Tag Info

Hot answers tagged

4

Your firewall is off after you ran those commands. The problem here is DNS setting. You don't have any DNS server to resolve host name www.google.com. A quick fix: echo nameserver 8.8.8.8 >> /etc/resolv.conf


3

Usually you would have to setup your web server with virtual hosts and maybe mod_proxy (for Apache). However, I would suggest that you use a reverse proxy such as haproxy to take care of that. Setup Haproxy so that it listens to port 80 and direct your traffic to your webservers using ACLs on the domain name. Setup your webserver with virtual hosts that ...


3

Its because iptables is not listed in your PATH variable. I think it should work with sudo. Try sudo iptabels -L If that too doesnt work then you should checkout where the iptables binary is and then add it to the PATH variable. In most cases it should be in /sbin/ . Still just varify in Debian7. If it is in /sbin/ then you can open .bashrc file and ...


3

I seriously doubt sudo iptables -P INPUT DROP produce the ending DROP rule. In fact, -P sets the policy, and the policy is found in the headers of the table: sudo iptables -L Chain INPUT (policy DROP) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination ...


2

Use the firewall-cmd command. Assuming you're opening the firewall up to OpenVPN on the default zone, carry out the following commands. If you are running it on a non-default zone, then add --zone=<zone> to the commands. First, list what's currently open: # firewall-cmd --list-services http https ssh Next, add the openvpn service: # firewall-cmd ...


2

/sbin/iptables -t nat -A PREROUTING -p tcp --dport 80 -d 10.13.235.42 -j DNAT --to-destination 209.208.27.224:27279 Works with the nat table. Appends the rule to the PREROUTING table so that decisions made in this rule can affect what routing decision gets made. Strictly for connections to port 80 on 10.13.235.42 which is presumably one of this machine's ...


2

With the WFAF, I was able to lock down a program so that it could only connect over specific ports via specific protocols to specific IP addresses That functionality would be a combination of SELinux for port number access control netfilter/iptables firewall for HBAC and protocol inspection. I'm not sw00ft enough with SELinux to give you full-on ...


2

The iptables command can pretty much only be usefully run as root, not as another user. So it is not in the default command search path for users other than root. To run iptables, run it as root, with either of these commands: su 'iptables --some-option …' sudo iptables --some-option … The executable is located in /sbin, which is in the default command ...


2

The problem is that you have a route in your local table that says: $ ip route show table local [...] local 192.168.1.101 dev eth0 scope host [...] When sending a packet with [src=192.168.1.101 dst=192.168.1.101], and expecting the router to send that packet back reflected (some will refuse to this kind of thing), you want the outgoing packet to skip that ...


2

Using SCAN_TIMEOUT I would assume that if psad detects scanning attacks from some nefarious IP address that it wholesale blocks it for the duration of time set in AUTO_BLOCK_TIMEOUT. If you just want to block scanning attacks then from the manual I would say you might want to use this timeout instead: SCAN_TIMEOUT 3600; excerpt ...


1

To specify the ip address 1.1.*, you would use 1.1.0.0/16. This notation is used for CIDR (classless inter-domain routing) and is the standard method used to specify blocks of addresses. The /16 indicates the network includes all of the lower 16 bits of the address, so it matches in this case the address block from 1.1.0.0 to 1.1.255.255.


1

Here are a couple of solutions that can introduce latency, packet re-ordering and packet drops on *BSD and Linux. Using netfilter to simulate Packet loss Using tc and netem to introduce delays and loss On FreeBSD, use dummynet. Here's an intro.


1

Using apache: This might be a simple starting point - especially if you are considering hosting your two processes using apache. Note that, as @Tony mentions, there are more efficient proxies available, which are definitely worth considering if you are not using apache to host your processes. You need to find the httpd.conf file for your particular ...


1

I needed to change a setting in VirtualBox. I had to change my Network Attached from Bridged Network to NAT and after restart I ran an ifconfig -a and it finally pulled an IP address!


1

dpkg -L iptables will show where the files are installed from the package iptables. dpkg -L iptables | grep iptables$ You can check the location of iptables binary file. For me on Ubuntu it is in /sbin/iptables. So run with /sbin/iptables -L and check.


1

init scripts are gone. Now its systemctl. Its out there in all CentOS7 docs. To chkconfig ipatables or to start iptables service at startup you need to use this:- systemctl enable iptables You should checkout simple things to be known about systemctl at the Cyberciti docs on iptables.


1

From all information you provided, I only guess that when you delete the rules, your Linux PC's ip address is not in iptables conntrack table anymore, so its traffic is dropped. The Windows PC's ip address may still appear in conntrack table, so its traffic is accepted. iptables process each rule, from top to bottom. So the order of rules you defined in ...


1

There are several modes with SSL and FTP: Implicit SSL, that is SSL from start (usually port 990) and never plain text. In this case you get no clear text information at the firewall about the dynamic data ports and thus cannot restrict communication to only these ports. Explicit SSL with "AUTH TLS" command before login to enable SSL but without CCC after ...


1

Answering this from perspective of Whonix 8. Links point to Whonix 8 source code. Generally Whonix's firewalls are white listing firewalls. This means, they use policy drop for all chains (input, forward, output) and a drop or reject rule as last rule. All traffic that is not explicitly white listed will be dropped or rejected (depending on chain). ...


1

are there any other typical webserver services that might break because of that? No. As long as you correctly configure rules for FTP (if you plan to use it) you'll be fine with allowing ESTABLISHED instead of ESTABLISHED and RELATED



Only top voted, non community-wiki answers of a minimum length are eligible