different IPs. The machine, a dedicated server, is an hlds game server, and the attacker overload the UDP ports, this cause a ...
2
votes
0answers
126 views

a good tool to analyse iptables log? [closed]

I have some linux server with iptables and I'm looking for an offline tool that allow log analysis to detect suspicious activity . I dont think that installing a web tool is a good choice beacause ...
1
vote
1answer
311 views

DROP vs REJECT DDoS [duplicate]

I asked somewhere else, and I got this response: Using DROP turns any type of DDoS attack into a SYN flood, because your server expects ACK responses which it will never get. Even if you can fine ...