A firewall is a program that controls the incoming and outgoing network traffic on a system. Use this tag for all questions related to firewall configuration and operation.

learn more… | top users | synonyms

1
vote
0answers
10 views

Iptables restrict all, allow multiple specified users to destination port

This great answer tells me how to prohibit all users from connecting to remote host on specified (in this case 25) port, except one user: iptables -I OUTPUT -m owner ! --uid-owner postfix -m tcp -p ...
0
votes
1answer
13 views

UFW app based filtering

is there any filtering in ufw which works sort-of like win firewall? basically allowing me not only to create ip/port/proto based rules, but also to bind such limitations to specific executables ...
-1
votes
0answers
22 views

Iptables ports not open

I was set up iptables, I made some forward rules, but the ports are not open for remote acess for exemple. If I'm in the same network of firewall, the Forward rules work well. But if I try to access ...
1
vote
1answer
56 views

How would I limit connections to certain services, to be only accesed via a connection coming from a sub-domains?

I have a personall machine running Ubuntu 14.04.4 LTS. I use it to host a Teamspeak and a Minecraft server and also a website. I am trying to make sub-domains to only point to the right services. So ...
0
votes
0answers
14 views

WLAN with multiple unique users

Following use case: There are 6 holiday apartments which all use the same WLAN. After a preceding law case due to illegal downloads every apartment needs to be monitored for eventually following ...
1
vote
1answer
43 views

iptables configuration

I'm trying to setup iptables, the forward rules are workin fine, but the output rules are making problems. I Can't access internet from the hosts beheind the firewall neither the firewall server can ...
1
vote
1answer
26 views

Block countries based on IP in firewall

I would like to restrict visibility of my server from outside my country. I am connecting to my personal server always from one or two countries. Is there a way to block all the IPs coming from all ...
3
votes
0answers
41 views

Why “echo f” in the case of clearing conntrack table doesn't work on debian?

Many people don't clear the conntrack table when they want to reload their firewall rules. When you have some ESTABLISHED connections, all the sessions won't be affected when you add a rule that ...
0
votes
1answer
37 views

Shorewall 4-interface setup

I am trying to use shorewall on Arch to manage a setup with 2 local networks and 2 ISP connections. Ultimately I want traffic from local network 1 (192.168.1.0/24 interface enp5s0) to use ISP 1 (76. .....
2
votes
0answers
15 views

What are the most restrictive external firewall / DNS listening port settings I can have for my DNS server (internal clients only)

This question relates specifically to hardening the configuration of DNS, firewalls and at the limit, ntp. (not proxys, http access,vpn's or other services). This is about the externally-facing side ...
3
votes
1answer
45 views

Add route from internal network to external network

I am using a box running Arch as my router and firewall (with shorewall). Recently, I tried to add another network onto the system, which failed horribly. After putting everything back where it was ...
1
vote
0answers
11 views

DD WRT restrict access but exclude subdomain

I know it's possible to restrict access to some websites in Access restrictions section. I'd like to know if it possible to exclude from restriction subdomain of a site. For example: http://...
0
votes
1answer
29 views

Understanding Iptables rules to prevent DDoS

Following IPTables rules exist on my system as some preventive measures against DDoS attacks -A INPUT -s 255.0.0.0/8 -j LOG --log-prefix "Spoofed source IP" -A INPUT -s 255.0.0.0/8 -j DROP -A INPUT -...
0
votes
1answer
29 views

iptables connection mark not balance

The following is my network topology: + + | | | | | | | +-----------...
1
vote
0answers
48 views

Why fail2ban doesn't put some IP address in jail

This is several days ago, I observed some IP addresses was't banned by fail2ban, and continued to brute force attack on different port of ssh. This an extract of my logwatch: undef: 22 times a [...
0
votes
1answer
52 views

How do I make sure the iptables is closed?

I want to disable iptables completely. I followed the instruction like /etc/init.d/iptables close it said there No such file or directory [root@dataapp02 tmp]# service iptables stop Redirecting ...
3
votes
3answers
62 views

IPtables installation question

I am new to installing iptables and have an excellent book called "Linux Firewalls: Attack Detection and Response" by Michael Rash. I have a few questions before I begin. I want to make an ...
0
votes
0answers
33 views

Unable to access http server when ufw is running, on Raspbian?

