A firewall is a program that controls the incoming and outgoing network traffic on a system. Use this tag for all questions related to firewall configuration and operation.

learn more… | top users | synonyms

2
votes
1answer
914 views

How to check if port forwarding is enabled?

I have just set up a DNS server for my own network, and many guides online suggest to make sure that port forwarding on port 53 is not enabled. The thing that is not clear to me is this: should I ...
1
vote
1answer
163 views

Does an in-kernel firewall sit between the network access layer and Internet layer?

This question is a follow-up to my previous question. Logic for me to says that an in-kernel firewall sits between the network access layer and the Internet layer, because it needs to have access to ...
0
votes
1answer
467 views

Socket Connection Refused (raspbian) but ports are open for connections

I'd like to establish a connection between my client and raspbian. Within my network, I can connect to my service at any time without any problems. Now I want to connect to my service via the ...
1
vote
0answers
106 views

pfsense: No more processes

Sometimes my pfsense (1.2.3-RELEASE) goes crazy: every nat rules go down the web interface reply me with many errors (Warning: shell_exec(): Unable to execute...) my ssh daemon refuse to open a new ...
0
votes
1answer
68 views

iptables correctness verification

I have so many questions around iptables and how it works. But we're using a modified kernel, and hence whatever experiment I try and fail, I can't be sure if it happens with Linux in common or just ...
0
votes
1answer
198 views

Iptables rule to allow only one port and block others

We have two apps running (on top of linux) and both communicates through port 42605. I wanted to quickly verify if this is the only port that's been used for communication between them. I tried below ...
0
votes
1answer
62 views

What does the last column in this IP table mean?

From a tutorial, I run $sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT $ sudo iptables -L and get target prot opt source destination ACCEPT ...
1
vote
0answers
275 views

Corosync & Pacemaker IPTables Rules

When using Corosync with two rings via multi-cast addresses 226.94.1.1 (Port 5405) & 226.94.1.2 (Port 5406) what iptables rules are required to allow two nodes to communicate optimally without ...
1
vote
1answer
255 views

Webserver establishing new outgoing connections from port 443

I've been trying to configure the firewall on a webserver running Apache using iptables commands. I took the approach of blocking all outgoing connections, except for those that are required. ...
2
votes
0answers
153 views

IPtables rule to double NAT [closed]

Let me rephrase it.. I just need an IPtable rule to do double NAT-ting.. Host A - Host B - Host C - Host D Host B should do both source NAT and destination NAT, so that my request from Host A ...
3
votes
1answer
100 views

How does iptables recognize packet state?

Consider these two sets of rules: Set A -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT -A INPUT -j REJECT -A OUTPUT -j ACCEPT Set B -A INPUT -m conntrack --ctstate ...
1
vote
1answer
287 views

iptables forwarding between subnets

I want to forward traffic between two subnets, I'm not very familiar with iptables. The forwarding works except when iptables is enabled. There must be something wrong with the rules, though ...
3
votes
2answers
615 views

Can logging be enabled in FirewallD

I'm running Fedora 20 and would like to see what my firewall is doing in the background. Is it possible to view a log of the traffic blocked by FirewallD?
1
vote
0answers
387 views

iptables and physdev match confusion

I'd like to be able to prevent a network bridge from generating certain types of traffic from some of its interfaces. If I understand iptables correctly, packets generate by a device appear on the ...
1
vote
2answers
139 views

What ports are essential and should generally be allowed on a Linux system?

I'm running a desktop computer, but one with high threat risk. I've blocked all ports using a firewall except: HTTP, HTTPS, DNS, one port for torrent client. Do any common processes in distros ...
1
vote
1answer
59 views

How can I protect my computer when the only way to access the internet is though a compromised internet connection?

I access the network through a connection which is most likely compromised by a MITM attack. I can't do much about it. What steps should I take to lessen the influence of this attack. I'm especially ...
1
vote
0answers
61 views

cntlm: the request was denied

I have configured CNTLM server between users and Windows TMG firewall. CNTLM configured with "allow all" - no any ACL or something like it: Gateway yes # # Useful in Gateway mode to allow/restrict ...
0
votes
1answer
276 views

iptables Port Forwarding — no service with the port

I have setup a network as in the image below: Firewall (FW) running CentOS 6 has two physical interfaces with subinterfaces: eth0:2 — 10.100.1.78/25 eth0:3 — 10.100.1.79/25 eth3 — 192.168.0.21/24 ...
2
votes
1answer
1k views

How to Block SSH Brute Force via Iptables and How does it work?

