Tag Info

New answers tagged

0

This is called "transparent proxy". You need two things to do it: Your proxy server should support it (transparent proxy). Squid is a well-known proxy server which supports transparent proxy mode. Configure your firewall / router to redirect HTTP traffic to your proxy like the iptables rule you have.


2

You could probably bend 'fail2ban' to your desires, using a custom filter to detect successful logins, and a custom action to add iptables rules for the detected source IP rather than banning them. It's a bit odd so you'd want some really good comments in your configuration for the next person coming along to be able to understand what on earth you were ...


0

There exist two solutions: As mention @andrii-kupchanko you can change ftp server configuration. This changes force server to send external IP (Public_IP2) to client as IP for passive backward-connection. Drawback is necessity of forwarding passive connection back to private subnet resident FTP-server (via iptables) and statically binding ports used by ...


0

Your ftp server should be configured, as it's behind NAT. You didn't say what ftp server software you are using, so i will provide required config directive example for proFTPd: # If your host was NATted, this option is useful in order to # allow passive tranfers to work. You have to use your public # address and opening the passive ports used on your ...


0

I tried the approach from Beast response (thanks!!) and had to change this fragment to make it work: /sbin/iptables -I INPUT -s $SOURCEIP -j DROP echo "/sbin/iptables -D INPUT -s $SOURCEIP -j DROP" | at now + $BANNEDTIME Basically I had to add sudo to the commands /sbin/iptables and at inside the script: sudo /sbin/iptables -I INPUT -s $SOURCEIP -j DROP ...


1

Solved: I put the following commands, I missed one. iptables -t nat -A PREROUTING -s 172.19.128.248 -j DNAT --to-destination 192.168.200.202 iptables -t nat -A PREROUTING -s 192.168.200.202 -j DNAT --to-destination 172.19.128.248 iptables -t nat -A POSTROUTING -p tcp -j SNAT --to-source 172.19.128.237


0

Okay, found that the CT target was added to kernel 2.6.34, and iptables 1.4.8 supports all new features of this kernel.


3

Federico is right. AWS has security groups assigned to each EC2 instance. These can be set to protocols or custom port/port ranges and set to allow your IP, custom IP or all. It'll always require a CIDR value if I recall, but if it's just you it'll tack on a /32 at the end of your IP address. Go to your main dashboard, locate the line that has your instance, ...


4

Sadly... probably not. However... one point-of-interest... your iptables -F is insufficient for flushing ALL your tables. (Yes, this is sufficient for flushing all the chains in the default filter table) You must specify each table to flush, not just the default one. i.e. iptables -t nat -F and/or iptables -t mangle -F.


2

ssh tunneling is configured by the ssh-daemon itself. If the SSH daemon does not permit tunneling, you'll need to re-configure it. Typically, it's just running openssh server... and you can edit the /etc/ssh/sshd_config and add AllowTcpForwarding yes (remove AllowTcpForwarding no) and reload sshd config. As far as sftp goes, this is a slightly different ...


0

I think the issue may be related to the interface. You should mention the physical interface, not the bridge. for example, i would replace routed0 by eth0 Then i am a bit uncomfortable with -d xxx.xxx.xxx.xxx. Usually we don't need to mention the destination ip, because we already know it is your public ip. if you don't put you public ip it may not work. i ...


0

There is a sysctl setting preventing dnat to loopback. replace eth0 below with your external interface traffic is coming in on. To allow it sysctl -w net.ipv4.conf.eth0.route_localnet=1 or echo 1 > /proc/sys/net/ipv4/conf/eth0/route_localnet and to check the setting. cat /proc/sys/net/ipv4/conf/eth0/route_localnet now you can dnat to 127.0.0.1


0

There is a sysctl setting preventing dnat to loopback. replace eth0 below with your external interface traffic is coming in on. To allow it sysctl -w net.ipv4.conf.eth0.route_localnet=1 and to check the setting. cat /proc/sys/net/ipv4/conf/eth0/route_localnet Now your dnat to 127.0.0.1 will work.


0

Your solution with iptables should work, but unfortunately the Linux kernel doesn't permit it, because the kernel code considers every incoming packet with destination address 127/8 a "martian" and it will not accept it. You can see this with: sysctl -w net.ipv4.conf.eth0.log_martians=1 To allow it traffic to 127/8 subnet use route_localnet # sysctl -w ...


0

Having been searching for a solution to my dnat to 127.0.0.1 failing, found the answer on the netfilter irc channel. It seems there is a sysctl setting preventing dnat to loopback. To allow it sysctl -w net.ipv4.conf.eth0.route_localnet=1 and to check the setting. cat /proc/sys/net/ipv4/conf/eth0/route_localnet


0

After a lot of a research, and trial and error, it turns out this is pretty easy to do. You do have to run multiple instances, one per bridge, in order to isolate all of the users to their respective networks. You just add a new .conf file for each instance and Debian will automatically create a new instance per .conf file. Just make sure you use different ...


