Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [firewall]

A firewall is a program that controls the incoming and outgoing network traffic on a system. Use this tag for all questions related to firewall configuration and operation.

337 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
7 votes
1 answer
3k views

OpenVPN and routing problem on OpenWRT

My home topology: router1 (192.168.1.1) - D-Link dsl2540u server with static IP available from Internet (ADSL via ppoe). 4 LAN ports. router2 (192.168.1.2) - D-Link DIR-300 with OpenWRT. Plays role ...
Alex's user avatar
  • 71
6 votes
0 answers
2k views

Linux bridge SNAT with ebtables

I was reading the following code (dot1x bridge bypass): https://github.com/mubix/8021xbridge/blob/master/scripts/trans_bridge.prepop A quick description, we have 2 interfaces, the first is connected ...
gip's user avatar
  • 141
4 votes
2 answers
671 views

How to expose a server with dynamic IPv6 address through OpenWrt firewall?

I want to make a web server running on my LAN available to the internet. My router runs OpenWrt 22.03 with firewall4. With IPv4, I would give the server a stable RFC 1918 address, then enable port ...
cjm's user avatar
  • 27.2k
4 votes
0 answers
4k views

Fail2ban & nftables errors, IPs not banned

So I've been experimenting with nftables in CentOS 8 and things are going pretty well, but I'm having a weird problem with fail2ban. Fail2ban cannot ban IPs with nftables-multiport or nftables-...
b6-redacted's user avatar
4 votes
1 answer
2k views

fail2ban with iptables-persistent

I've been running fail2ban for a bit, and recently installed iptables-persistent and am using it with ipset for a blacklist (there's one particular IP that is always hammering away at this machine). ...
zzxyz's user avatar
  • 319
4 votes
2 answers
3k views

Second OpenWRT network isn't getting an IP address

Goal I'd like to have two LANs: lan0 and lan1. lan0 is unencrypted traffic; lan1 will be an always-active VPN. I haven't configured the VPN, so it's currently just a second unencrypted network. I'...
craig's user avatar
  • 203
4 votes
1 answer
3k views

How to add multiple user.rules in ufw?

I know you can add rules one by one. But is there a way to add rules in one go - For instance, this is how you add rules in ufw in Debian - $ sudo ufw allow 80/tcp $ sudo ufw allow 443/tcp $ sudo ...
shirish's user avatar
  • 12.5k
4 votes
0 answers
142 views

Disable networking only inside of a single terminal

I want to run a command in the terminal to disable networking, just in that terminal. How can that be accomplished? I'm running OSX. Note: I only want to disable the networking in that terminal. ...
ademartini's user avatar
4 votes
0 answers
2k views

blocking all but specific ips from specific services in CentOS 7

In a CentOS 7 web server that needs to remain totally closed to the public, I need to block all ip addresses and then only allow specified ip addresses to access specified services. How can I ...
CodeMed's user avatar
  • 5,239
4 votes
1 answer
1k views

Dovecot/Postfix mail server replies to [SYN] with [RST, ACK] when user attempts to connect (POP3). Likely iptables?

Currently I'm trying to troubleshoot an e-mail server that will allow users to send e-mail, but not log in to the server (POP3) or receive e-mail using their Outlook clients. Previously this was ...
theCowardlyFrench's user avatar
3 votes
1 answer
37 views

Which is My Static IPv6 Interface Identifier?

I've been accustomed to IPv4 for so long and I'm really unfamiliar with IPv6. I recently wanted to add a firewall rule to my OpenWRT router to allow inbound IPv6 connection to a certain port of my ...
citrate's user avatar
  • 151
3 votes
0 answers
5k views

How do i convert iptables rules to nftables rules?

I was trying to figure out how to convert my iptables rules to nftables rules on an Ubuntu system. I tried to convert iptables to nftables using the automated converter, but it didn't appear to work. ...
O3NTbN6nLgF's user avatar
3 votes
0 answers
2k views

Is there a way to tag any specific application's traffic with DSCP/ToS

I recently made the switch from windows to linux (Manjaro). To manage traffic I had been using a windows feature that allowed me to specify the name of an application so that its network traffic ...
Depak's user avatar
  • 31
3 votes
1 answer
4k views

Set up nftables to only allow connections through a vpn and block all ipv6 traffic

I am trying to set up a nftables firewall on my archlinux distribution that only allows traffic through a vpn (and blocks all ipv6 traffic in order to prevent any ipv6 leaks) I have been playing ...
user246093's user avatar
3 votes
1 answer
161 views

Not seeing packets from internal->external firewall in AWS VPC

I am setting up an AWS VPC with an external/internal firewall to protect the hosts in the DMZ (for Internet->DMZ and DMZ->Internet traffic) and hosts on the local network (for DMZ->Local, Local->DMZ, ...
Albert Chin's user avatar
3 votes
1 answer
1k views

Block all traffic out except one port with pfctl for macOS

As stated in the question, I need to block all traffic out to internet except for one port on MAC OS X 10.8.x. I just need the commands to run from a shell or edit any conf file?
richardwhitney's user avatar
3 votes
1 answer
2k views

