New answers tagged

-2

Blocking ICMP has little to do with security. It was actual back in 90-s, when multiple security flaw existed, related to ICMP frag packets, mostly in Windows family. The IP stack has become mature since then. Blocking ICMP on firewall is now an urban legend. DoS or DDoS ICMP flood attacks are something purely theoretical too - it's cheaper and deadlier to ...


1

If you are referring to HTTP protocol and remote web-clients, like browsers, then, to display a warning page to a set of such clients, basing on their IP address information, you can use mod_rewrite to rewrite the DocumentRoot of a given vhost (the one that you want to protect) to some path, say /blacklisted.html. For example, consider the following ...


0

The first rule seems correct. The problem seems to be with the second rule. When the packet returns from 192.168.1.231:8080, you want to check that the sport is 8080 (not the dport). You may want to use iptables -t nat -nvL PREROUTING and iptables -t nat -nvL POSTROUTING And check the packet counters in order to undersand what goes through each rule.


0

It could be done using a bridging firewall. I had to do that at an old workcenter where our department wasn't allowed to create a private network, so I put up a bridging firewall (linux iptables and bridging software) between the link outside our network, and everything inside. You have to do some extra tricks to do it but it works. Here is one link that ...


2

Public vs private doesn't really matter here, you can use either one. However, I think you'll find that it's very tricky to implement what you're looking for without placing your existing servers into a dedicated subnet, private or public, for which the new server/FW acts as a gateway, because that's the most natural way to get traffic to flow systematically ...


0

also you need this at the top auto lo iface lo inet loopback auto lo iface lo inet loopback auto eth0 iface eth0 inet static address 148.111.111.200 netmask 255.255.255.255 pointopoint 148.111.111.193 gateway 148.111.111.193 broadcast 148.111.111.193 # default route to access subnet auto vmbr0 iface vmbr0 inet static ...


1

If you already use firewalld, then you should have fail2ban also use firewalld. There's no point in having it use iptables directly in this scenario. Not to mention that firewallcmd-ipset has much better performance for large ban lists than iptables-multiport.


2

I have done this using a combination of TC and iptables hashlimit. I created a TC bandwidth limiter outbound on the LAN interface (to target download traffic) set to 5 Mbits/second. I then use the iptables hashlimit module in the interface's output mangle chain such that if the packet rate exceeds a certain threshold, between any two distinct source and ...


1

you can solve this problem in a simple way, try to use recent module with iptables, recent keep track of the source address: iptables -m recent -h recent match options: [!] --set Add source address to list, always matches. [!] --rcheck Match if source address in list. [!] --update Match if source ...


0

You might be able to solve this using the connlimit module: http://www.cyberciti.biz/faq/iptables-connection-limits-howto/


0

It won't be possible to achieve without changing apache config. What you are doing is, forwarding request on a custom port (999) to apache that is running on port 80. But as you have noted already, iptables is anaware of the virtual site and is forwarding the request to apache, and apache is returning the default site. If you have only one virtual site, you ...


0

The solution I have come up so far is: iptables -t nat -A PREROUTING -p tcp -s 10.10.10.20 -d 1.2.3.4 --dport 53 -j DNAT --to-destination 10.10.10.10:53 iptables -t nat -A PREROUTING -p tcp -s 10.10.10.20 -d 1.2.3.4 --dport 53 -j DNAT --to-destination 10.10.10.10:53 the same rules goes for other services if any. So far I have not met any pitfalls and it ...


0

Using a bridge would have worked had I wanted to pass ALL traffic from one interface to another, however, I needed to keep some of the traffic locally. As far as I can tell, it is impossible to use iptables to forward a broadcast packet. I ended up just writing a program that retransmits received packets on a different interface.


0

Your setup looks good. You should look over iptables-persistent to make your firewall start up automatically after VPS reboot. It works really well (it is just a service which start in boot time and modify firewall with saved ruleset).


4

When you set your default policy to DROP and ACCEPT only what you need, this is clearly more secure than allowing everything by default and selectively DROP unwanted traffic types. This at least saves you from securing the services that are not meant to be accessed remotely (from outside your machine or your LAN). Your system is more secure when you expose ...


1

An inbound, local-destined packet is never going to go through the POSTROUTING chain of the NAT table: (https://www.garron.me/images/2012-04/Netfilter-packet-flow.svg) But Reading The Fine Manual reveals: SNAT This target is only valid in the nat table, in the POSTROUTING and INPUT chains [...] Kernels prior to 2.6.36-rc1 don't have the ...


0

Your nethogs output shows your IP in discussion with port 53 on other IPs (mostly belonging to akam.net). This is normal behavior if you are running a resolving DNS client. The list is growing because your iptables filter is incorrect and blocks dpt:53 also on the OUTPUT chain, which blocks your own resolver.


