Hot answers tagged iptables
You probably want -I INPUT instead of -A INPUT. -A INPUT is going to add the rule to the bottom of the chain. Meaning that if you have something like -p tcp --dport 25 -j ACCEPT before it, the ACCEPT is going to match first, and the processing will never get to your -j DROP rule. The -I INPUT will add the rule to the top, so it overrides everything else.
I'd accomplish this by adding sources to a zone. First checkout which sources there are for your zone: firewall-cmd --permanent --zone=public --list-sources If there are none, you can start to add them, this is your "whitelist" firewall-cmd --permanent --zone=public --add-source=192.168.100.0/24 firewall-cmd --permanent --zone=public ...
There are a few things involved here. Output from the local box uses the OUTPUT table, not PREROUTING. PREROUTING is for traffic flowing through the box. The iptables rule only matches when a packet is sent. When the client opens a connection, it has to bind to an address before a single packet is generated. When it binds, it picks the source address ...
You should be able to proxy YUM's traffic over the SSH connection like so: add to the /etc/yum.conf on the protected server: proxy=http://127.0.0.1:8080 from the server with normal inbound/outbound ssh access: $ ssh -R 8080:ssh.server:8080 firstname.lastname@example.org On the server where you want to run YUM commands: $ yum update References Port Forward ...
Only top voted, non community-wiki answers of a minimum length are eligible