Tag Info

Hot answers tagged

3

It's super simple: iptables -S gives you exactly what you ask for.


2

You should be able to achieve this by setting up a bridge between your two network interfaces. Assuming your integrated ethernet interface is eth0 and that the on via the USB adapter is eth1, a configuration like this in /etc/network/interfaces should work (provided you've installed the bridge-utils package and that your kernel supports it): auto lo br0 ...


2

What the rule does is simply enable SNAT for traffice originating from an openvpn client, so that openvpn clients can use the internet connection you this system. I.e. outgoing traffic from openvpn clients are allowed through, so you could consider this a hole in the firewall. I think the author was trying to write in a humorous style, which doesn't always ...


1

iptables will allow you to route selected packets to usespace for additional processing. (In your case selected packets would possibly mean all packets.) I've not done this but man iptables has this to say on the matter: TARGETS ACCEPT means to let the packet through. DROP means to drop the packet on the floor. QUEUE means to pass the packet to ...


1

"Connection Refused" means: The TCP connection does reach the server (or is being explicitly blocked by a firewall between the client and the server), assuming the latter isn't true - there are 3 possiblities: 1. The IP the client is connecting to isn't the IP or interface the server process is listening on, thus the operating system rejects the connection. ...


1

You are right: This is about routing, it has nothing to do with security.


1

No - ipables doesn't understand hostnames. You can use hostnames, but they will be translated to the current IPs at the time you issue the command and will be saved as IPs. When the IP changes, you'll be forwarded incorrectly.


1

You cannot unmask an IP address that has been masqueraded. However, what you can do is to avoid masquerading the IP address in the first place. If your remote filewall was on address 172.16.1.254 then something like this should work: iptables -t nat -A POSTROUTING '!' --dst 172.16.1.254 -j MASQUERADE Note that as you cannot route 192.168.0.0/16 addresses ...


1

Be aware that the Pi USB+Ethernet comes from a single dumb on-board chip that connects to a SINGLE port on the Pi GPU = i.e. the USB Ethernet dongle will NOT just 'link direct' to built in Ethernet Thus, when you attempt transfer data from one interface to the other, throughput is crippled as each byte has to be read by the CPU, wait whilst the CPU tells ...


1

Your best bet is to set the Pi with a static ip. From there you want to install a dhcp server apt-get install isc-dhcp-server You then edit the configuration file at /etc/conf.d/dhcp  which tells the dhcp server which interface on which to listen with this line: DHCP4_ARGS="... eth0" You then start the server daemon with: sudo ...


1

--direct commands cannot be made permanent. Use equivalent zone command: sudo firewall-cmd --zone=public --add-port=7199/tcp --permanent sudo firewall-cmd --reload and to check the result: sudo firewall-cmd --zone=public --list-all


1

Even if an answer has been accepted and up-voted, I do not think it is a correct one. I fail to find clear explanation in the documentation, but from the implemented behaviour it looks like that: interface and source are used as selectors - which zone(s) to activate both are ignored for the default zone (always active) So the answer would be: lock down ...



Only top voted, non community-wiki answers of a minimum length are eligible