I have a Raspberry Pi running Raspbian, with Apache2 for the web server. Some recent change seems to have broken my ability to access my web server, when ufw is running. The server simply doesn't ...
0
votes
2answers
78 views

Packet flow in a virtual bridge with two interfaces, centos 7

I am struggling to create a bridge firewall with iptables since I cannot find/catch packets flowing through a bridge with two interfaces in centos7. No ip addresses are configured on interfaces or the ...
3
votes
1answer
101 views

What ports need to be open on a firewall to access the internet?

Let's say as the example that I have a firewall that blocks ALL ports from all sources/destinations. What ports would I need to open to be able to successfully run: ping google.com ...and are ...
0
votes
0answers
12 views

pcfl - Allow ssh for an specific IP

I'm working with pfctl on Mac OS X. Im trying to make a policy/anchor what blocks SSH for ALL ips, minus specific ip. I try this: pass in on fxp0 proto tcp from any to any port < 22 flags S/SA ...
0
votes
2answers
46 views

Access to the internet from a firewalled server

I'm trying to set up a test Docker platform at work. I need pull images, but can't do so because the test server does not have direct internet access (firewalled). There is another server that can ...
0
votes
3answers
46 views

iptables: block all inbound traffic over a certain port number

It is possible using iptables (on Debian) to block all inbound connections for all the ports with a port number over (as an example) 16000. Like this (using 16000 as reference): The port 15999 is ...
4
votes
1answer
21 views

What does the “Incoming” option refer to in ufw?

I am configuring a firewall on my Linux Mint 17.2 to maximize security, mainly to put my mind at rest that no one will be able to do anything malicious. In gufw, there are options for allowing or ...
0
votes
0answers
33 views

How to firewall qemu/kvm guest in host machine?

I have a qemu guest with following network topology: Internet <-> eth1.96[bridge]tap96 <-> eth0[guest] I need to allow access to guest machine only from one specific /24 network and I ...
1
vote
1answer
63 views

Iptables rules doesn't work as expected

I need to block access to my server from the outside of my private network. I need to allow pings from my server out only to my private network and answer pings initiated from my private network as ...
1
vote
0answers
69 views

How to block access to “private” host-only network from VirtualBox nat interface (separate host-only networks)?

Scenario: 1 VirtualBox host with many vms. Different host-only networks are configured for different vm categories: Some vms are "private", others are "standard" vms. Most of these vms, including some ...
0
votes
1answer
58 views

Block incoming ssh with a reply message

I want to block all the incoming ssh to my system from a particular set of ips and send them a typical message saying something of sort: You don't have permissions to access this server as the ...
0
votes
0answers
13 views

Adding IP Blocklists to OSSEC

I've been reading through some documentations for OSSEC trying to learn some new tricks and such to make it more effective, and what I got really interested was looking into was seeing if it's ...
3
votes
1answer
228 views

Debian-Jessie: How do you check iptables status?

In old sysvinit I would just do service iptables status and see if it was running or not. But in newer Debian-Jessie I grep for iptables in the list of services and don't see iptables listed anywhere....
1
vote
3answers
95 views

preventing DoS attack in Apache webserver

This is the version of apache we're using - httpd-2.2.15-39.el6.centos.x86_64 We recently had our website down due to DoS attack and hence started exploring iptables, and how to use it to prevent DoS ...
1
vote
1answer
101 views

iptables rule explanation

I was looking to update iptables in our webserver which would prevent DoS attack to an extent. 1) Related to web traffic, below are the iptables rules i found. iptables -I INPUT -p tcp --dport 80 -...
0
votes
0answers
85 views

Which iptables chain does a new stream created by TEE go to?

Where do packets go after being created by the TEE target? I am working on mirroring some traffic that needs to go to multiple computers on my network. So what happens to both streams after using ...
2
votes
2answers
144 views

Traffic of specific program through vpn [duplicate]

is it possible to only let the traffic of Deluge through a VPN (OpenVPN) and the other traffic not with iptables? Kind regards
0
votes
0answers
123 views

Is there a local “firewall” to block by “X-Forwarded-For” IPs behind the reverse proxies?

