Hot answers tagged

5

You can use xtable addons geoip match feature. On debian install the xtable-addons-common package and then use use the geoip target e.g. to allow ssh from Netherlands NL: iptables -A INPUT -p tcp --dport 22 -m geoip --src-cc NL -j ACCEPT Make sure xt_geoip module is loaded and geoip database is downloaded. You can read xtable documentation for more ...


3

You could install a proxy on your laptop and configure all your apps to use it (on localhost). Then you could change the local proxy's config to either use a parent proxy or not, depending on your location. Tinyproxy is probably ideal for this task. Here's the description from the Debian package of it: Package: tinyproxy Version: 1.8.3-3+b1 Installed-...


2

Here, in your FORWARD chain, you allow some outgoing traffic. Although it can't come back, you should use the conntrack machine to allow this behavior in FORWARD chain for the LAN machines, and in the INPUT chain for the router. You haven't allow ICMP too, so ping can't pass. One more thing : I would specify an interface in FORWARD chain. If you don't, your ...


2

We don't: IPTABLES(8) iptables 1.4.19.1 NAME iptables — administration tool for IPv4 packet filtering and NAT SYNOPSIS ... iptables [-t table] -I chain [rulenum] rule-specification


2

You can use the hashlimit match. Take a look on the options here. In order to log once per source ip per hour, you would have, for example : iptables -A INPUT -m hashlimit --hashlimit-upto 1/hour --hashlimit-mode srcip -j LOG Basing on your needs, you can use the following modes : srcip, dstip, srcport, dstport and the following length : /sec, /minute, /...


2

Let's look at the pipeline: /sbin/iptables-save -t filter | grep -- "-A INPUT" | grep -v "fail2ban-\|f2b-" | sed -e "s#^-A#apply_rule /sbin/iptables -D#g" | xargs -0 echo -e "`declare -f apply_rule`\n" | /bin/bash iptables generates a list of rules, one rule per line. In other words, each rule is separated by a newline character, \n. With the ...


2

It's not clear what your actual problem is. Port 3306 is MySQL, is the attacker trying to break into your database? If the DB should not be accessible from outside, you should perhaps drop all connection requests from outside (I normally consider sending any reply packets to an attacker an unnecessary courtesy...) If the attacker somehow consumes your ...


1

netstat does not display ports that are open by iptables . It displays ports being listened to by a running program. You need to reconfigure your program to listen to 127.0.0.1, and then netstat will display it as "LISTENING".



Only top voted, non community-wiki answers of a minimum length are eligible