A firewall is a program that controls the incoming and outgoing network traffic on a system. Use this tag for all questions related to firewall configuration and operation.

learn more… | top users | synonyms

4
votes
1answer
1k views

Outgoing firewall application similar to Little Snitch for Mac

Is there a Linux application similar to Little Snitch? Little Snitch is an outgoing firewall that temporarily blocks outgoing network requests until the user decides whether to allow the connection or ...
2
votes
2answers
1k views

Can I use divert as an alternative to ipfw fwd?

I would like to lead some traffic through a transparent proxy (which actually is on another server and connected with an ssh tunnel). Normally I could do this: ipfw add forward localhost,8080 tcp ...
-2
votes
4answers
244 views

Steps to secure your server? [duplicate]

Possible Duplicate: What to use to harden Linux box? Apparmor, SELinux, grsecurity, SMACK, chroot? I'm just completed install my web server. So what should i do to secure it? I just ...
8
votes
2answers
10k views

How can I block a range of IP addresses with an Amazon EC2 instance?

I know a certain range of IP addresses are causing problem with my server, 172.64.*.* what is the best way to block access to my Amazon EC2 instance? Is there a way to do this using security groups or ...
12
votes
2answers
4k views

Per process firewall?

I've been reading around but can't seem to find a way to create per-process firewall rules. I know about iptables --uid-owner but that only works for outgoing traffic. I've considered scripting ...
2
votes
0answers
811 views

pfsense long ping to google

I have a pfsense box set up. What happens is I set a rule so I can't hit the admin interface 192.168.3.1 from the box. With the rule enabled --- www.l.google.com ping statistics --- 2 packets ...
11
votes
4answers
2k views

Why do we need a firewall if no programs are running on your ports?

When I try to telnet to a port on a server, and if there is no program listening on that port telnet dies with a "Unable to connect ... " error. I understand that. But, why do we need a firewall if ...
3
votes
2answers
1k views

How to check and block processes connecting to internet directly?

Is there a way to find which processes in my system are getting connected to net automatically. Is there a way to select and block net access of some processes permanently? I use mint 11. I use a USB ...
2
votes
1answer
669 views

Will the Firewall GUI in CentOS overwrite changes implemented by IPTABLES manual edits?

I would like to restrict access to the SSH port of a new CentOS 6.2 server to select IP addresses but the Firewall GUI utility seems to be an all-or-nothing scenario. Either the port is firewalled or ...
3
votes
1answer
443 views

What port range will ipfw nat use for aliasing?

I am using ipfw nat with the following config ipfw -q nat 1 config if em0 Which TCP and UDP ranges will the NAT choose its alias ports from? I would like it to be always from the range 49152–65535, ...
3
votes
2answers
804 views

FreeBSD kernel nat or natd?

As I notice more often with FreeBSD, there are always plenty of ways that lead to some specific goal. After figuring out which firewall I wanted (I choose ipfw) I now am completely insecure about ...
3
votes
3answers
4k views

Blocking outgoing connects with iptables

I have a (non production) machine where external supporters have shell-access (non-root). I want to prevent them from going further on into our network from that machine using iptables. The "normal" ...
5
votes
1answer
5k views

Ignore a specific ip for fail2ban

I am using fail2ban with ipfw on FreeBSD. Is there a way to ignore a specific ip address, making sure that fail2ban never blocks or reports it?
2
votes
1answer
497 views

UFW Limit does not appear to work

I have my ssh port changed to XXX. Then I did ufw limit XXX/tcp However, when I try to login, after 5/6 failed attempts I get thrown back to prompt, but I can try again. Is that supposed to be the ...
2
votes
3answers
2k views

Making sense of auth log

I am seeing some log enties that look like hacking attempts Type 1 Dec 26 03:09:01 ... CRON[9271]: pam_unix(cron:session): session closed for user root Dec 26 03:17:01 ... CRON[9308]: ...
1
vote
1answer
541 views

How can I move firewall settings from one Debian Squeeze web server to another?

I configured a Debian Squeeze virtual machine in VMWare on my laptop. I configured it with a very restrictive set of firewall rules using Firestarter. I then uploaded a copy of its disk image to use ...
3
votes
2answers
3k views

How to limit number off ssh login attempts per time interval

I am trying to limit number of ssh login attempts per time period. How might I do that? I have something like (in shorewall's rules) #ACTION SOURCE DEST PROTO DEST ...
7
votes
1answer
3k views

Why doesn't my iptables rule work?

