New answers tagged

0

Regardless of how you go about processing this info, you may need to move to a lower level language like C for performance. You might even need to go multi-threaded. I haven't tried it but the netfilter library libnetfilter_log looks promising. iptables is essentially the netfilter command line interface and netfilter is the packet filter in the Linux ...


0

I realized it is a "hairpin DNS" issue. Best solution I guess to configure NAT to not shortcut request to my own external IP to local IP... but still my provider not did it and I temporary fixed it by nano /etc/hosts added a line y.y.y.y myserver.com where y.y.y.y is my LOCAL address.


0

If you cant access to any external web site from your local machine try to change these two policies: iptables -A INPUT -i eth0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o eth0 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT For these: iptables -A INPUT -i eth0 -p tcp --sport 80 -m state --...


2

You can actually do this, but you'll need to use the NF_LOG iptables target and write a program that specifically covers your needs. NF_LOG will send packets to a receiving application which (given how quickly you manage to do what you are doing) would count the packets are a per-millisecond level. You can avoid writing out every packet doing this and ...


0

you can find out yourself, if its the fault of your iptables firewall. just use the follow command to the the current input rules: iptables -L INPUT -vn possible there is also a redirect set, so check this too with: iptables -t nat -L -vn Also Im not shure, if your OUTPUT rules is really right. You can add a logging rule on the end of your OUTPUT ...


1

Not quite the answer to your current problem, but it will render the whole issue moot since you're trying to trigger the script from the same host running your site anyway: When you need to run PHP scripts from cron you're generally better of running them from the PHP command line interface rather than making a web request to the script. Depending on the ...


1

Take a good look at the actual running iptables configuration ipatables -L -vn and ensure that nothing is blocking the source IP of the system running he curl/ping commands - take appropriate action. If there is nothing there then something upstream, between the systems may be blocking. As ping is being blocked I guess you could try mtr mtr -4 example....


2

You can give the tun device name in the .ovpn configuration file: Edit the file /etc/openvpn/server-vpngw.conf and add such lines: dev tun3 client-config-dir /etc/openvpn/ccd Then create the following file /etc/openvpn/ccd/vpn-name and edit it like so: ifconfig-push 10.8.2.202 10.8.2.201 push "route 172.16.12.0 255.255.255.0" push "route 10.2.4.0 255....


0

I think your issue is with the NAT POSTROUTING rule. ANY packet leaving the eth0 interface is subject to MASQUERADE'ing, even packets originating from your OVPN server itself. The problem comes with your OVPN Client connecting to the OVPN Server on udp/1194, and due to the MASQUERADE rule, the OVPN Server is sending its replies from a different port that ...


0

Your OUTPUT chain drops packets to all ports except 80. When you are loading the webpage at http://127.0.0.1:8080, its destination is port 8080, which is not allowed in the OUTPUT chain. You can allow all traffic from/to localhost with these lines: iptables -I INPUT 1 -i lo -j ACCEPT iptables -I OUTPUT 1 -o lo -j ACCEPT This does not affect the external ...


1

You can specify the source IP address or subnet with the parameter "-s" and then drop all the traffic from eth1 to eth0 sudo iptables -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT sudo iptables -A FORWARD -s 192.168.1.1 -i eth1 -o eth0 -j ACCEPT sudo iptables -A FORWARD -s 192.168.1.0/24 -i eth1 -o eth0 -j ACCEPT sudo iptables -A ...


1

Depending on how nice you want to be to the client, a possible solution can be: iptables -I INPUT -p udp --dport 111 -j DROP or iptables -I INPUT -p udp --dport 111 -j REJECT


0

Drop these rules: -A POSTROUTING -o br1 -j MASQUERADE -A POSTROUTING -o br2 -j MASQUERADE They perform SNAT on all traffic going to br1 and br2. Normally you will only want to have one MASQUERADE rule on the interface connected to the Internet. If each container is on on a separate bridge, I would put the containers in different subnets. They don't ...


