A firewall is a program that controls the incoming and outgoing network traffic on a system. Use this tag for all questions related to firewall configuration and operation.

learn more… | top users | synonyms

5
votes
1answer
2k views

Outgoing firewall application similar to Little Snitch for Mac

Is there a Linux application similar to Little Snitch? Little Snitch is an outgoing firewall that temporarily blocks outgoing network requests until the user decides whether to allow the connection or ...
4
votes
2answers
1k views

NAT and source IP filtering in PF, using OpenBSD >= 4.7

I just read a book about PF (The Book Of PF, No Starch), but there's one question not answered by it. If I have a gateway machine using two interfaces, $int_if and $ext_if, and I NAT the packages ...
0
votes
1answer
475 views

PPTP Through IPTables

If this has already been answered, I apologize, I could not find an answer to this during my searching. I am new at Linux/Unix and I have recently implemented a Raspberry Pi firewall/gateway on my ...
6
votes
1answer
3k views

Installing pfSense firewall on an SSD

I was looking at creating a home firewall running pfSense (as I could not get IPCop to boot properly on my hardware). Doing a little research, however, I have some concerns with installing it onto an ...
0
votes
0answers
24 views

'iptables -a' just hangs and never returns? [on hold]

I'd like to redirect requests in on port 80 to a service I already have running on port 8443. I swear I've used this command before on other systems and it's worked: sudo iptables -A PREROUTING -t ...
3
votes
1answer
66 views

Block all internet connections unless connected to OpenVPN server

I want to block all internet connections unless I'm connected to my OpenVPN. Now of course, I need to allow connection to the VPN server. Can this be done, by allowing out/in traffic to/from the VPN ...
14
votes
5answers
55k views

How to check whether firewall opened for a port but not listening on the port

We will be deploying a new application to a Server and the application will be listening on port 8443. We have asked Network team to open the firewall for the port 8443 on that server before deploying ...
1
vote
1answer
26 views

Debian Jessie server has no internet access

I have a server running Debian 8 Jessie that constantly loses it's internet access for seemingly no reason. The server has two wired connections, the internet access is on eth0 and the internal ...
1
vote
1answer
49 views

UFW rules to allow specific behaviour

I'm new to UFW. One of our servers were compromised and I had to immediately: Deny all inbound. Deny all outbound. Allow all SSH. Allow outbound DNS. Allow Git clone, push, pull, etc. Allow only ...
3
votes
3answers
8k views

How can I make iptables service start automatically after reboot on CenOS/RHEL7?

I am having a few issues with a newly installed home server I am preparing. I have installed CentOS7 on it and I found that port 80 and 443 are off by default. I therefore added them to the iptables ...
2
votes
2answers
49 views

Block Internet access, but not network access for a user

Hi I would like to block one user on all of the linux machines (Debian Wheezy) from being able to surf the internet, chat and email. However they are using linux based Rip stations for large format ...
1
vote
1answer
16 views

UFW: Allow traffic only from a dynamic IP on its last 2 elements

I am trying to setup the following rule on ufw: ufw allow from 217.87.123.0/24 So to allow incoming connections from all 217.87.123.* addresses. The problem is that my IP does not always start ...
0
votes
1answer
22 views

IP tables - how to configure connections into my compuer

I have a problem with following thing: Foreign connection is connection initialized not by my computer. I would like to accept only foreign connection such that port is 22 or from interval [1000, ...
4
votes
1answer
36 views

Is libvirt dnsmasq exposed to the network, if I run Fedora without a firewall?

There's this nice saying from Ubuntu: no open ports on the default install. Other Linux OS's look the same, including Fedora. No-one wants to worry about firewalls, if they don't need to. Yuck, ...
0
votes
0answers
34 views

Linux: Building our own firewall box?

I'm actually on AWS Cloud, but sick of their limitations of IP Blocking feature given in Network ACLs there. Because Network ACLs can "BLOCK" by IP but they have rule limitations. So i came to think ...
8
votes
5answers
1k views

iptables on tor exit node

I want to run an open Tor router. My exit policy will be similar to ReducedExitPolicy. But I also want to make it hard for the tor network to abuse my resources. Cases I want to prevent clients ...
5
votes
1answer
7k views

Ignore a specific ip for fail2ban

I am using fail2ban with ipfw on FreeBSD. Is there a way to ignore a specific ip address, making sure that fail2ban never blocks or reports it?
1
vote
0answers
11 views

What puts TCPMSS in iptables?

I used to have (well, I still sort of do) have a script that expects: -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu to have been entered in to iptables ahead of my ...
1
vote
1answer
37 views

Firewalling Samba

at the moment I'm trying to implement the firewall for my linux file server. Everything is working as expected except form the samba server. I have searched through the internet already but non of the ...
0
votes
0answers
42 views

IPTables if more than 30 connection in 1 minute ban IP for 1 hour?

I am trying to setup a firewall that limits to 3 connections per IP and also ban the IP for an hour if > 30 connection attempts in one minute. Is this all possible with iptables? So far I have only ...
1
vote
0answers
203 views

pfsense: squid transparent proxy not working in bridge mode

I have installed the latest version of pfsense. I have setup it up in bridge mode after creating a rule any for lan and wan respectively. I have setup the squid on transparent proxy mode with ssl ...
0
votes
1answer
203 views

What does the last column in this IP table mean?

I ran the following commands I found in a tutorial: $sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT $ sudo iptables -L and got target prot opt source ...
3
votes
0answers
23 views

connlimit counters start over after iptables restored

I have a connlimit rule in iptables that allow only 5 connection to port 80. iptables -A FORWARD -p tcp -m tcp --syn --dport 80 -m connlimit --connlimit-above 5 --connlimit-saddr -j DROP This ...
0
votes
1answer
24 views

Can Shorewall be used on VyOS?

Will VyOS still work right if I install Shorewall-lite on it? Shorewall seems like an easier way to setup a network, but VyOS seems pretty great for day-to-day management of a router / firewall. So ...
0
votes
0answers
123 views

string matching not working in iptables

We have a RHEL 6.7 DNS server and we are trying to discard packets that contain certain domains. For example, one of our DNS servers was involved in a random subdomain attack, where external hosts or ...
1
vote
1answer
249 views

How to setup reverse FTP in RHEL?

Researched: http://www.thecave.info/export-proxy-username-password-linux/ http://stackoverflow.com/questions/5334110/text-based-ftp-client-settings-behind-a-proxy ...
1
vote
1answer
14 views

ip_conntrack_max test not working

I am trying to do some ip_conntrack_max kernel parameter testing, but somehow its not working. -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT I have set following value to see its filling ...
1
vote
2answers
46 views

Is UFW behind a firewall(ed) gateway router necessary

Is it really necessary to run UFW behind my Gateway Router which already has Firewall/Port rules? In this example, I am discussing running UFW on an Internet Accessible (Linux) Server that is behind ...
0
votes
0answers
8 views

how to safely increate ip_conntrack value

How do i calculate how much memory my single ip_conntrack connection will eat? I am planning to increate ip_conntrack on system but i want to be careful to not overcommit number. Is that any basic ...
1
vote
1answer
165 views

firewall-cmd forward rules for interface with multiple IPs?

I'm looking for a way with firewall-cmd or another command to do the following. An incoming public interface has multiple ip addresses bound to it. How can I forward ports only for one of the IP ...
4
votes
3answers
5k views

Can logging be enabled in FirewallD

I'm running Fedora 20 and would like to see what my firewall is doing in the background. Is it possible to view a log of the traffic blocked by FirewallD?
1
vote
1answer
51 views

ipset v4.5: Unknown set type

I compiled ipset on CentOS5 32bit machine and i am getting weird errors My kernel: [root@localhost ipset-4.5]# uname -a Linux localhost.localdomain 2.6.18-400.1.1.el5 #1 SMP Thu Dec 18 00:58:32 EST ...
0
votes
1answer
19 views

In what order are the rules handled in the Linux Firewall Module in webmin?

