Questions tagged [firewall]
A firewall is a program that controls the incoming and outgoing network traffic on a system. Use this tag for all questions related to firewall configuration and operation.
1,040
questions
2
votes
1
answer
15
views
Tracing iptables Rules
I'm just beginning to dig into iptables for the first time today, so apologies for any naivete.
For reference, I'm using
Ubuntu 22.04.4 LTS (Jammy Jellyfish)
iptables v1.8.7 (nf_tables)
ufw 0.36.1
...
0
votes
1
answer
19
views
Why aren't my ipset counters incremented?
I'm trying to configure a firewall (using iptables on a Docker host) that allows inbound HTTP and HTTPS from everywhere, SSH from a certain set of IPs and no other incoming connections. I liked what I ...
3
votes
1
answer
32
views
Which is My Static IPv6 Interface Identifier?
I've been accustomed to IPv4 for so long and I'm really unfamiliar with IPv6.
I recently wanted to add a firewall rule to my OpenWRT router to allow inbound IPv6 connection to a certain port of my ...
- 141
0
votes
0
answers
31
views
nftables rules apparently blocking ssh traffic - could it be special characters?
I have a set of nftable rules of the following form:
chain INPUT {
type filter hook input priority filter; policy drop;
ip saddr 11.37.79.97/29 counter packets 0 bytes 0 log prefix ...
- 101
0
votes
1
answer
57
views
Install apache, php and mysql on Ubuntu 22.04 toolbox
I would like to install apache, php and mysql on Ubuntu 22.04 toolbox which is running in a Fedora 39 desktop VM.
I am following the steps instructions provided in this link, but is seems to have some ...
- 3
0
votes
1
answer
35
views
What configuration is blocking local ssh connections to my server?
So I recently bought a Raspberry Pi to work on a small passion project with the RetroPie Debian-based image.
I am now at the stage where I want to completely shield the server only allowing specific ...
- 1
1
vote
1
answer
63
views
nftables - multicast packets not matched
I've set up a rule to match multicast packets as follows:
add rule filter_4 new_out_4 meta pkttype multicast goto multicast_out_4
filter_4 is IPv4 table, new_out4 is output chain and multicast_out_4 ...
- 240
1
vote
1
answer
18
views
iptables rule not working as expected
I cannot get this one rule working right.
My interfaces:
#WAN
auto wan0
iface wan0 inet dhcp
#LAN
auto lan0.7
iface lan0.7 inet static
address 172.17.7.1
netmask 255.255.255.0
vlan-raw-...
- 11
0
votes
0
answers
48
views
Wireguard client incoming packets drop
I have a home server running Ubuntu Server. I'm running some services on docker which need a VPN client for anonymity. The wireguard client runs as a standalone application. I'm running traefik to ...
2
votes
1
answer
19
views
arptables not working with nmap
I'm trying to implement a way to prevent network scans from my notebook. One of the things I want is to allow arp request to specific hosts, like my gateway.
I added some rules using arptables and ...
- 253
0
votes
0
answers
24
views
Kafka with KRaft - what is listening on the random high port?
I'm in the process of writing some ansible to install Kafka on RHEL and I've got the service running and am about to configure the firewall to make the service accessible on the network.
When I look ...
- 998
0
votes
0
answers
18
views
Many UFW BLOCKs pr minute from numerous ports and numerous IP addresses
My syslog is flooded with numerous attacks of some sort coming from multiple sources.
I looked at all the other references in the search feature but none addressed tcp and from numerous sources
Feb 16 ...
- 207
0
votes
1
answer
33
views
Matching DSCP portion of ToS or traffic class byte using ebtables
Is it possible to match only the DSCP portion of the IPv4 ToS or IPv6 traffic class byte using ebtables? I see that ebtables has the --ip-tos match option for IPv4 packets and the --ip6-class match ...
- 101
2
votes
2
answers
92
views
nftables how to temporarily allow a port(s) for an application
I am using Warpinator on my android phone to transfer files between my linux machines and my mobile phone.
The application uses ports for 42001 for initial connection, and 42000 for data transfer. I ...
- 31
0
votes
0
answers
35
views
GUWF and firewall malfunctioning?
I keep adding IP addresses to the built-in Linux Mint "firewall" program (which is "GUWF" relabeled "firewall") and it worked for a while ... but now it doesn't look like ...
- 3
0
votes
1
answer
38
views
Iptables: order of redirect and input-filter
I will filter inbound traffic with iptables.
I have 2 goals.
a) Allow HTTPS inbound at port 443.
b) Redirect port 443 to process listening port on 9443.
Not sure about the processing of that 2 rules....
