A firewall is a program that controls the incoming and outgoing network traffic on a system. Use this tag for all questions related to firewall configuration and operation.

learn more… | top users | synonyms

0
votes
0answers
141 views

What is wrong with these iptables' rules?

The following is what I got after googling: iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT #allow loopback access iptables -A OUTPUT -d 255.255.255.255 -j ACCEPT #make sure you ...
4
votes
2answers
2k views

Why is the firewall off by default with Linux Mint?

One of the most common recommendations that I read for users that recently installed Linux Mint is to enable their firewall, which is pretty simple to do. But why is the firewall off by default in the ...
1
vote
0answers
94 views

Linux firewall distro that can configure a vpn connection as a WAN interface?

I'd like to setup linux as a router w/firewall between My machine and the internet. The linux box should connect to a VPN account using OpenVPN on boot (managed to get that done). Then the firewall ...
4
votes
1answer
722 views

bridge does not forwarding packets centos

I am using CentOS 6.5 64 and use xen to create a virtual machine (CentOS) ifconfig [root@CentOS ~]# ifconfig eth0 Link encap:Ethernet HWaddr 08:00:27:54:B3:FA inet6 addr: ...
1
vote
1answer
123 views

configure exim for system email forwarding (outside) , on a server with dynamic ip, behind a DNS router

Trying to configure exim to deleaver email to the outside world. I/We need to send email outside just for centralize certain admin notifications. Working on an already configured debian webserver, ...
4
votes
1answer
1k views

How to check if port forwarding is enabled?

I have just set up a DNS server for my own network, and many guides online suggest to make sure that port forwarding on port 53 is not enabled. The thing that is not clear to me is this: should I ...
1
vote
1answer
186 views

Does an in-kernel firewall sit between the network access layer and Internet layer?

This question is a follow-up to my previous question. Logic for me to says that an in-kernel firewall sits between the network access layer and the Internet layer, because it needs to have access to ...
0
votes
1answer
606 views

Socket Connection Refused (raspbian) but ports are open for connections

I'd like to establish a connection between my client and raspbian. Within my network, I can connect to my service at any time without any problems. Now I want to connect to my service via the ...
1
vote
0answers
121 views

pfsense: No more processes

Sometimes my pfsense (1.2.3-RELEASE) goes crazy: every nat rules go down the web interface reply me with many errors (Warning: shell_exec(): Unable to execute...) my ssh daemon refuse to open a new ...
0
votes
1answer
69 views

iptables correctness verification

I have so many questions around iptables and how it works. But we're using a modified kernel, and hence whatever experiment I try and fail, I can't be sure if it happens with Linux in common or just ...
0
votes
1answer
356 views

Iptables rule to allow only one port and block others

We have two apps running (on top of linux) and both communicates through port 42605. I wanted to quickly verify if this is the only port that's been used for communication between them. I tried below ...
0
votes
1answer
71 views

What does the last column in this IP table mean?

From a tutorial, I run $sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT $ sudo iptables -L and get target prot opt source destination ACCEPT ...
1
vote
0answers
363 views

Corosync & Pacemaker IPTables Rules

When using Corosync with two rings via multi-cast addresses 226.94.1.1 (Port 5405) & 226.94.1.2 (Port 5406) what iptables rules are required to allow two nodes to communicate optimally without ...
1
vote
1answer
318 views

Webserver establishing new outgoing connections from port 443

I've been trying to configure the firewall on a webserver running Apache using iptables commands. I took the approach of blocking all outgoing connections, except for those that are required. ...
2
votes
0answers
180 views

IPtables rule to double NAT [closed]

Let me rephrase it.. I just need an IPtable rule to do double NAT-ting.. Host A - Host B - Host C - Host D Host B should do both source NAT and destination NAT, so that my request from Host A ...
3
votes
1answer
119 views

How does iptables recognize packet state?

