A firewall is a program that controls the incoming and outgoing network traffic on a system. Use this tag for all questions related to firewall configuration and operation.

learn more… | top users | synonyms

0
votes
0answers
4 views

how to make firewall changes permanent via firewall-cmd?

I am trying to open some ports in CentOS 7. I am able to open a port with the following command: firewall-cmd --direct --add-rule ipv4 filter IN_public_allow 0 -m tcp -p tcp --dport 7199 -j ACCEPT ...
1
vote
1answer
12 views

libvirtd and filtered ports

I am new to virt-manager. After having configured a virtual network (new interface virbr0) with 2 VMs that should be able to communicate, I discovered that most ports are filtered. For example, the ...
1
vote
0answers
19 views

Linux Bridge Network with Static IP Addresses and Firewall

any and all help is appreciated. I am trying to set up my Network Map Can you give me advice in setting up my interface file? If I set a static IP on my PLC on the same gateway, I shouldn't need to ...
0
votes
1answer
32 views

iptables INPUT command

On a machine called ubuntu1, this is the iptables command: sudo iptables -A INPUT -p icmp -j DROP on the other computer (xp1) I can not ping the ubuntu1.So this is OK. But On ubuntu1 can ping xp1. ...
1
vote
0answers
13 views

Initial iptable rule and knockd operation in vps

Today I launched a vps with Debian 7 x64 and started playing around with it. I installed xampp as well as knock daemon to get my hands dirty. So, all I wanted to do was to actually block all requests ...
1
vote
2answers
27 views

iptables is ignoring rules?

I've found some strange traffic through tcpdump (traffic is ongoing always): 13:00:13.203754 IP 1.2.3.4.1028 > 188.113.188.16.56881: UDP, length 103 13:00:13.204396 IP 1.2.3.4.1028 > ...
0
votes
0answers
29 views

CentOS 7 Firewalld zone configuration for private web application

I have read all the man pages related to firewalld and also explored all of the files that come pre-installed in firewalld before it is configured. How can I configure the zones of the firewall to ...
0
votes
0answers
16 views

OpenVPN on Ubuntu VM

I am trying to create a VLAN Network from my home network for a web-dev platform. I am running Ubuntu servers in VirtualBox on a Windows 7 machine. I am running an Ubuntu DHCP/OpenVPN/Shorewall ...
1
vote
1answer
22 views

Iptable forward interfaces for gateway machine

I have two Ethernet interface being configured to use as system gateway ex: eth1: 10.10.1.0 eth2: 10.10.2.0 I want to forward all the packets which are coming to the 10.10.2.0 gateway contacting ...
1
vote
1answer
31 views

Assp won't start

I tried to install ASSP (Anti-Spam SMTP Proxy Server),but when I try to start it I get the following: $ perl assp.pl Perl version 5.012003 (5.12.3) is at least recommended to run ASSP 2.4.3 (14313) ...
0
votes
1answer
37 views

viewing firewalld logs via remote login to CentOS 7 server

I have firewalld installed in a remote CentOS server. When I log into the server over the internet as root, I type the following command to access the firewalld logs: journalctl ...
0
votes
0answers
33 views

Network firewall on CentOS, host cannot be resolved?

I have a centos machine and I am trying install some dependencies using yum. When I do this I keep getting a message saying the host cannot be resolved. I was told the previous person that used the ...
1
vote
1answer
33 views

Application specific DNS problem?

I'm working on a live stream transcoder application using nginx + ffmpeg. Everything works fine when I use avconv to transcode, but if I use ffmpeg, I get this error: [tcp @ 0xb4e9da0] Failed to ...
1
vote
1answer
49 views

Allow wifi connections only to a local service, don't route to the wired ethernet

I have a Raspberry Pi running Linux (Raspbian) which is connected to my corporate Internet over an Ethernet cable. The RPi also has a wifi adaptor plugged into a USB port. I've been following along ...
1
vote
1answer
67 views

log files in CentOS 7 [closed]

In CentOS 7, how can I locate and view all the system logs that tell me who tried to enter the system, who got in, what processes they contacted, what they accomplished, etc. I want to be able to ...
2
votes
2answers
71 views

outgoing SMTP 25 port blocked by ISP?

