Questions tagged [firewall]
A Firewall is an application or hardware device used to inspect and filter network traffic.
244
questions
196
votes
22
answers
111k
views
Is it normal to get hundreds of break-in attempts per day?
I just checked my server's /var/log/auth.log and found that I'm getting over 500 failed password/break-in attempt notifications per day! My site is small, and its URL is obscure. Is this normal? ...
- 1,537
60
votes
8
answers
8k
views
Why would I need a firewall if my server is well configured?
I admin a handful of cloud-based (VPS) servers for the company I work for.
The servers are minimal ubuntu installs that run bits of LAMP stacks / inbound data collection (rsync). The data is large ...
- 1,169
60
votes
5
answers
98k
views
iptables port redirect not working for localhost
I want to redirect all traffic from port 443 to the internal port 8080. I'm using this config for iptables:
iptables -t nat -I PREROUTING --source 0/0 --destination 0/0 -p tcp \
--dport 443 -...
- 601
110
votes
20
answers
31k
views
Why should I firewall servers?
PLEASE NOTE: I'm not interested in making this into a flame war! I understand that many people have strongly-held beliefs about this subject, in no small part because they've put a lot of effort into ...
- 5,362
85
votes
2
answers
234k
views
How to open port for a specific IP address with firewall-cmd on CentOS? [duplicate]
I would like to open port 4567 for the IP address 1.2.3.4 with the firewall-cmd command on a CentOS 7.1 server.
How can I achieve this, as the documentation I could find was too specific on this?
- 953
121
votes
7
answers
212k
views
REJECT vs DROP when using iptables
Is there any reason why I would want to have
iptables -A INPUT -j REJECT
instead of
iptables -A INPUT -j DROP
- 12.1k
62
votes
18
answers
45k
views
iptables Tips & Tricks [closed]
I'm sure Linux sysadmins are quite familiar with iptables, the userland interface to the netfilter packet-filtering framework.
Now, this "Question" is meant to be a Community Wiki for collecting ...
57
votes
10
answers
40k
views
Why not block ICMP?
I think I almost have my iptables setup complete on my CentOS 5.3 system. Here is my script...
# Establish a clean slate
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
...
- 2,439
105
votes
7
answers
115k
views
SSH from A through B to C, using private key on B [closed]
I'm looking for a simple way to SSH from my local machine, A, through a proxy, B, to a destination host, C. The private key that goes with the public key on C is on B, and I can't put that key on my ...
- 3,190
2
votes
3
answers
4k
views
Assert if a port is open to host, LAN, or the Internet
I can check if a port is open using the following command, though this does not tell me if this port is reachable on the running machine only (host), from the LAN only, or open to the Internet.
...
- 123
66
votes
8
answers
62k
views
What steps do you take to secure a Debian server? [closed]
I am installing a Debian server which is connected directly to the Internet. Obviously I want to make it as secure as possible. I would like you guys/gals to add your ideas to secure it and what ...
44
votes
2
answers
90k
views
Can I use ufw to setup a port forward?
Im currently using ufw to enforce some basic firewall rules. Is it possible to also use ufw to do port forwarding?
Specifically im wanting to forward incoming traffic to my server (same machine ...
- 511
40
votes
1
answer
44k
views
Will tcpdump see packets that are being dropped by iptables?
I have a firewall with these simple rules:
iptables -A INPUT -p tcp -s 127.0.0.1/32 --dport 6000 -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.16.20/32 --dport 6000 -j ACCEPT
iptables -A INPUT -p tcp ...
- 1,144
150
votes
11
answers
499k
views
best way to clear all iptables rules
I currently have this snippet:
# flush all chains
iptables -F
iptables -t nat -F
iptables -t mangle -F
# delete all chains
iptables -X
Is there a possibility that some impervious rule will stay ...
- 2,041
35
votes
7
answers
361k
views
What firewall ports do I need to open when using FTPS?
I need to access an FTPS server (vsftpd) on a vendor's site. The vendor has a firewall in front of the ftps server. I have a firewall in front of my FTPS client.
I understand that ports 990, 991 and ...
user3293
25
votes
3
answers
31k
views
Debugging iptables and common firewall pitfalls?
This is a proposed Canonical Question about understanding and debugging the software firewall on Linux systems.
In response to EEAA's answer and @Shog's comment that we need a suitable canonical Q&...
- 81.7k
2
votes
1
answer
3k
views
SMTP 25 closed even though I allow everything in firewall (Debian server running sendmail)
I am running sendmail + dovecot in my Debian server. I have enabled the firewall rules to allow everything:
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
...