- 585
0
votes
0
answers
21
views
How to access to a kubenetes pod from outside using proxmox(Virtualisation solution)
I have a proxmox host(@ip=231.25.36.12),inside I have installed a kubernetes cluseter, this cluster consists of 3 vms(these VMs are not routable I mean they are accessible just from proxmox node, they ...
0
votes
1
answer
55
views
Knockd not executing the knock command
I am trying to setup knock daemon, however it does not seem to execute the knock command. To debug the issue, I used this simple configuration, which is slightly edited example from the documentation:
...
- 1
1
vote
0
answers
60
views
Can't ping external sites in Linux guest that already has internet access
I have an Ubuntu 20.10 guest and an Ubuntu 20.04 host and other devices on my LOCAL network, but for some reason the guest can't ping websites (e.g. ping google.com). What's interesting is that I have ...
- 13
0
votes
1
answer
166
views
How to exclude dnsmasq used by libvirt from Mullvad VPN's "local network sharing" block
I don't use the local network expect dnsmasq for libvirt. With blocking local network I have no DNS on my VM. For that reason I want to exclude dnsmasq from the local network sharing block with split ...
- 81
1
vote
1
answer
93
views
How to flush the nft flowtable hash of active connections?
I have flowtable offloading working just perfect on my router. Sometimes I want to block some ongoing traffic, being handled via the flowtable. If I add a new blocking rule to the regular routing ...
- 51
0
votes
0
answers
27
views
I want to allow incoming traffic on a specific port like ssh and block all outgoing traffic in firewalld
I'm using Firewalld,
I want to block all the outgoing traffic.
And allow all incoming traffic or SSH connection for specific IPs.
I'm able to block all the outbound traffic and it is working by ...
- 1
0
votes
0
answers
326
views
I am unable to access my HTTP NGINX server over LAN
I have allowed the port in ufw and have the following configuration:
server {
listen 0.0.0.0:8000 default_server;
server_name _;
index index.html;
access_log /var/log/nginx/html....
0
votes
2
answers
317
views
Load iptables or nftables rules as fast as possible during boot and before the network interfaces be put online
I rely on my specific service to load iptables rules at startup in my debian installation, this service calls
iptables-restore my_rules.v4
ip6tables-restore my_rules.v6
and do some other scripts
...
- 2,890
0
votes
1
answer
39
views
Unable to make MAC Adress accessible in nftables
I have an Oculus Quest and I want only the Oculus to be able to see my miniDLNA server. So on the server itself I have the following config:
The Mac Adress I've given is 100% correct and when ...
0
votes
1
answer
71
views
Blocking all ports but a few in iptables
I am attempting to DROP all ports but one in iptables.
After running the following commands:
iptables -N WHITELIST
iptables -A INPUT --jump WHITELIST
iptables -A WHITELIST --protocol tcp --match tcp --...
- 26
1
vote
0
answers
470
views
How to find out what is blocking ssh traffic
I paid for a VPS, and it has a ssh connection option. Giving its IP address and provided port (22), i'm trying to connect:
ssh -vvvv user@ip
and get the connection timeout with such output:
OpenSSH_9....
0
votes
0
answers
90
views
why do I have requests from inside apache server with source ports 80 and 443
On one machine, I have a web server running (apache) and responding on ports 80 and 443. On this machine, I have a firewall (shorewall) that blocks everything except what I authorize, and I therefore ...
- 43
0
votes
0
answers
162
views
Configuring IPTABLES for Passive FTP Connection through NAT (Forwarding from One PC to Another Using a Second Ethernet Card)
I am trying to connect to an FTP server through a NAT network created by another PC that uses two Ethernet cards. I would like to access via FTP client the second PC's FTP server through the first one....
0
votes
0
answers
130
views
Disable Network Permission for all Flatpaks
The Flatseal Flatpak has a toggle to disable network permissions (share=network) for all Flatpaks installed on your system. How can I do this same thing by command line, for all Flatpaks installed on ...
- 13
0
votes
1
answer
173
views
How to define port forwarding
I run a server with a web server running as a rootless podman container. This exposes ports 10080 and 10443 because, as a rootless container, it is not allowed to expose ports 80 and 443.
So that my ...
- 1
0
votes
0
answers
96
views
Nftables does not work as expected to block with meter
Goal: Account for excess packets whose rate source IP and destination port are greater than 200 packets per second, example:
1s, 2s, 3s ...: IP 1.1.1.1 to MyServer:80
[This happens 201 times in ...
- 9
0
votes
0
answers
91
views
How is it possible that NAT doesn't back translate packets?
I have the following topology
and from myhost I can ping router2 but can't ping router1.
With tcpdump I can observe how my pings go and I see that both router1 and router2 reply. But only replies ...
- 3,255
0
votes
2
answers
37
views
Identify unique tcp connetion to a Linux server
I'm in the planning stages of migrating an application from one Linux server to a new Linux server. The new server will have a different IP address and a different hostname.
