Tag Info

Hot answers tagged

2

For a generic router, try the following as a script iptables -A FORWARD -i eth1 -d 10.10.2.0/24 -j ACCEPT iptables -A FORWARD -i eth2 -d 10.10.1.0/24 -j ACCEPT echo "1" > /proc/sys/net/ipv4/ip_forward


2

You should have a rule to accept everything on the loopback device so internal communication is not blocked by iptables. iptables -I INPUT -i lo -j ACCEPT iptables -I OUTPUT -o lo -j ACCEPT


2

There is one thing that you didn't configure in your iptables ruleset. You want to forward a port to a specific IP and port but you don't use any FORWARDing rule. The rules you'd need to forward traffic to your Virtual Machine should be. iptables -A FORWARD -p tcp -s "$PUBLIC_IP" --sport 80 -d "$VM_SITEWEB" –dport 80 -j ACCEPT iptables -A PREROUTING -t nat ...


2

No, iptables does not protect you from kernel vulnerabilities. In fact, iptables can also become an attack vector. There are other places where exploitable vulnerabilities could occur: The network driver. The SSH daemon itself. If you have sshd configured with weak passwords and someone manages to bruteforce it, then local privilege escalation exploits can ...


1

There is also a package designed for saving and restoring the iptables rules. You should get the desired results if you install iptables-persistent


1

The command which you are entering is just for blocking incoming ICMP connection if you want to block outgoing ICMP connection you have to choose output chain i.e sudo iptables -A OUTPUT -p icmp -j DROP


1

tcpdump shows you what the interface sees. Obviously packets have to arrive at the interface first before Netfilter (iptables) can kill them. Thus iptables can never prevent you from seeing incoming traffic. It can just prevent this traffic from having an effect (besides wasting your bandwidth...). But there should not be any outgoing packets any more. ...


1

lsof -p 1028 filters for process ID 1028. You should try: # lsof -Pnl +M -i4 for a list of open IPv4 ports and their owning processes. The -Pnl is optional, but makes it slightly quicker as it doesn't do name lookups etc for you. Or: # lsof -i :1028 to list everything listening on port 1028. If there is something strange going on, then you need to ...


1

If there is no logging specified in the firewall rule that rejects the connection attempts, then nothing will appear in the log. I suggest you read the RedHat firewalld reference which discusses adding logging requirements to firewall rules. Unfortunately, it's fairly complex and there are no shortcuts that I know of.



Only top voted, non community-wiki answers of a minimum length are eligible