I just setup postfix but I just realized my ISP outgoing blocks port 25 (SMTP). How do I send email outside? I can see my mail queue is filling up. Any suggestion?
1
vote
0answers
26 views

iptables: can't open tcp port

I'm running a Raspberry PI B+: Linux pi 3.12.28+ #709 PREEMPT Mon Sep 8 15:28:00 BST 2014 armv6l GNU/Linux The Raspberry is connect via lan (dhcp. ip: 192.168.78.29) to the local network. I'm trying ...
0
votes
0answers
31 views

Port randomly closing (iptables)

I'm running CentOS 6.5 on a VPS and one of the services I have running is murmur/mumble (A voip application). The issue I'm having is that the port clients connect on will be open when I initially ...
1
vote
1answer
17 views

Linux firewall techniques: MySql-Account

I'm having a discussion with a software developer in my nears. He is using MySql direct connections for a software. There is no PHP/SSH/whatever-Bridge involved for the communication, neither at ...
4
votes
1answer
47 views

Dovecot/Postfix mail server replies to [SYN] with [RST, ACK] when user attempts to connect (POP3). Likely iptables?

Currently I'm trying to troubleshoot an e-mail server that will allow users to send e-mail, but not log in to the server (POP3) or receive e-mail using their Outlook clients. Previously this was ...
-1
votes
1answer
20 views

iptables fowarding rules

I have an iptables rule in the FORWARD section that looks like this: 17 0 0 CONFIRMED tcp -- * * 0.0.0.0/0 172.16.30.240 tcp spt:587 dpt:587 ctorigdst ...
3
votes
0answers
172 views

OpenVPN and routing problem on OpenWRT

My home topology: router1 (192.168.1.1) - D-Link dsl2540u server with static IP available from Internet (ADSL via ppoe). 4 LAN ports. router2 (192.168.1.2) - D-Link DIR-300 with OpenWRT. Plays ...
0
votes
1answer
57 views

Isolate subnets on the same interface

I need to isolate Subnets on a linux machine CentOS that act as gateway. I have the following scenario. CentOS eth0 pub ip addres eth0.1 192.168.1.1 eth0.2 192.168.2.1 Now eth0.1 and eth0.2 can ...
0
votes
1answer
48 views

Allowing web server communication in Linux firewall

I have a unique situation. Let's say my webserver ( e.g. 10.0.0.2) is connected to eth0 of my firewall (gw 10.0.0.1). A local network (192.168.0.0/24) is also connected to eth1 (192.168.0.1/24) of my ...
0
votes
1answer
45 views

How to set up a stateful firewall on an am335x Starter Kit board?

In the past, I have used the following script to set up a stateful firewall (on a normal x64 Ubuntu machine) without issue: iptables -P INPUT DROP iptables -P FORWARD DROP iptables -N TCP iptables -N ...
1
vote
0answers
102 views

Iptables and --tcp-flags

If I have the following rule in the nat-table in the prerouting chain: 0 0 REDIRECT tcp -- eth5 any anywhere anywhere tcp flags:FIN,SYN,RST,ACK/SYN redir ports ...
2
votes
1answer
124 views

pf blocks all in/out traffic instead of just the one port I wanted to block

I need to block one incoming port with pf. I'm new to pf, and I can't figure out what I'm doing wrong here. Here is my entire rule file, made to block incoming port 22: set block-policy drop pass in ...
1
vote
1answer
42 views

Securing NFS in a multihomed environment

In a virtualised environment (VirtualBox with host-only networking) I want to share a folder on the host with the guest via NFS. I think that to achieve this, I should bind the NFS listening port to ...
1
vote
0answers
23 views

Are there any loopholes in IP restricting sshd?

Say that i want to only allow username/password logins on my private network, but restrict all external sources on to key/cert login. I would do something like this: RSAAuthentication yes ...
2
votes
1answer
119 views

Why doesn't Postfix reject a specific client's connection attempts?

My SMTP server is being probed. It looks like a brute force attach on SASL, where they're going through a password dictionary. Having seen thousands of these lines in the log files Sep 18 14:09:52 ...
1
vote
1answer
27 views

Does -o and -i make sense when the target host is already connected to the interface specified?

iptables -A FORWARD -s 192.168.20.7 -d 10.10.48.3 -p tcp --dport 25 -o eth1 -j ACCEPT iptables -A FORWARD -s 10.10.48.3 -d 192.168.20.7 -p tcp --sport 25 -i eth1 -j ACCEPT Tuning the firewall of my ...
0
votes
0answers
71 views

How to disable domain service at port 53 on WAN side in OpenWRT?

nmap on the WAN IP shows PORT STATE SERVICE 53/tcp open domain after basic configuration on a fresh OpenWRT (version Chaos Calmer) system. But the service should not be visible from WAN, but ...
3
votes
0answers
84 views

