Tag Info

Hot answers tagged

48

I love explaining this kind of thing through visualization. :-) Think of your SSH connections as tubes. Big tubes. Normally, you'll reach through these tubes to run a shell on a remote computer. The shell runs in a virtual terminal (tty). But you know this part already. Think of your tunnel as a tube within a tube. You still have the big SSH ...


27

There may not be a service running right now, but how about tomorrow? You have them all turned off, but what about your users? Anyone on a unix/windows/mac system can open a port > 1024 on any machine they have access to. What about malware? What about a virus? They can also open up ports and start serving information to the world, or start listening ...


14

At first, a firewall should be the last step to secure a server. Remove all software and services which are not needed, update your system with the latest available security patches and review your config files. Why do you want to avoid iptables? "Because I'm a newbie" is no real excuse. A "one click everything secure" firewall doesn't exist, and if a ...


12

What do the three rules do? Those 3 rules seem pretty self-explanatory: Reject incoming UDP packets with an ICMP message "port unreachable" Reject incoming TCP packets with "tcp reset" Reject incoming packets (of any other protocol) with ICMP message "protocol unreachable" If you're looking for more detail (about UDP/TCP packets, ICMP), you need to ...


9

The SNAT target requires you to give it an IP address to apply to all the outgoing packets. The MASQUERADE target lets you give it an interface, and whatever address is on that interface is the address that is applied to all the outgoing packets. In addition, with SNAT, the kernel's connection tracking keeps track of all the connections when the interface ...


9

I think you have mixed two different things: The OpenBSD packet filter facilities (sometimes called pf, and mostly controlled by pfctl). These are the basis of OpenBSD firewalling, the Linux equivalent is netfilter, mostly controlled by the iptables command. Comparable, but not compatible (and most say that OpenBSD is superior to Linux in this aspect). ...


8

You could add a TRACE rule early in the chain to log every rule that the packet traverses. I would consider using iptables -L -v -n | less to let you search the rules. I would look port; address; and interface rules that apply. Given that you have so many rules you are likely running a mostly closed firewall, and are missing a permit rule for the traffic. ...


8

Your question is a very similar to http://stackoverflow.com/questions/5451206/linux-per-program-firewall-similar-to-windows-and-mac-counterparts There was the --cmd-owner for iptables's owner module, but it was removed because it worked not properly. Now a first beta version of Leopard Flower is available, which solves the problem by a user space daemon. ...


8

ssh tunneling works by using the already established ssh connection for sending additional traffic. When you connect to a remote server, you usually just have 1 channel for the normal user interaction (or 3 channels if you consider STDIN/STDOUT/STDERR separate). At any time, the local or remote ssh process can open additional channels on the existing ...


8

Packets can be in various states when using stateful packet inspection. New: The packet is not part of any known flow or socket and the TCP flags have the SYN bit on. Established: The packet matches a flow or socket tracked by CONNTRACK and has any TCP flags. After the initial TCP handshake is completed the SYN bit must be off for a packet to be in state ...


7

Deleting the default route should do this. You can show the routing table with /sbin/route, and delete the default with: sudo /sbin/route del default That'll leave your system connected to the local net, but with no idea where to send packets destined for beyond. This probably simulates the "no external access" situation very accurately. You can put it ...


7

You might consider trying ufw. While it was created for Ubuntu Server, I believe that that it is also available in Debian. (UPDATE: Unfortunately, it looks like it is only available for squeeze and sid according to packages.debian.org, but it might still be worth looking at.) While I would say that you eventually want to move to writing your own iptable ...


7

The iptables command per default only shows entries of the filter table. But there are also other tables: There are probably some entries in the nat table. Add -t nat to your commands to look at them.


6

I wrote a blog post on basic Iptables rules for the desktop user a long time ago and you should probably read it, and its linked article on Stateful firewall design. But pre kernel 2.6.39 (which includes ipset and you may want to use that for whitelisting IP's if you have more than 10 to whitelist (where 10 is arbitrary)). First handle state's that we know ...


6

fail2ban does that, although I don't think it's the only such tool. (Amazed mentioned DenyHosts, although it seems to be SSH specific.)


6

Of course any services you have open will increase your vulnerable attack surface. What runs behind those services will determine how secure and insecure you become. If you write insecure PHP scripts and host them in your newly accessible Apache site, the world will be able to (and will!) exploit them. You should seriously consider what you are making ...


