A firewall is a program that controls the incoming and outgoing network traffic on a system. Use this tag for all questions related to firewall configuration and operation.

learn more… | top users | synonyms

1
vote
0answers
9 views

DD WRT restrict access but exclude subdomain

I know it's possible to restrict access to some websites in Access restrictions section. I'd like to know if it possible to exclude from restriction subdomain of a site. For example: ...
0
votes
1answer
22 views

Understanding Iptables rules to prevent DDoS

Following IPTables rules exist on my system as some preventive measures against DDoS attacks -A INPUT -s 255.0.0.0/8 -j LOG --log-prefix "Spoofed source IP" -A INPUT -s 255.0.0.0/8 -j DROP -A INPUT ...
0
votes
1answer
24 views

iptables connection mark not balance

The following is my network topology: + + | | | | | | | ...
1
vote
0answers
40 views

Why fail2ban doesn't put some IP address in jail

This is several days ago, I observed some IP addresses was't banned by fail2ban, and continued to brute force attack on different port of ssh. This an extract of my logwatch: undef: 22 times a ...
0
votes
1answer
39 views

How do I make sure the iptables is closed?

I want to disable iptables completely. I followed the instruction like /etc/init.d/iptables close it said there No such file or directory [root@dataapp02 tmp]# service iptables stop Redirecting ...
3
votes
3answers
58 views

IPtables installation question

I am new to installing iptables and have an excellent book called "Linux Firewalls: Attack Detection and Response" by Michael Rash. I have a few questions before I begin. I want to make an ...
0
votes
0answers
25 views

Unable to access http server when ufw is running, on Raspbian?

I have a Raspberry Pi running Raspbian, with Apache2 for the web server. Some recent change seems to have broken my ability to access my web server, when ufw is running. The server simply doesn't ...
0
votes
2answers
47 views

Packet flow in a virtual bridge with two interfaces, centos 7

I am struggling to create a bridge firewall with iptables since I cannot find/catch packets flowing through a bridge with two interfaces in centos7. No ip addresses are configured on interfaces or the ...
3
votes
1answer
61 views

What ports need to be open on a firewall to access the internet?

Let's say as the example that I have a firewall that blocks ALL ports from all sources/destinations. What ports would I need to open to be able to successfully run: ping google.com ...and are ...
0
votes
0answers
12 views

pcfl - Allow ssh for an specific IP

I'm working with pfctl on Mac OS X. Im trying to make a policy/anchor what blocks SSH for ALL ips, minus specific ip. I try this: pass in on fxp0 proto tcp from any to any port < 22 flags S/SA ...
0
votes
2answers
44 views

Access to the internet from a firewalled server

I'm trying to set up a test Docker platform at work. I need pull images, but can't do so because the test server does not have direct internet access (firewalled). There is another server that can ...
0
votes
3answers
40 views

iptables: block all inbound traffic over a certain port number

It is possible using iptables (on Debian) to block all inbound connections for all the ports with a port number over (as an example) 16000. Like this (using 16000 as reference): The port 15999 is ...
3
votes
1answer
18 views

What does the “Incoming” option refer to in ufw?

I am configuring a firewall on my Linux Mint 17.2 to maximize security, mainly to put my mind at rest that no one will be able to do anything malicious. In gufw, there are options for allowing or ...
0
votes
0answers
29 views

How to firewall qemu/kvm guest in host machine?

I have a qemu guest with following network topology: Internet <-> eth1.96[bridge]tap96 <-> eth0[guest] I need to allow access to guest machine only from one specific /24 network and I ...
1
vote
1answer
52 views

Iptables rules doesn't work as expected

I need to block access to my server from the outside of my private network. I need to allow pings from my server out only to my private network and answer pings initiated from my private network as ...
1
vote
0answers
49 views

How to block access to “private” host-only network from VirtualBox nat interface (separate host-only networks)?

