113 votes
Accepted

SSH from A through B to C, using private key on B

Schematic: ssh ssh A ------> B ------> C ^ ^ using A's using B's ssh key ssh key Preconditions: A is running ssh-agent; A can access B; B can access C; A's ssh ...
  • 1,483
102 votes
Accepted

How to open port for a specific IP address with firewall-cmd on CentOS?

Try this command firewall-cmd --permanent --zone=public --add-rich-rule=' rule family="ipv4" source address="1.2.3.4/32" port protocol="tcp" port="4567" accept' Check the zone file later to ...
88 votes

How to Unban an IP properly with Fail2Ban

Example for SSH in interactive mode. type in bash: fail2ban-client -i then in interactive mode type read the status of a jail: status sshd you'll get: Status for the jail: ssh |- Filter | |- ...
  • 981
88 votes

How to open port for a specific IP address with firewall-cmd on CentOS?

Create a new zone to accommodate this configuration. FirewallD zones are defined by source addresses and by interfaces. firewall-cmd --new-zone=special --permanent firewall-cmd --reload firewall-cmd -...
60 votes

UFW Firewall Rules ordering?

If you're interested in reordering your UFW rules, this is one way to do it. $ sudo ufw status numbered To Action From -- ------ --...
60 votes

I accidentaly forbid SSH connection to a remote server... What's next?

There are several alternatives: See if they have IPMI / "KVM" / console access to the server which lets you control it as if you had a physical keyboard plugged into it. If they don't offer that, see ...
  • 973
47 votes

I accidentaly forbid SSH connection to a remote server... What's next?

If you have not yet saved the IPtables rule, you can reboot server on VPS (if available) and the rule should disappear.
  • 1,414
45 votes
Accepted

How to remove access to a port using firewall on Centos7?

Solution: Do not forget the --runtime-to-permanent $ firewall-cmd --zone=public --remove-port=10050/tcp $ firewall-cmd --runtime-to-permanent $ firewall-cmd --reload
  • 915
41 votes

In the output of `last`, what does suffix ".d" after an IP address mean?

59.224.XX.178.d is not an IP-address but a hostname, or rather part of it. Last tries to do a reverse lookup and stores both the resulting hostname and ip-address for the remote host. By default the ...
  • 73.4k
37 votes
Accepted

iptables show just one chain

I almost deleted this question. D'oh! From man iptables: -L, --list [chain] List all rules in the selected chain.
  • 1,051
36 votes
Accepted

UFW comment existing rule?

If you add exactly same rule, then the existing rule gets overwritten and comment is updated there. E.g.: recyber@linux:~$ sudo ufw allow from 10.0.0.0/24 to any port 1234 comment "Comment" Rule ...
  • 376
33 votes

How to check if a port is blocked on a Windows machine?

Since PowerShell 4.0 you can use the command Test-NetConnection If you want to test Port 3306 as in your example the command is Test-NetConnection -ComputerName localhost -Port 3306 TechNet Test-...
  • 1,085
32 votes

How to check if a port is blocked on a Windows machine?

NETSTAT will tell you if the port is listening but it will not tell you if the port is open to the outside world. What I mean by this is that NETSTAT may show that the 0.0.0.0 is LISTENING on port ...
  • 1,829
32 votes

Where does UFW (uncomplicated firewall) save command-line rules to?

Ubuntu 16.04 LTS /etc/ufw/user.rules Debian 9 /etc/ufw/user.rules In general, try: locate user.rules Should output something like: /etc/ufw/user.rules /usr/share/ufw/user.rules /usr/share/ufw/...
  • 425
32 votes
Accepted

How to ssh to a server which I can not directly reach?

You can use the following command to set up an SSH tunnel from the remote server to your local machine: $ ssh -f -N -R 1234:localhost:22 user@your_machine_ip When the tunnel is set up, you can ...
  • 36.1k
31 votes
Accepted

What Does a Layer 3,4 Firewall do that a Layer 7 Does Not?

It sounds like you're getting a bit of misleading jargon. The technical definitions for these types of firewalls are: Layer 3 firewalls (i.e. packet filtering firewalls) filter traffic based solely ...
30 votes

Which ports do I need to open in the firewall to use NFS?

I found useful directions for my problem on this page, but there was no easy to follow recipe. So here's my recipe. TL;DR - need to allow both nfs ports (111, 2049) and mountd port after fixing it. ...
  • 401
30 votes

I accidentaly forbid SSH connection to a remote server... What's next?

This is what human-staffed help lines are for. Call the service provider, and have one of their operators remove the rule for you.
  • 301
26 votes
Accepted

Debugging iptables and common firewall pitfalls?

In general: Viewing and modifying the firewall configuration requires administrator privileges (root) as does opening services in the restricted port number range. That means that you should either be ...
  • 73.4k
25 votes

iptables: difference between NEW, ESTABLISHED and RELATED packets

Asumming for both server and client a restrictive INPUT and open OUTPUT, i.e.: iptables -P INPUT DROP iptables -P OUTPUT ACCEPT And from iptables-extensions(8) over the example of FTP in active mode:...
25 votes

iptables error: unknown option --dport

Another possible solution is that you're forgetting to run as root. I just ran into this when using the debian tutorial $ iptables -t nat -p tcp -I PREROUTING --src 0/0 --dst 127.0.0.1 --dport 80 -j ...
23 votes
Accepted

Check ufw default policy action

Try ufw status verbose: root@cmp:~# ufw status verbose Status: active Logging: on (low) Default: deny (incoming), allow (outgoing), disabled (routed) New profiles: skip Now I change it to allow: ...
  • 9,802
23 votes

How to block mysterious remote requests?

It is hard to say what exactly is going on here. However you state: The request looks like my server is spending time serving or getting other pages content. This together with the "GET http://...
  • 17.4k
22 votes
Accepted

Relationship between bastion host and jump host

A Bastion host is a machine that is outside of your security zone. And is expected to be a weak point, and in need of additional security considerations. Because your security devices are technically ...
  • 5,577
21 votes
Accepted

AWS EC2 deny single ip address and allow all

The only way to deny sources/IP addresses is to use Network ACL's in the VPC. These operate like a firewall allowing or blocking traffic incoming to your subnet, and operate above the Securtiy group ...
  • 432
20 votes

How to install gpg keys from behind a firewall?

Something like gpg --keyserver hkp://p80.pool.sks-keyservers.net:80 \ --keyserver-options "timeout=40 http-proxy=$http_proxy" \ --recv-keys B0F4253373F8F6F510D42178520A9993A1C052F8 ...
  • 524
19 votes

Ufw and Iptables. Which is better and why?

I ain't afraid of no quake i mean firewall! [ref.1] TL;DR PART a simple image about pizza can answer sometimes many questions :) Take a good look at this picture, then read the text below: (IMAGE) ...
  • 340
18 votes

CentOS 7 Firewall Configuration

Here are some commands with descriptions below that I came across and were helpful firewall-cmd --state view status of firewalld service (systemctl status firewalld) firewall-cmd --zone=public --...
16 votes

Debugging iptables and common firewall pitfalls?

Iptables/Firewall "introduction" A Firewall is basically a policy-based network filter. Linux firewalls are built around Netfilter; the kernel's network packet processing framework which is made of ...
  • 3,359

Only top scored, non community-wiki answers of a minimum length are eligible