Questions tagged [firewall]
A firewall is a program that controls the incoming and outgoing network traffic on a system. Use this tag for all questions related to firewall configuration and operation.
860
questions
0
votes
1answer
26 views
Iptables forward port traffic to another port with byte calculation
Problem
I want to 'redirect' traffic from one port to another. But I need to be able to calculate how much INPUT AND OUTPUT bytes were used in communicating through that port.
Half Solution
iptables -...
-1
votes
2answers
119 views
Blocking outgoing requests to specific domains e.g. facebook, twitter
I'm finding that Firefox and Chromium are both ignoring my /etc/hosts file.
Is there a way for me to block all outgoing requests to a particular set of domains e.g. Facebook.com and Twitter.com.
For ...
1
vote
0answers
22 views
Only KVM Guest Should Have Access To Internet
My setup has one server which also acts as the KVM host. Everything is built on Debian Buster, running several services for local use (networks 192.168.x.0/24). There are several wired network ...
1
vote
1answer
10 views
iptables DROP policy on INPUT causing 10+s of latency in SQL responses
I am trying to lock down my db server but have encountered something I cannot explain.
Chain INPUT (policy DROP)
num target prot opt source destination
1 ACCEPT tcp -- 0.0....
0
votes
2answers
44 views
My /etc/hosts is having no effect
I added a large number of domains to my /etc/hosts, in the hope of preventing outgoing traffic to those sites.
Now I have found however that my /etc/hosts is having no effect.
It's meant to serve as a ...
1
vote
1answer
56 views
Nftables default drop chain problem
I'd like to take a default drop approach to my firewall rules. I've created some rules for testing purposes:
table bridge vmbrfilter {
chain forward {
type filter hook forward priority -...
0
votes
0answers
12 views
firewalls, PackageKit, and cripplingly slow wireless throughput (oh my)
I'm a bit out of my element here, as network operation and security aren't something I have much experience with. My question relates to abysmal internet speed (speedtest results in 1Mbit down / '...
0
votes
0answers
21 views
How do I list out ports in a specific format?
I would like to print ports, their status, and what program is running on them in a format like this:
port#:portStatus:program
in order to make a script that can ask me if I would like to make a ...
3
votes
1answer
70 views
iptables recent module: remove entries older than
I am using iptables recent module:
-A INPUT -m recent --rsource --name PORTSCAN --set -j DROP
The above line adds offending IP addresses to /proc/net/xt_recent/PORTSCAN.
Now I am looking for a way ...
0
votes
0answers
16 views
Stop ISP firewall
I've set up an apache web server with port 80, I can access it very easily within the network by typing the IP x.x.x.x:80 in the browser (I know that I don't need to specify the HTTP port).
However, ...
1
vote
0answers
46 views
UPnP with firewalld
This question is probably related to: Fedora firewall with UPnP?
Because newer fedora workstations use firewalld, it's a bit of a different situation.
The problem I'm experiencing is that I can't ...
0
votes
0answers
23 views
Disallow port in URL when using reverse proxy
I want to run a reverse proxy, using nginx. My setup consists of one root nginx server (aforementioned proxy) and two other nginx servers that are in docker containers (with already exposed ports to ...
0
votes
1answer
16 views
accessing tcp port inside guest os
I would like to access a port on my guest OS from my host OS. I am using 127.0.0.1 on the guest OS since my database is also in that network, and since I just now understood(while it was right in ...
1
vote
2answers
30 views
IP Tables - Blocking Incoming Traffic
This question is in a way related this and this
My question is about blocking incoming connections using iptables. I read different posts in unix.stackexchange.com and got a basic understanding of ...
0
votes
1answer
14 views
block all VM connections but forward to a single host
I want to restrict internet access of a virtual windows machine. I want this machine to be able to reach a certain IP address and upload/dowload files from this server. I set up an OPNsense ...
2
votes
1answer
104 views
iptables forward some devices to different interfaces based on source IP
I'm trying to expand further on a recent question I had asked here (and was helped) based on this tutorial: https://www.instructables.com/Raspberry-Pi-VPN-Gateway/#step5.
Using a Raspberry PI as a VPN ...
0
votes
0answers
81 views
unbound-anchor and strict DNS-firewalling
I have a strict firewall policy in my local router for DNS-ports. I only open for certain DNS-servers and want to keep it that way.
