Tag Info

Hot answers tagged

3

You could set up NAT with each guest on its on private network. First, you'd need to stop bridging all of their network interfaces together (after all, if they're all on the same switch, they're hardly on their own private networks). Then you'd set up NAT rules, and maybe it'd work. But probably not—the outgoing path should work, but the return path is a ...


3

That's normal, and has nothing to do with NAT. Linux, by default, treats IP addresses as belonging to the machine¹, not to a particular interface. So it'll answer packets to 192.168.2.1 on any interface, not just the LAN interface. That said, NAT does not imply a firewall, or vice versa. You can, for example, map internal hosts 192.168.0.2–254 to public IPs ...


2

In my opinion your best bet will be to use a configuration management tool like Puppet, Chef, CFEngine or Ansible so you can define your policies based on the host type and apply it to any new host.


2

-P sets what happens by default, when no rule decides. That is, if a packet "falls" off the bottom of the table. That first line changes the default to accept the traffic. I'm not sure why that's there. The last line changes the default to drop traffic, which is clearly what you want since you only have ACCEPT rules.


2

You also need port 445 and make sure that you also have incoming related/established traffic allowed. grep 445 /etc/services microsoft-ds 445/tcp # Microsoft Naked CIFS microsoft-ds 445/udp


1

That ARP request means that M3 incorrectly thinks that M2 is on the same subnet, instead of behind the gateway M1. Almost certainly, it is one of two things: Subnet mask on (at least) M3 is wrong. You've configured something nonsensical; e.g., you've used the same subnet on both the M1/M3 and the M1/M2 networks. That's weird, because your chart shows ...


1

If you use these two lines: iptables -A FORWARD -s 192.168.10.0/24 -j ACCEPT iptables -A FORWARD -d 192.168.10.0/24 -j ACCEPT Then these two has no value as far as the security is concerned: iptables -A FORWARD -s 192.168.10.0/24 -d 0/0 -j ACCEPT iptables -A FORWARD -m state --state ESTABLISHED,RELATED -d 192.168.10.0/24 -j ACCEPT At first you have ...


1

Simple answer: no. What you're trying to do is, from a networking perspective, identical to trying to have multiple physical hosts with the same IP. It won't work.


1

You can't do that. A TCP request is started by a SYN packet which contains no data. You get the port numbers and IP addresses, but not the host name. You might be able to write some complicated rules that accept the connection, and look for the first packet with data to match the Host header—which isn't guaranteed to be in the first data packet, but usually ...


1

Consider to use fwbuilder (http://www.fwbuilder.org/). It's an opensource tool that manage a sort of kinds of firewall.


1

Some time ago I used ferm and a custom and simple bash script to generate rulesets and insert it in the correct order vía "include" directive in ferm. If you want logging connections, etc... you can use ulog-mysql, and save specific data matched with a specific iptables rule in mysql and graph whatever you want from this point forward. Another possibility ...


1

It seems redundant at first place, because iptables already loads automatically some of the modules. With the -p you specify the protocol, where -m you create a match argument that will check for specific atributes of a TCP packet. The documentation specifies that using the protocol(-p) is enough to load all match stuff. Source and quoting: ...These ...


1

What if the correct answer with route_localnet doesn't work?.. If your kernel doesn't include the patch for route_localnet, then... upgrade the kernel! Or there are other ways to forward the traffic coming to one interface to another port on another interface (in particular, to localhost) by running a process that would listen on the external interface and ...


1

You could use iptables and move that process into a cgroup: mkdir /sys/fs/cgroup/net_cls/block echo 42 > /sys/fs/cgroup/net_cls/block/net_cls.classid iptables -A OUTPUT -m cgroup --cgroup 42 -j DROP echo [pid] > /sys/fs/cgroup/net_cls/block/tasks


1

For a large or a considerable range of ip's my recommendation for you is use ipset If want to block an entire country ip block you can use the geoip module for iptables.



Only top voted, non community-wiki answers of a minimum length are eligible