Skip to main content
Share Your Experience: Take the 2024 Developer Survey
91 votes
Accepted

Limit SSH access to specific clients by IP address

You can limit which hosts can connect by configuring TCP wrappers or filtering network traffic (firewalling) using iptables. If you want to use different authentication methods depending on the client ...
sebasth's user avatar
  • 15k
54 votes
Accepted

No route to host with nc but can ping

Your no route to host while the machine is ping-able is the sign of a firewall that denies you access politely (i.e. with an ICMP message rather than just DROP-ping). See your REJECT lines? They ...
xhienne's user avatar
  • 17.9k
42 votes

Limit SSH access to specific clients by IP address

Here some additional configuration for SSH daemon to extend previous answer: Add user filtering with AllowUsers option in sshd_config file: AllowUsers [email protected].* [email protected].* otherid1 ...
tonioc's user avatar
  • 2,079
31 votes

Why does Debian come without a firewall enabled by default?

First, Debian tends to assume you know what you are doing, and tries to avoid making choices for you. The default install of Debian is fairly small and is secure — it doesn't start any services. And ...
Faheem Mitha's user avatar
  • 35.3k
29 votes
Accepted

What's the point of firewalling outgoing connections?

There can be many reasons why someone might want to have outgoing ports closed. Here are some that I have applied to various servers at various times The machine is in a corporate environment where ...
Chris Davies's user avatar
25 votes

How does reverse SSH tunneling work?

This is explained in SSH manual, especially the differences between -L (local) and -R (remote). -L -L [bind_address:]port:host:hostport Specifies that the given port on the local (client) host is to ...
kenorb's user avatar
  • 21.1k
24 votes

How to protect against port scanners?

Simple rate limit is not enough because nmap increases scan delay when it hits rate limit. Here is what you can do best with iptables. First create ipset lists ipset create port_scanners hash:ip ...
ibrahim's user avatar
  • 1,087
22 votes
Accepted

Why are my network connections being rejected?

Well, I figured it out. And it's a doozy. CentOS 8 uses nftables, which by itself isn't surprising. It ships with the nft version of the iptables commands, which means when you use the iptables ...
larsks's user avatar
  • 35.4k
20 votes

What's the point of firewalling outgoing connections?

To expand on @roaima's answer: Defense in depth. Imagine that one server is compromised by malware. The malware installs a program that starts trying to send spam. By denying outgoing connections on ...
dr_'s user avatar
  • 29.9k
18 votes

What is sport and dport?

Just to extend the answer of @xenoterracide You can read more about iptables in the manpage iptables(8) (type man 8 iptables) but there you will not find --dport or --sport. These options are listed ...
AdamKalisz's user avatar
18 votes
Accepted

How to block clients by IP address from accessing certain URLs on my web server?

This may be more heavy weight than you're looking for, but you might consider using fail2ban (https://www.fail2ban.org). That's a tool that can monitor your log files and automatically ban addresses ...
Andy Dalton's user avatar
  • 14.1k
18 votes
Accepted

When and how to use chain priorities in nftables

UPDATE: iptables-nft (rather than iptables-legacy) is using the nftables kernel API and in addition a compatibility layer to reuse xtables kernel modules (those described in iptables-extensions) when ...
A.B's user avatar
  • 36.9k
18 votes
Accepted

How do I get a list of the ports which belong to preconfigured firewall-cmd services?

You can find the xml files this information is stored in in /usr/lib/firewalld/services/ (for distro-managed services) and/or /etc/firewalld/services/ for your own user-defined services. For example, ...
Ulrich Schwarz's user avatar
16 votes
Accepted

How to import multiple ip's to Ipset?

You can use ipset save/restore commands. ipset save manual-blacklist You can run above command and see how you need to create your save file. Example output: create manual-blacklist hash:net ...
ibrahim's user avatar
  • 1,087
14 votes
Accepted

Is it bad to port forward port 443 for ssh?

It should work fine, it's not more secure than using a different port for ssh (or less secure for that matter). And no, outbound TCP sockets are not the same as inbound TCP sockets - so it should not ...
Elliott Frisch's user avatar
14 votes

Can you list iptables as a non-root user? and why?

It appears iptables needs both CAP_NET_RAW and CAP_NET_ADMIN to be able to read the tables. I tried $ cp /usr/sbin/iptables ~/iptables # note, it may be a symbolic link $ sudo setcap CAP_NET_RAW,...
meuh's user avatar
  • 51.7k
14 votes
Accepted

iptables - default action at the end of user-defined chain

If none of the rules in a user-defined chain match, the default behavior is effectively RETURN: processing will continue at the next rule in the parent chain. When a packet matches a rule whose ...
larsks's user avatar
  • 35.4k
14 votes

How to check if any firewall is already installed

I would have a look at the system services. It is a good idea to review the default setup, because there may be services that you don't need, and you can disable them to improve performance, even ...
Kate's user avatar
  • 869
13 votes
Accepted

SSH session through jumphost via remote port forwarding

It looks like you should be using local port-forwarding instead of remote port-forwarding. You may want to refer to the following helpful blog post by Dirk Loss: SSH port forwarding visualized It ...
igal's user avatar
  • 9,926
13 votes
Accepted

Restrict local port access to a specific user

Do the same for IPv6 ... localhost resolves to both an IPv4 and IPv6 address, and v6 is preferred. Edit 1: ip6tables -I OUTPUT -o lo -p tcp --dport 5000 --match owner --uid-owner 1000 -j DROP
tink's user avatar
  • 6,812
13 votes

Firewall rules based on Domain name instead of IP address

iptables itself only works with IP addresses, but you can create an ipset-based rule and update the ipset periodically. ipset create allowed hash:ip family inet # IPv4-only ipset create allowed6 ...
ibrahim's user avatar
  • 1,087
12 votes

Why does Debian come without a firewall enabled by default?

First off, I do want to repeat what has already been said: Debian caters to a rather different group of users than many other mainstream distributions, particularly so Ubuntu. Debian is geared toward ...
user's user avatar
  • 29.1k
11 votes
Accepted

What ports need to be open on a firewall to access the internet?

For DNS, you need to allow UDP packets between any port on an IP address inside the firewall, and port 53 on an IP address outside the firewall. For HTTPS, you need to allow TCP packets between any ...
Gilles 'SO- stop being evil''s user avatar
11 votes
Accepted

How to match both UDP and TCP for given ports in one line with nftables

With a recent enough nftables, you can just write: meta l4proto {tcp, udp} th dport 53 counter accept comment "accept DNS" Actually, you can do even better: set okports { type inet_proto ....
Totor's user avatar
  • 20.2k
11 votes
Accepted

CentOS 8 firewalld + nftables or just nftables

I think the answer is fairly straightforward. First, you have done exactly the right thing... Firewalld is a pure frontend. It's not an independent firewall by itself. It only operates by taking ...
henrystrick's user avatar
11 votes
Accepted

What is the relationship or difference among iptables, xtables, iptables-nft, xtables-nft, nf_tables, nftables

My view is that iptables, ip6tables, ebtables and arptable is a frontend tool-set to Netfilter. They are a user-space tool-set that format and compile the rules to load them in the core Netfilter that ...
dominix's user avatar
  • 655
10 votes

iptables: allow certain ips and block all other connection

The below rule will allow only your IP and Block all other IPs over port 22 or ssh. Test with a new terminal before disconnecting. iptables -I INPUT -p tcp ! -s yourIPaddress --dport 22 -j DROP
Ishtiyaque Noori's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible