Hot answers tagged

147

I love explaining this kind of thing through visualization. :-) Think of your SSH connections as tubes. Big tubes. Normally, you'll reach through these tubes to run a shell on a remote computer. The shell runs in a virtual terminal (tty). But you know this part already. Think of your tunnel as a tube within a tube. You still have the big SSH ...


93

I have drawn some sketches The machine, where the ssh tunnel command is typed is called »your host«. Introduction local: -L Specifies that the given port on the local (client) host is to be forwarded to the given host and port on the remote side. ssh -L sourcePort:forwardToHost:onPort connectToHost means: connect with ssh to connectToHost, and ...


28

There may not be a service running right now, but how about tomorrow? You have them all turned off, but what about your users? Anyone on a unix/windows/mac system can open a port > 1024 on any machine they have access to. What about malware? What about a virus? They can also open up ports and start serving information to the world, or start listening ...


24

What do the three rules do? Those 3 rules seem pretty self-explanatory: Reject incoming UDP packets with an ICMP message "port unreachable" Reject incoming TCP packets with "tcp reset" Reject incoming packets (of any other protocol) with ICMP message "protocol unreachable" If you're looking for more detail (about UDP/TCP packets, ICMP), you need to ...


21

The SNAT target requires you to give it an IP address to apply to all the outgoing packets. The MASQUERADE target lets you give it an interface, and whatever address is on that interface is the address that is applied to all the outgoing packets. In addition, with SNAT, the kernel's connection tracking keeps track of all the connections when the interface ...


21

I don't believe this is possible with ufw. ufw is just a frontend to iptables which also lacks this feature, so one approach would be to create a crontab entry which would periodically run and check if the IP address has changed. If it has then it will update it. You might be tempted to do this: $ iptables -A INPUT -p tcp --src mydomain.dyndns.org --dport ...


14

At first, a firewall should be the last step to secure a server. Remove all software and services which are not needed, update your system with the latest available security patches and review your config files. Why do you want to avoid iptables? "Because I'm a newbie" is no real excuse. A "one click everything secure" firewall doesn't exist, and if a ...


13

Packets can be in various states when using stateful packet inspection. New: The packet is not part of any known flow or socket and the TCP flags have the SYN bit on. Established: The packet matches a flow or socket tracked by CONNTRACK and has any TCP flags. After the initial TCP handshake is completed the SYN bit must be off for a packet to be in state ...


13

Because the tool called system-config-firewall(or it´s ncurses based brother system-config-firewall-tui) manages this file. Every time you use this tool to create new iptables rules, it will overwrite /etc/sysconfig/iptables. Related Manpage: 28.1.16. /etc/sysconfig/iptables-config This is why it's not recommended, but not prohibited. The best way to save ...


13

Use the firewall-cmd command. Assuming you're opening the firewall up to OpenVPN on the default zone, carry out the following commands. If you are running it on a non-default zone, then add --zone=<zone> to the commands. Note: If you use default public zone for your external facing network adapter then your loopback interface could also be ...


12

You could add a TRACE rule early in the chain to log every rule that the packet traverses. I would consider using iptables -L -v -n | less to let you search the rules. I would look port; address; and interface rules that apply. Given that you have so many rules you are likely running a mostly closed firewall, and are missing a permit rule for the traffic. ...


12

I wrote a blog post on basic Iptables rules for the desktop user a long time ago and you should probably read it, and its linked article on Stateful firewall design. But pre kernel 2.6.39 (which includes ipset and you may want to use that for whitelisting IP's if you have more than 10 to whitelist (where 10 is arbitrary)). First handle state's that we know ...


12

With the kernel's iptables completely empty (iptables -F), this will do what you ask: # iptables -A INPUT -p tcp --dport 22 -s 192.168.0.0/24 -j ACCEPT # iptables -A INPUT -p tcp --dport 22 -s 127.0.0.0/8 -j ACCEPT # iptables -A INPUT -p tcp --dport 22 -j DROP This says that all LAN addresses are allowed to talk to TCP port 22, that localhost gets the ...


11

As indicated in the comments, this is likely being caused by the UseDNS yes setting in the sshd_config on the server. The UseDNS setting is a common culprit for this very issue. Basically what happens is that your IP netblock either has a defective, or missing DNS server. So sshd is trying to do a reverse lookup on your IP address, and waits until it times ...


11

It's not the job of iptables to drop a packet when the port is closed, that's the job of the normal network stack (as without iptables). (To be precise: the network stack does not just drop the packet, it also politely informs the other side that there is nothing listening.) Just because iptables accept a packet does not mean there is anything listening. ...


10

Your question is a very similar to http://stackoverflow.com/questions/5451206/linux-per-program-firewall-similar-to-windows-and-mac-counterparts There was the --cmd-owner for iptables's owner module, but it was removed because it worked not properly. Now a first beta version of Leopard Flower is available, which solves the problem by a user space daemon. ...


10

Both if possible, just in case. Security groups are good because they are external to your host so the data never reach's you. They are not quite as configurable as most server based firewalls though. Unfortunately, EC2 security groups can only "allow" services through a default deny policy. So if you are trying to block access to a publicly "allowed" ...


10

I think you have mixed two different things: The OpenBSD packet filter facilities (sometimes called pf, and mostly controlled by pfctl). These are the basis of OpenBSD firewalling, the Linux equivalent is netfilter, mostly controlled by the iptables command. Comparable, but not compatible (and most say that OpenBSD is superior to Linux in this aspect). ...


10

ssh tunneling works by using the already established ssh connection for sending additional traffic. When you connect to a remote server, you usually just have 1 channel for the normal user interaction (or 3 channels if you consider STDIN/STDOUT/STDERR separate). At any time, the local or remote ssh process can open additional channels on the existing ...


10

If you want to see if you can form a TCP connection from a remote machine, get OpenCSW installed on that and the target machine, and install netcat on both. This is the syntax for using netcat to test TCP connections: nc -vz targetServer portNum For example to check SSH on "homeServer1": nc -vz homeserver1 22 That enables you to test TCP-level ...


9

You might consider trying ufw. While it was created for Ubuntu Server, I believe that that it is also available in Debian. (UPDATE: Unfortunately, it looks like it is only available for squeeze and sid according to packages.debian.org, but it might still be worth looking at.) While I would say that you eventually want to move to writing your own iptable ...


9

See whitelisting on the fail2ban website: # This will ignore connection coming from common private networks. # Note that local connections can come from other than just 127.0.0.1, so # this needs CIDR range too. ignoreip = 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 Another reference here: First, find ignoreip. It's always important for you to ...


8

Firewalls should reply with an ICMP message when they block a request. However, this is not necessarily the case (you will be interested in this nice article). You can test from the outside to see whether a port is accessible through a firewall and, if so, whether anything is listening on it. Here's three different scenarios involving a tcp request which ...


7

Deleting the default route should do this. You can show the routing table with /sbin/route, and delete the default with: sudo /sbin/route del default That'll leave your system connected to the local net, but with no idea where to send packets destined for beyond. This probably simulates the "no external access" situation very accurately. You can put it ...


7

Run iptables -L -v -n to see the packet and byte counters for every table and for every rule.


7

Reality is you're asking 2 different questions. --sport is short for --source-port --dport is short for --destination-port also the internet is not simply the HTTP protocol which is what typically runs on port 80. I Suspect you're asking how to block HTTP requests. to do this you need to block 80 on the outbound chain. iptables -A OUTPUT -p tcp --dport ...


7

Presuming you only want to accept incoming TCP traffic, you can use these rules to restrict outgoing traffic to established TCP connections (which would have to have been initiated from the outside) and IP addresses outside your LAN: iptables -A INPUT -p tcp -i lo -j ACCEPT iptables -A INPUT -p tcp -p 22 -j ACCEPT # repeat for other ports you want to ...


7

I finally found how-to. First, I had to add -i eth1 to my "outside" rule (eth1 is my WAN connection). I also needed to add two others rules. Here in the end what I came with : iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 8080 -j DNAT --to 10.32.25.2:80 iptables -t nat -A PREROUTING -p tcp --dport 8080 -j DNAT --to 10.32.25.2:80 iptables -t nat -A ...


7

The iptables command per default only shows entries of the filter table. But there are also other tables: There are probably some entries in the nat table. Add -t nat to your commands to look at them.


7

Link Mint is an Ubuntu-based distribution intended for desktop systems. One of its chief priorities is "ease of use" so a firewall just puts into play something that could break things for users. It's easier if the firewall only gets turned on if the operator is someone who knows what such a thing even is versus a novice user saying "Why don't it no worky?"



Only top voted, non community-wiki answers of a minimum length are eligible