If I'm not mistaken it's top to bottom correct? And the catch-all default action at the end is to just drop any packets that don't match the rules above. Should I be logging the dropped packets as ...
1
vote
1answer
59 views

ufw allow ssh - and then connection gets lost

I'm trying to set up a debian server in the cloud, over SSH. I log in using a key. After the initial startup I want to set UFW: apt-get install ufw ufw allow ssh ufw enable This is how I've done ...
1
vote
1answer
23 views

Basic Hosting Postgresql in Virtualbox + Ubuntu 14.04

I have configured Postgres to accept network connections from anywhere: In pg_hga.conf: host all all 0.0.0.0/0 md5 In postgresql.conf: listen_addresses = ...
-3
votes
1answer
47 views

i have problem with firewall this question like this: [closed]

configure packet filtering firewall to allow DNS, HTTPS from outside to server configure PAT for HTTP using port 8080 from outside to server deny all other services and i have problem like this ...
0
votes
1answer
211 views

Connection refused on port 8081 using curl

I have two CentOS 7 boxes, called Turbo and Demo. I started a daemon/service on the first one, Turbo, and wish to call the service from the second one, Demo. I started the service to monitor port ...
0
votes
1answer
55 views

Iptables: does dropping UDP packets take place in the user-space or kernel-space?

I know that Iptables is a user-space module, I also read it "configures" kernel modules to do big part of the filtering. So my question is, if I add a rule to allow only TCP:443 packets, would this be ...
3
votes
1answer
306 views

How can I let ipset entries “age”?

I am trying to establish a whitelist of clients that have successfully logged into the system, using ipset. What options do I have to let an entry age so that I can later discard it based on its age? ...
0
votes
0answers
20 views

Debian 8 and few questions about Graphical Firewall?

So I have installed Debian 8 today and so far so good. What I want to achieve now is to install firewall but can't find Firestarter in repos (discontinued ?). So I have installed a GUFW and set it up ...
4
votes
1answer
5k views

How to Block SSH Brute Force via Iptables and How does it work?

I'm planning to add the following rules to iptables to stop ssh brute force attack which are common these days. -A INPUT -i eth0.103 -p tcp -m tcp --dport 4522 -m state --state NEW -m recent --set ...
0
votes
0answers
12 views

Ubuntu Network Crashed?

So I have a server from ovh. When I was messing with the network I went to flush iptables and reload the network, and well it crashed all of the ports. So I thought I just need to reboot the server, ...
0
votes
1answer
17 views

firewall configuration to prevent a server-client malware connection

can i prevent a malware to connect on my pc simply setting ''incoming traffic to deny'' and allowing only outgoing traffic? I red that a malware could use the port knoking tecnique, but with a GUI ...
0
votes
1answer
17 views

How to customize Shorewall firewall logs

I am using Fedora 13 machine with shorewall installed. shorewall 4.6.6-RC1 iptables v1.4.7 Below is log format by shorewall: Oct 23 05:28:17 localhost kernel: shorewall:LAN-LAN:ACCEPT:IN= OUT=lo ...
0
votes
0answers
30 views

How can I improve this script to install pptpd & csf on a Centos 6.5 openvz box?

I'm working on a script to ease the deployment of pptpd and csf on openvz boxes. Here's what I've got so far: echo "Installing epel repository, wget, and bind-utils..." yum -y install epel* yum -y ...
0
votes
1answer
26 views

iptables logging for all except ICMP

I have iptables firewalls and its logging for all DROP packets or Deny. I want to tell it to no LOG any packet for ICMP protocol. How do i tell that *filter :INPUT DROP [0:0] :FORWARD ACCEPT [0:0] ...
1
vote
2answers
100 views

Route incoming and outgoing on same interface

My router currently provides the NAT to all the PCs and the Ubuntu desktop (with some server functions) in the network. I want to use the Ubuntu system as a proper firewall, but it only has one ...
3
votes
1answer
1k views

Proper way to handle FTP over SSL with restrictive firewall rules?

Without SSL, FTP works fine over a stateful Firewall, like netfilter (iptables) + the nf_conntrack_ftp kernel module like this: # modprobe nf_conntrack_ftp # iptables -A INPUT -m conntrack --ctstate ...
1
vote
0answers
44 views

How to Limit the hit-rate of connection for “X-Forwarded-for” IPs?

I have Apache, which is behind the Amazon ELB which forwards the IPs as in "X-Forwarded-for" header. I found some articles around to do the hitrate limitation but i doubt they are all for real IPs, ...
1
vote
0answers
29 views

Limiting number of simultaneous connections system-wide?

In my dormintory, I've got a not-so-nice networking environment, in which I'm identified only by mac-address of my ethernet card. In said environments, some limits of simultaneous opened connections ...