Consider these two sets of rules: Set A -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT -A INPUT -j REJECT -A OUTPUT -j ACCEPT Set B -A INPUT -m conntrack --ctstate ...
1
vote
1answer
344 views

iptables forwarding between subnets

I want to forward traffic between two subnets, I'm not very familiar with iptables. The forwarding works except when iptables is enabled. There must be something wrong with the rules, though ...
3
votes
2answers
813 views

Can logging be enabled in FirewallD

I'm running Fedora 20 and would like to see what my firewall is doing in the background. Is it possible to view a log of the traffic blocked by FirewallD?
1
vote
0answers
439 views

iptables and physdev match confusion

I'd like to be able to prevent a network bridge from generating certain types of traffic from some of its interfaces. If I understand iptables correctly, packets generate by a device appear on the ...
1
vote
2answers
152 views

What ports are essential and should generally be allowed on a Linux system?

I'm running a desktop computer, but one with high threat risk. I've blocked all ports using a firewall except: HTTP, HTTPS, DNS, one port for torrent client. Do any common processes in distros ...
1
vote
1answer
60 views

How can I protect my computer when the only way to access the internet is though a compromised internet connection?

I access the network through a connection which is most likely compromised by a MITM attack. I can't do much about it. What steps should I take to lessen the influence of this attack. I'm especially ...
1
vote
0answers
75 views

cntlm: the request was denied

I have configured CNTLM server between users and Windows TMG firewall. CNTLM configured with "allow all" - no any ACL or something like it: Gateway yes # # Useful in Gateway mode to allow/restrict ...
0
votes
1answer
318 views

iptables Port Forwarding — no service with the port

I have setup a network as in the image below: Firewall (FW) running CentOS 6 has two physical interfaces with subinterfaces: eth0:2 — 10.100.1.78/25 eth0:3 — 10.100.1.79/25 eth3 — 192.168.0.21/24 ...
2
votes
1answer
2k views

How to Block SSH Brute Force via Iptables and How does it work?

I'm planning to add the following rules to iptables to stop ssh brute force attack which are common these days. -A INPUT -i eth0.103 -p tcp -m tcp --dport 4522 -m state --state NEW -m recent --set ...
1
vote
2answers
2k views

FTP and iptables. Connection fails but ports are open

I installed proftp on my machine. With iptables disabled I can connect to the machine, using ftp-client or telnet. With iptables connection fails - telnet says "Connection failed" # works telnet ...
0
votes
2answers
30 views

Unable to apt-get after editing firewall settings

I am currently testing out the Tomcat on apache from turnkey Linux and I am unable to run any apt-get commands. The problem started when I edited the firewall settings from the webmin. How can I get ...
2
votes
1answer
6k views

Fedora 19: can't disable the firewall

I've installed a server (WSO2 ESB) in my laptop. When I run it, going to the browser and typing the console address https://10.13.6.75:9443/carbon, it works normally, but if I try it on another ...
11
votes
1answer
2k views

Is it better to set -j REJECT or -j DROP in iptables?

There's an example of iptables rules on archlinux wiki: # Generated by iptables-save v1.4.18 on Sun Mar 17 14:21:12 2013 *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [0:0] :TCP - ...
1
vote
0answers
191 views

Portforwarding: router nat vs iptables [closed]

I would like to host some services on my pc and make them available from internet. (I'm aware of the security implications, it's more like a test for now). I don't have experience with iptables but I ...
1
vote
1answer
490 views

Understanding the iptables rules created by FirewallD [on hold]

I am having a hard time trying to figure out what the iptables rules generated by FirewallD say. Focusing on the "public" input zone, I have the following rules: *filter :INPUT ACCEPT [0:0] :FORWARD ...
1
vote
0answers
33 views

How to send packets coming from a second router on a particular port back to the router, using iptables not a route

I have a Linux server which runs a particular service listening on a single TCP port. The Linux server connects to the internet using a PPP connection and also acts as router for a local network using ...
2
votes
1answer
137 views

Does negative vs positive matching impact firewall performance?

I am curious if using negative vs. positive matching impacts the performance of the netfilter stack. e.g. is iptables -I INPUT -p tcp -s 192.168.0.0/16 -j DROP equivalent to iptables -I INPUT -p tcp ...
1
vote
0answers
45 views

Shorewall “ERROR: Ordinary users may not start the /etc/shorewall configuration” in Cygwin

I am using Cygwin on Windows 7 and I have installed Shorewall 4.5.21.5. When I try to start shorewall in Cygwin, it gives me error: $ shorewall start ERROR: Ordinary users may not start the ...
3
votes
1answer
80 views

nc both fails and succeeds

Platform: RHEL 5.10 netcat Version: 1.84-10.fc6 I was trying to figure out if my inability to ssh was TCP-level and usually I use nc for this. This time, however, I got something unexpected. ...
2
votes
1answer
272 views