One of the items on my ...
- 1
0
votes
0
answers
70
views
Can't access webserver inside LAN
I have tried apache and php's internal server, with none of them I can access from another computer if I use the internal IP. \
In the browser it sais "The connection has timed out. The server at ...
- 11
2
votes
1
answer
2k
views
UFW Couldn't determine iptables version
I am building a custom embedded Linux platform based on the NXP i.MX8 with Yocto. I want to use UFW to setup the firewall. When I boot the system and try to use UFW it returns an error
Couldn't ...
- 79
1
vote
1
answer
581
views
nftables deleting a rule without passing handle (similar to iptables delete)
iptables syntax for delete is much simpler. if we replace the "append" with delete we get command for deletion of the rule.
nftable provides similar construct for few rule management aspect ...
0
votes
0
answers
266
views
What is "mtr --report --tcp --port=22" telling me?
RHEL 8.4
Here's the output of mtr to a server for which the firewall is open to port 22:
$ mtr --report --tcp --port=22 --no-dns Server1
Start: 2023-08-09T21:49:20-0400
HOST: foo.example.com ...
- 1,148
0
votes
1
answer
143
views
RHEL 6.4 basic firewall rule port 6162 does not take effect
I'm dealing with a RHEL version 6.4 server's firewall setting and the goal is to allow remote device to connect tcp port 6162, regardless of the type of services.
The iptables rules are shown below(...
- 57
0
votes
0
answers
785
views
Squeezebox can't connect to Logitech Media Server running on PC
Debian 11, I have installed Logitech Media Server to use with Squeezebox player. Server is running on local IP Address: 192.168.10.xxx port 9000. I configured that address on my Squeezebox player, but ...
- 525
0
votes
0
answers
37
views
Can't connect to ubuntu-ran cstrike server (27015 udp)
I've ran a Counter-Strike 1.6 Server on a Ubuntu 18 VPS.
When I run the hlds, The server looks fine when ran. (I'm running via ssh)
But I can't connect to it with my computer.
This is nmap output (X....
1
vote
1
answer
99
views
How to block a range of ip adresses with libirt's nwfilter for a specific mac(VM)
I'm a bit lost how to block a range of Ip adresses(preferbly for a specific mac adress of a VM)
<filter name='local-fileserver-only' chain='ipv4' priority='-700'>
<uuid>blank for now</...
- 41
0
votes
0
answers
27
views
Why do chains in Bridge type tables have different (default) priority values in nftables?
As the man page clearly shows https://www.netfilter.org/projects/nftables/manpage.html , the default "filter" priority value for Bridge table chains -200, while it is 0 for all table types, ...
- 216
0
votes
0
answers
316
views
Firewall problem on Debian 11 while trying to grant access to 443 port
Want to grant access to port 443 for two other computers.
All computers involved have Debian OS.
Ping and traceroute are successful from both IP addresses.
Rules added to iptables:
-A INPUT -s 192.168....
0
votes
1
answer
69
views
Iptables MASQUARADE seems to return the "RESULT" on The Internet instead of the demanding interface
I am trying to do an iptables masquerade from a WireGuard Interface and the Internet. It used to work but lately, I did add a few (just four) WireGuard Interfaces, and it stops working for all of ...
- 1
0
votes
0
answers
31
views
Block QoS packets from WiFi Router
I am currently trying to do some WiFi sensing using Channel State Information (CSI).
Unfortunately, every WiFi Router I have sends random QoS-packets to the WiFi clients and they are interrupting my ...
- 135
0
votes
0
answers
119
views
How to isolate machine using iptables and cgroups in ubuntu
I am trying to isolate a computer from the network.
I am running the following commands in linux:
#create net_cls folder for cgroup
mkdir /sys/fs/cgroup/net_cls
#mount the newly created folder
mount ...
- 101
0
votes
0
answers
144
views
How can I fix refused to connection error ERR_CONNECTION_REFUSED
I am using PopOS 22.04 LTS and FortiClient to access a web page. when I send a ping to this IP on the terminal, everything works well as below.
64 bytes from 10.190.16.13: icmp_seq=1 ttl=63 time=27.2 ...
- 111
0
votes
1
answer
277
views
How to make wireguard exclude port 80 from tunnel
I am running a Debian VPS host
My regular public IP is $A
Under Wireguard VPN my public IP is $B
I have services accessible on ports 4040 and 5050 on $B
I want to access port 80 from $A while ...
- 63
0
votes
0
answers
44
views
VPN disconeconnects when switching networks
TL;DR If I am connected to one network and then connect to VPN it works fine, but if I then connect to a different network then the VPN disconnects and tries to reconnect over the new network. I need ...
- 1