2

If, for example, your IPs are 192.168.10.10 and 192.168.10.11, and you want sshd to listen to port 443 on IP1, and httpd to Listen to port 443 on IP2: Add to your /etc/ssh/sshd_config file: ListenAddress 192.168.10.10:443 and restart SSH. SSH will now listen on port 443 of IP1. Add to your httpd.conf file (assuming Apache, should be easy with other ...


0

If you want to segregate IP1 ==> NGINX and IP2 ==> SSHD, I suggest you to turn on NetFilter w/ PREROUTING : Nginx listen on 8443 and SSHD on 22 ; close these ports and PAT the 443 port regarding of the source. Else, sorry, this isn't possible for one server to have two processes handling one Net socket (TCP/443), because the system couldn't know which ...


0

Yes, fail2ban is a good idea. But out of Netfilter that can be quite dirty because of bad TCP reply (you should add INPUT -p tcp -m state --state ESTABLISHED --sport 22 -j ACCEPT for instance) The best solution is actually in your /etc/ssh/sshd_config, limiting there your IPs : ListenAddress 70.5.1.1 ListenAddress 10.1.5.1


0

Try the following... Login to your home and work computer and execute the command below on each of them. dig +short myip.opendns.com @resolver1.opendns.com This will return the actual public IP you will be connecting from home and work respectively. These are the two IPs you need to add to your rule on your ssh server.


0

Try fail2ban. Most distros have it packaged and it comes with default rules for sshd. It will automatically ban all IPs (via iptables) with more then a certain amount of login failures.


1

First, I think you may need to enable ip forwarding. sysctl -w net.ipv4.ip_forward=1 to get your machine to be a router. Full details on ip forwarding are here. Second, I won't swear to this but your iptables rules look wrong to me. It seems you need something more like this: iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 1044 -j DNAT ...


0

Your rules are allowing incoming requests, but you may have a very restrictive IPTable configuration that is blocking all outgoing communications. If this is the case, then you will need to add additional rules. iptables -A OUTPUT -p tcp -d 12.34.56.78 --sport ssh -j ACCEPT iptables -A OUTPUT -p tcp -d 23.45.67.89 --sport ssh -J ACCEPT The rules above ...


0

It does. It works as you suspected: the policy will be applied to packages which doesn't have an explicit rule inside the chain. Since the is a specific rule to all packets, the policy will never be applied, and all packages will be accepted. What will happen to the packages in the end, however, that's an entirely another story, as it may depend on the ...


2

Actually, when you do: $ ssh -f -N -D 0.0.0.0:8080 root@192.168.3.182 $ curl --socks5 192.168.3.182:8080 ip.appspot.com The following events occur: CURL opens a TCP connection from [YOUR-HOST]:[RANDOM-PORT] to the SOCKS server that SSHD runs on 192.168.3.182:8080 SSHD accepts the connection CURL asks SSHD to open a new connection from ...


0

I just found samplicator which also seems to do this.


0

I just found samplicator which also seems to do this.


0

Whenever packets are targeted/sent to it. For example by a rule like: ip6tables -A INPUT -p tcp --dport 1:21 -j userChain1 The two rules: -A userChain1 -m limit --limit 4/sec -j REJECT --reject-with icmp6-port-unreachable -A userChain1 -j DROP Means for the first 4 packets per second a response is sent, (REJECT target) and everything past that is just ...


2

RST and ACK,FIN packets are part of the very tail end of a TCP connection. My understanding is that iptables's connection tracking engine takes a pretty robust approach to deleting state table entries, for security reasons: as soon as it sees one end of a connection trying to close it down, then (knowing that such a request signals the end of a conection, ...


1

The traffic from your VMs to the public internet must be routed through the interface of the host node so there is no way to completely remove the parent node as a hop in the traceroute results. However, you can use iptables on the parent node to block outbound ICMP packets. This will hide the IP address of your parent node in the traceroute results -- ...


-1

Issue in pyinotify: https://github.com/fail2ban/fail2ban/issues/878 in /etc/fail2ban/jail.conf or /etc/fail2ban/jail.local I changed "backend = auto" to "backend = polling" and everything works as expected ;) service fail2ban stop service fail2ban start


0

Have a look at the man page for ssh, it gives you a great example in there: man ssh SSH-BASED VIRTUAL PRIVATE NETWORKS ssh contains support for Virtual Private Network (VPN) tunnelling using the tun(4) network pseudo-device, allowing two networks to be joined securely. The sshd_config(5) configuration option PermitTunnel controls whether the server sup- ...


0

I'm not familiar with LXC or how devices are shared between host and container, however using iptables you can forward traffic from one interface to another like so; iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT Don't know if that helps you any.


