Tag Info

Hot answers tagged

3

A iptables rule like this works fine *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [1:156] -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 587 -j ACCEPT -A INPUT -j REJECT --reject-with ...


2

If you're not comfortable working with the iptables commands you could use UFW instead. UFW stands for Uncomplicated Firewall and is a way esaier tool to use than iptables. Install ufw on your Raspbery Pi with: sudo apt-get install ufw After you've installed ufw you can setup the defaults with: sudo ufw default deny incoming && sudo ufw default ...


2

In addition to the existing answer. If you prefer (like I do) to use the syntax from the iptables-save and iptables-restore command ip6tables-save and ip6tables-restore can be used. The convenient part is that you can share the same rule file for iptables-restore and ip6tables-restore respectively by prefixing all the version-specific lines with -4 and -6 ...


1

You can accomplish this using UFW. Enable UFW and set default incoming to deny: $ sudo ufw enable && sudo ufw default deny incoming Then you can allow specific IP's with: $ sudo ufw allow from 192.168.1.10 to any This will allow IP-address 192.168.1.10 to any port on your firewall.


1

As far as your browser is concerned, it's connected to 74.125.141.104. A DNAT doesn't change that fact. If you DNAT port 80 coming from the internet to port 80 on an internal webserver at e.g. 10.201.87.80, would you expect netstat on the remote system to show 10.201.87.80 as the remote IP or your external IP? PS: 10.201.87.64:599449 is impossible, port ...


1

You can't have a dynamic --log-prefix when using iptables. However, since SSL_CLIENT holds the source IP address you could look in the SRC="..." field to obtain it.


1

This is an example taken from http://www.andybev.com/index.php/Using_iptables_and_PHP_to_create_a_captive_portal . This does exactly what you want: IPTABLES=/sbin/iptables # Create internet chain # This is used to authenticate users who have already signed up $IPTABLES -N internet -t mangle # First send all traffic via newly created internet chain # At ...


1

Your initial instinct is correct. The first rule should be "allow all packets from this source range", followed by the "meter incoming packets" rule(s). IPTABLES rules are evaluated in the order they appear, with the first match winning. The only thing I would do differently is to make the INPUT policy DROP, rather than having an explicit DROP rule at the ...


1

I understand the routing table is a "fall through" table Not really. The routing table is ordered from "most specific route" to "least specific route". Your default route is via br0, and is defined as the route of last resort because there is no netmask (i.e. genmask is 0.0.0.0). because the 1st entry is 0.0.0.0 all traffic will go through the tun1 ...



Only top voted, non community-wiki answers of a minimum length are eligible