Tag Info

Hot answers tagged

5

Your command only lists the default filter table. There are a total of five tables: filter, nat, mangle, raw and security. These can be selected using the -t option: iptables -t nat -L -n


4

Netfilter encourages to use iptables-save command since it will provide you a detailed view of your built-in chains and those you've defined yourself. If you want to get a human readable view you can use iptables -L -v -n --line-n


3

You probably want -I INPUT instead of -A INPUT. -A INPUT is going to add the rule to the bottom of the chain. Meaning that if you have something like -p tcp --dport 25 -j ACCEPT before it, the ACCEPT is going to match first, and the processing will never get to your -j DROP rule. The -I INPUT will add the rule to the top, so it overrides everything else.


2

I'd accomplish this by adding sources to a zone. First checkout which sources there are for your zone: firewall-cmd --permanent --zone=public --list-sources If there are none, you can start to add them, this is your "whitelist" firewall-cmd --permanent --zone=public --add-source=192.168.100.0/24 firewall-cmd --permanent --zone=public ...


1

This is an alias I put in my ~/.bashrc (fw means "firewall" which is descriptive enough for me, change it if you'd like): Set up /etc/sudoers to allow you to run the iptables command with no password or only run it as root. alias fw='clear ; sudo iptables --line-numbers -nvL ; echo ; echo '\''nat:'\'' ; echo ; sudo iptables -t nat --line-numbers -nvL ; ...


1

The solution you found was correct: iptables -A OUTPUT -m limit --limit 10/s -j ACCEPT But it is assuming a default policy of DROP or REJECT which is not usual for OUTPUT. You need to add: iptables -A OUTPUT -j REJECT Be sure to add this rule after the ACCEPT one. Either execute them in this order, or use -I instead of -A for the ACCEPT. Also, ...


1

It's a bit tricky. You can isolate only traffic that passes through your gateway. For instance you can use that rules: iptables -I FORWARD -s 192.168.1.0/24 -d 192.168.2.0/24 -j DROP iptables -I FORWARD -d 192.168.1.0/24 -s 192.168.2.0/24 -j DROP or: iptables -I FORWARD -i eth0.1 -o eth0.2 -j DROP iptables -I FORWARD -o eth0.1 -i eth0.2 -j DROP Both ...


1

A few points: 1) fail2ban is just logic for modifying the system configuration so it doesn't really consume any bandwidth itself. 2) 60KB over the course of several minutes isn't that much bandwidth at all. 3) The 60KB of bandwidth you're looking at is for network traffic that matched the failed event. There's nothing you can do to lessen the traffic ...


1

There are a few things involved here. Output from the local box uses the OUTPUT table, not PREROUTING. PREROUTING is for traffic flowing through the box. The iptables rule only matches when a packet is sent. When the client opens a connection, it has to bind to an address before a single packet is generated. When it binds, it picks the source address ...


1

You should be able to proxy YUM's traffic over the SSH connection like so: add to the /etc/yum.conf on the protected server: proxy=http://127.0.0.1:8080 from the server with normal inbound/outbound ssh access: $ ssh -R 8080:ssh.server:8080 user@protected.server On the server where you want to run YUM commands: $ yum update References Port Forward ...



Only top voted, non community-wiki answers of a minimum length are eligible