A firewall is a program that controls the incoming and outgoing network traffic on a system. Use this tag for all questions related to firewall configuration and operation.

learn more… | top users | synonyms

4
votes
0answers
108 views

Disable networking only inside of a single terminal

I want to run a command in the terminal to disable networking, just in that terminal. How can that be accomplished? I'm running OSX. Note: I only want to disable the networking in that terminal. ...
4
votes
0answers
402 views

iptables: using “conntrack” and “recent” modules to block unsolicited packets

When I only allow RELATED and ESTABLISHED packets, and DROP everything else, my firewall rules work perfectly and I have no problems: ### VARIANT A -A INPUT -i wlan0 -m conntrack --ctstate RELATED,...
3
votes
0answers
49 views

Why “echo f” in the case of clearing conntrack table doesn't work on debian?

Many people don't clear the conntrack table when they want to reload their firewall rules. When you have some ESTABLISHED connections, all the sessions won't be affected when you add a rule that ...
3
votes
0answers
963 views

OpenVPN and routing problem on OpenWRT

My home topology: router1 (192.168.1.1) - D-Link dsl2540u server with static IP available from Internet (ADSL via ppoe). 4 LAN ports. router2 (192.168.1.2) - D-Link DIR-300 with OpenWRT. Plays ...
3
votes
0answers
283 views

Why doesn't ufw enforce firewall rules for traffic coming from Virtualbox VM

I've been running Linux Mint 17 on my laptop for a while and thought I had it locked down to not allow any incoming traffic through "Firewall Configuration" (ufw GUI)—I have also validated this from ...
3
votes
0answers
8k views

Redhat / Centos 7 Firewalld best practice for pptp or L2TP/IPsec rules

Having a quick look at Centos 7, and though I'd spin up a VPN daemon or 3, but immediately discovered the usual packages aren't yet in the core repositories, so had to dig around and found the ...
2
votes
0answers
22 views

Why does mounting external harddrive trigger a UFW event?

Today I noticed when I plug in my 2TB external Toshiba hard drive, it triggers a ufw event in my logs: Jul 20 11:24:20 linuxbox kernel: [152873.728277] [UFW BLOCK] IN=inet1 OUT= MAC= SRC=xxxa DST=...
2
votes
0answers
69 views

Why is traffic matching the public zone instead of the desired zone?

Trying to self-train on firewalld I set up apache and configured the zones as follows: [root@localhost ~]# firewall-cmd --get-active-zones work sources: 192.168.122.1 public interfaces: ens3 [...
2
votes
0answers
223 views

Defining IPv6 chains in ip6tables-restore/iptables-restore files, is it possible?

The format for the files generated by iptables-save/ip6tables-save and loadable through iptables-restore/ip6tables-restore stipulates that one can prepend -4 or -6 respectively so as to maintain the ...
2
votes
0answers
197 views

FreeBSD pf firewall, new connections severly delayed when nating

I have a newly setup fbsd 9.1 with pf, which itself doesn't experience any slowness when for example downloading a debian iso from my local debian repo (ftp.se.debian.org). Any machine behind it, ...
2
votes
0answers
2k views

openwrt firewall - block a set of ip addresses from internet access

I'm running OpenWRT Attitude Adjustment r33556 / LuCI Trunk (trunk+svn9325) on my WNDR3800. I would like to configure my firewall to: Only allow a specific range of IP addresses to access internet, ...
2
votes
0answers
119 views

how to list blocked connections events by the firewall?

So, I used firestarter that had logged blocked connections events with some useful details (but it is not being updated and I found somewhat unsafe as any moment we could click to deactivate the ...
2
votes
0answers
314 views

Port Forwarding Between 2 Internet Machines

Here's my scenario: Setup There are 3 machines: A: on the internet : has ip (a.a.a.a), has port pa open B: my server / gateway : has ip (b.b.b.b), has port pb open C: on the internet : has ip (c....
2
votes
0answers
1k views

pfsense long ping to google

I have a pfsense box set up. What happens is I set a rule so I can't hit the admin interface 192.168.3.1 from the box. With the rule enabled --- www.l.google.com ping statistics --- 2 packets ...
1
vote
0answers
11 views

DD WRT restrict access but exclude subdomain

I know it's possible to restrict access to some websites in Access restrictions section. I'd like to know if it possible to exclude from restriction subdomain of a site. For example: http://...
1
vote
0answers
53 views

Why fail2ban doesn't put some IP address in jail

This is several days ago, I observed some IP addresses was't banned by fail2ban, and continued to brute force attack on different port of ssh. This an extract of my logwatch: undef: 22 times a [...
1
vote
0answers
82 views

How to block access to “private” host-only network from VirtualBox nat interface (separate host-only networks)?

