Tag Info

New answers tagged

4

iptables -I OUTPUT -p tcp -m tcp --dport 443 -j REJECT --reject-with icmp-port-unreachable iptables -I OUTPUT -p tcp -m tcp --dport 80 -j REJECT --reject-with icmp-port-unreachable iptables -I OUTPUT -p tcp -m tcp -d youremailsiteIP/32 --dport 80 -j ACCEPT iptables -I OUTPUT -p tcp -m tcp -d youremailsiteIP/32 --dport 443 -j ACCEPT where youremailsiteIP is ...


0

libnetfilter_queue library from netfilter project seems the way: from netfilter.org: libnetfilter_queue is a userspace library providing an API to packets that have been queued by the kernel packet filter. It is is part of a system that deprecates the old ip_queue / libipq mechanism. I put packets in a queue with: sudo iptables -I FORWARD ...


1

It seem like you do not have any modules loaded that you need. By the way, which distro are you using which kernel version : uname -a Verify that modules mention by @ikrabbe are listed when you run one of these commands below : grep -i =m /usr/src/linux/.config cat /proc/modules | grep nat find /lib/modules/*/ -type f -iname '*.ko' | grep redirect ...


1

check your kernel configuration against CONFIG_IP_NF_TARGET_REDIRECT You need to enable that to use the -j REDIRECT target.


6

Make sure you accept also connection originated from inside. With iptables: iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT With Webmin, allow Connection states EQUALS Existing Connection


0

OK. The solution is that my host provider also offers Plesk. And there is a firewall running which somehow overwrites everything i setup manually.


0

The most basic form would look like this: block from any to 9.9.9.9 By default that will drop packets silently on all interfaces, in both directions. The friendly neighbor way would be to let the host know the address is unreachable: block return from any to 9.9.9.9 Getting a bit more involved - easier to manage and read when your rule set starts to ...


0

The first thing you don't understand is that we can't debug your iptables rules if you don't show them to us. That being said, I see a potential pitfall. But of course I don't know whether that is your problem. It's likely that the Java application establishes a TCP connection to the database once and for all when it starts. If your firewall merely blocks ...


2

You can translate MikroTik firewall rules to Linux iptables rules pretty easily. The only real difference is that iptables marking isn't quite as pretty, it likes 32 bit flags instead of nice long names, but "1" suffices most of the time. According to the iptables man pages: add chain=prerouting : -t mangle -A PREROUTING (Appends a new rule to the end of ...


2

First, you should think in the opposite way: you should configure your server's firewall to block all ports except those of the services you run on the machine. E.g. for a HTTP/HTTPS webserver that must be accessible via SSH, this is the relevant iptables config: *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A INPUT -m state ...



Top 50 recent answers are included