Lately, I have been trying out unbound. It works fine but there is ...
0
votes
0answers
26 views
UFW rules not working as expected
This is how the UFW configuration looks like in my Raspberry PI
Status: active
To Action From
-- ------ ----
1194/tcp ALLOW ...
1
vote
1answer
33 views
iptables does not block forwarding to another IP of the host itself
I have host used as gateway with
net.ipv4.conf.all.rp_filter=0
and iptables rpfilter that is used instead
iptables -t raw -A PREROUTING -m rpfilter --invert -j LOG-DROP-RP
My host have 2 interfaces ...
0
votes
0answers
17 views
Ubuntu 18 VM deployment with the firewall already disabled
What exactly do I add into the cloud_init.cfg file to have my Ubuntu 18.04.2 VM(s) deployed with the firewall already disabled since inception?
Also what (permanent) changes do I make in already ...
2
votes
2answers
139 views
iptables / route for returning incoming traffic back out of originating interface (eth0)
I'm just getting started with tinkering with Linux / IPTABLES and following this great tutorial here to successfully setup a RaspBerry Pi device (running RaspBerryPi OS / Debian) as a VPN Gateway. Any ...
1
vote
0answers
9 views
Converting an add-rule to a service for firewalld
I am having a hard time creating the following lines for multicasting into a service in firewalld.
firewall-cmd --permanent --add-port=49152-65532/udp
firewall-cmd --permanent --direct --add-rule ipv4 ...
0
votes
1answer
25 views
iptables: drop any ip not on whitelist, short circuiting chain
I have a whitelist of ip addresses I'm storing in a ipset. I want to craft an iptables rule for my input chain where any IP NOT on the whitelist gets dropped immediately and no rules further down the ...
0
votes
0answers
20 views
UFW firewall preventing updating packages even with less restrictive rules
I'm using UFW version ufw 0.36, on 20.04 Ubuntu.
Now i noticed that, by using:
ufw allow out http
ufw allow out https
ufw allow in http
ufw allow in https
ufw default deny incoming
ufw default deny ...
0
votes
1answer
35 views
Forward SSH traffic from public IP to local IP
I need to find a way to forward ssh traffic from a WAN ip address to a specific host IP address on a local network. The set up is as follows:
WAN ---------|Firewall| ----SSH Machine
EXTERNAL | ...
0
votes
1answer
39 views
Cannot cUrl self with public IP
My home network has a CentOS based server connected to it. I have a router, where the 80 and 443 ports are forwarded to that server.
I can reach this server with the public IP of the router and ...
0
votes
1answer
43 views
How does inbound port blocking work on a firewall?
Something is unclear to me about inbound traffic and firewalls.
My first assumption is that a firewall - say for a home router - should block all inbound ports. If you don't block all inbound ports, ...
1
vote
1answer
411 views
How to properly log and view nftables activity?
On Debian 10 buster I am having problems with docker containers unable to ping the docker host or even docker bridge interface, but able to reach the internet.
Allowing access as in related questions ...
0
votes
1answer
31 views
OpenVPN block users established connection?
following scenario:
I have clients connected to my VPN who are using a specific app that is using UDP Port 54477. However I want to block that connection during the night (ex. from 0-6). So I want to ...
0
votes
1answer
29 views
block port while its already being used?
let's say I have a program running that is already using a random tcp/udp port. If I deny connections now via iptables/ufw the port is still open for that programm until I close/reopen it. Is there ...
-1
votes
1answer
48 views
Qemu network traffic filtering with iptables
I need to filter both outcoming and incoming traffic of the guest system on Qemu (Linux). The host system is Linux too. I think iptables is a good tool, but I don't know how to use it here. What ...
0
votes
1answer
121 views
IPTables is blocking all outgoing traffic to http even though I allowed it
I am using the following code to allow DNS requests, and outgoing traffic to port 443, 22 and 80
However, all the traffic to port 443 and 80 is blocked for some reason
# Allowing DNS lookups (tcp, udp ...
0
votes
0answers
53 views
UFW kills SSH access on reboot
I'm trying to block all connectivity except what's required for a SSH server to function using the following commands on a freshly installed ubuntu 18.04 server:
sudo ufw allow ssh
sudo ufw default ...