I'm planning to add the following rules to iptables to stop ssh brute force attack which are common these days. -A INPUT -i eth0.103 -p tcp -m tcp --dport 4522 -m state --state NEW -m recent --set ...
1
vote
2answers
2k views

FTP and iptables. Connection fails but ports are open

I installed proftp on my machine. With iptables disabled I can connect to the machine, using ftp-client or telnet. With iptables connection fails - telnet says "Connection failed" # works telnet ...
0
votes
2answers
30 views

Unable to apt-get after editing firewall settings

I am currently testing out the Tomcat on apache from turnkey Linux and I am unable to run any apt-get commands. The problem started when I edited the firewall settings from the webmin. How can I get ...
2
votes
1answer
5k views

Fedora 19: can't disable the firewall

I've installed a server (WSO2 ESB) in my laptop. When I run it, going to the browser and typing the console address https://10.13.6.75:9443/carbon, it works normally, but if I try it on another ...
11
votes
1answer
1k views

Is it better to set -j REJECT or -j DROP in iptables?

There's an example of iptables rules on archlinux wiki: # Generated by iptables-save v1.4.18 on Sun Mar 17 14:21:12 2013 *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [0:0] :TCP - ...
1
vote
0answers
161 views

Portforwarding: router nat vs iptables [closed]

I would like to host some services on my pc and make them available from internet. (I'm aware of the security implications, it's more like a test for now). I don't have experience with iptables but I ...
2
votes
1answer
408 views

Understanding the iptables rules created by FirewallD

I am having a hard time trying to figure out what the iptables rules generated by FirewallD say. Focusing on the "public" input zone, I have the following rules: *filter :INPUT ACCEPT [0:0] :FORWARD ...
1
vote
0answers
32 views

How to send packets coming from a second router on a particular port back to the router, using iptables not a route

I have a Linux server which runs a particular service listening on a single TCP port. The Linux server connects to the internet using a PPP connection and also acts as router for a local network using ...
2
votes
1answer
123 views

Does negative vs positive matching impact firewall performance?

I am curious if using negative vs. positive matching impacts the performance of the netfilter stack. e.g. is iptables -I INPUT -p tcp -s 192.168.0.0/16 -j DROP equivalent to iptables -I INPUT -p tcp ...
1
vote
0answers
40 views

Shorewall “ERROR: Ordinary users may not start the /etc/shorewall configuration” in Cygwin

I am using Cygwin on Windows 7 and I have installed Shorewall 4.5.21.5. When I try to start shorewall in Cygwin, it gives me error: $ shorewall start ERROR: Ordinary users may not start the ...
3
votes
1answer
64 views

nc both fails and succeeds

Platform: RHEL 5.10 netcat Version: 1.84-10.fc6 I was trying to figure out if my inability to ssh was TCP-level and usually I use nc for this. This time, however, I got something unexpected. ...
2
votes
1answer
265 views

No internet even with iptables ACCEPT all

I was trying to setup the firewall settings, and probably did something wrong. I don't have internet now unless I stop iptables service I tried flushing,and accepting everything sudo iptables -F ...
0
votes
1answer
347 views

iptables couldn't load target allow

I am using the command below to allow all traffic from hosts on my internal network but it says "iptables v1.4.18: Couldn't load target `ALLOW':No such file or directory". What is the problem here? ...
1
vote
1answer
334 views

Archlinux not configured with iptables

I have been trying to set up iptables on my archlinux server, however when I run iptables -nvL I receive the error iptables v1.4.20: can't initialize iptables table 'filter': Table does not exist ...
4
votes
1answer
96 views

How do you do NAT port redirection with PF?

In Linux, you can do NAT port redirection with a command like this: iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8000 What is the equivalent with BSD's PF?
0
votes
1answer
186 views

iptables - why the stun, turn ports are not working to allow end points to access the server?

