A firewall is a program that controls the incoming and outgoing network traffic on a system. Use this tag for all questions related to firewall configuration and operation.

learn more… | top users | synonyms

1
vote
0answers
13 views

Separation between the User machine and Server machine by another linux for monitoring

I am planning to have three virtual machines with virtual box (m1, m2,m3). I already installed on m1 = Windows XP Home Edition, and on m2 = LUbuntu 15. The big picture is this : m1 : a user m2 : ...
0
votes
2answers
939 views

How to configure Centos 7 firewallD to allow docker containers free access to the host's network ports?

I have docker installed on CentOS 7 and I am running firewallD. From inside my container, going to the host (default 172.17.42.1) With firewall on container# nc -v 172.17.42.1 4243 nc: connect to ...
12
votes
4answers
7k views

Is there a way to find which iptables rule was responsible for dropping a packet?

I have a system that came with a firewall already in place. The firewall consists of over 1000 iptables rules. One of these rule is dropping packets I don't want dropped. (I know this because I did ...
0
votes
1answer
17 views

Firewall Rule Testing - telnet failing

I am testing firewall rules but the telnet is failing. The firewallrules have been implemented but the target server is not listening on the servers. How can I enable the target server ports to ...
4
votes
1answer
1k views

Outgoing firewall application similar to Little Snitch for Mac

Is there a Linux application similar to Little Snitch? Little Snitch is an outgoing firewall that temporarily blocks outgoing network requests until the user decides whether to allow the connection or ...
1
vote
0answers
89 views

CSF not blocking port when removed from csf.conf

I have removed VNC port 5901 from the csf.conf configuration file and executed a csf -f a csf -x and a csf -e to flush and restart CSF. There is a vncserver running on port 5901 and when doing an ...
3
votes
2answers
2k views

What is a solid iptables configuration for my desktop?

On my desktop, I want to configure iptables pretty strictly. I see no reason why I need to allow anything except for internet traffic that I initiated. And maybe even that could be limited to only a ...
0
votes
1answer
75 views

iptables - how to drop protocols [closed]

I have the desktop-server Debian Jessie machine running for testing purposes just for 19 hours now. I have already set a few rules as you can see above. But I am not really into networking. So it ...
0
votes
0answers
17 views

iptables: block communication with others in same subnet

I have a couple of devices in my subnet (e.g. 192.168.0.0/24) and would like to make sure that one of these devices (identified by MAC or IP) can only talk via the router (where I'd like to set up ...
4
votes
2answers
1k views

NAT and source IP filtering in PF, using OpenBSD >= 4.7

I just read a book about PF (The Book Of PF, No Starch), but there's one question not answered by it. If I have a gateway machine using two interfaces, $int_if and $ext_if, and I NAT the packages ...
1
vote
0answers
39 views

Wireless ssh “issue” (No route to host)

I installed Debian Jessie (gnome) on one of my machines today and it went smoothly except for the wifi. Calling this machine A, I set up an ssh connection with machine B (using an rsa key) and then I ...
5
votes
1answer
3k views

Installing pfSense firewall on an SSD

I was looking at creating a home firewall running pfSense (as I could not get IPCop to boot properly on my hardware). Doing a little research, however, I have some concerns with installing it onto an ...
1
vote
1answer
43 views

iptables - why do I get “Table does not exist (do you need to insmod?)”

I need to install some iptable ruels to block traffic that originates from a certain country, I found this script example on http://www.cyberciti.biz/faq/block-entier-country-using-iptables/ it works ...
2
votes
1answer
32 views

Iptables rule to drop packets to and from local network

I want to set a virtual machine on laptop, but I don't trust the guest system fully, so I would like to block it's access to local network (to network 192.168.0.1/16 or 10.0.0.1/8 or ... the other one ...
15
votes
2answers
14k views

UFW: Allow traffic only from a domain with dynamic IP address

I run a VPS which I would like to secure using UFW, allowing connections only to port 80. However, in order to be able to administer it remotely, I need to keep port 22 open and make it reachable from ...
1
vote
1answer
26 views

Using IPTables to Block Ports to Class A Subnets While Allowing Web Ports (80/443)

This is about a cPanel server which, like most servers, is under constant attack from lands afar. Considering that I only host to clients in the US and Canada, there is less of a reason to allow full ...
-1
votes
3answers
29 views

