Questions tagged [traffic-filtering]

Traffic filtering allows a device to apply security restrictions to network traffic. Filtering can be done on many levels but the most common are TCP, UDP and IP filtering.

Filter by
Sorted by
Tagged with
0
votes
1answer
33 views

Corruption using linux traffic control (tc command)

I am kinda new to doing traffic control using Linux tc commands. So i am doing some hands-on on introducing network delay, packet loss and corruption etc across two hosts in the same network. The ...
0
votes
0answers
11 views

Squid: Block url within allowed domain

I'm using Squid as a whitelist filter: acl white_list dstdomain "/etc/squid/filter_whitelist.txt" http_access allow white_list http_access block all filter_whitelist.txt contains .archlinux.org I ...
1
vote
3answers
72 views

Weird TCP/IP behavior on Linux server as well as enterprise Firewall on port 21

This is a tricky one. TL;DR: 1) Client establishes TCP handshake with the firewall on (closed/unavailable) port 21, even though firewall does not respond to client's SYN packet. 2) Client ...
0
votes
0answers
42 views

Windows 10 firewall block outbound policy (AOVPN)

Anyone ever manage to put together a working windows firewall policy to block outbound traffic to private & public networks on Windows 10? We're working on Always On VPN, using a device tunnel &...
0
votes
1answer
37 views

Filter/Analyze virtual machine traffic on another physical machine

Consider a host machine running multiple virtual machines. Hypervisor is most likely KVM with libvirt. The host machine should be connected to some firewall or switch for filtering/analyzing traffic. ...
1
vote
1answer
206 views

haproxy http check with a backup server shows 503 at main server down

I have been trying to setup a forward with haproxy. listen POC-2019-02-03 bind 0.0.0.0:8083 timeout connect 14000 timeout client 180000 timeout server 180000 mode http ...
0
votes
1answer
171 views

Filter traffic from IPv4 to IPv6 and vice versa

I've tried to filter (using nftables, but I'm open for a change if it works using iptables) traffic coming from an IPv4 network to an IPv6 network, but can't figure out how to do it. Suppose I have a ...
-2
votes
1answer
62 views

What is the ideal Windows Update / backup device for a LAN with a slow metered internet connection

I was just in Kenya for several weeks helping some wildlife conservation orgs with their computers and IT. The biggest issue (aside from not enough funds to update tech as often as they should) is ...
2
votes
2answers
3k views

Limit packet rate, open connections, and IP addresses

On Linux, can I use tools like tc, iptables or others to control/shape network traffic on a network interface, for the following purposes: Control the network packet number rate (or the total number)....
-5
votes
2answers
62 views

Trying to understand something [closed]

So I'm trying to figure something out, if I receive UDP traffic to my server from another server I can't really block it, like the iptables it's just blocking the traffic to being processed, but I ...
0
votes
2answers
59 views

How to make a IP Address Connecting to your DNS Server use another DNS Server with Conditions

As you can see, the Title is quite a mouthful but i don't exactly know what to call it but what it is.. PC1 (External):PC2 (Local): IP: 41.1.2.3 DNS: 168.5.5.5 IP: 41.4.4.5 DNS: 168.5.5.5 ...
0
votes
1answer
382 views

Send received mirrored traffic using iptables to docker application?

I have a setup that receives mirrored traffic from many IP addresses on my network card (eth0). I wanted to send the received packets destined to a particular IP address(say 8.8.8.8) to a docker ...
0
votes
1answer
294 views

filter with iptables incoming fraffic from VPN

I have set up a VPN to a private service provider via OpenVPN. This setup is using the VPN as default gateway. It all works fine but when I try to apply some basic iptables rules to filter traffic in ...
0
votes
1answer
342 views

How to allow data quotas using nDPI netfiltering

I am trying to allow a certain data quota for a user using nDPI netfiltering. This is the command I used for checking it. iptables -A INPUT -m ndpi --quota 2048 -j DROP Result is iptables v1.6.0: ...
0
votes
2answers
167 views

Inspecting TLS/SSL passing in/out of a network without specialised device?

At the moment I'm managing a small home office setup - a few PCs and a soft open source x86 *nix based router. I'd like to move traffic scanning / inspection onto an edge device. The motive is to ...
1
vote
1answer
294 views

traffic shaping using ifb redirect

I would like to use ifb to perform some shaping for multiple virtual interfaces. However, I am not sure how to tell the ifb interface to egress to a dedicated egress interface Right now vnet0 -> ...
0
votes
1answer
1k views

How to filter request using IP restrictions OR a filtering rule

We have an IIS site right now that has an allow list for a specific list of IP addresses, and all other IPs denied by default. We want to add another rule, that states that if the request coming in as ...
0
votes
1answer
387 views

Spam Traffic, DDOS Attack & Server Crashing

I am running phpfox application in my server under my main domain name fetlock.com and I am getting large amount of spam and also suffering from DDOS attacks from multiple IP addresses. My server ...
0
votes
0answers
664 views

Trouble using net_cls control group in tandem with tc for packet filtering

I'm having some trouble limiting network bandwidth using the net_cls control group in conjunction with the linux traffic controller (tc). I think I might just be confused about how I'm writing the ...
2
votes
2answers
294 views

How to stop a site from redirecting to yours?

