A firewall is a program that controls the incoming and outgoing network traffic on a system. Use this tag for all questions related to firewall configuration and operation.

learn more… | top users | synonyms

118
votes
3answers
75k views

How does reverse SSH tunneling work?

As I understand this, firewalls (assuming default settings) deny all incoming traffic that has no prior corresponding outgoing traffic. Based on Reversing an ssh connection and SSH Tunneling Made ...
14
votes
2answers
7k views

Per process firewall?

I've been reading around but can't seem to find a way to create per-process firewall rules. I know about iptables --uid-owner but that only works for outgoing traffic. I've considered scripting ...
3
votes
1answer
3k views

iptables/pf rule to only allow XY application/user?

I think there is no iptables/pf solution to only allow an XY application on e.g.: outbound tcp port 80, eth0. So if I have a userid: "500" then how could I block any other communications then the ...
11
votes
1answer
8k views

Configuring OpenVPN to use Firewalld instead of iptables on Centos 7

I need some help configuring OpenVPN on Centos 7 using firewalld. I used iptables on Centos 6.5 and only had to add the following lines to /etc/sysconfig/iptables: -A POSTROUTING -s "10.0.0.0/24" ...
8
votes
4answers
27k views

Set some firewall ports to only accept local network connections?

Basic firewall question: How do I set up the firewall on a system in a LAN so that some ports are only open to connections from the local area network, and not from the outside world? For instance, ...
6
votes
1answer
11k views

How to understand why the packet was considered INVALID by the `iptables`?

I set up some iptables rules so it logs and drops the packets that are INVALID (--state INVALID). Reading the logs how can I understand why the packet was considered invalid? For example, the ...
5
votes
1answer
2k views

How iptables tables and chains are traversed

I know linux has 3 built-in tables and each of them has its own chains as follow: FILTER: PREROUTING, FORWARD, POSTROUTING NAT: PREROUTING, INPUT, OUTPUT, POSTROUTING MANGLE: PREROUTING, INPUT, ...
3
votes
2answers
1k views

Do I need a special firewall on a personal computer

I am relatively new to Linux and was wondering about security issues. Most people agree that a virus-scanner is not useful on a linux system, but what about a firewall? I am using Debian wheezy stable ...
3
votes
2answers
698 views

Recommended reverse firewall applications for linux? [closed]

I'm looking for a reverse firewall, something like Little Snitch for Linux, but my google-fu is failing me. Does something like this exist on Linux?
1
vote
2answers
3k views

Error when redirecting ports with iptables: No chain/target/match by that name

I am trying to redirect all incoming TCP connections, originally to port 80, to port 8090, because I am running Confluence in 8090 and I want to avoid it running as root, which is a requirement to ...
0
votes
1answer
2k views

viewing firewalld logs via remote login to CentOS 7 server

I have firewalld installed in a remote CentOS server. When I log into the server over the internet as root, I type the following command to access the firewalld logs: journalctl ...
0
votes
4answers
2k views

Converting Linux into a Router- Traffic from eth0:0 to eth0

So I have been trying to convert my linux box which is running Mint into an router. eth0 has a public address that has 71.xx.xx.xx for an IP addr. I created an eth0:0 and set it an IP address , ...
-3
votes
1answer
50 views

i have problem with firewall this question like this: [closed]

configure packet filtering firewall to allow DNS, HTTPS from outside to server configure PAT for HTTP using port 8080 from outside to server deny all other services and i have problem like this ...
19
votes
1answer
11k views

Is it better to set -j REJECT or -j DROP in iptables?

There's an example of iptables rules on archlinux wiki: # Generated by iptables-save v1.4.18 on Sun Mar 17 14:21:12 2013 *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [0:0] :TCP - ...
8
votes
3answers
20k views

IPTables - Port to another ip & port (from the inside)

I currently have a NAS box running under port 80. To access the NAS from the outside, I mapped the port 8080 to port 80 on the NAS as follow: iptables -t nat -A PREROUTING -p tcp --dport 8080 -j DNAT ...
14
votes
2answers
16k views

( /etc/sysconfig/iptables ) “Manual customization of this file is not recommended.” Why?

