Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [firewall]

A firewall is a program that controls the incoming and outgoing network traffic on a system. Use this tag for all questions related to firewall configuration and operation.

Filter by
Sorted by
Tagged with
0 votes
2 answers
59 views

Wireguard and Ubuntu 22.04. Forcing traffic from port 25 over VPN

So Im hosting a server in a docker container which is a client in a VPN network. I Cant send any egress traffic out of port (say ummm 52) through the host. That box is a client to a wireguard server. ...
Nimrod5000's user avatar
1 vote
1 answer
35 views

Prevent port scanning on OpenWRT

Imagine you need to have open ports on your Internet router but you don't want them to be easily discovered or enumerated. How can you prevent hackers/companies from scanning your open ports?
Artem S. Tashkinov's user avatar
0 votes
1 answer
35 views

How are source ports chosen for iptables SNAT targets?

By default the SNAT target keeps the source port of the original packet. If that port is already in use, it chooses one at random. Is there any way to influence the choice of this port or gage the ...
Philippe's user avatar
  • 459
1 vote
1 answer
82 views

How does linux report SNAT port exhaustion [closed]

I would like to monitor a router for potential SNAT port exhaustion. I'm fully aware of how unlikely this is to happen. I would still like to know how I could detect this on my running system. Does ...
Philippe's user avatar
  • 459
2 votes
0 answers
21 views

Add user or process information in nftables logs

Hy, Is it possible to customize nftables log's to add more informations ? For example, it could be interesting to get users ( id, gid, ... ) or processes informations that try to out. Example of ...
Pierre B's user avatar
0 votes
0 answers
20 views

How to Allow all NATed traffic from iptables firewall via pfsense (gateway)

I have an iptables firewall (machine 1) and a centos 7 based gateway (machine 2), which is having 2 interfaces (machine-2:int-1) from WAN [/30] and (machine-2:int-2) is LAN [/28] one of the static IP ...
Ratna Kumar's user avatar
2 votes
1 answer
28 views

Tracing iptables Rules

I'm just beginning to dig into iptables for the first time today, so apologies for any naivete. For reference, I'm using Ubuntu 22.04.4 LTS (Jammy Jellyfish) iptables v1.8.7 (nf_tables) ufw 0.36.1 ...
ALittleHelpFromMyFriends's user avatar
0 votes
1 answer
23 views

Why aren't my ipset counters incremented?

I'm trying to configure a firewall (using iptables on a Docker host) that allows inbound HTTP and HTTPS from everywhere, SSH from a certain set of IPs and no other incoming connections. I liked what I ...
user23957395's user avatar
3 votes
1 answer
37 views

Which is My Static IPv6 Interface Identifier?

I've been accustomed to IPv4 for so long and I'm really unfamiliar with IPv6. I recently wanted to add a firewall rule to my OpenWRT router to allow inbound IPv6 connection to a certain port of my ...
citrate's user avatar
  • 151
0 votes
0 answers
45 views

nftables rules apparently blocking ssh traffic - could it be special characters?

I have a set of nftable rules of the following form: chain INPUT { type filter hook input priority filter; policy drop; ip saddr 11.37.79.97/29 counter packets 0 bytes 0 log prefix ...
wolfsshield's user avatar
0 votes
1 answer
69 views

Install apache, php and mysql on Ubuntu 22.04 toolbox

I would like to install apache, php and mysql on Ubuntu 22.04 toolbox which is running in a Fedora 39 desktop VM. I am following the steps instructions provided in this link, but is seems to have some ...
pablo's user avatar
  • 3
0 votes
1 answer
36 views

What configuration is blocking local ssh connections to my server?

So I recently bought a Raspberry Pi to work on a small passion project with the RetroPie Debian-based image. I am now at the stage where I want to completely shield the server only allowing specific ...
Ress's user avatar
  • 1
1 vote
1 answer
135 views

nftables - multicast packets not matched

I've set up a rule to match multicast packets as follows: add rule filter_4 new_out_4 meta pkttype multicast goto multicast_out_4 filter_4 is IPv4 table, new_out4 is output chain and multicast_out_4 ...
metablaster's user avatar
1 vote
1 answer
19 views

iptables rule not working as expected

I cannot get this one rule working right. My interfaces: #WAN auto wan0 iface wan0 inet dhcp #LAN auto lan0.7 iface lan0.7 inet static address 172.17.7.1 netmask 255.255.255.0 vlan-raw-...
Lee's user avatar
  • 11
0 votes
0 answers
72 views

Wireguard client incoming packets drop

I have a home server running Ubuntu Server. I'm running some services on docker which need a VPN client for anonymity. The wireguard client runs as a standalone application. I'm running traefik to ...
Randy Peeters's user avatar
2 votes
1 answer
32 views

arptables not working with nmap

I'm trying to implement a way to prevent network scans from my notebook. One of the things I want is to allow arp request to specific hosts, like my gateway. I added some rules using arptables and ...
Alberto Pires's user avatar
0 votes
0 answers
28 views

Kafka with KRaft - what is listening on the random high port?

