A firewall is a program that controls the incoming and outgoing network traffic on a system. Use this tag for all questions related to firewall configuration and operation.

learn more… | top users | synonyms

0
votes
1answer
365 views

Stateful user-space firewall for Linux

Is there any stateful user-space firewall for Linux? I'm looking for a firewall that doesn't rely on anything in Linux kernel (like iptables/netfilter) and works with raw packets.
1
vote
1answer
457 views

Open UDP Ports; Can I Close Them?

I'm trying to secure my internet browsing. I just reinstalled Xubuntu 14.04 and GUFW firewall. I have 8 UDP ports open. I don't understand why. The software I currently have open are Firefox, GUFW, ...
0
votes
1answer
30 views

What port uses my backportpackage or bzr?

I am working in a company what uses Ubuntu Precise on the desktops behind a proxy. The Proxy is available in /etc/environment and set as: http_proxy, https_proxy, ftp_proxy, no proxy and their ...
2
votes
1answer
595 views

How to use both syn proxy and connlimit rules with iptables?

I want to write both syn proxy and connlimit rules. I want to send packets to syn proxy first because of performance issue. Here is rule sample. I use bridge interfaces but I dont think it is ...
0
votes
1answer
50 views

kernel security and IDS Firewall + AV together or not?

I try to hardening my server. For doing so, I got a general question: Should I install kernel security patches like selinux and an Anti-Virus with Intrusion Detection Firewall? Does it make sense to ...
1
vote
1answer
315 views

How to setup reverse FTP in RHEL?

Researched: http://www.thecave.info/export-proxy-username-password-linux/ http://stackoverflow.com/questions/5334110/text-based-ftp-client-settings-behind-a-proxy http://www.cyberciti.biz/faq/linux-...
4
votes
1answer
518 views

Changed SSH port without allowing it through firewall, locked out now - what to do?

I have a VPS where I changed the SSH port from the default 22. Unfortunately I forgot to allow the new port through the firewall. I don't have physical access to the server, and my host does not seem ...
1
vote
1answer
247 views

firewall-cmd forward rules for interface with multiple IPs?

I'm looking for a way with firewall-cmd or another command to do the following. An incoming public interface has multiple ip addresses bound to it. How can I forward ports only for one of the IP ...
4
votes
0answers
390 views

iptables: using “conntrack” and “recent” modules to block unsolicited packets

When I only allow RELATED and ESTABLISHED packets, and DROP everything else, my firewall rules work perfectly and I have no problems: ### VARIANT A -A INPUT -i wlan0 -m conntrack --ctstate RELATED,...
1
vote
3answers
2k views

what is dhcpv6-client service in firewalld, and can i safely remove it?

In a CentOS 7 server, I type in firewall-cmd --list-all, and it gives me the following: public (default, active) interfaces: enp3s0 sources: services: dhcpv6-client https ssh ports: ...
2
votes
1answer
428 views

blocking all but specific ips from specific services in CentOS 7

In a CentOS 7 web server that needs to remain totally closed to the public, I need to block all ip addresses and then only allow specified ip addresses to access specified services. How can I ...
0
votes
1answer
666 views

Block all but specified range of ip's input to an specific port [duplicate]

In a CentOS 7 web server, how do I configure firewalld to block all but a specific list of ip addresses from making successful http or https requests? I know that I can use httpd.conf to restrict by ...
0
votes
1answer
1k views

how to make firewall changes permanent via firewall-cmd?

I am trying to open some ports in CentOS 7. I am able to open a port with the following command: firewall-cmd --direct --add-rule ipv4 filter IN_public_allow 0 -m tcp -p tcp --dport 7199 -j ACCEPT ...
1
vote
1answer
87 views

libvirtd and filtered ports

I am new to virt-manager. After having configured a virtual network (new interface virbr0) with 2 VMs that should be able to communicate, I discovered that most ports are filtered. For example, the ...
1
vote
0answers
167 views

Linux Bridge Network with Static IP Addresses and Firewall

any and all help is appreciated. I am trying to set up my Network Map Can you give me advice in setting up my interface file? If I set a static IP on my PLC on the same gateway, I shouldn't need to ...
0
votes
1answer
74 views

iptables INPUT command

On a machine called ubuntu1, this is the iptables command: sudo iptables -A INPUT -p icmp -j DROP on the other computer (xp1) I can not ping the ubuntu1.So this is OK. But On ubuntu1 can ping xp1. ...
1
vote
0answers
83 views

Initial iptable rule and knockd operation in vps

Today I launched a vps with Debian 7 x64 and started playing around with it. I installed xampp as well as knock daemon to get my hands dirty. So, all I wanted to do was to actually block all requests ...
1
vote
2answers
176 views

iptables is ignoring rules?