2

DNS is primarily UDP on port 53. But why are you blocking it in OUTPUT chain as well? Do you not want to resolve any domain name from this machine?


2

DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:53 Generally DNS traffic is UDP with fallback to TCP. You need to DROP UDP to port 53 too. iptables -I INPUT -p udp --destination-port 53 -j DROP


0

In the /etc/vz/vz.conf IPTABLES variable is defined this way: IPTABLES="ipt_REJECT ipt_tos ipt_limit ipt_multiport iptable_filter iptable_mangle ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_length" Therefor, when you use commas between the modules it brakes the format of the variable, just remove the commas. To avoid this error: can't initialize iptables ...


0

Note that when Docker daemon starts, it adds DOCKER chain to *filter and *nat rules. If you clear all iptables rules afterwards, using e.g. ufw, you might break expected behaviour. When you start a container, a FORWARD rules is added to DOCKER chain. Docker is running command like this: iptables --wait -t filter -A DOCKER ! -i docker0 -o docker0 -p tcp -d ...


0

As configured I think your main problem is the DROP at the end of the LOGGING chain. It is dropping all packets that reach it. The gem command will be using a random ephemeral port to make the connection to the remote system. Packets will be returned to it and as you don't you only allow packets to explicit ports in your INPUT chain you are blocking them ...


0

You can do this my configuring iptables to 'mark' the messages e.g. iptables -A INPUT -s 192.0.2.0/24 -j LOG --log-prefix='[iptables] ' Which will cause a log message that is prefixed with the text [iptables] Now you can configure your rsyslog to send these messages to a particular log file by adding a suitable entry to it's configuration e.g. ...


0

there is a way to log packets in IPTables. first you need to create new chain to logging packets. iptables -N LOGGING then you need to append which packets you are gonna log using following commands. iptables -A INPUT -j LOGGING iptables -A OUTPUT -j LOGGING now you can log the packets to the syslogs using this. iptables -A LOGGING -m limit --limit ...


1

Your firewall is missing major part. The first packet go to outside correctely (as the OUTPUT policy is ACCEPT). The fist incoming packet is rejected as there is nothing allow in INPUT rule. You should have a iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT to allow the connection tracking to allow the packet to come. The second packet will ...


1

You need to allow incoming packets, related to your outgoing connections. iptables -I INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT If that doesn't work: iptables -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT Differences are discussed here: ...


0

If you configured the ip tables through webmin and checked "Enable firewall at boot time" then you should delete this line : post-up iptables-restore < /etc/iptables.up.rules in etc/network/interfaces this is true on Debian and so I would imagine Ubuntu too


0

In general, you should consider 1) MySQL bind-address, and 2) the firewall. Since you aren't able to make a connection with telnet SERVER_IP 3306, either the firewall is blocking the connection or MySQL is not listening on that port. Firewall You should review your firewall rules as a set, without piping to grep, to see if there are any matching rules ...


1

Rackspace now has Security Groups! Before this, though, it would certainly be possible to use a Linux box as a firewall. The Vyatta server image is designed just for this purpose—though it's not a "cheap server" at $6.24/d, it is a cheap firewall.


2

As mentioned before, it has nothing to do with iptables. Your service is listening to local (loopback) interface only and therefore is unavailable from outside. You need to reconfigure your service. If you are not familiar with that, you may try the following. Find configuration file of your service and make backup copy of it Open the configuration file ...


1

First, all the rules you have listed above is added to the INPUT chain, which deals with packets destined for the local server/pc (from outside) . Second, they are either blocking incoming requests from known private ip address block ( -s for source) or to broadcast or reserved addresses (-d for destination) So, there is no apparent reason for those ...


0

Here is your problem: According to your configuration, Both NIC are using Metric:1 If you want to use ETH1 as the primary NIC, change the Metric to 0. Your Configuration: eth0 Link encap:Ethernet HWaddr 04:01:33:0E: UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 eth1 Link encap:Ethernet HWaddr 04:01:33:0E: UP BROADCAST RUNNING ...


0

Solution finally found. ftp is on chroot,and is pure-ftpd This line Bind 10.2.2.1,2121 Don't work on chroot,but work out of chroot This line Bind *,2121 Works perfect in chroot I use this firewall script iptables -A INPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT iptables -A INPUT -i lo -j ACCEPT ...


0

To answer your question, yes. I ran a sample rule on my Debian box... iptables -t nat -A PREROUTING -i xenbr0 -p tcp --dport 64000:65000 -j DNAT --to 172.16.10.10:61000-62000 ... which produced no output, indicating success. I'm running kernel 3.16.0-4-amd64. Checking the NAT rule via iptables -t nat -vnL PREROUTING, I see the rule is listed... DNAT ...