Scenario: 1 VirtualBox host with many vms. Different host-only networks are configured for different vm categories: Some vms are "private", others are "standard" vms. Most of these vms, including some ...
1
vote
0answers
70 views

How to limit the number of connections per-host passing through a router/bridge?

For some reasons, our Internet provider has a limitation on the number of simultaneous opened connections between the machines hosted in our private network and the Internet which is around 4000 ...
1
vote
0answers
48 views

What puts TCPMSS in iptables?

I used to have (well, I still sort of do) have a script that expects: -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu to have been entered in to iptables ahead of my ...
1
vote
0answers
536 views

pfsense: squid transparent proxy not working in bridge mode

I have installed the latest version of pfsense. I have setup it up in bridge mode after creating a rule any for lan and wan respectively. I have setup the squid on transparent proxy mode with ssl ...
1
vote
0answers
53 views

How to Limit the hit-rate of connection for “X-Forwarded-for” IPs?

I have Apache, which is behind the Amazon ELB which forwards the IPs as in "X-Forwarded-for" header. I found some articles around to do the hitrate limitation but i doubt they are all for real IPs, ...
1
vote
0answers
32 views

Limiting number of simultaneous connections system-wide?

In my dormintory, I've got a not-so-nice networking environment, in which I'm identified only by mac-address of my ethernet card. In said environments, some limits of simultaneous opened connections ...
1
vote
0answers
82 views

UFW Preventing Web Browsing

I have the following rule set configured using UFW on Debian Jessie 8.2.0: Status: active Logging: on (low) Default: deny (incoming), deny (outgoing) New profiles: skip To ...
1
vote
0answers
31 views

Forward public network around current network

For the purposes of this discussion, I have a very current always-on linux machine with two nics: wifi0 eth0 A very crude diagram of my desired configuration looks like this: ...
1
vote
0answers
23 views

Separation between the User machine and Server machine by another linux for monitoring

I am planning to have three virtual machines with virtual box (m1, m2,m3). I already installed on m1 = Windows XP Home Edition, and on m2 = LUbuntu 15. The big picture is this : m1 : a user m2 : ...
1
vote
0answers
183 views

Wireless ssh “issue” (No route to host)

I installed Debian Jessie (gnome) on one of my machines today and it went smoothly except for the wifi. Calling this machine A, I set up an ssh connection with machine B (using an rsa key) and then I ...
1
vote
0answers
356 views

Change timeout of an entry of ipset with iptables rule

I'm trying to create a set with ipset and using it in some iptables rules. ipset has timeout option to set a countdown timeout to an entry of a set to automatically remove it after a period of time. ...
1
vote
0answers
41 views

equivalent of iptables rule in ip6tables

I m newbie in the iptables. I have the following iptables rules in the source code of a project iptables -t mangle -I PREROUTING ! -i br0 -p TCP --dport 45 -j MARK --set-mark 0x1000 iptables -t nat -...
1
vote
0answers
315 views

How to create a rule on IPCop firewall for bittorrent trafic to work properly?

I've been trying to use my favourite torrent client (µTorrent) after setting up my IPCop (last update 2.1.9) and it warned me that my router/firewall was blocking the traffic and that I had to open a ...
1
vote
0answers
147 views

CSF not blocking port when removed from csf.conf

I have removed VNC port 5901 from the csf.conf configuration file and executed a csf -f a csf -x and a csf -e to flush and restart CSF. There is a vncserver running on port 5901 and when doing an ...
1
vote
0answers
51 views

Shorewall configuration : providers and LAN

Hi all and thanks in advance for the answers. Currently, I have different providers configured in shorewall. I'll will probably have to change one of them. The problem is I won't have any Public IP ...
1
vote
0answers
165 views

How do you tweak iptables limit rules on openSUSE Tumbleweed?