2

If you want to show the IP addresses and port numbers without showing their names, you can use the option -n. So, your command will be iptables -L -n If you look at the manual man iptables, you can read: -n, --numeric Numeric output. IP addresses and port numbers will be printed in numeric format. By default, the program will try to display ...


0

man pf.conf tos | This rule applies to packets with the specified TOS bits set. TOS may be given as one of lowdelay, throughput, reliability, or as either hex or decimal. For example, the following rules are identical: pass all tos lowdelay pass all tos 0x10 pass all tos 16 ...


1

You can whitelist anything you want writing the following at the top of the CHAIN: iptables -t mangle -A rate-limiter <rule to match whitelisted> -j RETURN Packets matching the whitelisted networks will return to POSTROUTING without modification.


0

Does the traffic from your server to 2.2.2.2:443 (the original destination) traverse the AP? In that case the translation would apply, so change your DNAT rules so that traffic originating from the server is excluded from the DNAT translation. iptables -t nat -A PREROUTING -p tcp ! -s x.x.x.x --dport 80 -m conntrack --ctstate NEW -j DNAT --to x.x.x.x:8880 ...


1

/sbin/iptables -I OUTPUT -j TRAFFICFILTERUP should be /sbin/iptables -I FORWARD -j TRAFFICFILTERUP


1

You can modify your rule by adding the option --connlimit-mask 0. This effectively enables you to limit connections globally and all IPs will be treated without any distinction. On the contrary, the default value 32 for IPv4 means to match every single IP alone. As suggested by @JayMcTee, you can use web server level solution to limit connections limit. ...


2

I have been trying to solve this problem for a while now, and while I ultimately decided not to bind my server process to localhost (I used 0.0.0.0:PORT), for a while I was unsure of where my incoming packets were actually going given I thought I had the right NAT rule. The answer was that the kernel was intercepting them as martian packets, and discarding ...


3

Doing any kind of proxying based on the DNS hostname used also requires that the application protocol carries the host header in some way. To my knowledge there are no such headers involved in FTP, so I don't see how this will be possible. Maybe with a custom FTP proxy, that sends you to different servers based on the username or something like that. TLDR: ...


0

Why iftop is showing so much traffic if iptables is blocking it to come inside my server? Because pcap utilities look capture data from an interface before any netfilter(iptables) rules have been applied. Your rule blocking the traffic will prevent that traffic from being forwarded, or processed by any software running on the server. Netfilter cannot ...


0

This should works: FILE=iplist #This is file name of recent module output. It may vary on your system (like iplist) TICKS=$(grep CONFIG_HZ= /boot/config-$(uname -r)|awk -F= '{print $2}') # Get current ticks per sec printit() { Len=`echo $1|wc -c` Date=$DATE Dot="." Loop=`echo 50-$Len|bc` loop=0 while [ $loop -le $Loop ] do ...


1

I think you will need traffic control instead of IPTables rules. There is a manual for the 'tc' program: http://www.tldp.org/HOWTO/html_single/Traffic-Control-HOWTO/ And a simple tutorial for its usage: http://chsoft.biz/lartc/tc_tutorial.html Following these, you can create a simple rule to distribute the traffic equally.


1

Your INPUT chain drops dynamically opened ports. I think you should accept the packages related to your OUTPUT traffic. Add this line before the DROP rules: /sbin/iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT http://www.revsys.com/writings/quicktips/nat.html


1

You need to use POSTROUTING chain for do what you want to do. iptables -t nat -A POSTROUTING -p tcp -d 10.0.2.5 --dport 80 -j SNAT --to 69.31.21.42:80 man iptables and POSTROUTING (for altering packets as they are about to go out)


-2

First of all please know that it's not possible to forward TCP IP:Port to another IP:Port. This is only possible with UDP and there's a separate Perl script for that. Yes you can forward an IP directly to another machine, not a specific port.


0

There is no difference in the routing needed for ssh and http. Both are running over TCP and are playing no tricks with the underlying IP traffic. According to your question both are using the same hostname, but you did not mention whether that hostname resolves to just one or multiple IP addresses. Using the telnet command you can verify if a connection ...


3

A host based firewall might protect your services, but the offending traffic still needs to be delivered to your host before it can be discarded. Your uplink is still a finite resource and if the amounts of garbage your attacker sends increases so will the risk for a detrimental effect on legitimate traffic. You might want to contact your hosting provider ...


1

You don't say what VPN software you are using. This comes down to a routing issue. Here's something to get you started from the Linux Advanced Routing and Traffic Control Howto: http://lartc.org/howto/lartc.rpdb.multiple-links.html Under OpenVPN, you can do this on the client side or server side. On the client: redirect-gateway def1 allow-pull-fqdn ...



Top 50 recent answers are included