New answers tagged

2

When I was looking for something similar the suggestions seemed to be along the lines of 'run the program under a separate user' - as you can write per-user iptables rules - http://www.cyberciti.biz/tips/block-outgoing-network-access-for-a-single-user-from-my-server-using-iptables.html. Having said that, selinux rules might do what you're looking for - ...


1

The IPTABLE rules you created will reject all the traffic, remove them. Those apache rules are useless as well. I think the only way to do what you want is to add 3 virtual network adapters to your Linux server, then each adapter would have a valid external IP address. You would configure the DNS to point each domain name to point to one of the 4 IP ...


2

Here, in your FORWARD chain, you allow some outgoing traffic. Although it can't come back, you should use the conntrack machine to allow this behavior in FORWARD chain for the LAN machines, and in the INPUT chain for the router. You haven't allow ICMP too, so ping can't pass. One more thing : I would specify an interface in FORWARD chain. If you don't, your ...


5

You can use xtable addons geoip match feature. On debian install the xtable-addons-common package and then use use the geoip target e.g. to allow ssh from Netherlands NL: iptables -A INPUT -p tcp --dport 22 -m geoip --src-cc NL -j ACCEPT Make sure xt_geoip module is loaded and geoip database is downloaded. You can read xtable documentation for more ...


1

Make sure you don't set the default gateway in the netctl files or in any other files. If using DHCP to get IP addresses make sure to disable getting the default gateway (dhcpcd -G). Running "ip route ls" should not show any default gateways. Only "ip route show table all" would list the default gateways for each ISP table. Something like this: default via ...


2

I've done something like that on an Arch server. The server had enp4s8 as the "external" network, and wlp1s0 as the "internal" network. enp4s8 had a statically-defined IP address of 10.0.0.3, and a default route to 10.0.0.1, the DSL modem. /usr/bin/ip link set dev wlp1s0 up /usr/bin/ip addr add 172.16.0.1/24 dev wlp1s0 sleep 10 modprobe iptable_nat echo ...



Top 50 recent answers are included