New answers tagged firewall
1
Your rule consider packets that enter the router via eth0, are routed to be output from wlan0 and are new from the point of the connection tracker.
What is new? It is basically not what is expected or assured or replied and so on. When packet travels connection tracker, it is searched in its state table. The table contains source and destination addresses ...
1
Nevermind, AWS Lightsail had automatically updated the Linux kernel. Therefor the wireguard-dkms module was out of date. The problem was not specific to Lightsail but rather a common issue when using the wireguard-dkms module.
To make wireguard work again, the headers for the new kernel version must be installed, so the wireguard-dkms module can be rebuild/...
0
As workaround I inserted rule in raw (or mangle) table:
firewall-cmd --direct --add-rule ipv4 mangle PREROUTING_direct 0 \
-m set --match-set ipsetname src -j DROP
This chain is before INPUT and as i have no FORWARD on this machine - it solves my problem.
1
You can insert an iptables rule with iptables -I parameter
So if you specify
iptables -I INPUT -j INPUT_direct
this rule will be inserted to to top.
If you specify it with a row numer:
iptables -I INPUT 2 -j INPUT_direct
it will be inserted as rule in line 2.
In order to move the rule:
Delete it first:
iptables -D INPUT -j INPUT_direct
Insert it to the top
...
0
The question isn't well-worded (maybe for non-English native) so I'm unsure if I understood the problem correctly. You can use either:
NLB to point to your instances then use the NLB name as the endpoint
Cloud Map discovery service to keep records up-to-date
lambda to update the records
VPN to securely expose DNS to certain subnet only
or...
0
If the Apache server is set up so that it is not Apache that deals with 404s, e.g. dynamic server or reverse proxy, these do not go to the error_log, so the apache-noscript filter is not the best solution. So a quick custom solution is an option. And by implementing one learns how to do it as often one may have a unique problem worth making the filter more ...
1
You could look into Cloudflare for Teams which can be used to enforce authentication based on your configured policies before allowing the connection to your origin server. The policies can include country.
Teams can be used for web application or also for other TCP based application such as SSH.
Here is a tutorial explaining the approach.
0
In the meantime I learned that one CAN mark packets (see, e.g., How to set mark on packet when forwarding it in nat prerouting table?), and also learned more about which iptables operations are applied when (https://www.digitalocean.com/community/tutorials/a-deep-dive-into-iptables-and-netfilter-architecture). With these the solution is straightforward:
in /...
0
I was re-reading my question after posting to make sure it was accurate and came up with an idea... It worked.
I adjusted the DD-WRT's external interfaces Subnet mask to a /30 or 255.255.255.252 so all of its external traffic would be sent to its egress and be dropped/ignored...
The DD-WRT WAN/External interface is now configured with
Address: 192.168.1.1
...
2
An AWS security group is just a firewall.
And the egress rule that allows everything simply allows your instances to make outgoing connections to anywhere.
If you make a connection between two instances, egress rules apply to the instance making the outgoing connection, and ingress rules apply to the instance receiving the incoming connection. These may be ...
0
You can skip the dummy interface and REDIRECT such traffic to the localhost IP address.
In the nat table:
-A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8080
Then you tell ufw to allow traffic to that port, but only destined to the localhost IP address.
sudo ufw allow to 127.0.0.1 port 8080 proto tcp
1
There are several ways to achieve your use case. With GCP product, you can use Cloud Armor for a location-based traffic filtering through its Web Application Firewall.
Here are several threads that can also help you on your use case:
https://stackoverflow.com/questions/23682114/google-app-engine-block-incoming-traffic-by-country
Relatively easy way to block ...
google-cloud-platform
1
This is a source of common confusion ...
TCP_IN allows all the ports listed, regardless of csf.allow (except the csf.allow rule is a deny rule)
So, if you really wanted to selectively allow access to a port, you would exclude it from TCP_IN of csf.conf ... and then have it in csf.allow
2
High Availability (most likely)
Cisco ASAs are commonly recommended in pairs for HA (High Availability) in Active/Standby. This is due to their typically critical nature in the network.
The decision for a single firewall is often the result of financial, design and risk considerations.
I concur with @BrandonXavier, this adds an additional layer of ...
0
It doesn't need to be blocked, if for example your INPUT/FORWARD/OUTPUT policy is drop by default.
You can easily check by adding following statement to your iptables to the router. I assume you have a PC within a local network
iptables -I FORWARD -s your.int.IP -p tcp --dport 3306 -j ACCEPT
and make sure your output policy also allows it
iptables -I ...
0
this should work like charm
netsh advfirewall firewall set rule name="my rule" new remoteip=157.60.0.67
0
I found some solution(s), thanks to a very nice person on the #firewalld IRC (kudos to @erig if you are reading this).
In version 0.9.x of Firewalld, developers have introduced "forward filtering" capabilities, which is exactly what I was looking for. However, as of 2020-02-03 it's sadly not well documented anywhere, and many distributions are ...
2
Had the same scenario. Found that packets from lo to docker0 were being blocked by CSF's OUTPUT ruleset.
Resolved by adding "docker0" to ETH_DEVICE_SKIP, which causes CSF to add a blanket ACCEPT rule to the INPUT and OUTPUT chains for this interface. This should not be a problem since AFAIK docker0 should never be bound to a physical interface, ...
1
Ok, trying to summarize here.
If you get no connection at all when trying to connect from a remote machine, then it's definitely a networking and/or firewall issue. Please note that being able to connect to the machine from itself doesn't necessarily mean you'll be able to do the same from the outside, because the connection can be blocked anywhere in the ...
0
I think this may be to do with network profiles. Try Get-NetConnectionProfile and see if the connections on the windows machine are public or private under "NetworkCategory". This is public/private relative to the network connections of machine itself not public/private relative to Azure.
To change the connection:
Set-NetConnectionProfile -Name &...
Top 50 recent answers are included
