Tag Info

Hot answers tagged

59

I love explaining this kind of thing through visualization. :-) Think of your SSH connections as tubes. Big tubes. Normally, you'll reach through these tubes to run a shell on a remote computer. The shell runs in a virtual terminal (tty). But you know this part already. Think of your tunnel as a tube within a tube. You still have the big SSH ...


27

There may not be a service running right now, but how about tomorrow? You have them all turned off, but what about your users? Anyone on a unix/windows/mac system can open a port > 1024 on any machine they have access to. What about malware? What about a virus? They can also open up ports and start serving information to the world, or start listening ...


15

What do the three rules do? Those 3 rules seem pretty self-explanatory: Reject incoming UDP packets with an ICMP message "port unreachable" Reject incoming TCP packets with "tcp reset" Reject incoming packets (of any other protocol) with ICMP message "protocol unreachable" If you're looking for more detail (about UDP/TCP packets, ICMP), you need to ...


14

At first, a firewall should be the last step to secure a server. Remove all software and services which are not needed, update your system with the latest available security patches and review your config files. Why do you want to avoid iptables? "Because I'm a newbie" is no real excuse. A "one click everything secure" firewall doesn't exist, and if a ...


10

I have drawn some sketches The machine, where the ssh tunnel command is typed is called »your host«. Introduction local: -L Specifies that the given port on the local (client) host is to be forwarded to the given host and port on the remote side. ssh -L sourcePort:forwardToHost:onPort connectToHost means: connect with ssh to connectToHost, and ...


10

Packets can be in various states when using stateful packet inspection. New: The packet is not part of any known flow or socket and the TCP flags have the SYN bit on. Established: The packet matches a flow or socket tracked by CONNTRACK and has any TCP flags. After the initial TCP handshake is completed the SYN bit must be off for a packet to be in state ...


10

Because the tool called system-config-firewall(or it´s ncurses based brother system-config-firewall-tui) manages this file. Every time you use this tool to create new iptables rules, it will overwrite /etc/sysconfig/iptables. Related Manpage: 28.1.16. /etc/sysconfig/iptables-config This is why it's not recommended, but not prohibited. The best way to save ...


9

The SNAT target requires you to give it an IP address to apply to all the outgoing packets. The MASQUERADE target lets you give it an interface, and whatever address is on that interface is the address that is applied to all the outgoing packets. In addition, with SNAT, the kernel's connection tracking keeps track of all the connections when the interface ...


9

Your question is a very similar to http://stackoverflow.com/questions/5451206/linux-per-program-firewall-similar-to-windows-and-mac-counterparts There was the --cmd-owner for iptables's owner module, but it was removed because it worked not properly. Now a first beta version of Leopard Flower is available, which solves the problem by a user space daemon. ...


9

I think you have mixed two different things: The OpenBSD packet filter facilities (sometimes called pf, and mostly controlled by pfctl). These are the basis of OpenBSD firewalling, the Linux equivalent is netfilter, mostly controlled by the iptables command. Comparable, but not compatible (and most say that OpenBSD is superior to Linux in this aspect). ...


8

You could add a TRACE rule early in the chain to log every rule that the packet traverses. I would consider using iptables -L -v -n | less to let you search the rules. I would look port; address; and interface rules that apply. Given that you have so many rules you are likely running a mostly closed firewall, and are missing a permit rule for the traffic. ...


8

ssh tunneling works by using the already established ssh connection for sending additional traffic. When you connect to a remote server, you usually just have 1 channel for the normal user interaction (or 3 channels if you consider STDIN/STDOUT/STDERR separate). At any time, the local or remote ssh process can open additional channels on the existing ...


7

Deleting the default route should do this. You can show the routing table with /sbin/route, and delete the default with: sudo /sbin/route del default That'll leave your system connected to the local net, but with no idea where to send packets destined for beyond. This probably simulates the "no external access" situation very accurately. You can put it ...


