Questions tagged [traffic-filtering]
Traffic filtering allows a device to apply security restrictions to network traffic. Filtering can be done on many levels but the most common are TCP, UDP and IP filtering.
41
questions
0
votes
0
answers
134
views
Traffic Control - Searching clsact filters by parent ID
According to net, sched: add clsact qdisc you add filter on ingress and egress after adding clsact,e.g.
➜ tc qdisc add dev foo clsact
➜ tc qdisc show dev foo
➜ tc filter add dev foo ingress bpf ...
- 121
0
votes
0
answers
55
views
Block by IP via Linux Traffic Control
i have 2 PtP Interfaces and i am using TC to realize some simple Passthrough setup. I am mirroring the traffic from the incoming if to the outgoing if like so
tc filter add dev <ingress_if> ...
0
votes
1
answer
748
views
iptables rules to route a domain through a vpn interface and remaining traffic via default interface
I have a wireguard vpn connection to access certain private services hosted on private ec2 instances. But I want to be able to use my default internet connection for remaining traffic and only route ...
0
votes
1
answer
107
views
Is ingress filtering described in RFC2827 implemented in most routers? How does such implementation look like?
RFC 2827 describes the idea of ingress filtering that is meant to
deal with DOS attacks that utilize IP spoofing:
An input traffic filter on the ingress (input) link of "router 2", which ...
- 105
1
vote
0
answers
35
views
shape voice linux traffic using tc
How to set up a traffic control policy so voice traffic has maximum bandwidth of an specific interface?
I tried
tc qdisc add dev $WIFI handle 1: root tbf rate 10mbit burst 32kbit latency 10ms
but how ...
- 11
0
votes
1
answer
36
views
Traffic Filtering between Security Zones
I have an organization's network, containing 4 zones: inside, outside, DMZ1 and DMZ2.
DMZ1 contains external-facing servers - DNS, WEB and Mail servers. DMZ2 hosts internal servers- Radius, DHCP, ...
0
votes
1
answer
79
views
Strange traffic to Google Cloud VPS
I have one small project running on Google Cloud. And during last couple of weeks I notice serious unexpected traffic to it and (a bit surprisingly in 2020-ths) additional bills for it. The volume of ...
google-cloud-platform
0
votes
1
answer
1k
views
Corruption using linux traffic control (tc command)
I am kinda new to doing traffic control using Linux tc commands. So i am doing some hands-on on introducing network delay, packet loss and corruption etc across two hosts in the same network. The ...
- 1
1
vote
3
answers
318
views
Weird TCP/IP behavior on Linux server as well as enterprise Firewall on port 21
This is a tricky one.
TL;DR:
1) Client establishes TCP handshake with the firewall on
(closed/unavailable) port 21, even though firewall does not respond to
client's SYN packet.
2) Client ...
- 111
0
votes
1
answer
154
views
Filter/Analyze virtual machine traffic on another physical machine
Consider a host machine running multiple virtual machines. Hypervisor is most likely KVM with libvirt. The host machine should be connected to some firewall or switch for filtering/analyzing traffic. ...
1
vote
1
answer
444
views
haproxy http check with a backup server shows 503 at main server down
I have been trying to setup a forward with haproxy.
listen POC-2019-02-03
bind 0.0.0.0:8083
timeout connect 14000
timeout client 180000
timeout server 180000
mode http
...
- 113
0
votes
1
answer
415
views
Filter traffic from IPv4 to IPv6 and vice versa
I've tried to filter (using nftables, but I'm open for a change if it works using iptables) traffic coming from an IPv4 network to an IPv6 network, but can't figure out how to do it.
Suppose I have a ...
- 1
-2
votes
1
answer
71
views
What is the ideal Windows Update / backup device for a LAN with a slow metered internet connection
I was just in Kenya for several weeks helping some wildlife conservation orgs with their computers and IT. The biggest issue (aside from not enough funds to update tech as often as they should) is ...
- 105
2
votes
1
answer
6k
views
Limit packet rate, open connections, and IP addresses
On Linux, can I use tools like tc, iptables or others to control/shape network traffic on a network interface, for the following purposes:
Control the network packet number rate (or the total number)....
- 123
-5
votes
2
answers
70
views
Trying to understand something [closed]
So I'm trying to figure something out, if I receive UDP traffic to my server from another server I can't really block it, like the iptables it's just blocking the traffic to being processed, but I ...
0
votes
2
answers
72
views
How to make a IP Address Connecting to your DNS Server use another DNS Server with Conditions
As you can see, the Title is quite a mouthful but i don't exactly know what to call it but what it is..
PC1 (External):PC2 (Local):
IP: 41.1.2.3
DNS: 168.5.5.5
IP: 41.4.4.5
DNS: 168.5.5.5
...
- 1
0
votes
1
answer
632
views
Send received mirrored traffic using iptables to docker application?
I have a setup that receives mirrored traffic from many IP addresses on my network card (eth0).
I wanted to send the received packets destined to a particular IP address(say 8.8.8.8) to a docker ...
- 1
0
votes
1
answer
667
views
filter with iptables incoming fraffic from VPN
I have set up a VPN to a private service provider via OpenVPN.
This setup is using the VPN as default gateway.
It all works fine but when I try to apply some basic iptables rules to filter traffic in ...
- 105
0
votes
1
answer
415
views
How to allow data quotas using nDPI netfiltering
I am trying to allow a certain data quota for a user using nDPI netfiltering.
This is the command I used for checking it.
iptables -A INPUT -m ndpi --quota 2048 -j DROP
Result is
iptables v1.6.0: ...
0
votes
2
answers
469
views
Inspecting TLS/SSL passing in/out of a network without specialised device?
