Tag Info

Hot answers tagged

3

No, you can't do this with DNS, IPtables or the hosts file. You'd need to point those domains to a proxy, or something that has knowledge of what you want done, which will in turn re-direct the clients to the "right" place.


2

You are confusing dport and sport. For instance if you want to get back DNS replies, this : iptables -A INPUT -p udp --dport dns -j ACCEPT Should be : iptables -A INPUT -p udp --sport dns -j ACCEPT You made this mistake almost everywhere.


2

Don't bother. fail2ban maintains its own state and will recreate its firewall rules when restarted.


2

i think you are missing some kernel module in your openvz container, because if I use "iptables -t nat -I POSTROUTING -m state --state NEW -p tcp --dport 25 -o venet0 -m statistic --mode nth --every 5 --packet 0 -j SNAT --to-source 1.1.1.2" in my linux workstation it works Maybe the missing modules is "xt_statistic"


2

You need to allow ICMP requests inbound, something like this should do it: iptables -A INPUT -p icmp --icmp-type 8 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT


2

You don't have ICMP allowed in your iptables rules. iptables -A INPUT -p icmp -j ACCEPT iptables -A OUTPUT -p icmp -j ACCEPT


2

Docker is not "running a firewall" itself, it uses host iptables and its rules are bound to the docker bridge interface (docker0 by default). As you want to forward a host's port to a docker container, you don't need to edit iptables rules, docker run provides option -p hostPort:containerPort to do this and will handle all iptables rules itself. The ...


1

One way to do this would be to use unshare -n to put the process into its own network namespace. This will effectively constrain the interfaces it can bind to such that it will only ever send out the interfaces exported over the namespace. This is equivalent to putting it on a VM with only one interface but 'cheaper' in the sense it doesn't require the ...


1

The issue is that your NAT rule in the PREROUTING chain of the nat table translates host's port 3306 to 172.17.0.2:33066 and not to 172.17.0.2:3306 thus the rule in the FORWARD chain of the filter table doesn't match anything since it tries to drop traffic forwarded to destination port 3306.


1

You will need to add local host to the localnet definition. acl localnet src 127.0.0.1 # localhost acl localnet src ::1 # IPv6 localhost Using a firewall to force transparent proxy access on localhost will require some additional parameters to ignore traffic from squid.



Only top voted, non community-wiki answers of a minimum length are eligible