Questions tagged [firewall]
A firewall is a program that controls the incoming and outgoing network traffic on a system. Use this tag for all questions related to firewall configuration and operation.
1,006
questions
0
votes
1
answer
22
views
How to make wireguard exclude port 80 from tunnel
I am running a Debian VPS host
My regular public IP is $A
Under Wireguard VPN my public IP is $B
I have services accessible on ports 4040 and 5050 on $B
I want to access port 80 from $A while ...
- 53
0
votes
0
answers
15
views
VPN disconeconnects when switching networks
TL;DR If I am connected to one network and then connect to VPN it works fine, but if I then connect to a different network then the VPN disconnects and tries to reconnect over the new network. I need ...
- 1
0
votes
1
answer
161
views
choosing firewall: ufw vs nftables vs iptables
I'm using Ubuntu 18.04 on embedded system and I need to choose a firewall app between the followings: ufw, nftables, iptables.
Can you recommend one of them and why its better than the others?
Thanks
- 159
1
vote
1
answer
48
views
nftables doesn't see KDE Connect packets between two machines on the same interface
I'm using nftables on a router running NixOS 22.11 (with the latest XanMod kernel patches and acpid as well as irqbalance enabled). The machine has 3 interfaces: enp4s0 which is connected to the ...
- 13
0
votes
0
answers
36
views
systemd-journald.service: unit configures an IP firewall, but the local system does not support BPF/cgroup
I’ve just installed ubuntu 22.04 on my jetson nano. Docker does not work on 22.04,but it works on ubuntu 18.04 and 20.04. I used the same kernel version for ubuntu 18,20 and 22. This :
Linux marietto-...
- 491
2
votes
1
answer
73
views
One Static IP - Multiple Web server - Mikrotik RouterOS
I want to expose my 2 web servers over the internet. Now I have a single public IP which is terminated on my WAN router, and I also have a MikroTik firewall, behind the firewall both web servers are ...
0
votes
0
answers
10
views
Firewalld configuration / pinhole?
I have a host with two interfaces:
ens32 /zone=internal 10.10.0.47
ens36 /zone=public 192.168.0.47
I have a workstation at 192.168.0.88
I'm trying to configure firewalld to allow ssh only from a set '...
- 3
0
votes
1
answer
47
views
Using iptables, how can i open a port only when i'm in my home network?
I want to host a service for syncing stuff between my laptop and my phone. Since I don't own a server, I decided i would host the services on my laptop. For my phone to be able to connect to that ...
- 135
0
votes
0
answers
29
views
Unable to parse HTTP packet using netfilter hooks in kernel module
I am trying to parse HTTP packets using netfilter hooks in my kernel module. I came across this code snippet on How to print data from TCP packets which I modified to make it build. However, I am ...
- 101
0
votes
1
answer
28
views
Allow a certain set of domain names corrisponding ip with resolution and whitelisting on the fly
I'm trying to setup a firewall config for a specific machine. The firewall is configured to block all traffic except for a certain set of allowed IPs.
Today I was asked to put on a teamviewer service ...
- 2,644
0
votes
1
answer
75
views
how can I enable sshd on MacOS ventura, if "systemsetup -setremotelogin on" doesn't work?
I am trying to enable remotelogin on MacOS (Ventura). "sudo systemsetup -setremotelogin on" says it is already enabled (confirmed by the GUI), but if I try to login from my Linux PC I get
% ...
- 1
0
votes
1
answer
44
views
Cannot connect to wifi hotspot while vpn is turned on
I am using warp-cli (cloudflare vpn) and after I enable the vpn, I cannot connect any new devices to the wifi-hotspot. Existing connected devices stay connected while vpn is turned on but no new ...
0
votes
1
answer
30
views
nftables, accept policy, given TCP port, LAN machines only
This is a nftables beginner question.
Given the rule:
iifname $NIC_NAME tcp dport 22 accept
in the chain_input chain below:
table inet table_inet {
chain chain_input {
type filter hook ...
- 101
0
votes
1
answer
99
views
What are the consequences of blocking incoming UDP port 68 on my computer?
In a FreeBSD 13.1 install, I enabled the IPFW firewall and set firewall_type="workstation" in /etc/rc.conf. This allows outgoing requests, while denying incoming requests. When I checked the ...
- 2,426
1
vote
2
answers
153
views
UFW not blocking connection
I am using the Cloudflare IPv4 and IPv6 lists to block all connections to my server from any IP that is not owned by Cloudflare.
When I run sudo ufw status on the server I get:
Status: active
To ...
0
votes
0
answers
62
views
How does the nftables set-syntax replacement for meters work exactly?
nftables nowadays recommends to use sets instead of meters when e.g. creating dynamic per-IP blacklists (example adapted from man pages v0.98:
set blackhole {
type ipv4_addr
flags dynamic
...
