10 votes
Accepted

DigitalOcean Network Firewall allowing SSH connections on ports other than only 22

Services are listening on certain port, e.g. sshd on port 22 by default. It means that if there is ssh client request to establish connection on the port other than 22 it would not be heard by the ...
  • 179
7 votes

iptables - use service name or port number, IP-address or hostname?

The effect may not always be what the administrator expects. A little background: The netfilter modules in the linux kernel operate on IP packets. They mainly evaluate, process and/or modify the ...
  • 73.4k
7 votes

DigitalOcean Network Firewall allowing SSH connections on ports other than only 22

First of all, your ssh daemon is not listening on any port but 22. So noone can connect to it on a port different from port 22. For a connection to succeed, it has to be allowed by firewall, and ...
  • 5,168
4 votes

How to prevent being cut off a remote machine after a misconfiguration of a firewall playbook

A solution is to register a command using the at utility that will disable the firewall completely after a timeout period. And if the playbook successfully proceeds past the end, the command is ...
  • 521
4 votes

Firewall use-case on a server with no open ports?

Would the firewall's only purpose just to log attacks attempts, and possibly blocking them via Fail2Ban, or similar service? Defense in depth. Blocking everything incoming means that a single ...
  • 5,168
4 votes

Block IPs without receiving traffic

There's nothing you can do. You don't control the upstream infrastructure, so you can't drop packets before they reach you.
  • 5,168
3 votes
Accepted

Is a server firewall (i.e. UFW) necessary if a firewall is setup through the server provider?

A "host based firewall" is the more generic term for the firewall rules that you manage with UFW. They are complimentary with a "network firewall", which is configured ...
  • 5,520
3 votes

UFW comment existing rule?

I know this is a grave dig, but needing to do this myself lead to a much easier answer, so when someone else looks for this, they may benefit. This lead to a quick investigation of adding a faux rule ...
  • 405
3 votes

Redis cannot bind a specific ip address?

As far as I understand, the "bind" is like an "allow connections from this ip"but I might've misunderstood it. You have. The configuration file for redis is fairly self ...
  • 5,168
2 votes

Docker Swarm. Containers in one overlay network but on different nodes can't reach each other via tcp

I deployed my Docker Swarm cluster on multiple VMWare ESXi VMs and tried the solution @hattivatt suggested and it worked. However, this does not persist over reboot and additional effort was required ...
2 votes
Accepted

iptables list line numbers script iptables-save -bash: number-rules: command not found

You need to make sure number-rules is executable and then need to use ./ to execute it from the current working directory, as that's not in your path - so iptables -S | ./number-rules
  • 1,128
2 votes

CMD - Check if exist firewall rule, and add if not

I strongly suggest using PowerShell. There is a specific set of cmdlets for managing Windows Firewall, and it's a lot better environment for scripting. https://docs.microsoft.com/en-us/powershell/...
  • 69.3k
2 votes
Accepted

How can I tell (or prove) packets are being dropped by my router or my ISP?

It sounds like the problem is incorrectly configured hairpin NAT, which is something some SOHO routers automatically configure correctly and in others that requires specific routing and NAT rules. ...
  • 1,167
2 votes

Why does Test-NetConnection indicate connection can be made, but I cannot visit the site?

Clearly, the Test-NetConnection command did not produce accurate results, as the web browser was not able to reach github.com. That's not an accurate statement. Test-NetConnection did in fact make a ...
  • 109k
2 votes

Firewall rule for IAP traffic added but ssh for GCP server still not working

Upon looking around the GCP instance settings, I discovered the following: Check the status of firewall allowed traffic (sudo ufw status) In my case, only Nginx traffic is allowed. Allow traffic for ...
  • 41
2 votes

Firewall use-case on a server with no open ports?

If you have a public IP address then the machine is vulnerable to any mistakes. Install a new service that has ports open by default and you are immediately vulnerable. Accidentally open a port on an ...
2 votes
Accepted

Firewall Ports Domain Controller to Clients

You do not. Ports only need to be opened from Client to Server for Active Directory Authentication.
  • 499
2 votes

Why add "keep state" to pf firewall rules

Without examples or asking the people who create the configurations, at least two reasons might be copying known working configurations without understanding the configurations or a partial ...
  • 2,834
2 votes

Why add "keep state" to pf firewall rules

To complement Paul's answer - I looked this up from the OpenBSD pf documentation: The keep state option is the implicit default for all filter rules. Despite this, when specifying stateful options, ...
  • 345
2 votes
Accepted

Assert if a port is open to host, LAN, or the Internet

From the host itself you can not reliably check if an external firewall or security rule blocks access. Additionally an external check can’t easily distinguish between the server itself or a network ...
  • 73.4k
2 votes

Can UDP packets be RELATED to an established TCP connection?

If you want to find out what kind of traffic is being blocked, you can use tcpdump to see all the traffic, including what is being blocked. Without knowing what is being blocked, I think it is likely ...
  • 21
1 vote

Nginx not serving from port 80 and 443, but works on other ports

Fixed by using the solution from: https://unix.stackexchange.com/a/247952/532896 Although I'm still not sure what caused the iptables rules for ports 80 and 443 to disappear when UFW rules are still ...
1 vote

UFW on debian vps not working as expected

I fixed the issue by reviewing my system setup and found out that I am using IRedMail which automatically sets up nftables also Debian's default. So All I had to do was to configure nftables to my ...
1 vote
Accepted

what is the use of "remote(client) port" for inbound firewall rule?

There are many software and protocols where clients may request servers from fixed ports. What comes in my mind is the DNS, where client request (from port 53) a remote server (port 53). So a in-...
1 vote
Accepted

Shorewall: IPSet from blrules not applying

Your configuration snippets contain only the "from" rules, so the IPSets currently have effect only on the incoming connections. If you want to block outgoing packets as well, you need to ...
  • 6,945
1 vote
Accepted

How to stop rejection of DNS queries?

DISCLAIMER: I am not really experienced / familiar with firewalld, so my judgement / opinion might be biased / inaccurate. It's actually not very difficult to allow IP forwarding between two ...
  • 724
1 vote
Accepted

Does blocking all outgoing traffic on cloud instance lock me out?

Blocking all outgoing traffic won't lock you out. Outgoing traffic refers to connections that originate from the server and arrive somewhere else. As long as incoming traffic is allowed, you should be ...
1 vote
Accepted

Firewalld port forwarding fails

You probably need to add masquerading to your port forwarding (to apply SNAT along with the DNAT port-forward, so that 100.1.1.1 knows to respond back through your firewalld host). The simplest way to ...
1 vote
Accepted

How to block internet access for OpenVPN clients and restrict traffic to VPN network? (Installed with openvpn-install)

This can be achieved through the use of iptables, by blocking traffic headed from the OpenVPN network interface to the network interface with internet access. openvpn-install creates a few iptables ...
1 vote

Why does Test-NetConnection indicate connection can be made, but I cannot visit the site?

The two statements "the connection can be made" and "I am able to proceed with what I intend to do" are far from equivalent, and a simple TCP connection test like Test-...

Only top scored, non community-wiki answers of a minimum length are eligible