New answers tagged

0

/sbin/iptables -L Will list all the active rules.


3

As for firewalls, I would be worried where they are placed, your Internet speeds, and how much rules you need on them. They can pretty much dictate the kind of hardware you will need. Be aware for more performance/higher speeds you may need better NIC cards. In the past I used top tier Intel Pro cards. About router/firewalls in ISP settings, I used to have ...


2

nftables are currently under development to replace iptables, and while they don't say as much, I would consider it "beta" for now. I don't have any insight into their timeline, but you can read more here: http://netfilter.org/projects/nftables/ Many linux distributions already have iptables enabled by default. Either it's compiled in, or they load the ...


1

I'd use shorewall in preference to writing iptables rules directly. There are also alternatives such as firewalld. With regard to kernel compilation it really depends whether or not the features that you need are available either in the stock kernel or as a modular add-in. If they are not, then you're going to need to roll your own. However, that's not ...


0

Got it now. Turning on Forwarding does not enable some kernel variables that are needed so I had to manually enable them. These are, net.bridge.bridge-nf-call-ip6tables=1 net.bridge.bridge-nf-call-iptables=1 net.bridge.bridge-nf-call-arptables=0 I turned off arptables since I don't need it.


0

You have confused your networking layers. Handwavingly, iptables works for network-layer forwarded IP packets and not for link-layer forwarded ethernet frames, which is the type of forwarding done by a bridge. A bridge works by keeping a list of which MAC addresses are seen on which ports. So traffic can flow from p1p to p1p2 without doing any IP routing. ...


1

I got this working. From the server which has internet-access: ssh -R any-port:proxy-ip:proxy-port user@testserver Then, once I'm on the test server: export http_prox=http://username:password@localhost:any-port/ eg: ssh -R 2001:proxy-ip:8080 root@testserver [root@testserver]# export http_proxy=http://proxyuser:proxyuser-password@localhost:2001/ ...


3

For DNS, you need to allow UDP packets between any port on an IP address inside the firewall, and port 53 on an IP address outside the firewall. For HTTPS, you need to allow TCP packets between any port on an IP address inside the firewall, and port 443 outside the firewall, or more rarely any port outside the firewall (some websites are not on the default ...


0

You could set up a ssh-based virtual private network using the tun network pseudo-device; man ssh gives an example. If you don't have admin access on the internet-accessible server you might consider sshuttle to accomplish the same thing.


2

You have to block tcp and udp ports: iptables -A INPUT -p tcp --match multiport --dports 16000:65535 -j DROP iptables -A INPUT -p udp --match multiport --dports 16000:65535 -j DROP


4

Use Multiport for that iptables -A INPUT -p tcp --match multiport --dports 16000:65535 -j DROP also you may try iptables -A INPUT -p tcp --dport 16000:65535 -j DROP


2

If the ports are contiguous, like yours are, then use the --destination-port,--dport [!] port[:port] syntax to set up the range: ... --destination-port 16000:65535 ...


1

I had the same problem with mqtt broker called vernemq, but solved it by adding the following. $ sudo vmq-admin listener show To show the list o allowed IP's and ports for vernemq $ sudo vmq-admin listener start port=1885 -a 0.0.0.0 --mountpoint /appname --nr_of_acceptors=10 --max_connections=20000 To add any IP and your new port. Now you should be able ...



Top 50 recent answers are included