Editing this file directly /etc/sysconfig/iptables can save me so much headaches so much time and so on... and yet on the very top of the file it says.. Manual customization of this file is not ...
12
votes
3answers
42k views

iptables: allow certain ips and block all other connection

How do I allow certain ips and block all other connection in iptables?
7
votes
4answers
7k views

Debian: Which firewall for a newbie?

I have to install a firewall on my server (so without X Server). It's a debian lenny. If it is possible, I want to avoid the use of iptables. Is there a way to install/configure a firewall for a ...
8
votes
1answer
5k views

Why doesn't my iptables rule work?

I have two interfaces on my VPS: eth0 and eth0:0. I want to block incoming packets on port 80 on eth0:0 using iptables. I tried this, but it doesn't work: iptables -A INPUT -i "eth0:0" -p tcp ...
15
votes
5answers
64k views

How to check whether firewall opened for a port but not listening on the port

We will be deploying a new application to a Server and the application will be listening on port 8443. We have asked Network team to open the firewall for the port 8443 on that server before deploying ...
1
vote
3answers
22k views

How to block https facebook site using iptables [duplicate]

Possible Duplicate: iptables to block https websites I am using Zentyal Os as a firewall, it working fine like blocking http sites and but I am not able to block https facebook site. My ...
6
votes
4answers
19k views

What prevents a machine from responding to pings?

I have a CentOS release 5.4 linux box on Amazon EC2 that I'm trying to set up to be monitored via Nagios. The machine is in the same security group as the nagios server, but it seems to be ...
6
votes
2answers
1k views

Configuring a vncserver so it's only accessible from my ssh tunnel

Since I use vnc through an ssh tunnel, is there any way I can block the open vnc port that the remote machine is listening on without it affecting my ability to use the ssh tunnel? Both machines are ...
4
votes
3answers
237 views

OpenBSD's pf: disable network access for a given user, except for ssh.

If we are using the default firewall for OpenBSD, how can we modify it to disable all the network access for a normal user except for one thing: we want to ssh to the user from random hosts! So ...
1
vote
0answers
74 views

How to send packets coming from a second router on a particular port back to the router, using iptables not a route

I have a Linux server which runs a particular service listening on a single TCP port. The Linux server connects to the internet using a PPP connection and also acts as router for a local network using ...
3
votes
1answer
499 views

Changed SSH port without allowing it through firewall, locked out now - what to do?

I have a VPS where I changed the SSH port from the default 22. Unfortunately I forgot to allow the new port through the firewall. I don't have physical access to the server, and my host does not seem ...
1
vote
2answers
149 views

Route incoming and outgoing on same interface

My router currently provides the NAT to all the PCs and the Ubuntu desktop (with some server functions) in the network. I want to use the Ubuntu system as a proper firewall, but it only has one ...
1
vote
1answer
506 views

multiple user-types/access-rules for OpenVPN on CentOS 7 and firewalld

How can I define separate roles for users and administrator in OpenVPN running on CentOS 7 server? Specifically, the users must only be allowed to https, while the administrator must be allowed to ...
1
vote
1answer
678 views

Does an in-kernel firewall sit between the network access layer and Internet layer?

This question is a follow-up to my previous question. Logic for me to says that an in-kernel firewall sits between the network access layer and the Internet layer, because it needs to have access to ...
1
vote
1answer
3k views

Redirect http using iptables for an ip range

I have a range of ip addresses (10.13.13.10-19) that I want to redirect all outgoing http traffic to an internal webserver. So if someone in that range tried to access any site, the html from my ...
0
votes
1answer
37 views

iptables logging for all except ICMP

I have iptables firewalls and its logging for all DROP packets or Deny. I want to tell it to no LOG any packet for ICMP protocol. How do i tell that *filter :INPUT DROP [0:0] :FORWARD ACCEPT [0:0] ...
0
votes
1answer
925 views

how to make firewall changes permanent via firewall-cmd?

I am trying to open some ports in CentOS 7. I am able to open a port with the following command: firewall-cmd --direct --add-rule ipv4 filter IN_public_allow 0 -m tcp -p tcp --dport 7199 -j ACCEPT ...
-1
votes
1answer
2k views

How to block HTTPS site using RHEL Squid?

I want to block HTTPS sites using Linux Squid server. How can I do this?