- 1
1
vote
1
answer
632
views
Wireguard over TCP tunnel at 443 port, blocked ports bypassing, solution for OpenWRT
I'm facing a problem - I would like to connect many embedded devices with OpenWRT to my Wireguard server, but all the ports except 80, 443 and some others are blocked. Moreover only TCP is allowed in ...
- 11
1
vote
0
answers
65
views
How to firewall a network namespace using firewalld?
I'm running fedora 36 using firewalld as my firewall.
I set up a network namespace called "wireguard". It contains the interface wg0 which connects to Mullvad VPN. I set it up like this:
ip ...
3
votes
1
answer
47
views
What are ARP hardware type 37, opcode 21 and protocol type 0x90bd?
I am currently testing netfilter / nftables / nft. As a starting point, I have made a ruleset that drops nearly everything in and out, and have written the rules so that every dropped packet is logged....
- 2,583
0
votes
1
answer
27
views
What subsystem is responsible if I can connect via s2s VPN connection only in one direction?
I have configured the following s2s VPN (in pfSense) connection which is working in general.
Unfortunately, I can connect (ping, netcat, ssh) only from client to the server, but not back.
If I can ...
- 3,017
0
votes
1
answer
186
views
What is the correct way to increase nf_conntrack in ubuntu 18.04?
Yesterday I had issues with my database server dropping packets with:
[Tue Feb 28 21:01:00 2023] nf_conntrack: nf_conntrack: table full, dropping packet
I know there a plenty of solutions easy to ...
- 1,175
2
votes
1
answer
129
views
How do I manually edit firewall rules on Debian via rescue mode, locked out of ssh!
I run an OVH VPS with Debian 10 and Virtualmin/Webmin to manage my websites.
I got completely messed up by trying to install CSF; it destroyed my firewall tables and locked me out. I need to know how ...
- 193
0
votes
1
answer
132
views
UFW Block in Syslog - Why are many different IPs trying to connect to my server
first of all I want to clear up that I'm not a network expert and just trying to understand things. I hope I can find help here and get a bit smarter.. I'm hosting a service on a Ubuntu 22.04 vps. ...
- 1
0
votes
1
answer
47
views
How to block connection from eth1 through firewall daemon?
I have Debian 11 using the new Firewall Daemon, and I have a device connected to eth1. I want to block all connections from internet or any IP other than the local IP in the range 10.147.20.0/24.
Is ...
- 189
1
vote
1
answer
44
views
How to allow certain clients to talk to others in the same IP range when client-to-client communication is prevented?
I have a tap0 VPN working. In order to make the customers not talk I commented the #client-to-client line, it worked.
Now I want to leave some IPs talking to the customers. Eg:10.8.0.2 and 10.8.0.6 ...
- 11
0
votes
0
answers
161
views
Luci openWRT UCI firewall rule update without position number
Hey all I have been trying find some code that would allow me to update my firewall rule via the UCI.
The way I am currently adding the new rule is like this:
uci add firewall rule
uci set firewall.@...
- 121
0
votes
1
answer
148
views
How to secure the tap interface with nftables
The Qemu VM can be connected to LAN mainly in two ways: type=user or type=tap. The user mode completely isolate the VM in private network, which is sNATed to host main network stack. The use of tap is ...
- 1,120
1
vote
2
answers
230
views
How to block all outbound traffic except Tor
I have tried to use these rules with iptables but after I have used same rules in ip6tables, it has blocked everything.
Why do my ip6tables rules block everything?
iptables -F OUTPUT
iptables -A ...
- 19
1
vote
1
answer
105
views
iptables recent --mask not working
when I add following rule to iptables, everything works as expected. The offending IP is added to BLACKLIST and dropped.
iptables -A INPUT -m recent --rsource --name BLACKLIST --update -j DROP
when I ...
- 186
0
votes
0
answers
128
views
fail2ban and firewalld and Drop zone - strange behavior with rich-rule (add-source works fine)
firewalld and fail2ban settings:
LOG_TAG1=HTTP-DENY_
LOG_TAG2=HTTPS-DENY_
F2B_NAME=http_https_deny
sudo firewall-cmd --zone=public --add-rich-rule="rule family=ipv4 port port=80 protocol=tcp log ...
0
votes
0
answers
42
views
Create two Wi-Fi networks, one without internet, OpenWRT?
So I'm trying to create two separate Wi-Fi networks, hosted by the same OpenWRT machine. More specifically, I want to know what manipulation of the config files /etc/config/wireless, /etc/config/...
-1
votes
1
answer
101
views
ssh with dynamic local port forwarding
I know remote port forwarding can dynamically allocate port.
ssh remote -R 0:10.19.24.19:5555
but unfortunately, the remote server's iptables forbid great range of ports.