How to stop outbound ftp from being established. centos/ rhel

What is the method to block a machine from establishing connection to an outside ftp server. Both ftp and sftp. inet, iptables, shutdown service?
1
vote
2answers
37 views

Unlocking all ports in a router when using Linux

I heard that Linux's open ports are not very vulnerable, so a normal desktop Linux installation doesn't need a firewall. Still, my router (Dlink) blocks some ports, even in LAN. Would it be a bad ...
1
vote
1answer
19 views

Advanced Policy Firewall: allow_hosts.rules doesn't work

I'm trying to open ports for Nimsoft. In allow_hosts.rules I opened ports for private network: tcp:in:d=48000_48020:s=10.0.0.0/8 tcp:out:d=48000_48020:d=10.0.0.0/8 During starting apf I see that ...
0
votes
0answers
33 views

Linux VM as a firewall

I have 3 vms a->b->c. I want to setup b as a firewall. Traffic is routed from a to c through b and I put a file on c. How do I show that b works as a firewall (first show that you are able to transfer ...
0
votes
3answers
79 views

Port is open but I can't ssh to it

My company PC is behind the firewall, I want to connect to my remote server. The port is open however I can not connect to it, does anyone know the root cause? From my company PC connect to my ...
1
vote
0answers
52 views

Change timeout of an entry of ipset with iptables rule

I'm trying to create a set with ipset and using it in some iptables rules. ipset has timeout option to set a countdown timeout to an entry of a set to automatically remove it after a period of time. ...
0
votes
2answers
223 views

How to let the Firewall of RHEL7 the SNMP connection passing?

How to let the Firewall of RHEL7 the SNMP connection passing? When I did this command on the computer: systemctl stop firewalld All the SNMP packet are passing well. When I restarted firewalld ...
0
votes
2answers
36 views

Working with firewall-protected server through ssh (dynamic IP)

I need to work on a Debian 6 server through SSH. The server is firewall-protected and SSH connections are filtered based on the user IP. Unfortunately I have an ISP provider with dynamic IP - it's ...
0
votes
0answers
24 views

Is there any way to configure fully automated proxyclient for workstations?

My network diagram is similar to above image; pc-router is also acting as firewall & I'm running squid on it. pc-router is running debian Vlan having workstations running fedora, ubuntu and ...
2
votes
1answer
52 views

iptables to block all websites

I have Debian 7, and I want to block all websites in my computer, unless my email, using IPTABLES or others firewall. How can I block all website, include http and https too. How can I do this?
1
vote
2answers
198 views

Error when redirecting ports with iptables: No chain/target/match by that name

I am trying to redirect all incoming TCP connections, originally to port 80, to port 8090, because I am running Confluence in 8090 and I want to avoid it running as root, which is a requirement to ...
1
vote
1answer
63 views

Blocking or forwarding packets as access point

I set up my Pi 2 as a wifi access point following this tutorial. I'd like to implement a rudimentary QoS, according to the DSCP field in every packet's header. That means, blocking packets using low ...
3
votes
1answer
183 views

Which ports should I open for apt-get to work?

I installed Webmin, and then set up the firewall like this: INPUT SSH port ALLOWED Webmin port ALLOWED HTTP port (80) ALLOWED DROP EVERYTHING ELSE FORWARDING no rules OUTPUT no rules If I remove ...
0
votes
1answer
42 views

ufw rule deny default outgoing

I want to deny all outgoing traffic by default, except ssh connections. I added this rules: ufw default deny outgoing ufw allow ssh Then I restarted the firewall by: ufw disable ufw enable ...
1
vote
1answer
96 views

Block outgoing connections to certain IP using PF

Can someone give me a hint on how to setup a basic deny rule whenever any TCP request is sent to a specific IP address? I am using the PF packet filter. Any help?
3
votes
1answer
196 views

How to combine iptables rulesets

Say there are several iptables scripts (run at boot time), all of which run something like iptables -A ... to add rules. I'm thinking this could be improved, turning all those shell scripts into text ...
0
votes
1answer
57 views

Block outgoing connection from running process

I have an java application that I have been developing. I use a external db server that I can't control. I want to simulate connection error to it, but I'm unable to do it. I have tried to use ...
2
votes
1answer
116 views

How to Mark Traffic using IPtables?

