Tag Info

Hot answers tagged

3

iptables is a firewall statefull, as opposite as stateless which means it identifies connections as streams, associated with states. the connection is first initiated (NEW state), (SYN packet for tcp, or first packet for UDP). Then, a decision is taken (BLOCK, DROP, or ACCEPT). This is what you created before the ESTABLISHED rule. If a packet is accepted on ...


3

I would be tempted to do something like this by creating a chain. Then adding rules to the chain to return the stuff you don't want. The stuff that lasts to the final rule of the chain will be the stuff you do want. # untested # create a new input counter chain /sbin/iptables -t filter -N inputcounter # redirect all traffic to chain /sbin/iptables -t ...


1

Based on information you provided (specifically the output of the first EDIT: "netstat -lanp | grep ':123'" and second EDIT: "netstat -nlap | grep 'ntpd'"), it's clear that: at the time of the first edit: your system were running a process with PID 24483; such process declared itself as named "ntpd"; such process bound to UDP port 123 for several IPv4 ...


1

There are mistake in Your iptables rule: iptables -A OUTPUT -m owner --uid-owner ntp -p udp --dport 123 -j ACCEPT If You use --uid-owner it is necessary to define uid - numeric value. For the program name You need another option: --cmd-owner. Correct rule is: iptables -A OUTPUT -m owner --cmd-owner ntp -p udp --dport 123 -j Detailed explanation You ...


1

It may seem counter-intuitive but only packets that conntrack doesn't know about go through the NAT table. This makes attempting to use string matching problematic for NATing: by the time the string appears in a packet the connection is already established. Usually using iptables string matching is ill-advised and you should do something at a higher layer ...



Only top voted, non community-wiki answers of a minimum length are eligible