1
vote
1answer
51 views
Why is it that TCP packets can be modified to block invalid packets, but not UDP packets
On a random day I was googling iptables rules to harden my desktop, and came across this post[1]. At some point the guide mentions blocking invalid TCP packets using tcp-modules with these rules;
...
0
votes
1answer
26 views
Iptables rules script problem
I found this script online, but there are 2 problems after executing on linux mint:
No internet from USB WiFi adapter, only from internal wifi
Can not connect to any VPN
What do I have to change ...
0
votes
0answers
59 views
smbstatus --shares returns no shares
Issue: I am trying to set up a Centos 8 samba share to be viewable on Arch + Windows
I am new-ish to linux, but completely new to Centos, I set up a server and set up samba from this guide: https://...
0
votes
0answers
74 views
How to set up apache server for public domain on linux?
I am running Arch Linux on my computer.
tl;dr I have portforwarded apache and the router on port 80 and disabled all firewalls on my computer and router. Apache has started and started with no visible ...
0
votes
0answers
75 views
How to: Linphone network ports for firewall
After some experimentation, I have found that the following ports need to be opened on the host firewall:
Linphone dynamic port range: 10000-17000 (I have not seen anything yet outside of this)
...
0
votes
1answer
59 views
Modifying firewall rules with pfctl on NetBSD 4
I'm wanting to modify some firewall/NAT rules on a device (Apple Airport) running NetBSD 4.0. I'm not that familiar with BSD and pf, so want to check the right approach. I can change the pf.conf file (...
0
votes
1answer
76 views
kernel modules missing
I'm using this NPi i.MX6ULL (armhf) board here. It comes with a customised linux distribution, based on Debian Buster. But it's been completely stripped down to the bare minimum.
My question isn't ...
0
votes
0answers
41 views
Setting up a Debian Firewall (with UFW) on a bridge connection (wi-fi) — Broken pipe ERROR
Good morning, I'm currently working on the creation of a web server.
Here is my setup :
MacbookPro running -> VirtualBox
VirtualBox running -> Debian 10.04 (only command line)
Docker with -> ...
0
votes
0answers
8 views
firewall-cmd open port issue
I have CentOS 7.7.
I try to open port 9001
by the command: firewall-cmd --zone=public --add-port=9001/tcp --permanent & firewall-cmd --reload'
I can see the port in the command firewall-cmd --list-...
0
votes
1answer
174 views
How do I open firewall for NFS server on OpenSuse Tumbleweed?
When I disable the server firewall, the exported directories appear on the NFS client. Otherwise they don't.
I've tried allowing the 'nfs' service on both the "public" and "internal&...
0
votes
0answers
207 views
Using qemu/kvm with nftables? (without firewalld!)
With libvirt/qemu/kvm you can define a bridge (or more) to be used by the guest machines. The libvirt machinery should take care of the creation of the bridge - normally called virbr0 with virbr0-nic (...
1
vote
2answers
75 views
iptables - Drop NAT rules based on rule/name, NOT rule number
I need to script some Iptables rule changes involving NAT rules (-t nat) on Ubuntu 16 servers.
It seems like the common way to drop a rule using -D [rule here] does not work with the -t identifier... ...
2
votes
0answers
42 views
How do I see how much CPU time my firewall uses?
I was attacked with a DNS Amplification and as a result added nearly 4,000 IP addresses to my firewall using fail2ban.
I have seen many people worried about how many rules they include in their ...
0
votes
1answer
135 views
Forward debian LAN to another router without nat
Is it possible to create network forwarding through debian without using nat?
I have the following network structure.
ip: xxx.xxx.xxx.xxx/xx ---- Internet - wan - [Router with nat] --- lan (10.1.1.1/...
0
votes
1answer
44 views
Securing private network during port forwarding?
If I open port to a single server on a private network, will that put every computer in my network at security risk? For example, if I have a company desktop and allow ssh into that desktop from a ...
2
votes
2answers
63 views
How to safely allow particular remote IP access to particular servers on private network?
I have HPC that I want people to use it remotely without giving them access to other computers in the private network. Other computers are operating on network. I am using port forwarding.
sudo ...
2
votes
2answers
139 views
Centos 7 firewall is blocking file exchange
My Centos 7 firewall is blocking file exchange (import and export) with an external FTP client if I try to connect via script. Everything works fine if I disable the firewall. Do you know if a ...