Apache is not starting up

When I execute the sudo service httpd reload my apache is not starting up. I have checked the configuration file issuing sudo httpd -d and it is all OK. I have a simple vhost file. This is from the ...
Georgi Stoyanov's user avatar
3 votes
0 answers
1k views

AIX firewall accept established connection

I'm trying to configure a firewall for AIX to accept incoming connections on ports 22 and 443 and deny everything else. All is ok; the server accepts connections only on 22 and 443, but after that I ...
boncalo mihai's user avatar
3 votes
1 answer
820 views

Iptables rule to drop packets to and from local network

I want to set a virtual machine on laptop, but I don't trust the guest system fully, so I would like to block it's access to local network (to network 192.168.0.1/16 or 10.0.0.1/8 or ... the other one ...
Cytadela8's user avatar
3 votes
1 answer
241 views

package from IP arrives at certain port => open portrange to IP for x seconds

I have been toiling with an issue on iptables: I am trying to make a portrange open to a specific IP for x seconds/minutes as a result of a single packet being sent to a specific port. Not exactly ...
cxou's user avatar
  • 402
3 votes
0 answers
1k views

Why doesn't ufw enforce firewall rules for traffic coming from Virtualbox VM

I've been running Linux Mint 17 on my laptop for a while and thought I had it locked down to not allow any incoming traffic through "Firewall Configuration" (ufw GUI)—I have also validated this from ...
Kristofer's user avatar
  • 293
3 votes
1 answer
286 views

FreeBSD pf firewall, new connections severly delayed when nating

I have a newly setup fbsd 9.1 with pf, which itself doesn't experience any slowness when for example downloading a debian iso from my local debian repo (ftp.se.debian.org). Any machine behind it, ...
user135361's user avatar
3 votes
1 answer
445 views

IPFW Port Forwarding

This is my situation: I want to connect to an OpenVPN server from my office (we're using a proxy, only ports 80 and 443 are allowed). Server IP address is: 176.31.250.232:843 My static IP address is:...
Zi0P4tch0's user avatar
2 votes
0 answers
21 views

Add user or process information in nftables logs

Hy, Is it possible to customize nftables log's to add more informations ? For example, it could be interesting to get users ( id, gid, ... ) or processes informations that try to out. Example of ...
Pierre B's user avatar
2 votes
2 answers
150 views

nftables how to temporarily allow a port(s) for an application

I am using Warpinator on my android phone to transfer files between my linux machines and my mobile phone. The application uses ports for 42001 for initial connection, and 42000 for data transfer. I ...
benibilme's user avatar
2 votes
0 answers
535 views

Make ufw log without rsyslog

I have no ufw logs on my minimized Ubuntu 22.04 server. sudo ufw status verbose output: $ sudo ufw status verbose Status: active Logging: on (low) On the internet I found I need rsyslogd enabled. On ...
unixcandles's user avatar
2 votes
1 answer
648 views

Why am I locked out of my machine with these ufw rules?

I have a server on ip 192.168.1.200 My goals are: I should be able to log in to my server via port 22 from anywhere From inside 192.168.1.200 I should be able to access the Internet via ports 443 and ...
Duke Dougal's user avatar
  • 1,055
2 votes
1 answer
5k views

How to tell which application UFW is blocking

I have a Debian system running ufw. I have "default deny" on all outgoing connections and I open specific communications (ports and/or IP addresses) as needed. I use the dmesg log to see if ...
bitsmack's user avatar
  • 205
2 votes
0 answers
1k views

UPnP with firewalld

This question is probably related to: Fedora firewall with UPnP? Because newer fedora workstations use firewalld, it's a bit of a different situation. The problem I'm experiencing is that I can't ...
rudib's user avatar
  • 1,632
2 votes
1 answer
1k views

iptables forward some devices to different interfaces based on source IP

I'm trying to expand further on a recent question I had asked here (and was helped) based on this tutorial: https://www.instructables.com/Raspberry-Pi-VPN-Gateway/#step5. Using a Raspberry PI as a VPN ...
Joe's user avatar
  • 93
2 votes
0 answers
70 views

How do I see how much CPU time my firewall uses?

I was attacked with a DNS Amplification and as a result added nearly 4,000 IP addresses to my firewall using fail2ban. I have seen many people worried about how many rules they include in their ...
Alexis Wilke's user avatar
  • 2,909
2 votes
0 answers
684 views

Is there a Linux firewall that also limits applications access to specific ports?

Is there a firewall application in Linux that lets you control network traffic on a per-application/per-process basis AND lets you limit that access by port/destination (like Outpost/Kerio/Sygate/...
Time4Tea's user avatar
  • 2,385
2 votes
0 answers
368 views

Allowing inbound/outbound traffic through iptables for an executable

A program I'm writing binds to several 0.0.0.0:0 (UDP) ports , and as such, the port I need open is nondeterministic. However, once obtained, I need to ensure the local firewall allows all traffic to ...
Thomas Braun's user avatar
2 votes
2 answers
2k views

keepalived no route to host, firewall issue?

