As of May 31, 2023, we have updated our Code of Conduct.

Questions tagged [firewall]

A firewall is a program that controls the incoming and outgoing network traffic on a system. Use this tag for all questions related to firewall configuration and operation.

Filter by
Sorted by
Tagged with
0 votes
1 answer
22 views

How to make wireguard exclude port 80 from tunnel

I am running a Debian VPS host My regular public IP is $A Under Wireguard VPN my public IP is $B I have services accessible on ports 4040 and 5050 on $B I want to access port 80 from $A while ...
jf4i2d's user avatar
  • 53
0 votes
0 answers
15 views

VPN disconeconnects when switching networks

TL;DR If I am connected to one network and then connect to VPN it works fine, but if I then connect to a different network then the VPN disconnects and tries to reconnect over the new network. I need ...
Zaph's user avatar
  • 1
0 votes
1 answer
161 views

choosing firewall: ufw vs nftables vs iptables

I'm using Ubuntu 18.04 on embedded system and I need to choose a firewall app between the followings: ufw, nftables, iptables. Can you recommend one of them and why its better than the others? Thanks
hutcruchi's user avatar
  • 159
1 vote
1 answer
48 views

nftables doesn't see KDE Connect packets between two machines on the same interface

I'm using nftables on a router running NixOS 22.11 (with the latest XanMod kernel patches and acpid as well as irqbalance enabled). The machine has 3 interfaces: enp4s0 which is connected to the ...
Quentin's user avatar
  • 13
0 votes
0 answers
36 views

systemd-journald.service: unit configures an IP firewall, but the local system does not support BPF/cgroup

I’ve just installed ubuntu 22.04 on my jetson nano. Docker does not work on 22.04,but it works on ubuntu 18.04 and 20.04. I used the same kernel version for ubuntu 18,20 and 22. This : Linux marietto-...
Marietto's user avatar
  • 491
2 votes
1 answer
73 views

One Static IP - Multiple Web server - Mikrotik RouterOS

I want to expose my 2 web servers over the internet. Now I have a single public IP which is terminated on my WAN router, and I also have a MikroTik firewall, behind the firewall both web servers are ...
Sarim Shekhani's user avatar
0 votes
0 answers
10 views

Firewalld configuration / pinhole?

I have a host with two interfaces: ens32 /zone=internal 10.10.0.47 ens36 /zone=public 192.168.0.47 I have a workstation at 192.168.0.88 I'm trying to configure firewalld to allow ssh only from a set '...
TexasTim's user avatar
0 votes
1 answer
47 views

Using iptables, how can i open a port only when i'm in my home network?

I want to host a service for syncing stuff between my laptop and my phone. Since I don't own a server, I decided i would host the services on my laptop. For my phone to be able to connect to that ...
laalsaas's user avatar
  • 135
0 votes
0 answers
29 views

Unable to parse HTTP packet using netfilter hooks in kernel module

I am trying to parse HTTP packets using netfilter hooks in my kernel module. I came across this code snippet on How to print data from TCP packets which I modified to make it build. However, I am ...
goodman's user avatar
  • 101
0 votes
1 answer
28 views

Allow a certain set of domain names corrisponding ip with resolution and whitelisting on the fly

I'm trying to setup a firewall config for a specific machine. The firewall is configured to block all traffic except for a certain set of allowed IPs. Today I was asked to put on a teamviewer service ...
user3450548's user avatar
  • 2,644
0 votes
1 answer
75 views

how can I enable sshd on MacOS ventura, if "systemsetup -setremotelogin on" doesn't work?