The situation is quite typical. I'm using CentOS + Apache(s) behind a Load-balancer for the WebSites. At this point, let's assume i don't have any access to the Load-balancer (or) let's forget ...
1
vote
0answers
55 views

How to limit the number of connections per-host passing through a router/bridge?

For some reasons, our Internet provider has a limitation on the number of simultaneous opened connections between the machines hosted in our private network and the Internet which is around 4000 ...
3
votes
1answer
321 views

Block all internet connections unless connected to OpenVPN server

I want to block all internet connections unless I'm connected to my OpenVPN. Now of course, I need to allow connection to the VPN server. Can this be done, by allowing out/in traffic to/from the VPN ...
1
vote
1answer
112 views

Debian Jessie server has no internet access

I have a server running Debian 8 Jessie that constantly loses it's internet access for seemingly no reason. The server has two wired connections, the internet access is on eth0 and the internal ...
1
vote
1answer
144 views

UFW rules to allow specific behaviour

I'm new to UFW. One of our servers were compromised and I had to immediately: Deny all inbound. Deny all outbound. Allow all SSH. Allow outbound DNS. Allow Git clone, push, pull, etc. Allow only ...
2
votes
2answers
127 views

Block Internet access, but not network access for a user

Hi I would like to block one user on all of the linux machines (Debian Wheezy) from being able to surf the internet, chat and email. However they are using linux based Rip stations for large format ...
1
vote
1answer
21 views

UFW: Allow traffic only from a dynamic IP on its last 2 elements

I am trying to setup the following rule on ufw: ufw allow from 217.87.123.0/24 So to allow incoming connections from all 217.87.123.* addresses. The problem is that my IP does not always start ...
0
votes
1answer
23 views

IP tables - how to configure connections into my compuer

I have a problem with following thing: Foreign connection is connection initialized not by my computer. I would like to accept only foreign connection such that port is 22 or from interval [1000, ...
4
votes
1answer
110 views

Is libvirt dnsmasq exposed to the network, if I run Fedora without a firewall?

There's this nice saying from Ubuntu: no open ports on the default install. Other Linux OS's look the same, including Fedora. No-one wants to worry about firewalls, if they don't need to. Yuck, ...
0
votes
0answers
45 views

Linux: Building our own firewall box?

I'm actually on AWS Cloud, but sick of their limitations of IP Blocking feature given in Network ACLs there. Because Network ACLs can "BLOCK" by IP but they have rule limitations. So i came to think ...
1
vote
0answers
39 views

What puts TCPMSS in iptables?

I used to have (well, I still sort of do) have a script that expects: -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu to have been entered in to iptables ahead of my ...
1
vote
1answer
79 views

Firewalling Samba

at the moment I'm trying to implement the firewall for my linux file server. Everything is working as expected except form the samba server. I have searched through the internet already but non of the ...
0
votes
0answers
104 views

IPTables if more than 30 connection in 1 minute ban IP for 1 hour?

I am trying to setup a firewall that limits to 3 connections per IP and also ban the IP for an hour if > 30 connection attempts in one minute. Is this all possible with iptables? So far I have only ...
6
votes
1answer
42 views

connlimit counters start over after iptables restored

I have a connlimit rule in iptables that allow only 5 connection to port 80. iptables -A FORWARD -p tcp -m tcp --syn --dport 80 -m connlimit --connlimit-above 5 --connlimit-saddr -j DROP This ...
0
votes
1answer
56 views

Can Shorewall be used on VyOS?

Will VyOS still work right if I install Shorewall-lite on it? Shorewall seems like an easier way to setup a network, but VyOS seems pretty great for day-to-day management of a router / firewall. So ...
0
votes
0answers
234 views

string matching not working in iptables

We have a RHEL 6.7 DNS server and we are trying to discard packets that contain certain domains. For example, one of our DNS servers was involved in a random subdomain attack, where external hosts or ...