I've found some strange traffic through tcpdump (traffic is ongoing always): 13:00:13.203754 IP 1.2.3.4.1028 > 188.113.188.16.56881: UDP, length 103 13:00:13.204396 IP 1.2.3.4.1028 > 180.183....
0
votes
1answer
3k views

CentOS 7 Firewalld zone configuration for private web application

I have read all the man pages related to firewalld and also explored all of the files that come pre-installed in firewalld before it is configured. How can I configure the zones of the firewall to ...
0
votes
0answers
72 views

OpenVPN on Ubuntu VM

I am trying to create a VLAN Network from my home network for a web-dev platform. I am running Ubuntu servers in VirtualBox on a Windows 7 machine. I am running an Ubuntu DHCP/OpenVPN/Shorewall ...
1
vote
1answer
74 views

Iptable forward interfaces for gateway machine

I have two Ethernet interface being configured to use as system gateway ex: eth1: 10.10.1.0 eth2: 10.10.2.0 I want to forward all the packets which are coming to the 10.10.2.0 gateway contacting ...
1
vote
1answer
381 views

Assp won't start

I tried to install ASSP (Anti-Spam SMTP Proxy Server),but when I try to start it I get the following: $ perl assp.pl Perl version 5.012003 (5.12.3) is at least recommended to run ASSP 2.4.3 (14313) ...
0
votes
1answer
2k views

viewing firewalld logs via remote login to CentOS 7 server

I have firewalld installed in a remote CentOS server. When I log into the server over the internet as root, I type the following command to access the firewalld logs: journalctl --output=json-...
0
votes
0answers
2k views

Network firewall on CentOS, host cannot be resolved?

I have a centos machine and I am trying install some dependencies using yum. When I do this I keep getting a message saying the host cannot be resolved. I was told the previous person that used the ...
1
vote
1answer
163 views

Application specific DNS problem?

I'm working on a live stream transcoder application using nginx + ffmpeg. Everything works fine when I use avconv to transcode, but if I use ffmpeg, I get this error: [tcp @ 0xb4e9da0] Failed to ...
1
vote
1answer
176 views

Allow wifi connections only to a local service, don't route to the wired ethernet

I have a Raspberry Pi running Linux (Raspbian) which is connected to my corporate Internet over an Ethernet cable. The RPi also has a wifi adaptor plugged into a USB port. I've been following along ...
2
votes
1answer
13k views

log files in CentOS 7 [closed]

In CentOS 7, how can I locate and view all the system logs that tell me who tried to enter the system, who got in, what processes they contacted, what they accomplished, etc. I want to be able to ...
2
votes
2answers
344 views

outgoing SMTP 25 port blocked by ISP?

I just setup postfix but I just realized my ISP outgoing blocks port 25 (SMTP). How do I send email outside? I can see my mail queue is filling up. Any suggestion?
1
vote
0answers
474 views

iptables: can't open tcp port

I'm running a Raspberry PI B+: Linux pi 3.12.28+ #709 PREEMPT Mon Sep 8 15:28:00 BST 2014 armv6l GNU/Linux The Raspberry is connect via lan (dhcp. ip: 192.168.78.29) to the local network. I'm trying ...
1
vote
1answer
36 views

Linux firewall techniques: MySql-Account

I'm having a discussion with a software developer in my nears. He is using MySql direct connections for a software. There is no PHP/SSH/whatever-Bridge involved for the communication, neither at ...
4
votes
1answer
489 views

Dovecot/Postfix mail server replies to [SYN] with [RST, ACK] when user attempts to connect (POP3). Likely iptables?

Currently I'm trying to troubleshoot an e-mail server that will allow users to send e-mail, but not log in to the server (POP3) or receive e-mail using their Outlook clients. Previously this was ...
-1
votes
1answer
31 views

iptables fowarding rules

I have an iptables rule in the FORWARD section that looks like this: 17 0 0 CONFIRMED tcp -- * * 0.0.0.0/0 172.16.30.240 tcp spt:587 dpt:587 ctorigdst 24.103....
3
votes
0answers
935 views

OpenVPN and routing problem on OpenWRT

My home topology: router1 (192.168.1.1) - D-Link dsl2540u server with static IP available from Internet (ADSL via ppoe). 4 LAN ports. router2 (192.168.1.2) - D-Link DIR-300 with OpenWRT. Plays ...
0
votes
1answer
434 views

Isolate subnets on the same interface

I need to isolate Subnets on a linux machine CentOS that act as gateway. I have the following scenario. CentOS eth0 pub ip addres eth0.1 192.168.1.1 eth0.2 192.168.2.1 Now eth0.1 and eth0.2 can ...
1
vote
1answer
110 views

Allowing web server communication in Linux firewall

I have a unique situation. Let's say my webserver ( e.g. 10.0.0.2) is connected to eth0 of my firewall (gw 10.0.0.1). A local network (192.168.0.0/24) is also connected to eth1 (192.168.0.1/24) of my ...
0
votes
1answer
291 views

How to set up a stateful firewall on an am335x Starter Kit board?