I'm in the process of writing some ansible to install Kafka on RHEL and I've got the service running and am about to configure the firewall to make the service accessible on the network. When I look ...
azzid's user avatar
  • 1,000
0 votes
0 answers
21 views

Many UFW BLOCKs pr minute from numerous ports and numerous IP addresses

My syslog is flooded with numerous attacks of some sort coming from multiple sources. I looked at all the other references in the search feature but none addressed tcp and from numerous sources Feb 16 ...
brad's user avatar
  • 207
0 votes
1 answer
62 views

Matching DSCP portion of ToS or traffic class byte using ebtables

Is it possible to match only the DSCP portion of the IPv4 ToS or IPv6 traffic class byte using ebtables? I see that ebtables has the --ip-tos match option for IPv4 packets and the --ip6-class match ...
Xt531bd's user avatar
  • 101
2 votes
2 answers
145 views

nftables how to temporarily allow a port(s) for an application

I am using Warpinator on my android phone to transfer files between my linux machines and my mobile phone. The application uses ports for 42001 for initial connection, and 42000 for data transfer. I ...
benibilme's user avatar
0 votes
0 answers
40 views

GUWF and firewall malfunctioning?

I keep adding IP addresses to the built-in Linux Mint "firewall" program (which is "GUWF" relabeled "firewall") and it worked for a while ... but now it doesn't look like ...
natS's user avatar
  • 3
0 votes
1 answer
43 views

Iptables: order of redirect and input-filter

I will filter inbound traffic with iptables. I have 2 goals. a) Allow HTTPS inbound at port 443. b) Redirect port 443 to process listening port on 9443. Not sure about the processing of that 2 rules....
chris01's user avatar
  • 595
0 votes
0 answers
21 views

How to access to a kubenetes pod from outside using proxmox(Virtualisation solution)

I have a proxmox host(@ip=231.25.36.12),inside I have installed a kubernetes cluseter, this cluster consists of 3 vms(these VMs are not routable I mean they are accessible just from proxmox node, they ...
estem estem's user avatar
0 votes
1 answer
65 views

Knockd not executing the knock command

I am trying to setup knock daemon, however it does not seem to execute the knock command. To debug the issue, I used this simple configuration, which is slightly edited example from the documentation: ...
Stefan's user avatar
  • 1
1 vote
0 answers
68 views

Can't ping external sites in Linux guest that already has internet access

I have an Ubuntu 20.10 guest and an Ubuntu 20.04 host and other devices on my LOCAL network, but for some reason the guest can't ping websites (e.g. ping google.com). What's interesting is that I have ...
Ashkan Arabi's user avatar
0 votes
1 answer
173 views

How to exclude dnsmasq used by libvirt from Mullvad VPN's "local network sharing" block

I don't use the local network expect dnsmasq for libvirt. With blocking local network I have no DNS on my VM. For that reason I want to exclude dnsmasq from the local network sharing block with split ...
clooney's user avatar
  • 81
1 vote
1 answer
125 views

How to flush the nft flowtable hash of active connections?

I have flowtable offloading working just perfect on my router. Sometimes I want to block some ongoing traffic, being handled via the flowtable. If I add a new blocking rule to the regular routing ...
xevior's user avatar
  • 51
0 votes
0 answers
28 views

I want to allow incoming traffic on a specific port like ssh and block all outgoing traffic in firewalld

I'm using Firewalld, I want to block all the outgoing traffic. And allow all incoming traffic or SSH connection for specific IPs. I'm able to block all the outbound traffic and it is working by ...
Tech_div's user avatar
0 votes
0 answers
373 views

I am unable to access my HTTP NGINX server over LAN

I have allowed the port in ufw and have the following configuration: server { listen 0.0.0.0:8000 default_server; server_name _; index index.html; access_log /var/log/nginx/html....
RadoslavL's user avatar
0 votes
2 answers
393 views

Load iptables or nftables rules as fast as possible during boot and before the network interfaces be put online

I rely on my specific service to load iptables rules at startup in my debian installation, this service calls iptables-restore my_rules.v4 ip6tables-restore my_rules.v6 and do some other scripts ...
user3450548's user avatar
  • 2,944
0 votes
1 answer
52 views

Unable to make MAC Adress accessible in nftables

I have an Oculus Quest and I want only the Oculus to be able to see my miniDLNA server. So on the server itself I have the following config: The Mac Adress I've given is 100% correct and when ...
Iron Dude's user avatar
0 votes
1 answer
71 views

Blocking all ports but a few in iptables

I am attempting to DROP all ports but one in iptables. After running the following commands: iptables -N WHITELIST iptables -A INPUT --jump WHITELIST iptables -A WHITELIST --protocol tcp --match tcp --...
sawntoe's user avatar
  • 26
1 vote
0 answers
566 views

How to find out what is blocking ssh traffic

I paid for a VPS, and it has a ssh connection option. Giving its IP address and provided port (22), i'm trying to connect: ssh -vvvv user@ip and get the connection timeout with such output: OpenSSH_9....
Sergey Shopin's user avatar
0 votes
0 answers
95 views

why do I have requests from inside apache server with source ports 80 and 443

On one machine, I have a web server running (apache) and responding on ports 80 and 443. On this machine, I have a firewall (shorewall) that blocks everything except what I authorize, and I therefore ...
Chris972's user avatar
0 votes
0 answers
195 views

