Tag Info

New answers tagged

0

Think of a firewall as a sheep dip where everything is "cleansed' before information (because thats what data is) moves to the next stage of transmission. If you can deal with the slight degradation of speed, base your network security on old fashioned store and forward philosophy. Everything, including email, are temporarily stored on the firewall, AV ...


0

There are several methods to add new rules to current chains. For example; You should write a shell script that reads ip addresses in a file and inserts them to chain. #!/bin/bash for ip in `cat ipadresses.txt` do iptables -I INPUT -p tcp -s $ip -m multiport --dports80,443 -j ACCEPT done You should save current rules to a file and add rules directly ...


1

it has to be something like this ovs-ofctl add-flow xenbr0 "dl_src={mac-address} priority=39000 dl_type=0x0800 nw_dst={ip-address} idle_timeout=65000 action=normal" ovs-ofctl add-flow xenbr0 "dl_src={mac-address} priority=38000 dl_type=0x0800 nw_src=ANY idle_timeout=65000 tp_dst=3389 action=normal" ovs-ofctl add-flow xenbr0 "dl_src={mac-address} ...


0

The solution I use for blocking realtime bad activity IP's coming out of AWS and others is this... In my CSF Firewall in the config for LFD Blocklists I use a list found here - http://myip.ms/browse/blacklist/Blacklist_IP_Blacklist_IP_Addresses_Live_Database_Real-time Download Blacklist for CSF Firewall ยป ...


1

I think I found the answer already: There are ^M characters after every newline. I believe if I remove them the commands will work. I'm using VIM and if I view them in vim by doing a ':e ++ff=unix' it shows '^M' after every newline.


0

so you have two /8 networks from your ISP (one for each of the two ports). a /8 is a huge network, I wonder why you get such a large address space, but anyway. if you have two separate ip addresses on two separate ports if you want to setup a firewall and then have some of the same ip seriesd behind the network, then you should split your two subnets in ...


9

I wouldn't trust that machine anymore, and would reinstall and probably scan for rootkits (some rootkits even survive formatting of a drive). If you care about security, my personal advice would be to restart fresh.


3

It shouldn't, unless there is a bug. However, iptables -A is not idempotent, and if you run it multiple times (or run a redundant iptables -A command against an existing or loaded configuration), it will add the rule again whether or not it is an exact duplicate of a dispositive rule. Another thing that might be happening is that resolution gives multiple ...


0

Poor man's solution: use port knocking. Probably it isn't the best choice, and it may rise alerts on IDS (if not trained to discard this false positive, but login attempts from recently changed IPs will raise them too). Anyways it may suffice, since you would be setting it as a last resort, after a (hopefully) remote event of changing all 3 IPs withouht ...


4

Ping uses the ICMP protocol, not TCP. Routing tables are not involved in intra-subnet communication, unless you meant security groups.


0

For security reasons many services may listen only on the localhost (127.0.0.1 and/or ::1) interface. These services will not be reachable from other servers without tunneling. Check which port are listening on which addresses with the command netstat -ln | sort | less. This will give you a scrollable list of listening services including the IP address ...


0

Need to do some sleuthing? run "strace iptables-save" and look through the output for the files that this command opens. ignore library files, one of the file it opens to read will be the ruleset you are looking for.


3

iptables-persistent wheezy package saves the rules in /etc/iptables/rules.v4. You could view the source of the package here: https://packages.debian.org/search?keywords=iptables-persistent


0

Look at these pictures taken from Wikipedia "Network address translation" page. In "Full Cone NAT" Once an internal address (iAddr:iPort) is mapped to an external address (eAddr:ePort), any packets from iAddr:iPort are sent through eAddr:ePort. Any external host can send packets to iAddr:iPort by sending packets to eAddr:ePort. In Symmetric NAT ...


2

You can combine any check with the negate plugin to invert the check logic. You can redefine CRIT, WARN, UNKNOWN, and OK to other states, for example. See the --help output for more info. If you're concerned about DROP policies increasing the check time, you can just shorten the timeout. For a check like this, you probably don't need to check every 5 ...


5

Since the release of RedHat/CentOS 7, the previous firewall system has been replaced with firewalld. At the time of writing there is no curses-like console interface similar to system-config-firewall. If you don't mind using a GUI you could use firewall-config instead. If you need something for the console you will have to use firewall-cmd instead. For ...


10

Yes, of course. The job of a monitoring system is to ensure that the business requirements are currently being met by the IT infrastructure, whatever those requirements are. My gut feeling is that there's no easy limit (well, 65535) to the number of ports you're monitoring to ensure that they don't suddenly become open, and that the best way to achieve ...


2

It depends exactly on what you are using to blacklist the ADs of course. If you are using an external tool like squidguard, then it will be somewhat difficult. If you are doing everything with Squid ACLs, then it should be easy. It would look something like this. I am assuming your would have an acl named ads_bl that describes the ads to blacklist. # ...


1

Load the external module with modprobe ipt_REJECT and try again. DROP is in native, but REJECT is optionnal If it is a custom kernel, you maybe need to add it in the kernel compilation. Check the /boot/config file if it exists.


0

I see 2 things : You should not put any rules before: -A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT Your "INVALID" rule should not be there, and looks far too much convoluted, and likely to be buggy. I suggest you limit it to only -m state --state INVALID and I strongly suggest that you log the INVALID packets. There are also bugs ...


4

You mean e.g. iptables -F INPUT iptables -I INPUT 1 -j RETURN From man iptables: If [...] a rule in a built-in chain with target RETURN is matched, the target specified by the chain policy determines the fate of the packet. The chain policy is set with iptables -P, and can be found at the beginning of the output of iptables -L -n -v, eg: Chain ...


0

You cannot make this network setup using the ccd feature, because your OpenVPN server needs to have an address in each subnet you want to use. You should run multiple copies of OpenVPN, one for each /24 subnet that you are using. Each OpenVPN server instance then has a unique IP address in the subnet. So, for example, for subnet 10.8.0.0/24, you would have ...


0

With OpenVPN, you can choose which routes will be sent over the VPN and which routes will be local-only; for instance, you can set only things going to your machine, or your subnet, etc will route through the VPN, but all other traffic will flow as normal. This should be configurable on the server side. Here's an example that you can adapt for your needs, ...


0

Good day all, I AM WRITING THE AS A "TUTORIAL" FOR THOSE WHO ARE SEEKING HELP WITH IPTABLES I have been experimenting with different rules and after lots of hearaches and iptables flushes I have figured out and also got some understanding of why I had no internet access/throughput from tun0 to the eth0 interface /etc/sysconfig/iptables # Generated by ...



Top 50 recent answers are included