I have a simple two server config of keepalived. The master/backup selection is working fine but I can't connect to the VIP from the backup server. When I try connecting, on the master I can see ARP ...
user693861's user avatar
2 votes
0 answers
168 views

ipfw dummynet per ip fair traffic shaping

I want to shape traffic in such way, that no specific user could exhaust WAN connection that much so other users would be affected. I have ISP link with 100Mbits/s bandwidth and sometimes some users ...
Никита's user avatar
2 votes
2 answers
1k views

How to find rule by number of pfctl output in FreeBSD?

I have the following excerpt from pfctl -vvss command: re2 icmp 10.10.0.62:1 <- 192.168.10.56:1 0:0 age 00:08:30, expires in 00:00:05, 192:7 pkts, 14400:584 bytes, rule 117 id: ...
Dims's user avatar
  • 3,255
2 votes
0 answers
425 views

Reverse SSH tunnel techniques or procedures?

What are the techniques to SSH into a machine which is behind NAT and at least not forwarding SSH ports, perhaps behind a firewall? What I've come across is teleport, but I'm not quite sure that it's ...
Thufir's user avatar
  • 1,900
2 votes
0 answers
184 views

how to properly make the firewall block any application by group?

to block the application I followed this, but like: groupadd nonet adduser $USER nonet iptables -A OUTPUT -m owner --gid-owner nonet -j REJECT #put at /etc/rc.local sudo -k iptables --list |grep ...
Aquarius Power's user avatar
2 votes
0 answers
722 views

How to handle aggressive HTTP requests from the same IP?

My server has recently been suffering temporary floods of probing HTTP requests looking for PHPMyAdmin. They come from various IPs and come in series. That is, for a few seconds I'm getting a bunch of ...
user avatar
2 votes
2 answers
3k views

Redirect web server from port 5000 to port 80 on localhost (Fedora, firewall-cmd)

On Fedora 24, a web server (Node.js) is running (standalone, no apache/nginx) on port 5000. http://localhost:5000 works How to make it accessible on port 80? Tried this systemctl restart firewalld ...
Marius's user avatar
  • 133
2 votes
1 answer
648 views

Does Linux still enforce a connection tracking limit?

We've recently upgraded to Ubuntu 16.04 (kernel 4.4) and I've noticed some new behavior regarding net.netfilter.nf_conntrack_max. In the past (with 12.04 running 3.2) if you hit nf_conntrack_max you ...
marcantonio's user avatar
2 votes
0 answers
170 views

Does Linux still enforce a connection tracking limit?

We've recently upgraded to Ubuntu 16.04 (kernel 4.4) and I've noticed some new behavior regarding net.netfilter.nf_conntrack_max. In the past (with 12.04 running 3.2) if you hit nf_conntrack_max you ...
marcantonio's user avatar
2 votes
0 answers
1k views

iptables script to block all internet access except for desired applications

CONTEXT: I wanted to have a shell script that would block all Inbound/Outbound traffic to my computer, UNLESS I decide I want to use the browser or some other application, in which case I would ...
Webeng's user avatar
  • 423
2 votes
0 answers
112 views

ip6tables rule to allow unrecognized next-header

I have a compliance test that is requiring me to respond to unrecognized next-headers per RFC 2460. I am running a debian 3.16 kernel. My current firewall implementation is dropping these frames per ...
broncofan7's user avatar
2 votes
1 answer
33 views

How to create foolproof user that is only allowed to video chat with one person

I have to give a laptop to my 4 yr old who lives very far away from me, so that we can have regular video chats. I want to restrict any other use for that laptop, including video chats with other ...
Mephisto's user avatar
  • 1,087
2 votes
0 answers
784 views

how to forward all UDP traffic to VPN client IP with ufw

I'm using sipgate with freepbx and I've got down to what I presume is the final hurdle with the one-way audio issue. From everything I've read the issue points to NAT. I need to forward all UDP ...
Onimusha's user avatar
  • 113
2 votes
1 answer
639 views

Why does mounting external harddrive trigger a UFW event?

Today I noticed when I plug in my 2TB external Toshiba hard drive, it triggers a ufw event in my logs: Jul 20 11:24:20 linuxbox kernel: [152873.728277] [UFW BLOCK] IN=inet1 OUT= MAC= SRC=xxxa DST=...
jtlindsey's user avatar
  • 333
2 votes
0 answers
700 views

What puts TCPMSS in iptables?

I used to have (well, I still sort of do) have a script that expects: -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu to have been entered in to iptables ahead of my ...
Peter Turner's user avatar
  • 1,694
2 votes
1 answer
407 views

how to set ufw firewall/iptable rules for a VPN Server to be explicit in allowing certain connections?

I want to connect to a VPN. I want to enable ufw firewall or iptables so that there is no connection that goes out of the VPN tunnel or that comes in (except that for VPN server). Could you ...
donnies's user avatar
  • 21
2 votes
0 answers
158 views

Why is traffic matching the public zone instead of the desired zone?

Trying to self-train on firewalld I set up apache and configured the zones as follows: [root@localhost ~]# firewall-cmd --get-active-zones work sources: 192.168.122.1 public interfaces: ens3 [...
Bratchley's user avatar
  • 16.9k

1
2 3 4 5
7