Why doesn't ufw enforce firewall rules for traffic coming from Virtualbox VM

I've been running Linux Mint 17 on my laptop for a while and thought I had it locked down to not allow any incoming traffic through "Firewall Configuration" (ufw GUI)—I have also validated this from ...
2
votes
1answer
61 views

psad: do not block access to HTTP

I want to block intruders via psad, but HTTP and HTTPS should not be blocked. For example, if someone is scanning my dedicated server via nmap, psad should block him for 2 hours, but he should still ...
1
vote
0answers
188 views

Configure firewalld for OpenVPN (server-bridge) in Fedora 20

I've installed an OpenVPN server on Fedora 20 (server-bridge), but I cannot get it to work. I'm almost sure that It's a firewall issue. I'm trying to connect from an OSX client, but I can connect ...
1
vote
0answers
2k views

Redhat / Centos 7 Firewalld best practice for pptp or L2TP/IPsec rules

Having a quick look at Centos 7, and though I'd spin up a VPN daemon or 3, but immediately discovered the usual packages aren't yet in the core repositories, so had to dig around and found the ...
1
vote
1answer
133 views

curl timeout troubleshooting

I tried to curl popular websites e.g. curl google.com or curl google.com:80 and there is always a timeout error. Some troubleshooting steps performed: Able to curl localhost with response Able to ...
2
votes
2answers
2k views

How can I make iptables service start automatically after reboot on CenOS/RHEL7?

I am having a few issues with a newly installed home server I am preparing. I have installed CentOS7 on it and I found that port 80 and 443 are off by default. I therefore added them to the iptables ...
2
votes
2answers
131 views

Delay when iptables icmp rules take effect

I have setup my iptables to disable all incoming connection, i.e. :INPUT DROP [0:65535] When the iptables has been started, I run the following command to enable ping: /usr/sbin/iptables -A INPUT ...
3
votes
1answer
120 views

Proper way to handle FTP over SSL with restrictive firewall rules?

Without SSL, FTP works fine over a stateful Firewall, like netfilter (iptables) + the nf_conntrack_ftp kernel module like this: # modprobe nf_conntrack_ftp # iptables -A INPUT -m conntrack --ctstate ...
-2
votes
1answer
91 views

How can I tease Sonicwall ?

In my college, I can't use the web, because they use Sonicwall network firewalls How can I tease it? For I use all websites in my college? Please see the result when I access a website blocked ...
0
votes
1answer
60 views

Linux hosts.deny settings are not applied

I want to make a bunch of websites unaccessible on my computer. My hosts.allow file: sendmail: all # /etc/hosts.allow: list of hosts that are allowed to access the system. # See ...
0
votes
1answer
56 views

how to find out wich chain in iptables in listing

Suppose I have the following two entries line of iptables: iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE iptables -A INPUT -s 192.168.1.0/24 -j DROP So, I have POSTROUTING and INPUT chains. ...
3
votes
1answer
2k views

Configuring OpenVPN to use Firewalld instead of iptables on Centos 7

I need some help configuring OpenVPN on Centos 7 using firewalld. I used iptables on Centos 6.5 and only had to add the following lines to /etc/sysconfig/iptables: -A POSTROUTING -s "10.0.0.0/24" ...
0
votes
0answers
67 views

How can I use 0.0.0.0/0 in ipset hash:net,port?

Right now, if I do ipset a ansible_allowed 0.0.0.0/0,tcp:22 I get ipset v6.19: The value of the CIDR parameter of the IP address is invalid and instead I have to add 0.0.0.0/1,tcp:22 ...
3
votes
1answer
93 views

IPTables rules for specific processes [duplicate]

I have a lot more experience with the Windows Firewall with advanced functionality than I do with IPTables. With the WFAF, I was able to lock down a program so that it could only connect over specific ...
1
vote
1answer
199 views

Curious about strange ICMP type 3 code 10 traffic to my IP address

My firewall (iptables) logs some strange ICMP type 3 code 10 traffic that I am curious to understand (specifically how or if this could be an exploit of some sort). Type 3 = Destination ...
1
vote
0answers
54 views

How to debug the network issue in case of blocked database connections

I am trying to understand if my analysis of the below information is correct. For all the 3 scenarios listed here, port 80, port 3306 and port 22 are open in the server's firewall. Also, for all the 3 ...
2
votes
1answer
492 views

Unable to access website hosted on virtual machine

I'm on a mac (osx 10.9.3) running CentOS7 in virtualbox. I would like to access the website hosted on the virtual machine. Browsing to the Guest IP returns webpage not available. I'm able to ping and ...
9
votes
2answers
3k views

( /etc/sysconfig/iptables ) “Manual customization of this file is not recommended.” Why?

Editing this file directly /etc/sysconfig/iptables can save me so much headaches so much time and so on... and yet on the very top of the file it says.. Manual customization of this file is not ...