At the moment I'm managing a small home office setup - a few PCs and a soft open source x86 *nix based router. I'd like to move traffic scanning / inspection onto an edge device.
The motive is to ...
- 714
1
vote
1
answer
462
views
traffic shaping using ifb redirect
I would like to use ifb to perform some shaping for multiple virtual interfaces. However, I am not sure how to tell the ifb interface to egress to a dedicated egress interface
Right now vnet0 -> ...
- 115
0
votes
1
answer
1k
views
How to filter request using IP restrictions OR a filtering rule
We have an IIS site right now that has an allow list for a specific list of IP addresses, and all other IPs denied by default. We want to add another rule, that states that if the request coming in as ...
- 143
0
votes
1
answer
445
views
Spam Traffic, DDOS Attack & Server Crashing
I am running phpfox application in my server under my main domain name fetlock.com and I am getting large amount of spam and also suffering from DDOS attacks from multiple IP addresses. My server ...
- 1
0
votes
0
answers
802
views
Trouble using net_cls control group in tandem with tc for packet filtering
I'm having some trouble limiting network bandwidth using the net_cls control group in conjunction with the linux traffic controller (tc). I think I might just be confused about how I'm writing the ...
- 495
2
votes
2
answers
418
views
How to stop a site from redirecting to yours?
One of our competitors recently shut down. Instead of just taking their site down, they decided to redirect all their traffic to us with a 302 redirect. All of the traffic is redirected to us with the ...
- 639
2
votes
2
answers
1k
views
Rejecting traffic where ACCEPT header is empty on favicon.ico requests
As part of filtering out potential harmful traffic, I currently reject traffic where $_SERVER["HTTP_ACCEPT"] is empty.
I notice from my logs that a fair number of requests have been rejected due to ...
- 399
6
votes
1
answer
259
views
Tools for detecting network traffic filtering [closed]
In Iran we have an ongoing problem with the govt. blocking and manipulating various network protocols. I'm looking for a tool, framework or platform to help us analyze and report on any of these ...
- 63
0
votes
1
answer
281
views
Managed switches and WFilter
we are looking to use WFilter to monitor workstation traffic, it looks like we need a router or switch that does port mirroring, now would that mean we need a managed switch? And if so, would all the ...
- 245
0
votes
1
answer
203
views
Security risks of allowing incoming traffic as a response of a previous request
I understand that somebody would want to block incoming traffic as a general rule except for public resources. And I also understand that you could want to block all outgoing traffic except for ...
- 209
0
votes
2
answers
64
views
Web filtering choices [closed]
I'm in the process of starting up my own business and I would like to know when it comes to web content filtering what are my options? I can honestly admit I'm looking for a more user friendly system ...
2
votes
1
answer
526
views
What is the purpose of filtering egressing traffic (CSF)?
For a while now I am using CSF as main firewall with LFD, and OSSEC as main IDS. (I like OSSEC over the overreacting builtin IDS of CSF).
I tested it for small DoS attacks such a slowloris variants ...
- 23
1
vote
2
answers
4k
views
plesk + high POP3/IMAP traffic, how to check details?
Please check this image, it's a screenshot from plesk 10 of 1 domains mail traffic:
This domain has about 1GB POP3/IMAP (OUT) traffic each day. I know that this is not normal because I know the owner ...
- 165
2
votes
1
answer
4k
views
Linux income filtering based on private destination IP address
I am trying to set up a QoS script in my OpenWRT box so that traffic coming from the Internet is classified into a low prio and a high prio class. The criteria to classify traffic is its destination ...
- 301
3
votes
1
answer
5k
views
Ingress filtering in Linux traffic control: Redirect traffic to IFB device
I have an openwrt router and I want to shape incoming traffic in order to classify all the traffic addressed to a certain IP address in my home network as low priority. For that purpose I want to ...
- 301
-3
votes
1
answer
3k
views
How to get Comcast to stop blocking me? [closed]
I am a web developer running a demo server at home. My site is accessible from Atlanta as well as via my local cellular network. However, both a webserver I have in Utah and a webserver of a service ...
3
votes
4
answers
2k
views
Is there a good way to keep IPv6 multicast packets off WiFi?
I work on a product that consists of a number of headless Linux boxes that work together as a cluster.
These boxes synchronize their state with each other by sending proprietary-format link-local IPv6 ...
- 1,323
2
votes
2
answers
414
views
What is 17.10.13.204 (Apple?) doing that's always blocked as port-scanning traffic?
I've just recently noticed an IP address that has been showing up in our SonicWall logs on a pretty frequent basis. Throughout the course of an average day, we'll see around 100 dropped packets ...
- 356
1
vote
5
answers
278
views
Barring connections if VPN is down
I have a VPN account and use it for sensitive communication. However the VPN connection sometimes is dropped while my main connection to the internet is still alive.
The pages I visit through VPN are ...
- 311
1
vote
3
answers
12k
views
Cisco IOS router MAC or IP address filtering
I'm trying to filter a specific device from my network. Either MAC or IP address filtering would do the trick, but I have trouble finding the exact Cisco IOS commands to use. My router is a Cisco 870 ...
- 275
2
votes
2
answers
7k
views
Cisco ASA not forwarding traffic from one interface to another
I am needing help in the configuration process of my Cisco ASA 5510. I have set up 4 Cisco ASA interconnected together via a big LAN. Each Cisco ASA has 3 or 4 LANs attached to them. The IP routing ...
- 7,314
1
vote
3
answers
555
views
Unexpected ports open (traffic filtering?)
Discovered this when securing my VPS. No matter which host I scan with nmap, I always get these 2 ports open:
1863/tcp open unknown
5190/tcp open aol
What could be the reasons for this?
EDIT:
I'm ...
- 279