Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
4

Port 80: Port 80 needs to be open so that the Nginx can redirect to port 443. If you block port 80 clients trying to connect via http will time out. There is a website dedicated to argue that ICMP should not be blocked. ACK is the last step in the three-way handshake TCP uses to establish a connection. The port range 32768-65535 is for ephemeral ports. So ...


3

Docker opens ports in the firewall itself, for any ports that are EXPOSEd by the running containers. These do not show up in ufw output, but can be viewed in iptables. You should: Ensure that only ports that need to be accessible to the Internet are EXPOSEd. Use docker-compose to orchestrate the creation and running of multiple related containers. They can ...


2

Filtering output (local originated) packets isn't a common practice, better don't do it if you don't sure what you're doing exactly. To allow the outgoing dns (required by dns resolving) you should accept new state packets to 53 port in OUTPUT chain. iptables -A OUTPUT -p tcp --dport 53 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -p ...


2

To clarify up front: this isn't an answer to your question about nftables. It's to offer some other options. If you fully control the machine in question (i.e. there are no untrusted users who might produce malicious NTP queries), then there's no substantive difference to security by allowing outbound NTP to any server versus allowing access to only the ...


1

As has been said, you should be sure that blocking fragments is really your goal, and not a method you think is best for your goal, while better methods would exist. Anyway, for what it's worth you must: use a recent enough kernel. The feature was added in kernel 4.16. CentOS uses 3.10. While many features are backported (starting with nftables which isn't ...


1

We've changed the local IP address of the Barracuda Service and changed the Apaches listen ip from Listen 0.0.0.0:80 to Listen local.ip:80 The third thing we did was to uninstall iptables (maybe part of the problem) And it works!


Only top voted, non community-wiki answers of a minimum length are eligible