One of our competitors recently shut down. Instead of just taking their site down, they decided to redirect all their traffic to us with a 302 redirect. All of the traffic is redirected to us with the ...
2
votes
2answers
1k views

Rejecting traffic where ACCEPT header is empty on favicon.ico requests

As part of filtering out potential harmful traffic, I currently reject traffic where $_SERVER["HTTP_ACCEPT"] is empty. I notice from my logs that a fair number of requests have been rejected due to ...
6
votes
1answer
171 views

Tools for detecting network traffic filtering [closed]

In Iran we have an ongoing problem with the govt. blocking and manipulating various network protocols. I'm looking for a tool, framework or platform to help us analyze and report on any of these ...
0
votes
1answer
278 views

Managed switches and WFilter

we are looking to use WFilter to monitor workstation traffic, it looks like we need a router or switch that does port mirroring, now would that mean we need a managed switch? And if so, would all the ...
0
votes
1answer
106 views

Security risks of allowing incoming traffic as a response of a previous request

I understand that somebody would want to block incoming traffic as a general rule except for public resources. And I also understand that you could want to block all outgoing traffic except for ...
0
votes
2answers
60 views

Web filtering choices [closed]

I'm in the process of starting up my own business and I would like to know when it comes to web content filtering what are my options? I can honestly admit I'm looking for a more user friendly system ...
2
votes
1answer
496 views

What is the purpose of filtering egressing traffic (CSF)?

For a while now I am using CSF as main firewall with LFD, and OSSEC as main IDS. (I like OSSEC over the overreacting builtin IDS of CSF). I tested it for small DoS attacks such a slowloris variants ...
1
vote
2answers
3k views

plesk + high POP3/IMAP traffic, how to check details?

Please check this image, it's a screenshot from plesk 10 of 1 domains mail traffic: This domain has about 1GB POP3/IMAP (OUT) traffic each day. I know that this is not normal because I know the owner ...
2
votes
1answer
4k views

Linux income filtering based on private destination IP address

I am trying to set up a QoS script in my OpenWRT box so that traffic coming from the Internet is classified into a low prio and a high prio class. The criteria to classify traffic is its destination ...
3
votes
1answer
4k views

Ingress filtering in Linux traffic control: Redirect traffic to IFB device

I have an openwrt router and I want to shape incoming traffic in order to classify all the traffic addressed to a certain IP address in my home network as low priority. For that purpose I want to ...
-3
votes
1answer
3k views

How to get Comcast to stop blocking me? [closed]

I am a web developer running a demo server at home. My site is accessible from Atlanta as well as via my local cellular network. However, both a webserver I have in Utah and a webserver of a service ...
3
votes
4answers
2k views

Is there a good way to keep IPv6 multicast packets off WiFi?

I work on a product that consists of a number of headless Linux boxes that work together as a cluster. These boxes synchronize their state with each other by sending proprietary-format link-local IPv6 ...
2
votes
2answers
380 views

What is 17.10.13.204 (Apple?) doing that's always blocked as port-scanning traffic?

I've just recently noticed an IP address that has been showing up in our SonicWall logs on a pretty frequent basis. Throughout the course of an average day, we'll see around 100 dropped packets ...
1
vote
5answers
229 views

Barring connections if VPN is down

I have a VPN account and use it for sensitive communication. However the VPN connection sometimes is dropped while my main connection to the internet is still alive. The pages I visit through VPN are ...
1
vote
3answers
12k views

Cisco IOS router MAC or IP address filtering

I'm trying to filter a specific device from my network. Either MAC or IP address filtering would do the trick, but I have trouble finding the exact Cisco IOS commands to use. My router is a Cisco 870 ...
2
votes
2answers
7k views

Cisco ASA not forwarding traffic from one interface to another

I am needing help in the configuration process of my Cisco ASA 5510. I have set up 4 Cisco ASA interconnected together via a big LAN. Each Cisco ASA has 3 or 4 LANs attached to them. The IP routing ...
1
vote
3answers
503 views

Unexpected ports open (traffic filtering?)

Discovered this when securing my VPS. No matter which host I scan with nmap, I always get these 2 ports open: 1863/tcp open unknown 5190/tcp open aol What could be the reasons for this? EDIT: I'm ...