Configuring IPTABLES for Passive FTP Connection through NAT (Forwarding from One PC to Another Using a Second Ethernet Card)

I am trying to connect to an FTP server through a NAT network created by another PC that uses two Ethernet cards. I would like to access via FTP client the second PC's FTP server through the first one....
Giacomo Ornati's user avatar
0 votes
0 answers
145 views

Disable Network Permission for all Flatpaks

The Flatseal Flatpak has a toggle to disable network permissions (share=network) for all Flatpaks installed on your system. How can I do this same thing by command line, for all Flatpaks installed on ...
jophuh's user avatar
  • 23
0 votes
1 answer
177 views

How to define port forwarding

I run a server with a web server running as a rootless podman container. This exposes ports 10080 and 10443 because, as a rootless container, it is not allowed to expose ports 80 and 443. So that my ...
M.Ede's user avatar
  • 1
0 votes
0 answers
107 views

Nftables does not work as expected to block with meter

Goal: Account for excess packets whose rate source IP and destination port are greater than 200 packets per second, example: 1s, 2s, 3s ...: IP 1.1.1.1 to MyServer:80 [This happens 201 times in ...
Gabriel's user avatar
0 votes
0 answers
92 views

How is it possible that NAT doesn't back translate packets?

I have the following topology and from myhost I can ping router2 but can't ping router1. With tcpdump I can observe how my pings go and I see that both router1 and router2 reply. But only replies ...
Dims's user avatar
  • 3,255
0 votes
2 answers
37 views

Identify unique tcp connetion to a Linux server

I'm in the planning stages of migrating an application from one Linux server to a new Linux server. The new server will have a different IP address and a different hostname. One of the items on my ...
goswell's user avatar
0 votes
0 answers
70 views

Can't access webserver inside LAN

I have tried apache and php's internal server, with none of them I can access from another computer if I use the internal IP. \ In the browser it sais "The connection has timed out. The server at ...
Martzy's user avatar
  • 11
2 votes
1 answer
3k views

UFW Couldn't determine iptables version

I am building a custom embedded Linux platform based on the NXP i.MX8 with Yocto. I want to use UFW to setup the firewall. When I boot the system and try to use UFW it returns an error Couldn't ...
PhilBot's user avatar
  • 79
2 votes
2 answers
727 views

nftables deleting a rule without passing handle (similar to iptables delete)

iptables syntax for delete is much simpler. if we replace the "append" with delete we get command for deletion of the rule. nftable provides similar construct for few rule management aspect ...
Amit Priyadarshi's user avatar
0 votes
0 answers
298 views

What is "mtr --report --tcp --port=22" telling me?

RHEL 8.4 Here's the output of mtr to a server for which the firewall is open to port 22: $ mtr --report --tcp --port=22 --no-dns Server1 Start: 2023-08-09T21:49:20-0400 HOST: foo.example.com ...
RonJohn's user avatar
  • 1,148
0 votes
1 answer
158 views

RHEL 6.4 basic firewall rule port 6162 does not take effect

I'm dealing with a RHEL version 6.4 server's firewall setting and the goal is to allow remote device to connect tcp port 6162, regardless of the type of services. The iptables rules are shown below(...
user53815's user avatar
0 votes
0 answers
889 views

Squeezebox can't connect to Logitech Media Server running on PC

Debian 11, I have installed Logitech Media Server to use with Squeezebox player. Server is running on local IP Address: 192.168.10.xxx port 9000. I configured that address on my Squeezebox player, but ...
minto's user avatar
  • 525
0 votes
0 answers
39 views

Can't connect to ubuntu-ran cstrike server (27015 udp)

I've ran a Counter-Strike 1.6 Server on a Ubuntu 18 VPS. When I run the hlds, The server looks fine when ran. (I'm running via ssh) But I can't connect to it with my computer. This is nmap output (X....
RAVEN.exe's user avatar
1 vote
1 answer
121 views

How to block a range of ip adresses with libirt's nwfilter for a specific mac(VM)

I'm a bit lost how to block a range of Ip adresses(preferbly for a specific mac adress of a VM) <filter name='local-fileserver-only' chain='ipv4' priority='-700'> <uuid>blank for now</...
Hazmat's user avatar
  • 41
0 votes
0 answers
31 views

Why do chains in Bridge type tables have different (default) priority values in nftables?

As the man page clearly shows https://www.netfilter.org/projects/nftables/manpage.html , the default "filter" priority value for Bridge table chains -200, while it is 0 for all table types, ...
T Nierath's user avatar
  • 216
0 votes
0 answers
337 views

Firewall problem on Debian 11 while trying to grant access to 443 port

Want to grant access to port 443 for two other computers. All computers involved have Debian OS. Ping and traceroute are successful from both IP addresses. Rules added to iptables: -A INPUT -s 192.168....
Lars Volker's user avatar

1
2 3 4 5
21