0

Thanks for the replies, in the end I managed to fix it with the help of a colleague of mine. The target server had only a local route in it's routing table, and no default route. I assumed that it doesn't have to have a default gateway, as there would be only incoming UDP traffic. The problem went away after setting up a default gateway - the traffic coming ...


0

Something outside your control is blocking port 81. Use Name Based virtual hosting and/or a reverse proxy on port 80 instead. Your firewall us blocking connections to port 81. You will need to INSERT a rule into your INPUT table to open the port. You should take a look at the documentation for iptables(1). I'm sure you'll find plenty of hep on SF and the ...


0

Your routing table is in play here. Your proxy is located on an Internet-routable IP address. Your eth0 interface is configured with an Internet-routable IP address as well, likely with a default route pointed to your WAN gateway (Comcast, AT&T, etc.). Your eth1 interface is configured with a non-Internet routable IP address. What's happening is your ...


0

Please post the output of iptables -vnL and iptables -t nat -vnL so that we can see your rulesets and determine possible firewalling issues. Also, if your services are running on 127.0.0.1, then you must either: 1) Change the interface that your service binds to from lo or from 127.0.0.1 2) Create a NAT rule that takes packets coming into a physical ...


1

I copied your first combined iptables rule into my Ubuntu box and it worked for me: iptables -A INPUT -i wlan0 -m conntrack --ctstate NEW,ESTABLISHED,RELATED -s 172.16.10.0/24,172.16.9.0/24 -p tcp --dport 8400:8403 -j ACCEPT -m comment --comment "Working! :)" I received no output following that command, signifying success. I also ran your ...


2

Your server is not listening on port 587. I accept that you think you've been able to connect to it from some other machines, but I can only surmise that they've been going through some kind of transparent proxy which has hijacked connections to mail-server-type services, and whisked you off to some local mail server. In other words, the machine that can't ...


1

Your iptables NAT redirects will work but be aware that this method is dependent on the conntrack module. If your server has too many simultaneous requests, the conntrack table will become full and you will experience downtime. You can of course increase the size of the conntrack hash-table and how the hash-lookups are done, but this may impact performance. ...


0

In the end I solved this by getting second network interface to my router device. I configured second interface to connect the other other network. Then I just created new static route to my virtual network using ip route add command.


0

You don't need iptables, haproxyetc for a such simple task. Just install rinetd, its configuration file is most simple. <your IP/FQDN> <your port> <where to forward IP/FQDN> <where to forward port> i.e. old.webserver.com 80 new.webserver.com 80


11

Your INPUT rule allows traffic with source port 80 - but traffic coming into a web server is for destination port 80. You are, in essence, allowing only INPUT traffic from other webservers. Change --sport to --dport in your rule, and all should be better. The same point applies to nearly all your other rules, by the way.


1

You also have to make sure that -A Forwarding is not set to ACCEPT as your Server would become an Open Router which could (and most likely will) be used for malicious activity. With that said just add a rule to Forward only the traffic you need and you should be good to go. Forwarding is probably disabled for 2 reasons: Number 1 being that every module ...


1

I have moved data centers a few times, with a full class C block changing along with the move. It is wise to use conntrack in iptables as well as snat. Here is a handy little script I used a few times. Simple and works like a charm. Add additional ports as needed. Once DNS has refreshed and you have no more connections, remove the iptables rules. ...


4

Part of what got me wondering if there's something I'm missing is the question of why ip_forward isn't always set to 1 and instead defaults to 0 - like is there some security risk or undesired behavior if having it set to 1 in certain situations. If your system (as with many others) does not need to be a router there is no reason to enable routing. ...


1

You can use haproxy for this. The config can be found below: global chroot /var/lib/haproxy pidfile /var/run/haproxy.pid maxconn 4000 user haproxy group haproxy daemon stats socket /var/lib/haproxy/stats defaults mode http option abortonclose no option ...


1

ip_forwarding: ip_forwarding could be dangerous in situations where public ip addresses are used. A newly installed Linux machine could then be used as a router for networks that are not supposed to be routed this way. iptables: The main problem with your iptables setup is probably the routing on the new machine. That machine has to use the old machine as a ...


1

There is no inherent insecurity with IP forwarding itself, other then how your firewall is configured, if they are the same machine. On the contrary, it can provide some sort of security by hiding the real server ip. By enabling ip_forwarding one can turn a linux box into a router (that can do packet forwarding between networks) which is not always needed ...



Top 50 recent answers are included