2
votes
2answers
1k views

Reduce firewall rules by half - one iptables rule for tcp and udp

I have a number of iptables rules on my firewall that look like this: iptables -A zone_lan_forward -p tcp -d 1.2.3.0/24 -j ACCEPT iptables -A zone_lan_forward -p udp -d 1.2.3.0/24 -j ACCEPT Is ...
5
votes
1answer
943 views

Is it possible to duplicate a UDP unicast stream with iptables?

I have a proprietary system which transmit a udp video stream from unit #1 (192.168.1.1) to unit #2 (.1.2). I can't make changes to this system, and I'm trying to clone this udp stream so I can access ...
0
votes
1answer
257 views

Countermeasures versus incoming DNS reflection attack

i am currently experiencing a DNS reflection attack towards my server. I am getting a massive amount of answers via UDP from Port 53 that my server has never asked for: 02:53:57.626156 IP (tos ...
2
votes
0answers
686 views

Forwarding udp ports iptables packets “lost”?

I have a Linux router (Debian 6.x) where i forward some ports to internal services. Some tcp ports (like 80, 22...) are OK. I have one Application listening on port 54277udp. No return is coming from ...
0
votes
2answers
1k views

iptables rules for botnet (UDP flood) protection

I'm currently experiencing a massive UDP attack on my server. I host a couple of gameservers, mainly Tf2, CS:GO, CS 1.6 and CS:Source, and my 1.6 server is being flooded. I tried different rules in ...
1
vote
1answer
777 views

iptables port forwarding for active UDP connections

I am trying to set up port forwarding on UDP from port 12345 to port 54321 using the following: iptables -t nat -A PREROUTING -p udp -i eth0 -d 192.168.0.1 --dport 12345 -j DNAT --to ...
0
votes
1answer
259 views

How to block specific UDP packet outgoing from machine using iptables

I want to block specific UDP packet OUTGOING from my machine using iptables. Packet has a string in "hex in RAW"(?) i want to check packet by it. Like: If UDP packet hex RAW match "test_text" - block ...
2
votes
2answers
848 views

IPtables: is there a minimum UDP packet size for a DNS lookup?

IPtables for a virtual dedicated server. I would like to block UDP scans and I was wondering whether there's a minimum packet size for a DNS lookup? Nmap sends 0-byte UDP packets (source : ...
1
vote
2answers
763 views

Limit UDP connections per IP iptables

I want to limit connections per IP for a specific UDP port. I got it working for TCP, but somehow it doesn't work on UDP. These are my rules: For TCP (working) iptables -A INPUT -p tcp --syn ...
2
votes
1answer
836 views

Block all incoming DNS requests EXCEPT from IPs x,y,

I want to block all incoming requests on my two DNS servers APART FROM certain IP addresses e.g. IP of 1.2.3.4 will be allowed to make requests but NOBODY else will. How do you do this with iptables? ...
11
votes
2answers
6k views

Does traceroute use UDP or ICMP or both?

When I do a trace on the www.google.com domain from my laptop, am I using icmp or udp ? I thought it was icmp type 11 but while searching for something else I came across rules where icmp type 30 was ...
3
votes
1answer
1k views

How to create UDP proxy using iptables

I have a server running UDP server on port 50000. This server receives updates from clients, and pings back the clients every 5 seconds to the socket they were connected from. Now I want to redirect ...
0
votes
1answer
2k views

Iptables ratelimit UDP DOS attacks

Well, I've been a victim of Ddos attacks and I really can't figure out how to avoid it. On some machines it works, while on some it doesn't or probably I'm doing it wrong in some way, Attackers are ...
0
votes
0answers
418 views

Prevent from UDP flood

How should I prevent from UDP flood attacks? My ISP don't wan't to block those attacks. So all I can do is block this using IPTABLES, I'm using Debian 5.0. I heard that if there is not maany IP ...
2
votes
1answer
1k views

Forward broadcast to fixed IP using IPTables

I need to forward (route) broadcast packets from several wireless clients to a single server in the fixed network. The wireless and fixed network are not bridged for security reasons. With the ...
2
votes
1answer
725 views

iptables -m string inspecting udp payload only

This is the rule I'm working with: iptables -A QUERY -p udp -m length --length 24:63 -m udp -m string --algo bm --hex-string '|ffffffff|' --from 12 --to 28 -j QUERYLIMIT Is there a way to inspect ...
-1
votes
2answers
1k views

How can I reject all incoming UDP packets except for DNS lookups?

I set my server to reject ALL incoming UDP packets, to prevent UDP floods. However, I was told that because I use my own domain and server for my nameservers, this can cause some problems. How can I ...
0
votes
2answers
238 views

Problem in creating UDP sockets

Our production server is running PostgreSQL v8.2.3 on Red Hat Enterprise Linux Server release 5 (Tikanga). For some reason, statistics collector in PostgreSQL is not working. Even posted this ...
0
votes
1answer
868 views

Iptables REDIRECT + openvpn problem

I want to redirect connection to port 22 to my openvpn binded port, on 60001. Openvpn is running on server on 60001 server:~$ sudo netstat -apn | grep openvpn udp 0 0 67.xx.xx.137:60001 ...
0
votes
1answer
846 views

How to relax firewall for UDP connections/ports for a specific IP address?

My server is Red Hat Enterprise Linux Server release 5. iptables version is v1.3.5. I want to allow all UDP connections / port for the IP address 192.168.0.200. This IP address is configured in my ...
2
votes
2answers
2k views

Broadcast UDP over VPN

I have OpenVPN configured and have 5 dd-wrt router clients. I would like the machines on those routers to be-able to UDP Broadcast across all 5 networks. I cannot bridge the interfaces(to my ...
4
votes
2answers
6k views

Iptables: “-p udp --state ESTABLISHED”

let's look at these two iptables rules which are often used to allow outgoing DNS: iptables -A OUTPUT -p udp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A ...
2
votes
1answer
598 views

KVM virtualized CentOS can send/recieve TCP but not UDP

I've installed CentOS 5 inside KVN on FC12. I've setup a bridged network that works fine. I can ping the virtualized host from any of my other computers and the other way as well. I can also access ...