7

You might consider trying ufw. While it was created for Ubuntu Server, I believe that that it is also available in Debian. (UPDATE: Unfortunately, it looks like it is only available for squeeze and sid according to packages.debian.org, but it might still be worth looking at.) While I would say that you eventually want to move to writing your own iptable ...


7

I wrote a blog post on basic Iptables rules for the desktop user a long time ago and you should probably read it, and its linked article on Stateful firewall design. But pre kernel 2.6.39 (which includes ipset and you may want to use that for whitelisting IP's if you have more than 10 to whitelist (where 10 is arbitrary)). First handle state's that we know ...


7

See whitelisting on the fail2ban website: # This will ignore connection coming from common private networks. # Note that local connections can come from other than just 127.0.0.1, so # this needs CIDR range too. ignoreip = 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 Another reference here: First, find ignoreip. It's always important for you to ...


7

The iptables command per default only shows entries of the filter table. But there are also other tables: There are probably some entries in the nat table. Add -t nat to your commands to look at them.


7

Link Mint is an Ubuntu-based distribution intended for desktop systems. One of its chief priorities is "ease of use" so a firewall just puts into play something that could break things for users. It's easier if the firewall only gets turned on if the operator is someone who knows what such a thing even is versus a novice user saying "Why don't it no worky?"


6

fail2ban does that, although I don't think it's the only such tool. (Amazed mentioned DenyHosts, although it seems to be SSH specific.)


6

Of course any services you have open will increase your vulnerable attack surface. What runs behind those services will determine how secure and insecure you become. If you write insecure PHP scripts and host them in your newly accessible Apache site, the world will be able to (and will!) exploit them. You should seriously consider what you are making ...


6

I use vncserver -localhost [other options here] when I start the vncserver on my debian boxes. This means VNC only accepts connections from the loopback of the remote machine.


6

This netfilter diagram (svg) seems to fit.


6

With the kernel's iptables completely empty (iptables -F), this will do what you ask: # iptables -A INPUT -p tcp --dport 22 -s 192.168.0.0/24 -j ACCEPT # iptables -A INPUT -p tcp --dport 22 -s 127.0.0.0/8 -j ACCEPT # iptables -A INPUT -p tcp --dport 22 -j DROP This says that all LAN addresses are allowed to talk to TCP port 22, that localhost gets the ...


6

Looks to me like that is because of a new version of iptables that came out in October. -m state --state has been obsoleted in favour of -m conntrack --ctstate. Hence, "The state match is obsolete. Use conntrack instead." http://forums.gentoo.org/viewtopic-t-940302-start-0.html http://blog.yjl.im/2012/11/iptables-state-match-is-obsolete-use.html ...


6

If you want to see if you can form a TCP connection from a remote machine, get OpenCSW installed on that and the target machine, and install netcat on both. This is the syntax for using netcat to test TCP connections: nc -vz targetServer portNum For example to check SSH on "homeServer1": nc -vz homeserver1 22 That enables you to test TCP-level ...


6

and yet on the very top of the file it says.. Hmmm, that's strange. At the top of mine it says: # Manual customization of this file is strongly encouraged. Someone must have changed it ;) And in fact even moved it out of /etc/sysconfig so it would not get "auto uncustomized" by the package manager or anything else ;) ;) I think the point here in ...


5

Run iptables -L -v -n to see the packet and byte counters for every table and for every rule.


5

Dan Robbins (the creator of Gentoo) wrote a great article on Stateful Firewall Design. It's by far the easiest to understand iptables tutorial. It says '2.4' however all but the kernel config will apply equally as well to '2.6'. Even though the article is hosted by gentoo (I could have linked to IBM developerworks too) it's distribution independent (except ...


5

Scapy is commonly used tool for this purpose. It can be used for creating any kind of packets.


5

iptables rules are sequential, meaning the first rule they hit that matches gets executed. rules like ACCEPT, DROP, and REJECT are terminal, meaning the packet will not proceed further into the chain.-A means append. So what you've done is match everything and REJECT it # everything stops here accept tcp port 80 # we never reach this because everything ...



Only top voted, non community-wiki answers of a minimum length are eligible