I have two interfaces on my VPS: eth0 and eth0:0. I want to block incoming packets on port 80 on eth0:0 using iptables. I tried this, but it doesn't work: iptables -A INPUT -i "eth0:0" -p tcp ...
4
votes
2answers
380 views

How can I use one network port for VPN and the other for everything else?

My Linux machine has two network ports with two IP addresses. I want to use one port for my VPN and accounting, and the other port for other usages. How can I tell Linux not to allow any requests from ...
3
votes
1answer
455 views

Using rsync + cron to sync a machine behind a firewall with my dropbox

I have a machine (A) behind a firewall with no access to the Internet, on this machine I can NFS mount directories on another machine (B) which can access internet, and is accessible from Internet, ...
3
votes
2answers
655 views

How to listen to all ports (UDP and TCP) or make them all appear open in Debian

I got an external Debian server. The problem is that my university campus doesn't allow connections to go outside when the port is different than TCP port 22, 80, 443, or UDP port 123. I tested them ...
0
votes
1answer
2k views

How to really security a linux-mint-desktop?

I'm installing some security software in my mint9Gnome. I first went to Firestarter and looks like a pretty start. Now I'm going to OSSEC and want some good tools to search my logs too. Thinking ...
3
votes
2answers
806 views

Letting NFS through a FreeBSD PF firewall

I'm trying to configure my firewall (PF) on FreeBSD to let NFS traffic through. I know that NFS uses both TCP and UDP to connect to the client along with a bunch of daemons that use random port ...
4
votes
1answer
839 views

Force VPN using IPtables?

I want to force the use of VPN using iptables, therefore while VPN is disabled no outgoing traffic shall be allowed (except maybe some DHCP stuff...). Now i guess I could just block everything not ...
9
votes
1answer
8k views

Difference between SNAT and Masquerade

I am confused what's the actual difference between SNAT and Masquerade? If I want to share my internet connection on local network than whether should I select SNAT or Masquerade? Give me some ...
2
votes
2answers
507 views

Recommended reverse firewall applications for linux? [on hold]

I'm looking for a reverse firewall, something like Little Snitch for Linux, but my google-fu is failing me. Does something like this exist on Linux?
3
votes
1answer
289 views

Converting a line from a firewall on OpenBSD 4.9 to OpenBSD 4.7

What is the OpenBSD 4.7 equivalent of this line from OpenBSD 4.9 for use with pf? no nat on egress proto udp from 192.168.1.10 port 4672 to any
0
votes
1answer
690 views

Can't connect remotely to server running redhat (ec2)

I created a RedHat 6.1 VM with EC2. Logged in as root, I installed (unzipped) JDK1.7 in /root/bin/jdk1.7.0 and installed (unzipped) GlassFish 3.1.1 in /root/bin/glassfish3. I set JAVA_HOME and ...
-1
votes
1answer
10k views

What is sport and dport?

I want to stop internet on my system using iptables so what should I do? iptables -A INPUT -p tcp --sport 80 -j DROP or iptables -A INPUT -p tcp --dport 80 -j DROP ?
2
votes
1answer
2k views

iptables rule to allow access to internet

I made default policy of my machine- iptables -A INPUT -j REJECT #DROP ALL PACKETS TO INPUT CHANNEL INPUT channel has been blocked. Now I want to allow only some specific services like I should be ...
5
votes
4answers
2k views

How can I send spoofed packets in Linux

In order to test a firewall, I want to send malformed packets to its interface, regardless of my routing table. Is there a way to ask linux "send this exact tcp package, to this MAC address, ...
2
votes
2answers
482 views

Security with Kernel IP Forwarding Enabled

I recently enabled IP Forwarding on a production web server that also acts as a VPN server. What, if any, security issues did I just set myself up for? And are there any iptables rules I should set ...
5
votes
4answers
11k views

Set some firewall ports to only accept local network connections?

Basic firewall question: How do I set up the firewall on a system in a LAN so that some ports are only open to connections from the local area network, and not from the outside world? For instance, ...
1
vote
1answer
1k views

Fedora firewall with UPnP?

