Tag Info

Hot answers tagged

6

Make sure you accept also connection originated from inside. With iptables: iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT With Webmin, allow Connection states EQUALS Existing Connection


5

Leave the OUTPUT chain untouched. Put these in your INPUT chain iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -s 1.2.3.4 -j ACCEPT iptables -A INPUT -j DROP # or REJECT The first rule allows your iptables configuration to accept traffic for established connections (i.e. those initiated by your own server to other ...


4

iptables -I OUTPUT -p tcp -m tcp --dport 443 -j REJECT --reject-with icmp-port-unreachable iptables -I OUTPUT -p tcp -m tcp --dport 80 -j REJECT --reject-with icmp-port-unreachable iptables -I OUTPUT -p tcp -m tcp -d youremailsiteIP/32 --dport 80 -j ACCEPT iptables -I OUTPUT -p tcp -m tcp -d youremailsiteIP/32 --dport 443 -j ACCEPT where youremailsiteIP is ...


4

Linux has a feature called network namespaces which allow you to essentially have multiple network stacks on the same machine, and assign one to a program when running it. This is a feature typically used for containers, but you can also use it to accomplish what you want. The ip netns subcommands manage it. Creating a new network namespace with no access ...


3

Everyone. limit match has no additional qualifications. hashlimit match is more configurable. iptables-extensions via man iptables. Note many "users" can be behind one IP (NAT, http proxy, CGNAT). I have no idea what a best practice would be here. But this implementation doesn't sound useful because HTTP supports persistent connections. Apache ...


2

You can use /etc/hosts.deny and /etc/hosts.allow. /etc/hosts.allow: ALL: allowed_ip /etc/hosts.deny: ALL: ALL This configuration access to your server only from allowed ip (this might be a problem in some cases). May be you have to use some firewall to specify access to your server. But above will not handle httpd and ICMP requests you can try ...


2

You can translate MikroTik firewall rules to Linux iptables rules pretty easily. The only real difference is that iptables marking isn't quite as pretty, it likes 32 bit flags instead of nice long names, but "1" suffices most of the time. According to the iptables man pages: add chain=prerouting : -t mangle -A PREROUTING (Appends a new rule to the end of ...


2

The Debian way of setting up iptables on boot is by using the iptables-persistent package. Simply install the iptables-persistent package, set up the iptables rules like you want them, and then run netfilter-persistent save. (Note that the command starts with netfilter and not iptables.) See the man page for netfilter-persistent for more details. The ...


2

Turns out my router was set up to forward some high ports to the internal SSH port - so basically the problem was caused by some ancient configuration leftovers. How stupid.


1

First, the filter rules are somehow redundant. When you never drop and your policy is ACCEPT, adding some more ACCEPT rules has no point. No package will be filtered. The way I tested this was by pinging from a device on the 172.20.0.0/16 subnet( ping -s 10240 172.30.0.9 ) I never actually tried to send huge ping blocks of 10kByte through a network and ...


1

I don't have a definitive answer for a Debian 8 way of setting up iptables at boot, but rc.local should work. With systemd, rc.local is handled by /lib/systemd/system/rc-local.service, which is automatically started after the network and runs /etc/rc.local start. The only requirement is that /etc/rc.local is executable: chmod 755 /etc/rc.local You also ...


1

It seem like you do not have any modules loaded that you need. By the way, which distro are you using which kernel version : uname -a Verify that modules mention by @ikrabbe are listed when you run one of these commands below : grep -i =m /usr/src/linux/.config cat /proc/modules | grep nat find /lib/modules/*/ -type f -iname '*.ko' | grep redirect ...


1

check your kernel configuration against CONFIG_IP_NF_TARGET_REDIRECT You need to enable that to use the -j REDIRECT target.


1

I'll guess that openwrt routers have a full blown iptables command. If so, then the question becomes as easy as parsing the iptables traffic counters. As an example, let's assume that I am keen on measuring traffic to the GoogleDNS server 8.8.8.8 on a vanilla server that has no iptables rules as seen below ❯❯❯ sudo iptables -n -L -xv Chain INPUT ...


1

Maybe someone has a better answer, but here are mine. Create an identical rule but one whose target is LOG rather than ACCEPT or DROP etc. That rule comes before the one you want to test. iptables -I OUTPUT -s 192.168.100.10 -p tcp --dport 22 -j LOG --log-level info You can find the log output wherever you have kernel logs directed to. (If you don't ...


1

iptables -A INPUT -s 1.1.1.1 -j ACCEPT iptables -A OUTPUT -d 1.1.1.1 -j ACCEPT iptables -P INPUT DROP iptables -P OUTPUT DROP service iptables save service iptables restart


1

Just to add to Normunds answer: $ sudo firewall-cmd --permanent --zone=work --add-source=172.16.0.0/12 $ sudo firewall-cmd --permanent --zone=work --add-port=8080-8090/tcp To block all other traffic: $ sudo firewall-cmd --set-default-zone=drop Warning: if you access from remote machine, this may disconnect your login session. If you did not get the ...



Only top voted, non community-wiki answers of a minimum length are eligible