I am trying to enable remotelogin on MacOS (Ventura). "sudo systemsetup -setremotelogin on" says it is already enabled (confirmed by the GUI), but if I try to login from my Linux PC I get % ...
Harri's user avatar
  • 1
0 votes
1 answer
44 views

Cannot connect to wifi hotspot while vpn is turned on

I am using warp-cli (cloudflare vpn) and after I enable the vpn, I cannot connect any new devices to the wifi-hotspot. Existing connected devices stay connected while vpn is turned on but no new ...
Tuhin Garai's user avatar
0 votes
1 answer
30 views

nftables, accept policy, given TCP port, LAN machines only

This is a nftables beginner question. Given the rule: iifname $NIC_NAME tcp dport 22 accept in the chain_input chain below: table inet table_inet { chain chain_input { type filter hook ...
Léa Massiot's user avatar
0 votes
1 answer
99 views

What are the consequences of blocking incoming UDP port 68 on my computer?

In a FreeBSD 13.1 install, I enabled the IPFW firewall and set firewall_type="workstation" in /etc/rc.conf. This allows outgoing requests, while denying incoming requests. When I checked the ...
Flux's user avatar
  • 2,426
1 vote
2 answers
153 views

UFW not blocking connection

I am using the Cloudflare IPv4 and IPv6 lists to block all connections to my server from any IP that is not owned by Cloudflare. When I run sudo ufw status on the server I get: Status: active To ...
Just a nice guy's user avatar
0 votes
0 answers
62 views

How does the nftables set-syntax replacement for meters work exactly?

nftables nowadays recommends to use sets instead of meters when e.g. creating dynamic per-IP blacklists (example adapted from man pages v0.98: set blackhole { type ipv4_addr flags dynamic ...
reijerh's user avatar
1 vote
1 answer
632 views

Wireguard over TCP tunnel at 443 port, blocked ports bypassing, solution for OpenWRT

I'm facing a problem - I would like to connect many embedded devices with OpenWRT to my Wireguard server, but all the ports except 80, 443 and some others are blocked. Moreover only TCP is allowed in ...
Sink's user avatar
  • 11
1 vote
0 answers
65 views

How to firewall a network namespace using firewalld?

I'm running fedora 36 using firewalld as my firewall. I set up a network namespace called "wireguard". It contains the interface wg0 which connects to Mullvad VPN. I set it up like this: ip ...
minamikoarikui's user avatar
3 votes
1 answer
47 views

What are ARP hardware type 37, opcode 21 and protocol type 0x90bd?

I am currently testing netfilter / nftables / nft. As a starting point, I have made a ruleset that drops nearly everything in and out, and have written the rules so that every dropped packet is logged....
Binarus's user avatar
  • 2,583
0 votes
1 answer
27 views

What subsystem is responsible if I can connect via s2s VPN connection only in one direction?

I have configured the following s2s VPN (in pfSense) connection which is working in general. Unfortunately, I can connect (ping, netcat, ssh) only from client to the server, but not back. If I can ...
Dims's user avatar
  • 3,017
0 votes
1 answer
186 views

What is the correct way to increase nf_conntrack in ubuntu 18.04?

Yesterday I had issues with my database server dropping packets with: [Tue Feb 28 21:01:00 2023] nf_conntrack: nf_conntrack: table full, dropping packet I know there a plenty of solutions easy to ...
Freedo's user avatar
  • 1,175
2 votes
1 answer
129 views

How do I manually edit firewall rules on Debian via rescue mode, locked out of ssh!

I run an OVH VPS with Debian 10 and Virtualmin/Webmin to manage my websites. I got completely messed up by trying to install CSF; it destroyed my firewall tables and locked me out. I need to know how ...
GodsDead's user avatar
  • 193
0 votes
1 answer
132 views

UFW Block in Syslog - Why are many different IPs trying to connect to my server

first of all I want to clear up that I'm not a network expert and just trying to understand things. I hope I can find help here and get a bit smarter.. I'm hosting a service on a Ubuntu 22.04 vps. ...
mojo_x's user avatar
  • 1
0 votes
1 answer
47 views

How to block connection from eth1 through firewall daemon?