In the past, I have used the following script to set up a stateful firewall (on a normal x64 Ubuntu machine) without issue: iptables -P INPUT DROP iptables -P FORWARD DROP iptables -N TCP iptables -N ...
1
vote
0answers
273 views

Iptables and --tcp-flags

If I have the following rule in the nat-table in the prerouting chain: 0 0 REDIRECT tcp -- eth5 any anywhere anywhere tcp flags:FIN,SYN,RST,ACK/SYN redir ports ...
2
votes
1answer
1k views

pf blocks all in/out traffic instead of just the one port I wanted to block

I need to block one incoming port with pf. I'm new to pf, and I can't figure out what I'm doing wrong here. Here is my entire rule file, made to block incoming port 22: set block-policy drop pass in ...
2
votes
1answer
204 views

Securing NFS in a multihomed environment

In a virtualised environment (VirtualBox with host-only networking) I want to share a folder on the host with the guest via NFS. I think that to achieve this, I should bind the NFS listening port to ...
2
votes
1answer
46 views

Are there any loopholes in IP restricting sshd?

Say that i want to only allow username/password logins on my private network, but restrict all external sources on to key/cert login. I would do something like this: RSAAuthentication yes ...
2
votes
1answer
536 views

Why doesn't Postfix reject a specific client's connection attempts?

My SMTP server is being probed. It looks like a brute force attach on SASL, where they're going through a password dictionary. Having seen thousands of these lines in the log files Sep 18 14:09:52 ...
1
vote
1answer
45 views

Does -o and -i make sense when the target host is already connected to the interface specified?

iptables -A FORWARD -s 192.168.20.7 -d 10.10.48.3 -p tcp --dport 25 -o eth1 -j ACCEPT iptables -A FORWARD -s 10.10.48.3 -d 192.168.20.7 -p tcp --sport 25 -i eth1 -j ACCEPT Tuning the firewall of my ...
3
votes
0answers
270 views

Why doesn't ufw enforce firewall rules for traffic coming from Virtualbox VM

I've been running Linux Mint 17 on my laptop for a while and thought I had it locked down to not allow any incoming traffic through "Firewall Configuration" (ufw GUI)—I have also validated this from ...
2
votes
1answer
243 views

psad: do not block access to HTTP

I want to block intruders via psad, but HTTP and HTTPS should not be blocked. For example, if someone is scanning my dedicated server via nmap, psad should block him for 2 hours, but he should still ...
1
vote
0answers
334 views

Configure firewalld for OpenVPN (server-bridge) in Fedora 20

I've installed an OpenVPN server on Fedora 20 (server-bridge), but I cannot get it to work. I'm almost sure that It's a firewall issue. I'm trying to connect from an OSX client, but I can connect (...
3
votes
0answers
8k views

Redhat / Centos 7 Firewalld best practice for pptp or L2TP/IPsec rules

Having a quick look at Centos 7, and though I'd spin up a VPN daemon or 3, but immediately discovered the usual packages aren't yet in the core repositories, so had to dig around and found the ...
1
vote
1answer
941 views

curl timeout troubleshooting

I tried to curl popular websites e.g. curl google.com or curl google.com:80 and there is always a timeout error. Some troubleshooting steps performed: Able to curl localhost with response Able to ...
3
votes
3answers
9k views

How can I make iptables service start automatically after reboot on CenOS/RHEL7?

I am having a few issues with a newly installed home server I am preparing. I have installed CentOS7 on it and I found that port 80 and 443 are off by default. I therefore added them to the iptables ...
2
votes
2answers
376 views

Delay when iptables icmp rules take effect

I have setup my iptables to disable all incoming connection, i.e. :INPUT DROP [0:65535] When the iptables has been started, I run the following command to enable ping: /usr/sbin/iptables -A INPUT -...
4
votes
1answer
1k views

Proper way to handle FTP over SSL with restrictive firewall rules?

Without SSL, FTP works fine over a stateful Firewall, like netfilter (iptables) + the nf_conntrack_ftp kernel module like this: # modprobe nf_conntrack_ftp # iptables -A INPUT -m conntrack --ctstate ...