I'm trying to mark traffic, How shall I write following code in terms of IPtables? /ip firewall mangle> add chain=prerouting src-address=10.1.1.1/32 action=mark-connection \ ...
2
votes
1answer
517 views

iptables Port Forwarding — no service with the port

I have setup a network as in the image below: Firewall (FW) running CentOS 6 has two physical interfaces with subinterfaces: eth0:2 — 10.100.1.78/25 eth0:3 — 10.100.1.79/25 eth3 — 192.168.0.21/24 ...
0
votes
1answer
108 views

How to block telnet using iptables command

I am trying to block telnet on my server but I have failed to do so. I have added following firewall rules in INPUT chain of filter table for the same. INPUT CHAIN(filter table): <some other ...
1
vote
2answers
88 views

iptables configuration - ssh connection only from a remote network

I'm trying to configure Iptables of a server in order to permit SSH incoming connections only from a certain network. by the way this is the rule chain : # Drop anything we aren't explicitly ...
14
votes
1answer
12k views

Difference between SNAT and Masquerade

I am confused what's the actual difference between SNAT and Masquerade? If I want to share my internet connection on local network then whether should I select SNAT or Masquerade?
0
votes
0answers
59 views

Why is my laptop being blocked from connecting to a PPTP VPN server?

I have a fairly simple network at home Internet --> Modem --> Linux Router --> Switch --> Laptop The problem: There is a PPTP VPN server at work that I need to connect to from home. I configured my ...
0
votes
1answer
72 views

to allow certain ips and block all other connections on AMAZON EC2 ubuntu 12.04

How do I allow certain IPs and block all other connection in iptables on AMAZON EC2?
0
votes
1answer
191 views

is iptables broken on my raspberry-pi? how to fix?

I am getting some person(s) trying to brute force my ssh, from multiple ip addresses (small sample) : May 22 19:50:02 rpi sshd[1272]: pam_unix(sshd:auth): authentication failure; logname= uid=0 ...
2
votes
2answers
109 views

How can I allow SSH and SMTP only using IPTables?

I've got a raspberry pi set up to send me periodic emails. As it's connected to the internet 24/7, I need IPTables set up properly. I want to allow incoming SSH and allow emails to send out on port ...
11
votes
3answers
16k views

How can I block a range of IP addresses with an Amazon EC2 instance?

I know a certain range of IP addresses are causing problem with my server, 172.64.*.* what is the best way to block access to my Amazon EC2 instance? Is there a way to do this using security groups or ...
6
votes
2answers
14k views

IPTables - Port to another ip & port (from the inside)

I currently have a NAS box running under port 80. To access the NAS from the outside, I mapped the port 8080 to port 80 on the NAS as follow: iptables -t nat -A PREROUTING -p tcp --dport 8080 -j DNAT ...
1
vote
1answer
49 views

Help about CentOS 7 apps & Driver [closed]

I'm using pc for several years but never tried Linux so I'm quite noob in this field. I'm using Autodesk maya, Nuke & will learn houdini very soon. I found that linux works faster for this apps so ...
0
votes
2answers
99 views

Determine what port OpenSUSE firewall is blocking

I am having a problem with the WebStorm IDE in that I cannot use its built-in FTP capabilities probably due to my OpenSUSE (Tumbleweed) firewall blocking some needed ports. I am assuming that because ...
1
vote
1answer
49 views

Linux IPTables - Ignore Range of IPAddresses

I am currently modifying some of my IPtables rules on a public server and have run into a bit of a dilemma. The goal is to do the following: Rate limit the amount of SSH connections that can be made ...
1
vote
0answers
22 views

equivalent of iptables rule in ip6tables

I m newbie in the iptables. I have the following iptables rules in the source code of a project iptables -t mangle -I PREROUTING ! -i br0 -p TCP --dport 45 -j MARK --set-mark 0x1000 iptables -t nat ...
3
votes
4answers
3k views

How to do domain filtering in Linux?

Preferably something similar to iptables. Basically, I want to do domain filtering/whitelisting/blacklisting like I would with IPs in iptables. Are there any recommendations on how to do this?
0
votes
0answers
79 views

firewalld isn't blocking/dropping ports for ports mapped from docker containers

I have firewalld installed and running on my machine. here are my active zones # firewall-cmd --list-all-zones ... drop (active) interfaces: enp2s0 sources: services: http https ssh ports: ...