I have a fresh install of openSUSE Tumbleweed, it is logging a lot firewall related stuff due to my apple devices multicasting to enable airplay. Lines look like: Mar 14 12:45:13 server kernel: SFW2-...
1
vote
0answers
147 views

ufw firewall - how to only “allow” when I am going through a proxy

I am using a proxy to navigate on internet, and I am trying to setup a firewall that will only let me connect to internet via this proxy: if I forgot to turn on the proxy, that I should not be able ...
1
vote
0answers
182 views

OpenWRT on embedded device as firewall

I have the following setup in my network: My internet comes in through an ATT Uverse modem/router. The router is in bridge mode because that ATT Uverse modem/router connects to a second higher ...
1
vote
0answers
163 views

Redirect all ARP traffic from eth0 to eth1

I would like to redirect ARP traffic, but I'm struggling with arptables and ebtables. I have 2 interfaces: eth0 10.10.10.25 eth1 10.10.10.20 Both in 10.10.10.0/24 I want to redirect the ARP ...
1
vote
0answers
171 views

Linux Bridge Network with Static IP Addresses and Firewall

any and all help is appreciated. I am trying to set up my Network Map Can you give me advice in setting up my interface file? If I set a static IP on my PLC on the same gateway, I shouldn't need to ...
1
vote
0answers
83 views

Initial iptable rule and knockd operation in vps

Today I launched a vps with Debian 7 x64 and started playing around with it. I installed xampp as well as knock daemon to get my hands dirty. So, all I wanted to do was to actually block all requests ...
1
vote
0answers
498 views

iptables: can't open tcp port

I'm running a Raspberry PI B+: Linux pi 3.12.28+ #709 PREEMPT Mon Sep 8 15:28:00 BST 2014 armv6l GNU/Linux The Raspberry is connect via lan (dhcp. ip: 192.168.78.29) to the local network. I'm trying ...
1
vote
0answers
288 views

Iptables and --tcp-flags

If I have the following rule in the nat-table in the prerouting chain: 0 0 REDIRECT tcp -- eth5 any anywhere anywhere tcp flags:FIN,SYN,RST,ACK/SYN redir ports ...
1
vote
0answers
342 views

Configure firewalld for OpenVPN (server-bridge) in Fedora 20

I've installed an OpenVPN server on Fedora 20 (server-bridge), but I cannot get it to work. I'm almost sure that It's a firewall issue. I'm trying to connect from an OSX client, but I can connect (...
1
vote
0answers
112 views

How to debug the network issue in case of blocked database connections

I am trying to understand if my analysis of the below information is correct. For all the 3 scenarios listed here, port 80, port 3306 and port 22 are open in the server's firewall. Also, for all the 3 ...
1
vote
0answers
228 views

How do I control ip routing in the new firewalld?

I have the following scenario: Our fedora server is connected to the internet on eth0 and has a second nic, wlan0 acting as an access point. The purpose of the access point is to provide a connection ...
1
vote
0answers
381 views

iptables server behind NAT accessible from outside as well as inside the nat

I have 2 machines with a KVM running on each machine - so two kvms with the below networking Host 1: 192.168.10.100 (eth2) 10.10.100.1 (virbr1) KVM 1 (NAT with Host 1): 10.10.100.128 (eth0 ...
1
vote
0answers
204 views

Linux firewall distro that can configure a vpn connection as a WAN interface?

I'd like to setup linux as a router w/firewall between My machine and the internet. The linux box should connect to a VPN account using OpenVPN on boot (managed to get that done). Then the firewall ...
1
vote
0answers
934 views

iptables and physdev match confusion

I'd like to be able to prevent a network bridge from generating certain types of traffic from some of its interfaces. If I understand iptables correctly, packets generate by a device appear on the ...
1
vote
0answers
370 views

cntlm: the request was denied

I have configured CNTLM server between users and Windows TMG firewall. CNTLM configured with "allow all" - no any ACL or something like it: Gateway yes # # Useful in Gateway mode to allow/restrict ...
1
vote
0answers
80 views

How to send packets coming from a second router on a particular port back to the router, using iptables not a route

I have a Linux server which runs a particular service listening on a single TCP port. The Linux server connects to the internet using a PPP connection and also acts as router for a local network using ...
1
vote
0answers
95 views

Shorewall “ERROR: Ordinary users may not start the /etc/shorewall configuration” in Cygwin

I am using Cygwin on Windows 7 and I have installed Shorewall 4.5.21.5. When I try to start shorewall in Cygwin, it gives me error: $ shorewall start ERROR: Ordinary users may not start the /etc/...
1
vote
0answers
472 views

destination IP mangle table

I have machine with 2 interfaces: eth1 connected to internet (ip xx.xx.xx.xx) eth0 connected to my laptop (ip yy.yy.yy.yy) I add those lines to the firewall file in order to manage the bandwidth ...
1
vote
0answers
202 views

Firewall config prevents hibernate connecting to postgres in CentOS6.3

I have an operating environment in CentOS 6.3 that has tomcat7 and postgres9.2 installed. There is just one web application deployed in tomcat that tries to establish a connection from localhost to ...