I have Debian 11 using the new Firewall Daemon, and I have a device connected to eth1. I want to block all connections from internet or any IP other than the local IP in the range 10.147.20.0/24. Is ...
Dr.Sherif Omran's user avatar
1 vote
1 answer
44 views

How to allow certain clients to talk to others in the same IP range when client-to-client communication is prevented?

I have a tap0 VPN working. In order to make the customers not talk I commented the #client-to-client line, it worked. Now I want to leave some IPs talking to the customers. Eg:10.8.0.2 and 10.8.0.6 ...
PS-PS's user avatar
  • 11
0 votes
0 answers
161 views

Luci openWRT UCI firewall rule update without position number

Hey all I have been trying find some code that would allow me to update my firewall rule via the UCI. The way I am currently adding the new rule is like this: uci add firewall rule uci set firewall.@...
StealthRT's user avatar
  • 121
0 votes
1 answer
148 views

How to secure the tap interface with nftables

The Qemu VM can be connected to LAN mainly in two ways: type=user or type=tap. The user mode completely isolate the VM in private network, which is sNATed to host main network stack. The use of tap is ...
schweik's user avatar
  • 1,120
1 vote
2 answers
230 views

How to block all outbound traffic except Tor

I have tried to use these rules with iptables but after I have used same rules in ip6tables, it has blocked everything. Why do my ip6tables rules block everything? iptables -F OUTPUT iptables -A ...
Bulcsú Édes's user avatar
1 vote
1 answer
105 views

iptables recent --mask not working

when I add following rule to iptables, everything works as expected. The offending IP is added to BLACKLIST and dropped. iptables -A INPUT -m recent --rsource --name BLACKLIST --update -j DROP when I ...
400 the Cat's user avatar
0 votes
0 answers
128 views

fail2ban and firewalld and Drop zone - strange behavior with rich-rule (add-source works fine)

firewalld and fail2ban settings: LOG_TAG1=HTTP-DENY_ LOG_TAG2=HTTPS-DENY_ F2B_NAME=http_https_deny sudo firewall-cmd --zone=public --add-rich-rule="rule family=ipv4 port port=80 protocol=tcp log ...
it_buddha's user avatar
0 votes
0 answers
42 views

Create two Wi-Fi networks, one without internet, OpenWRT?

So I'm trying to create two separate Wi-Fi networks, hosted by the same OpenWRT machine. More specifically, I want to know what manipulation of the config files /etc/config/wireless, /etc/config/...
Max Arena's user avatar
-1 votes
1 answer
101 views

ssh with dynamic local port forwarding

I know remote port forwarding can dynamically allocate port. ssh remote -R 0:10.19.24.19:5555 but unfortunately, the remote server's iptables forbid great range of ports. Is there anyway for ssh to ...
coel's user avatar
  • 1
1 vote
1 answer
301 views

How can I diagnose and reduce the number of dropped packets coming in from the WAN ethernet interface?

I have a couple Ubuntu servers each running as a firewall/router. I've noticed one has a much higher RX-drop count than the other. The drops seems to jump in spurts. This last netstat shows about 2.6% ...
fivejeez's user avatar
0 votes
1 answer
134 views

UFW not fully loading rules on startup

I have a server with default deny and several UFW rules. UFW is enabled on startup (systemctl enable UFW). When I reboot only some of the rules don't get applied properly and I can't access some ...
Mike's user avatar
  • 113
-1 votes
1 answer
318 views

OpenVPN Port 1194 not accepted in iptables policy but still accessible

I am able to connect to my OpenVPN server via port 1194, even though this port is not allowed (accepted) in my iptables config. I can confirm no exception is defined as this command gives no output: ...
studio-pj's user avatar
0 votes
1 answer
157 views

Configuring a firewalld killswitch

I want to configure a firewalld killswitch on my computer but don't know how to go about it. I want to block all incoming traffic. The outgoing traffic should only be allowed on a specific IP address, ...
user avatar
1 vote
1 answer
209 views

How can I force an applications source port?