I have this iptables where all working except tcp/udp port 3478 and 5349. $ cat /etc/sysconfig/iptables # Generated by iptables-save v1.4.7 on Thu Nov 21 10:21:41 2013 *filter :FORWARD ACCEPT [0:0] ...
0
votes
0answers
528 views

Fail2ban - alternative robust for enterprise protection against DoS attack in SIP and similar to fail2ban features

Is there any fail2ban like software for CentOS 2.6.32-358.6.2.el6.x86_64 ? (fail2ban is 0.8.10 installed) but its slowing down the system completely, i was looking for something which can be similar ...
2
votes
2answers
268 views

Do I need a special firewall on a personal computer

I am relatively new to Linux and was wondering about security issues. Most people agree that a virus-scanner is not useful on a linux system, but what about a firewall? I am using Debian wheezy stable ...
2
votes
1answer
32 views

Ubuntu blocks access to services when not logged in

I'm not really sure what's going on here. I have the following: A fresh install of Ubuntu 12.04 LTS. Jira 6.1.2 installed as per instructions from Atlassian. Confluence 3.5.13 installed as per ...
1
vote
0answers
290 views

destination IP mangle table

I have machine with 2 interfaces: eth1 connected to internet (ip xx.xx.xx.xx) eth0 connected to my laptop (ip yy.yy.yy.yy) I add those lines to the firewall file in order to manage the bandwidth ...
4
votes
2answers
438 views

fail2ban log parsing too slow on Raspberry Pi - options?

I'm running fail2ban on a Raspberry Pi at 950MHz which I cannot overclock further. The Pi is occasionally subject to SYN floods on particular ports. I've set up iptables to throttle the rate of SYNs ...
1
vote
2answers
235 views

How does KVM set its own netfilter rules?

I've been poking around with KVM VM's on Centos 6.4 and after some hair pulling and copious amounts of trying to break my desk with my head due to not having an internet connection on my VM's, I found ...
1
vote
2answers
274 views

Open a port CentOS

I'm new in CentOS and I'm trying to create a little script in Python, something like: $ python -m SimpleHTTPServer If I try to access port 8000 in my web browser, I don't get access, however if I ...
3
votes
1answer
429 views

Rsync over ssh tunnel - using gateway server

Environment: ---------- ---------- /| ------------ | Work | | Gateway| | | | cluster | |Station |--------------------------------| ...
1
vote
1answer
45 views

Reach service on VM with private address

I have this configuration: source: https://www.lucidchart.com/publicSegments/view/5256a1e5-afb0-4c7a-96fa-35750a00527d/image.png Basically, I have to reach a service which is running on the virtual ...
1
vote
0answers
134 views

Firewall config prevents hibernate connecting to postgres in CentOS6.3

I have an operating environment in CentOS 6.3 that has tomcat7 and postgres9.2 installed. There is just one web application deployed in tomcat that tries to establish a connection from localhost to ...
2
votes
1answer
146 views

What are the pros and cons to editing iptables configuration file vs adding rules via the iptables command

I am working with a product on CentOS that occasionally needs to automatically add and remove rules from the iptables configuration. For example, during an update, we want to explicitly refuse ...
1
vote
1answer
260 views

how to investigate Firewall blocked outbound TCP

CentOS webserver with CSF (Config Server Firewall) running. Blocking all outbound / Inbound traffic except listed ports 80 81 22 21 etc. for web, mail & FTP services etc. I'm use to seeing heaps ...
1
vote
1answer
287 views

FreeBSD ipfw keepstate vs setup keep-state

A lot of examples where people are using keep-state with setup together. For example: ipfw add 1 allow tcp from any to me 22 setup keep-state Because of setup, this rule will allow only SYN ...
6
votes
1answer
5k views

UFW: Allow traffic only from a domain with dynamic IP address

I run a VPS which I would like to secure using UFW, allowing connections only to port 80. However, in order to be able to administer it remotely, I need to keep port 22 open and make it reachable from ...
0
votes
2answers
228 views

Isolate a hosts networking with iptables

I want to isolate a host on my home intranet using iptables on my linux router. So say for instance, I have a host that has the IP of 10.0.1.50 and I want it to be able to talk to the rest of the ...
2
votes
0answers
110 views

FreeBSD pf firewall, new connections severly delayed when nating

I have a newly setup fbsd 9.1 with pf, which itself doesn't experience any slowness when for example downloading a debian iso from my local debian repo (ftp.se.debian.org). Any machine behind it, ...