- 143
310
votes
17
answers
773k
views
How to Unban an IP properly with Fail2Ban
I'm using Fail2Ban on a server and I'm wondering how to unban an IP properly.
I know I can work with IPTables directly: iptables -D fail2ban-ssh <number>
But is there not a way to do it with ...
- 3,363
62
votes
5
answers
9k
views
I accidentaly forbid SSH connection to a remote server... What's next?
Let's say it again, we all make mistakes, and I have just made one.
A brief history: I was doing some stuff on a VPS (Debian) I'm renting, when I noticed some strange behaviour. Using the netstat ...
- 621
56
votes
3
answers
132k
views
Ubuntu ufw: set a rule on a per interface basis
I want to create a rule that allows anyone on eth1 to access port 80. Can UFW do this or should I go back to using Shorewall?
To clarify: this is a capabilties question, can ufw handle interfaces as ...
- 4,870
20
votes
2
answers
19k
views
Why is our firewall (Ubuntu 8.04) rejecting the final packet (FIN, ACK, PSH) with a RST
Background, for a long time we have had problems with our firewall that sometimes keep HTTP requests hanging partially loaded until TCP times out.
After tracing the traffic on the firewall I noticed ...
- 307
13
votes
10
answers
5k
views
Why buy high end hardware firewalls?
There exist firewalls from Juniper and Cisco that cost more than a house.
So I wonder: what does one get from a $10.000+ firewall compared to an 2U server with 4x 10Gbit network cards running e.g. ...
- 10.6k
8
votes
4
answers
12k
views
What to do with an out-of-warranty Barracuda Spam/Web filter?
I'm working with an organization that would like to start using a old Barracuda Spam Filter 300 unit. I've sold and configured plenty of these, but was surprised to see that this unit's warranty ...
- 199k
78
votes
1
answer
147k
views
What is the difference between a Source NAT, Destination NAT and Masquerading?
What is the difference between a Source NAT, Destination NAT and Masquerading?
For example, I thought IP Masqurading was what they used to call it in Linux?
But what confuses me is that in our Astaro ...
- 14.7k
67
votes
2
answers
192k
views
iptables: difference between NEW, ESTABLISHED and RELATED packets
Part of a firewall on a server :
iptables -A INPUT -p tcp --dport 22 -m state NEW --state -m recent --set
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 100 --...
- 1,387
37
votes
6
answers
12k
views
Hardware Firewall Vs. Software Firewall (IP Tables, RHEL)
My hosting company says IPTables is useless and doesn't provide any protection. Is this a lie?
TL;DR
I have two, co-located servers. Yesterday my DC company contacted me to tell me that because I'm ...
user80776
25
votes
7
answers
60k
views
Enable Ping in Windows Server Firewall?
I've just installed Windows Server 2008 on a server and I'm able to connect through Remote Desktop but can't ping. Do I need to open an special port on the firewall to be able to ping a server?
- 889
21
votes
3
answers
87k
views
How to log the ip addresses trying to connect to a port?
Is it possible to log all IP addresses that trying to connect or connected to port "5901" in Linux Debian?
How can i do that?
- 387
5
votes
5
answers
12k
views
iptables port forwarding on debian
I'm trying to setup a simple port forwarding firewall and I can't make the basic non-firewall configuration to work. I have setup the iptables script as follows
#!/bin/sh
# interfaces
LAN="eth1"
...
- 539
4
votes
3
answers
5k
views
systemd-timesyncd requires incoming ephemeral ports opened
I'm trying to get some sort of time synchronization configured for a Ubuntu server. The server is behind a cloud-provider-stateless firewall. Through some trial and error I found out that in order for ...
- 219
128
votes
4
answers
1.0m
views
How to check if a port is blocked on a Windows machine?
On the Windows platform, what native options to I have to check if a port (3306, for example) on my local machine (as in localhost), is being blocked?
- 1,393
68
votes
4
answers
170k
views
Windows equivalent of iptables?
Dumb question:
Is there an equivalent of iptables on Windows? Could I install one via cygwin?
The real question: how can I accomplish on Windows what I can accomplish via iptables?
Just looking for ...
- 905
58
votes
6
answers
147k
views
iptables error: unknown option --dport
The command iptables no longer recognizes one of the most commonly used options when defining rules: --dport.
I get this error:
[root@dragonweyr /home/calyodelphi]# iptables -A INPUT --dport 7777 -j ...