I have an application running on a local Linux machine A, that needs to be able to communicate with another machine B, listening on port 12325. Problem arises when devices cannot communicate by ...
Lewis Smith's user avatar
1 vote
0 answers
198 views

On nixos, how to configure the firewall to restrict access to only certain domains?

I would like to configure my nixos machine to only connect to certain domains. In the firewall section of the nixos manual, I see how to specify networking.firewall.enable to enable the firewall. ...
mherzl's user avatar
  • 1,369
0 votes
0 answers
23 views

How can I isolate my firewall rules in a chain such that I can reset them separately?

I've been running some iptables rules for a while, which are (I hope) fine, no issues so far. Here's a snippet of that # Block all input and forward traffic, both IPv4 and IPv6 iptables -P INPUT DROP ...
The Quantum Physicist's user avatar
1 vote
0 answers
71 views

Block access to other private IP addresses on CentOS

I want to limit the access of CentOS device in LAN. For example, it's local IP is 192.168.1.2 and I want to block all traffic from this device to other local IPs from 192.168.1.1 to 192.168.1.254 ...
discover's user avatar
  • 111
1 vote
2 answers
406 views

How to add and delete a temporary nftables accept rule

To get and renew a Letsencrypt certificate, I need to open the http port 80 while certbot is running, and close it afterwards. (There is no normal web service in this server). With iptables I used ...
mivk's user avatar
  • 3,376
0 votes
1 answer
341 views

How to block subdomains containing a string with iptables

I already know how to block domains that contain a specified string iptables -A INPUT -m string --algo bm --string "test" -j DROP iptables -A OUTPUT -m string --algo bm --string "test&...
Maximilian's user avatar
0 votes
1 answer
47 views

Gufw configuration for basic usage

i have installed recently Gufw and ufw on my arch linux machine. i was wondering what is the proper rule configuration for basic usage (what to allow/deny on which ports). can someone recommend some ...
Charbel Eid's user avatar
0 votes
0 answers
198 views

Cannot access port 8080

This is the current situation : root@vmi1046457:~# docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS ...
Raphael10's user avatar
  • 101
1 vote
0 answers
58 views

How to block or whitelist specific webpages or files within a domain but block most of the domain?

I know how to use /etc/hosts to redirect www.herpaderp.com to 0.0.0.0 The problem is I need one page file from the website on a regular basis. I want to whitelist www.herpaderp.com/dir/foo.bar while ...
Max Power's user avatar
  • 229
0 votes
0 answers
30 views

Firewall stateful and stateless rule in simplified format

I am trying to use a simplified format of the syntax used by FreeBSD. Got to write stateful and stateless rule. For example: Allow a single Internal admin host to access the firewall ssh port and the ...
bostongeorge's user avatar
0 votes
0 answers
115 views

UFW seems to be ignoring allowed ports in specific cases - Solved

I've got a Raspberry Pi set up with UFW firewall to try and secure it as best as possible. Most of the rules seem to work absolutely fine, but for some reason, it's blocking specific connections which ...
BallistiX09's user avatar
0 votes
1 answer
42 views

Firewall reliability

First layer of defence and device isolation of all my linux boxes is firewall denying all incoming connections simply by... sudo ufw default deny incoming ...However I sometimes for a different ...
M_Ryan's user avatar
  • 1
0 votes
0 answers
435 views

Enabling outbound traffic on all network ports

I am working on a network gateway implemented with a single board computer running Ubuntu (I can't confirm the version since it is not an off-the-shelf distro, it is built using buildroot). I am ...
WedaPashi's user avatar
  • 101
0 votes
0 answers
195 views

Multiple iptables.rules files or include statement

I think that Title is self-explanatory. Anyway, what I'm looking for is a way to modularize my /etc/iptables.rules file, so I can easily manage them, e.g. a file with standard rules which all server ...
Roberto Iglesias's user avatar

1
2 3 4 5
21