6

With the kernel's iptables completely empty (iptables -F), this will do what you ask: # iptables -A INPUT -p tcp --dport 22 -s 192.168.0.0/24 -j ACCEPT # iptables -A INPUT -p tcp --dport 22 -s 127.0.0.0/8 -j ACCEPT # iptables -A INPUT -p tcp --dport 22 -j DROP This says that all LAN addresses are allowed to talk to TCP port 22, that localhost gets the ...


6

Looks to me like that is because of a new version of iptables that came out in October. -m state --state has been obsoleted in favour of -m conntrack --ctstate. Hence, "The state match is obsolete. Use conntrack instead." http://forums.gentoo.org/viewtopic-t-940302-start-0.html http://blog.yjl.im/2012/11/iptables-state-match-is-obsolete-use.html ...


6

If you want to see if you can form a TCP connection from a remote machine, get OpenCSW installed on that and the target machine, and install netcat on both. This is the syntax for using netcat to test TCP connections: nc -vz targetServer portNum For example to check SSH on "homeServer1": nc -vz homeserver1 22 That enables you to test TCP-level ...


5

Dan Robbins (the creator of Gentoo) wrote a great article on Stateful Firewall Design. It's by far the easiest to understand iptables tutorial. It says '2.4' however all but the kernel config will apply equally as well to '2.6'. Even though the article is hosted by gentoo (I could have linked to IBM developerworks too) it's distribution independent (except ...


5

iptables rules are sequential, meaning the first rule they hit that matches gets executed. rules like ACCEPT, DROP, and REJECT are terminal, meaning the packet will not proceed further into the chain.-A means append. So what you've done is match everything and REJECT it # everything stops here accept tcp port 80 # we never reach this because everything ...


5

See whitelisting on the fail2ban website: # This will ignore connection coming from common private networks. # Note that local connections can come from other than just 127.0.0.1, so # this needs CIDR range too. ignoreip = 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 Another reference here: First, find ignoreip. It's always important for you to ...


5

Presuming you only want to accept incoming TCP traffic, you can use these rules to restrict outgoing traffic to established TCP connections (which would have to have been initiated from the outside) and IP addresses outside your LAN: iptables -A INPUT -p tcp -i lo -j ACCEPT iptables -A INPUT -p tcp -p 22 -j ACCEPT # repeat for other ports you want to ...


5

You could use Linux containers to create an environment with no network interfaces. For example, if I create a configuration file like this: # lxc.network.type = empty And then start a shell like this: # lxc-execute --name bash -f /tmp/lxc.conf /bin/bash I will find that within this shell there are no network devices available other than lo: # ...


5

I have drawn some sketches The machine, where the ssh tunnel command is typed is called »your host«. Introduction local: -L Specifies that the given port on the local (client) host is to be forwarded to the given host and port on the remote side. ssh -L sourcePort:forwardToHost:onPort connectToHost means: connect with ssh to connectToHost, and ...


5

Short answer: The Internet Doesn't Work That Way Longer answer: IP address blocks are not neatly demarcated per country. As far as IPv4 is concerned, the parent organization IANA allocated (past tense -- they're out of blocks) address blocks to the various NICs, which operate in very wide regions as you can see here. They then assign IP blocks to ISPs on a ...


5

My first instinct is that in your example the cost and complexity of your rules is identical and which is better is as much personal preference as anything else. The inversion generally is not more complex as a matching rule in netfilter. The general consensus seems to be that the number and ordering of rules is much more important for optimal performance ...


4

You wrote So, how do I simulate "no external access" in my development machine? How do I "deactivate" my ethernet interface and reactivate later with no hassle? Are these two questions or one question? I'm not sure what you mean by simulate "no external access". However, to deactivate the ethernet interface you could simply do #ifdown eth0 ...


4

Depends vastly on your needs. iptables can be quite easy to master, when you understand how it works. There are three chains in the filter table that contain rules: INPUT, OUTPUT and FORWARD. If you're wishing to block only packets coming into your server, then the INPUT chain is all you really need to be concerned about. After that, it's just setting the ...


4

So, basically your Linux box acts as a firewall? First, enable IP forwarding. echo 1 > /proc/sys/net/ipv4/ip_forward echo 1 > /proc/sys/net/ipv4/conf/all/forwarding Then, add some forwarding rules: iptables -A FORWARD -i eth0 -j ACCEPT iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT Secure the FORWARD chain: iptables -P ...



Only top voted, non community-wiki answers of a minimum length are eligible