2

There is three main chains to catch all traffic - INPUT, OUTPUT, and FORWARD - put appropriate rules in all of them to see any kind of traffic. There is no direct way to do this. There is no chain (by default) to catch dropped/rejected traffic and no any flag in the packet itself to signify that it will be dropped. So, you need to create custom chain and ...


3

Instead of using iptables by itself, I recommend that you use a firewall management package like Shorewall to configure the firewall. There you can easily configure different zones in your network, and configure access between them. However, if you want to use iptables only, you add this line after your route command: iptables -A FORWARD -s 192.168.123.0/...


2

Without testing this myself, I can't be sure, but it seems like this is just a case of a bad regex line for directing requests to your php-fpm engine. location ~ [^/]\.php(/|$) { Will only match location requests which end with ".php/" (which is uncommon), or explicitly end with ".php". I'm assuming you used the guide here, which is fine (though I've ...


0

The problem is you're using OpenVZ. OpenVZ is running a 2.6 kernel which does not have the capabilities that the firewalld daemon relies upon and all of the systemd changes are backported into sysvinit for OpenVZ.


0

I've never used UFW for my iptables configuration. I've always used cmd-line iptables/bash scripts to accomplish my firewalling. So my answer here is going to be in that format. This rule is to accomplish the NAT you want: iptables -t nat -A PREROUTING -d 91.121.XXX.XXX -p tcp --dport 2121 -j DNAT --to 192.168.122.59:21 What it does is accept TCP ...


0

Not sure if the following it too generic for you (if so, please post a comment accordingly), but your given regex doesn't match the host: ... value of the log generated by the attacker, specifically the / inside there. You could try out this instead: failregex = ^ \[error\] \d+#\d+: \*\d+ user "\S+":? (password mismatch|was not found in ".*"), client: <...


1

I was certain I didn't do anything to cause this issue, but it was my VPS provider after all. I just needed to click on the rebuild network button to get it working again.


5

Windows Server 2012 has a built-in firewall, which can be managed from either GUI (running wf.msc) or PowerShell, using Network Security Cmdlets.


0

Ubuntu 16.04 LTS /etc/ufw/user.rules In general, try: locate user.rules Should output something like: /etc/ufw/user.rules /usr/share/ufw/user.rules /usr/share/ufw/user.rules.md5sum /usr/share/ufw/iptables/user.rules


0

We wrote a special module for this called iptables_raw which allows us to easily manage iptables. Everything is explained in this blog post. Here is an example of how to use the module: # Allow all IPv4 traffic coming in on port 80 - iptables_raw: name=allow_tcp_80 rules='-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT' # Delete the above rule - ...


0

I'm answering my own question : the problem was coming from the following parameters : /proc/sys/net/bridge/bridge-nf-filter-pppoe-tagged /proc/sys/net/bridge/bridge-nf-filter-vlan-tagged I set them to 1 and it allowed the subsequent frames/packets to be forwarded into iptables FORWARD table. Thank you for you help.


0

Are you able to verify that the source/client sending original SYN packet is NOT actually two endpoints with the same IP address being shared behind the NAT??? YOu must verify this first before we can proceed to resolving this for you. Please verify and get back to us. One way to test is to SSH from the NAT box to the client box, and that connection should ...


0

Would be useful to share with us iptables -L -n -v In order to drop a traffic on bridged interface, just use: iptables -A FORWARD -p tcp --dport 53 -j DROP iptables -A FORWARD -p udp --dport 53 -j DROP Feel free to use tcpdump -i any -n port 53 to see wheras the traffic really goes through the server. You can also use: iptables -A FORWARD -j LOG --...


0

By default, Docker use a userland proxy (docker-proxy) to expose ports. Try disable it with: --userland-proxy=false


1

I was able to see connecting clients ip from my container using --net=host. use --iptables=false, so docker will not mess up with your host's iptables config. Enable ip forwarding on your docker host: echo 1>/proc/sys/net/ipv4/ip_forward --net=host Tell Docker to skip placing the container inside of a separate network stack. In essence, this choice ...


2

Linux uses the strong end system model. IP addresses do not act in a way as if they were different machines. Instead a machine acts like it owns all its IP addresses. Since 192.168.150.1 and 192.168.1.1 are the same machine, no forwarding or routing is needed. If you reach one, you've reached the other.