Is there anyway for ssh to ...
- 1
1
vote
1
answer
301
views
How can I diagnose and reduce the number of dropped packets coming in from the WAN ethernet interface?
I have a couple Ubuntu servers each running as a firewall/router. I've noticed one has a much higher RX-drop count than the other. The drops seems to jump in spurts. This last netstat shows about 2.6% ...
- 11
0
votes
1
answer
134
views
UFW not fully loading rules on startup
I have a server with default deny and several UFW rules. UFW is enabled on startup (systemctl enable UFW). When I reboot only some of the rules don't get applied properly and I can't access some ...
- 113
-1
votes
1
answer
318
views
OpenVPN Port 1194 not accepted in iptables policy but still accessible
I am able to connect to my OpenVPN server via port 1194, even though this port is not allowed (accepted) in my iptables config. I can confirm no exception is defined as this command gives no output: ...
- 99
0
votes
1
answer
157
views
Configuring a firewalld killswitch
I want to configure a firewalld killswitch on my computer but don't know how to go about it.
I want to block all incoming traffic. The outgoing traffic should only be allowed on a specific IP address, ...
flippunk
1
vote
1
answer
209
views
How can I force an applications source port?
I have an application running on a local Linux machine A, that needs to be able to communicate with another machine B, listening on port 12325. Problem arises when devices cannot communicate by ...
- 11
1
vote
0
answers
198
views
On nixos, how to configure the firewall to restrict access to only certain domains?
I would like to configure my nixos machine to only connect to certain domains.
In the firewall section of the nixos manual, I see how to specify networking.firewall.enable to enable the firewall.
...
- 1,369
0
votes
0
answers
23
views
How can I isolate my firewall rules in a chain such that I can reset them separately?
I've been running some iptables rules for a while, which are (I hope) fine, no issues so far. Here's a snippet of that
# Block all input and forward traffic, both IPv4 and IPv6
iptables -P INPUT DROP
...
1
vote
0
answers
71
views
Block access to other private IP addresses on CentOS
I want to limit the access of CentOS device in LAN.
For example, it's local IP is 192.168.1.2 and I want to block all traffic from this device to other local IPs from 192.168.1.1 to 192.168.1.254 ...
- 111
1
vote
2
answers
406
views
How to add and delete a temporary nftables accept rule
To get and renew a Letsencrypt certificate, I need to open the http port 80 while certbot is running, and close it afterwards. (There is no normal web service in this server).
With iptables I used ...
- 3,376
0
votes
1
answer
341
views
How to block subdomains containing a string with iptables
I already know how to block domains that contain a specified string
iptables -A INPUT -m string --algo bm --string "test" -j DROP
iptables -A OUTPUT -m string --algo bm --string "test&...
0
votes
1
answer
47
views
Gufw configuration for basic usage
i have installed recently Gufw and ufw on my arch linux machine.
i was wondering what is the proper rule configuration for basic usage (what to allow/deny on which ports).
can someone recommend some ...
- 57
0
votes
0
answers
198
views
Cannot access port 8080
This is the current situation :
root@vmi1046457:~# docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS ...
- 101
1
vote
0
answers
58
views
How to block or whitelist specific webpages or files within a domain but block most of the domain?
I know how to use /etc/hosts to redirect www.herpaderp.com to 0.0.0.0
The problem is I need one page file from the website on a regular basis.
I want to whitelist www.herpaderp.com/dir/foo.bar while ...
- 229
0
votes
0
answers
30
views
Firewall stateful and stateless rule in simplified format
I am trying to use a simplified format of the syntax used by FreeBSD.
Got to write stateful and stateless rule.
For example:
Allow a single Internal admin host to access the firewall ssh port and the ...
- 13
0
votes
0
answers
115
views
UFW seems to be ignoring allowed ports in specific cases - Solved
I've got a Raspberry Pi set up with UFW firewall to try and secure it as best as possible. Most of the rules seem to work absolutely fine, but for some reason, it's blocking specific connections which ...
0
votes
1
answer
42
views
Firewall reliability
First layer of defence and device isolation of all my linux boxes is firewall denying all incoming connections simply by...
sudo ufw default deny incoming
...However I sometimes for a different ...
- 1
0
votes
0
answers
435
views
Enabling outbound traffic on all network ports
I am working on a network gateway implemented with a single board computer running Ubuntu (I can't confirm the version since it is not an off-the-shelf distro, it is built using buildroot). I am ...
- 101
0
votes
0
answers
195
views
Multiple iptables.rules files or include statement
I think that Title is self-explanatory. Anyway, what I'm looking for is a way to modularize my /etc/iptables.rules file, so I can easily manage them, e.g. a file with standard rules which all server ...