I'm using Fedora 15 and Transmission BT client. Transmission can't open ports unless the firewall is disabled. I searched some posts that said add 1900 to the trusted ports, or via a iptable rule: ...
3
votes
1answer
293 views

Setting up the firewall for amule on OpenBSD 4.7 gateway

I'm trying to properly setup the firewall on my gateway (OpenBSD 4.7) using pf to allow amule (on 10.0.0.104) to operate properly as discussed here: Now I know pf has changed a bit from OpenBSD 4.7 ...
2
votes
1answer
3k views

How to stop firewall from writting logs to /var/log/messages?

I'm running OpenSUSE 11.4. The problem is that I can set easily what to log, but not where to log. And currently the same logs are written to /var/log/firewall and /var/log/messages. I still want ...
4
votes
2answers
2k views

What tools do I need to intercept and change an incoming packet on a WP2-Personal wifi hub

Which tools should I research into to intercept a plain text packet, edit it and then continue it on it's way. I am using Ubuntu 11.04 and Backtrack 5; my wifi is WPA2-person encrypted. I need to edit ...
5
votes
2answers
4k views

How to limit P2P/torrent traffic on an OpenWrt 10.03 router?

We have a WRT160NL router with OpenWRT 10.03, and a 60-70 Mbit connection (from ISP, don't ask why). This router can do 30-35 Mbit on ethernet(i mean cable)..ok! There are ~7 PC's using this Wireless ...
1
vote
1answer
552 views

Why does Firestarter say my firewall is active but ufw status shows it as inactive?

I am using Linux Mint and am having the following issue. Firestarter tells my that my firewall is active and it does indeed seem to be active. However when I type "sudo ufw status" into the terminal, ...
3
votes
1answer
210 views

iptables infographic

Is there an infographic somewhere that describes the logical flow of iptables? Specifically, I'm looking for something that diagrams which point in the process ip_conntrack applies.
0
votes
3answers
595 views

EBtales not working

I wanted to go a little bit further and install EBtables (the 2-layer filtering and routing table). The purpose of it was to only allow the minimal necessary(IPv4 and ARP). To test it I ran: ebtables ...
6
votes
4answers
7k views

Fail2ban block with IPtables doesn't work on Debian Lenny. [moved ssh port]

I've recently decided to do some security maintenance. I saw my logs, and there were some tries against my SSH server. At first, I moved away the SSH port from the default 22. After it, I read ...
2
votes
2answers
9k views

Problems setting up TigerVNC and firewall

I have a box running a fresh install of Fedora 15. I've installed TigerVNC server on it and client on my Windows machine. I've added -A INPUT -m state --state NET -m tcp -p tcp --dport 5900 -j ACCEPT ...
6
votes
2answers
728 views

Configuring a vncserver so it's only accessible from my ssh tunnel

Since I use vnc through an ssh tunnel, is there any way I can block the open vnc port that the remote machine is listening on without it affecting my ability to use the ssh tunnel? Both machines are ...
2
votes
3answers
404 views

Port monitoring on GNU/Linux based NAT router

I am using a Ubuntu machine as a NAT router. How can I find out the following: the ports on which the LAN machines are listening or communicating (both tcp and udp); which local machines have ...
3
votes
1answer
2k views

iptables/pf rule to only allow XY application/user?

I think there is no iptables/pf solution to only allow an XY application on e.g.: outbound tcp port 80, eth0. So if I have a userid: "500" then how could I block any other communications then the ...
1
vote
1answer
1k views

I can't figure out how to install Firestarter Fedora

I am feeling stupid. I have been searching for 3 hours with no success. I installed Fedora 14 and tried to do yum install firestarter but the package was not found. I also tried from a GUI and found ...
7
votes
1answer
584 views

Opening port 80 but remain secure

I have a standard installation of Ubuntu 10.04, and have installed the LAMP stack so I can do some web development locally. On my router I have opened port 80 so I can develop with external services ...
7
votes
2answers
16k views

iptables: allow certain ips and block all other connection

How do I allow certain ips and block all other connection in iptables?
2
votes
1answer
500 views

Is there any PF log parser for FreeBSD

I am runing FreeBSD 8 stable with PF as firewall, I am looking for any tool for parsing PF log's.