- 691
27
votes
4
answers
83k
views
Windows Advanced Firewall: What does "Edge Traversal" mean?
this should be a really simple one:
In Advanced Windows Firewall on Windows Server 2008+, Properties > Advanced, what does "Edge Traversal" mean?
I Googled it, of course, and was unable to come up ...
- 2,283
26
votes
3
answers
101k
views
What does "incoming" and "outgoing" traffic mean?
I've seen many resources explaining how to set up a server's firewall to allow incoming and outgoing traffic on HTTP standard ports (80 and 443), but I can't figure out why I would need either of them....
- 363
16
votes
4
answers
19k
views
Hardware firewall vs VMware firewall appliance
We have a debate in our office going on whether it's necessary to get a hardware firewall or set up a virtual one on our VMWare cluster.
Our environment consists of 3 server nodes (16 cores w/ 64 GB ...
- 1,962
15
votes
7
answers
80k
views
What is an edge server / router / device?
What is an edge server? We see some references to them, but we never see a definition.
Some Student
13
votes
3
answers
11k
views
SSH from A through B to C, using private key on A
These is my scenario:
Host C is not accessible from A.
Host B is accessible from A.
Host C is accessible from B.
Both B and C have ~/.ssh/id_rsa.pub (from A) in authorized_keys
B does not have the ...
- 4,660
12
votes
23
answers
28k
views
Best practices to block social sites
In our company we have around 100 workstations with Internet access, and the day-to-day situation is getting worse and worse from the perspective of using
Internet access for the purpose of doing ...
7
votes
2
answers
42k
views
How do I forward/NAT all traffic to one interface/IP to a remote IP?
I have one "server A" that has multiple IPs attached to it, like so:
eth0:0 1.1.1.1
eth0:1 1.1.1.2
eth0:2 1.1.1.3
I have another "server B" that also has multiple IPs attached to it, like so:
eth0:...
- 670
5
votes
1
answer
13k
views
How can I rate limit SSH connections with iptables?
I'm trying to limit the number of possible SSH connections to my server but it just seems to lock me out every time. I'm not very familiar with iptables but I've been reading up on the rules that I ...
- 263
5
votes
3
answers
13k
views
Automatically block IP who requests certain URL
One of our client's PHPBB (surprise, surprise) got hacked. I have taken it down by simply changing the directory name for now however the address example.com/forum/* is still getting hits from ...
- 335
5
votes
8
answers
76k
views
Active FTP client blocked by Windows Firewall on Windows 7
I have an application that runs as a service and contains an FTP client. It needs to connect to an FTP server that only supports Active FTP. When I attempt to get a list of files or download a file, ...
- 151
4
votes
3
answers
6k
views
iptables REDIRECT works only for first packet
i need to redirect all UDP packets with destination port 15000 to port 15001 if the packet contains for example the string test. i have these two simple rules:
iptables -t nat -A PREROUTING -i eth0 -...
- 172
4
votes
2
answers
9k
views
socat connect-connect "proxy" two inbound TCP connections to expose a firewalled service?
I'm struggling a bit trying to see how to use socat (or a similar TCP port redirector) to expose a firewalled service on a PC.
Here's the scenario: I have a server PC which will be acting as a ...
- 276
4
votes
3
answers
3k
views
iptables -- OK, **now** am I doing it right?
This is a follow up to a previous question where I asked whether my iptables config is correct.
CentOS 5.3 system.
Intended result: block everything except ping, ssh, Apache, and SSL.
Based on ...
- 2,439
3
votes
2
answers
389
views
ipTables: How to improve the current set-up?
It took a lot of time and digging to get my ipTables working fairly well.
Current status: 'Works' w/ a noticeable, reproducible (almost unacceptable) delay on SSH connections. This delay goes away as ...
- 124
3
votes
3
answers
1k
views
Iptables rules with ! character
I have entered iptables rules to log a specific connection on our server, but it doesn't seem to be working as I want it to. Here are the rules:
1 LOG tcp -- !10.51.0.0/16 0.0.0.0/...
- 33
3
votes
1
answer
1k
views
Changed AWS EC2 firewall rule and locked out of ssh
I have an AWS EC2 instance using SLES15. I manually edited /etc/sysconfig/SuSEfirewall2 to open some ports. I messed up the FW_SERVICES_EXT_TCP because I thought I am adding on top of what's already ...
- 155
2
votes
1
answer
3k
views
How to Deploy an ASP.NET Web API- and Browser-based Application to a Production Environment [closed]
(Please forgive if this is posted in an incorrect forum. We didn’t know exactly where to post it.)
We have an ASP.NET Web API single page application - a browser-based app running in IIS to serve up ...
- 197