1

This depends on your IPTABLES setup. It sounds as if you masquerade while forwarding, something like this: iptables -t nat -A POSTROUTING --out-interface docker0 -j MASQUERADE If you want the client to see the original IP, you have to disable masquerading, and just use NAT and PREROUTING. There are tons of manuals for this out there. Just make sure your ...


0

Look at rate limiting. It can throttle connections to the specified rate. You will likely need to limit on a per minute basis as I believe the rates are integers. A rate of 24/min should work. You will have to test to see how bursty the connections will be.


0

The answer is that conntrack only lists IPv4 connections by default. If I do user@router:~$ sudo conntrack -L -f ipv6 > /dev/null conntrack v1.2.1 (conntrack-tools): 23864 flow entries have been shown. user@router:~$ sudo conntrack -L > /dev/null conntrack v1.2.1 (conntrack-tools): 6713 flow entries have been shown. then the sum of the two ...


0

I too had to do a similar thing recently, and in searching came upon this answer. Unfortunately, the answer of Nafe uses ipfw which is now deprecated and unavailable in OSX; and the answer of Kevin Leary is indeed a bit hackish. So I had to make something better (cleaner) and decided to share it here for posterity. This answer is largely based on the ...


3

My bad. I didn't notice i was using --internal. Self-explanatory!


0

Full Multicast routing gets much trickier (so much easier in the days of hubs). There is a package to install to make it much easier. WiFi is configured to not allow a WiFi device to talk to another WiFi device.


0

I managed to work it out. Although I had already added net.ipv4.ip_forward=1 to /etc/sysctl.conf (which most guides point out), I also need to add net.ipv4.conf.all.proxy_arp=1. The iptables configuration then just needs to allow all traffic on both interfaces and it works!


2

This does not secure the connection between these hosts at all. It lowers the attack surface on the server side when you limit access to daemons as much as you can but it doesnt help you when it comes to connection security. If possible you should enable SSL to increase the security of the connection. If this isn't possible you might consider setting up an ...


0

A quick turnaround way for this could be modifying how logging is working to make it record $http_x_forwarded_for values which will then log actual client IP. Not sure weather you will be able to modify how your logging is happening but i hope this helps.


0

The first rule uses the connection tracking extension ctstate and inverts dynamic network address translation protocol ! - I believe the rules are saying, when the source is from 172.16.100.0/24 and the destination is the same network don't NAT the source (so if this is a virtual router then that would be dhcp offers and the like, also any host to host ...


0

So this is the definitive answer i was looking for. You first need to set NAT (prerouting) rule to redirect the traffic to the correct server/computer. Done like this... iptables -t nat -A PREROUTING -p tcp -s yy.yy.yy.0/24 --dport 3389 -j DNAT --to-destination 192.168.1.xx:3389 Then you need a Filter (FORWARD) Rule to allow the traffic to flow to the ...


0

it looks like iptables can not add more IP addresses after some point That is expected behaviour for an ipset hashtable as described in the manual in the Introduction: ... When entries added by the SET target of iptables/ip6tables, then the hash size is fixed and the set won't be duplicated, even if the new entry cannot be added to the set. No ...


0

You have no rule to allow outgoing, although your rules for ports 22 and 443 appear to be bi-direction. You should be filtering ICMP on the external interface, and allowing DNS traffic on port 53 (both UDP and TCP). I would recommend you use a n IPv6 capable firewall builder. There are ports that you likely want to block outgoing traffic on even if you ...


1

If you're just using a REST API, it will typically respond from the IP address that you contacted, otherwise the HTTP TCP connection wouldn't work. But if you're actually using a service that creates out-of-band TCP connections back to your original client IP, or some other IP, then the owners of that API need to expose the list of source IPs to you so you ...


1

You're probably not getting all the IPs from DNS because some of the instances that communicate with your service are background workers or task boxes etc. Without a reliable way to determine what IPs are likely to attempt to access your service, you won't be able to limit access by IP. You could use Amazon's IP range API to open up access to that entire ...



Top 50 recent answers are included