No internet even with iptables ACCEPT all

I was trying to setup the firewall settings, and probably did something wrong. I don't have internet now unless I stop iptables service I tried flushing,and accepting everything sudo iptables -F ...
0
votes
1answer
405 views

iptables couldn't load target allow

I am using the command below to allow all traffic from hosts on my internal network but it says "iptables v1.4.18: Couldn't load target `ALLOW':No such file or directory". What is the problem here? ...
1
vote
1answer
360 views

Archlinux not configured with iptables

I have been trying to set up iptables on my archlinux server, however when I run iptables -nvL I receive the error iptables v1.4.20: can't initialize iptables table 'filter': Table does not exist ...
4
votes
1answer
101 views

How do you do NAT port redirection with PF?

In Linux, you can do NAT port redirection with a command like this: iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8000 What is the equivalent with BSD's PF?
0
votes
1answer
212 views

iptables - why the stun, turn ports are not working to allow end points to access the server?

I have this iptables where all working except tcp/udp port 3478 and 5349. $ cat /etc/sysconfig/iptables # Generated by iptables-save v1.4.7 on Thu Nov 21 10:21:41 2013 *filter :FORWARD ACCEPT [0:0] ...
0
votes
0answers
553 views

Fail2ban - alternative robust for enterprise protection against DoS attack in SIP and similar to fail2ban features

Is there any fail2ban like software for CentOS 2.6.32-358.6.2.el6.x86_64 ? (fail2ban is 0.8.10 installed) but its slowing down the system completely, i was looking for something which can be similar ...
2
votes
2answers
319 views

Do I need a special firewall on a personal computer

I am relatively new to Linux and was wondering about security issues. Most people agree that a virus-scanner is not useful on a linux system, but what about a firewall? I am using Debian wheezy stable ...
2
votes
1answer
34 views

Ubuntu blocks access to services when not logged in

I'm not really sure what's going on here. I have the following: A fresh install of Ubuntu 12.04 LTS. Jira 6.1.2 installed as per instructions from Atlassian. Confluence 3.5.13 installed as per ...
1
vote
0answers
301 views

destination IP mangle table

I have machine with 2 interfaces: eth1 connected to internet (ip xx.xx.xx.xx) eth0 connected to my laptop (ip yy.yy.yy.yy) I add those lines to the firewall file in order to manage the bandwidth ...
4
votes
2answers
466 views

fail2ban log parsing too slow on Raspberry Pi - options?

I'm running fail2ban on a Raspberry Pi at 950MHz which I cannot overclock further. The Pi is occasionally subject to SYN floods on particular ports. I've set up iptables to throttle the rate of SYNs ...
1
vote
2answers
273 views

How does KVM set its own netfilter rules?

I've been poking around with KVM VM's on Centos 6.4 and after some hair pulling and copious amounts of trying to break my desk with my head due to not having an internet connection on my VM's, I found ...
1
vote
2answers
351 views

Open a port CentOS

I'm new in CentOS and I'm trying to create a little script in Python, something like: $ python -m SimpleHTTPServer If I try to access port 8000 in my web browser, I don't get access, however if I ...
3
votes
1answer
462 views

Rsync over ssh tunnel - using gateway server

Environment: ---------- ---------- /| ------------ | Work | | Gateway| | | | cluster | |Station |--------------------------------| ...
1
vote
1answer
46 views

Reach service on VM with private address

I have this configuration: source: https://www.lucidchart.com/publicSegments/view/5256a1e5-afb0-4c7a-96fa-35750a00527d/image.png Basically, I have to reach a service which is running on the virtual ...
1
vote
0answers
137 views

Firewall config prevents hibernate connecting to postgres in CentOS6.3

I have an operating environment in CentOS 6.3 that has tomcat7 and postgres9.2 installed. There is just one web application deployed in tomcat that tries to establish a connection from localhost to ...
2
votes
1answer
153 views

What are the pros and cons to editing iptables configuration file vs adding rules via the iptables command

I am working with a product on CentOS that occasionally needs to automatically add and remove rules from the iptables configuration. For example, during an update, we want to explicitly refuse ...