Scenario: 1 VirtualBox host with many vms. Different host-only networks are configured for different vm categories: Some vms are "private", others are "standard" vms. Most of these vms, including some ...
0
votes
1answer
56 views

Block incoming ssh with a reply message

I want to block all the incoming ssh to my system from a particular set of ips and send them a typical message saying something of sort: You don't have permissions to access this server as the ...
0
votes
0answers
13 views

Adding IP Blocklists to OSSEC

I've been reading through some documentations for OSSEC trying to learn some new tricks and such to make it more effective, and what I got really interested was looking into was seeing if it's ...
3
votes
1answer
137 views

Debian-Jessie: How do you check iptables status?

In old sysvinit I would just do service iptables status and see if it was running or not. But in newer Debian-Jessie I grep for iptables in the list of services and don't see iptables listed ...
1
vote
3answers
80 views

preventing dos attack in apache webserver

This is the version of apache we're using - httpd-2.2.15-39.el6.centos.x86_64 We recently had our website down due to DoS attack and hence started exploring iptables, and how to use it to prevent DoS ...
1
vote
1answer
92 views

iptables rule explanation

I was looking to update iptables in our webserver which would prevent DoS attack to an extent. 1) Related to web traffic, below are the iptables rules i found. iptables -I INPUT -p tcp --dport 80 ...
0
votes
0answers
49 views

Which iptables chain does a new stream created by TEE go to?

Where do packets go after being created by the TEE target? I am working on mirroring some traffic that needs to go to multiple computers on my network. So what happens to both streams after using ...
2
votes
2answers
97 views

Traffic of specific program through vpn [duplicate]

is it possible to only let the traffic of Deluge through a VPN (OpenVPN) and the other traffic not with iptables? Kind regards
0
votes
0answers
109 views

Is there a local “firewall” to block by “X-Forwarded-For” IPs behind the reverse proxies?

The situation is quite typical. I'm using CentOS + Apache(s) behind a Load-balancer for the WebSites. At this point, let's assume i don't have any access to the Load-balancer (or) let's forget ...
1
vote
0answers
41 views

How to limit the number of connections per-host passing through a router/bridge?

For some reasons, our Internet provider has a limitation on the number of simultaneous opened connections between the machines hosted in our private network and the Internet which is around 4000 ...
3
votes
1answer
246 views

Block all internet connections unless connected to OpenVPN server

I want to block all internet connections unless I'm connected to my OpenVPN. Now of course, I need to allow connection to the VPN server. Can this be done, by allowing out/in traffic to/from the VPN ...
1
vote
1answer
91 views

Debian Jessie server has no internet access

I have a server running Debian 8 Jessie that constantly loses it's internet access for seemingly no reason. The server has two wired connections, the internet access is on eth0 and the internal ...
1
vote
1answer
120 views

UFW rules to allow specific behaviour

I'm new to UFW. One of our servers were compromised and I had to immediately: Deny all inbound. Deny all outbound. Allow all SSH. Allow outbound DNS. Allow Git clone, push, pull, etc. Allow only ...
2
votes
2answers
98 views

Block Internet access, but not network access for a user

Hi I would like to block one user on all of the linux machines (Debian Wheezy) from being able to surf the internet, chat and email. However they are using linux based Rip stations for large format ...
1
vote
1answer
18 views

UFW: Allow traffic only from a dynamic IP on its last 2 elements

I am trying to setup the following rule on ufw: ufw allow from 217.87.123.0/24 So to allow incoming connections from all 217.87.123.* addresses. The problem is that my IP does not always start ...
0
votes
1answer
23 views

IP tables - how to configure connections into my compuer

I have a problem with following thing: Foreign connection is connection initialized not by my computer. I would like to accept only foreign connection such that port is 22 or from interval [1000, ...
4
votes
1answer
89 views

Is libvirt dnsmasq exposed to the network, if I run Fedora without a firewall?

There's this nice saying from Ubuntu: no open ports on the default install. Other Linux OS's look the same, including Fedora. No-one wants to worry about firewalls, if they don't need to. Yuck, ...
0
votes
0answers
42 views

Linux: Building our own firewall box?

I'm actually on AWS Cloud, but sick of their limitations of IP Blocking feature given in Network ACLs there. Because Network ACLs can "BLOCK" by IP but they have rule limitations. So i came to think ...
1
vote
0answers
33 views

What puts TCPMSS in iptables?

