New answers tagged

0

Try this: modprobe ip_nat_pptp I also was not able to connect from my LAN even though all rules were very relaxed.


3

Allow first your local connection and your RELATED, ESTABLISHED connections protocols. $ sudo iptables -A INPUT -p tcp -s 127.0.0.1 -j ACCEPT $ sudo iptables -A INPUT -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT $ sudo iptables -A INPUT -p udp -m state --state RELATED,ESTABLISHED -j ACCEPT $ sudo iptables -A INPUT -p icmp -m state --state ...


0

Comment out one gateway. The one without Internet connection: #gateway 192.169.1.10 Standard configuration can have only one and your route shows it is the internal gateway used right now. If there are other networks behind this gateway add this: post-up /sbin/ip route add 192.169.X.0/24 via 192.169.1.10 post-down /sbin/ip route del 192.169.X.0/24 via ...


1

You need to allow incoming on the ports you opened, not just outgoing. Otherwise the destination server will not be able to send you a response. If you notice, your ssh works because you're allowing incoming and outgoing. GIT does not work because you're blocking the response from the remote server. DNS is probably broken as well. MySQL: by default your ...


0

Although this question is old, I came across the same issue and discovered the solution here. systemctl mask firewalld systemctl stop firewalld Basically firewalld conflicts iptables and so will prevent iptables from loading: # cat /usr/lib/systemd/system/firewalld.service [Unit] Description=firewalld - dynamic firewall daemon Before=network.target ...


0

If you are simply trying to black one nodes's outbound access to the internet, and are sure they only need resources on their local subnet, then remove the default gateway route for that host. ip route delete <gateway address> dev <interface>


3

Use iptables rule to block outbound traffic for a specific user: http://www.cyberciti.biz/tips/block-outgoing-network-access-for-a-single-user-from-my-server-using-iptables.html This way you even have full control over ranges of ips that get through (for instance, only allow LAN address block). It's probably useful also to block only specific ports. ...


0

I figured a short workaround which is not entirely perfect: I set the rule to accept IP's in the range: 217.87.0.0/16 This means only the first 16 bytes of the IP are static and the rest dynamic. I guess it's more secure than not adding any rule at all.


0

For accepting port 22 -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT For ports 1000-1100 -A INPUT -m state --state NEW -m tcp -p tcp --dport 1000:1100 -j ACCEPT if you enter these lines into /etc/sysconfig/iptables file on your linux machine and restart iptables service with service iptables restart command, you should be good to go.


2

On 23/11/12 12:50, Gene Czarcinski wrote: Libvirt is in the process of changing for using bind-interface to using bind-dynamic to fix a security related issue where dnsmasq was responding to port 53 queries which did not occur on an address on the virtual network interface that instance of dnsmasq was supporting. Checking ps -ax|grep dnsmasq, ...



Top 50 recent answers are included