I used to have (well, I still sort of do) have a script that expects: -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu to have been entered in to iptables ahead of my ...
1
vote
1answer
70 views

Firewalling Samba

at the moment I'm trying to implement the firewall for my linux file server. Everything is working as expected except form the samba server. I have searched through the internet already but non of the ...
0
votes
0answers
94 views

IPTables if more than 30 connection in 1 minute ban IP for 1 hour?

I am trying to setup a firewall that limits to 3 connections per IP and also ban the IP for an hour if > 30 connection attempts in one minute. Is this all possible with iptables? So far I have only ...
6
votes
1answer
37 views

connlimit counters start over after iptables restored

I have a connlimit rule in iptables that allow only 5 connection to port 80. iptables -A FORWARD -p tcp -m tcp --syn --dport 80 -m connlimit --connlimit-above 5 --connlimit-saddr -j DROP This ...
0
votes
1answer
51 views

Can Shorewall be used on VyOS?

Will VyOS still work right if I install Shorewall-lite on it? Shorewall seems like an easier way to setup a network, but VyOS seems pretty great for day-to-day management of a router / firewall. So ...
0
votes
0answers
212 views

string matching not working in iptables

We have a RHEL 6.7 DNS server and we are trying to discard packets that contain certain domains. For example, one of our DNS servers was involved in a random subdomain attack, where external hosts or ...
1
vote
1answer
16 views

ip_conntrack_max test not working

I am trying to do some ip_conntrack_max kernel parameter testing, but somehow its not working. -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT I have set following value to see its filling ...
0
votes
0answers
9 views

how to safely increate ip_conntrack value

How do i calculate how much memory my single ip_conntrack connection will eat? I am planning to increate ip_conntrack on system but i want to be careful to not overcommit number. Is that any basic ...
0
votes
2answers
63 views

Is UFW behind a firewall(ed) gateway router necessary

Is it really necessary to run UFW behind my Gateway Router which already has Firewall/Port rules? In this example, I am discussing running UFW on an Internet Accessible (Linux) Server that is behind ...
1
vote
0answers
456 views

pfsense: squid transparent proxy not working in bridge mode

I have installed the latest version of pfsense. I have setup it up in bridge mode after creating a rule any for lan and wan respectively. I have setup the squid on transparent proxy mode with ssl ...
1
vote
1answer
99 views

ipset v4.5: Unknown set type

I compiled ipset on CentOS5 32bit machine and i am getting weird errors My kernel: [root@localhost ipset-4.5]# uname -a Linux localhost.localdomain 2.6.18-400.1.1.el5 #1 SMP Thu Dec 18 00:58:32 EST ...
0
votes
1answer
103 views

In what order are the rules handled in the Linux Firewall Module in webmin?

If I'm not mistaken it's top to bottom correct? And the catch-all default action at the end is to just drop any packets that don't match the rules above. Should I be logging the dropped packets as ...
1
vote
1answer
144 views

ufw allow ssh - and then connection gets lost

I'm trying to set up a debian server in the cloud, over SSH. I log in using a key. After the initial startup I want to set UFW: apt-get install ufw ufw allow ssh ufw enable This is how I've done ...
1
vote
1answer
28 views

Basic Hosting Postgresql in Virtualbox + Ubuntu 14.04

I have configured Postgres to accept network connections from anywhere: In pg_hga.conf: host all all 0.0.0.0/0 md5 In postgresql.conf: listen_addresses = ...
-3
votes
1answer
50 views

i have problem with firewall this question like this: [closed]

configure packet filtering firewall to allow DNS, HTTPS from outside to server configure PAT for HTTP using port 8080 from outside to server deny all other services and i have problem like this ...
0
votes
1answer
918 views

Connection refused on port 8081 using curl

I have two CentOS 7 boxes, called Turbo and Demo. I started a daemon/service on the first one, Turbo, and wish to call the service from the second one, Demo. I started the service to monitor port ...
0
votes
1answer
81 views

Iptables: does dropping UDP packets take place in the user-space or kernel-space?

I know that Iptables is a user-space module, I also read it "configures" kernel modules to do big part of the filtering. So my question is, if I add a rule to allow only TCP:443 packets, would this be ...