The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
0answers
21 views

Improve iptables configuration [on hold]

First, I am not able to ping with ipv6 (ping6) to my server even being able to ping with ipv4 (ping). What should I modify to be able to ping to and from my server with ipv6? Second, what should I ...
0
votes
0answers
10 views

How to set up iptables [migrated]

I try to understand how iptables works but after a lot of hours and read a lot of articles i have stuck. That i want to do is DROP INPUT & FORWARD policy and open some ports. More specifically, i ...
1
vote
0answers
26 views

OpenWRT: iptables rules will be deleted automatically [migrated]

In my OpenWRT instance, I have added iptables rules in the Input filter table, but the problem is when I turn on my system I found that the rules are deleted. What can I do so that the rules are not ...
0
votes
0answers
26 views

Abnormal traffic in EC2

I was monitoring traffic in an EC2 instance when I noticed this: 11:34:43.065720 IP 193.138.74.104.59973 > 224.0.0.252.5355: UDP, length 22 11:34:43.102451 IP 193.138.74.88.137 > ...
1
vote
0answers
52 views

Host-based security architecture for web server network

I am begining with network security and after studying for a while about often used technologies I got to this architecture for my home server (sorry it is not in english). I considered 3 basic ...
0
votes
1answer
48 views

Is it worth it to use sshguard when only allowing ssh login from specific IP?

I'm running a VPS (under ArchLinux) and was wondering if sshguard was useful in the following case. My iptables rule for SSH in looks like this : iptables -A INPUT -p tcp --source $Trusted --dport ...
0
votes
2answers
164 views

Opening port 53 on server Risks?

I looked about but couldn't find a similar enough question. I have some remote servers positioned on clients networks, which provide various services (raspberry pi) - and their firewall config is as ...
0
votes
2answers
131 views

Preventing ARP spoofing in DMZ

Is there any possible way to implement a defence mechanism in a firewall to be able to prevent ARP spoofing in a DMZ. Our DMZ server consist of two webservers and a database (which should be available ...
1
vote
1answer
74 views

How does DROP rule work in iptables?

I'm working with iptables in order to close one or two open ports. So I tried this rule in order to change the default policy. # iptables -A INPUT -p tcp --dport 3333 -j DROP Then I checked the ...
3
votes
2answers
186 views

Firewall egress filtering / quick whitelisting

Suppose your Aunt or Uncle is easily fooled by phishing attempts and their computer has multiple root kits and key loggers running. Assume their computing habits will never change. Looking at his ...
-1
votes
1answer
289 views

ARP: Forwarding or dropping with IPTABLES

So, I ve been trying to ARP Poison my home computer and router (Intended to learn and discover the networks bahaviour). And with success. The whole time I ve been using: with ...
0
votes
1answer
119 views

How to prevent outgoing UDP attacks?

My server has been the target from hackers 3 times in the last month, and the attack seem to follow the same pattern. The attack another site from my server using UDP connection. The report from my ...
1
vote
0answers
135 views

Limit Packets Per Second

Since last week I have been seeing something fishy and it seems to be worsening. I tried many firewalls and they seem to be useless. I blocked all unwanted ports and only few ports are open so I found ...
2
votes
1answer
523 views

Using Linux iptables to implement a stateless, packet filtering firewall

When I began my career in network security, almost a decade back, the industry standard was stateful firewalls that even had the ability to inspect some application layer protocols. I had only heard ...
0
votes
0answers
85 views

Blocking IP After multiple connection with Netsh advfirewall to mitigate DDos

Hello I wanna block Ip address if they exceed 20 connections with port 80 TCP for HTTP Server. I wanna do this using Netsh advfirewall, In Linux I use IPTables: iptables -I INPUT -p tcp --dport ...
0
votes
1answer
257 views

iptables intercept received packet with proxy and then forward to destination

Lets say I receive internet through my eth1 port and share it via hotspot to other devices (wlan0 port) [internet]----(eth1)[my computer](wlan0 hotspot) | ...
3
votes
2answers
258 views

How web application firewalls protect application from DDoS attacks?

How to protect a web application from DDoS by the implementation of Web Application firewalls? How effective is this method?
1
vote
0answers
90 views

IPtables accepting SMTP without being configured?

Well i was building a new server and inputed there some IPtables rules, i set postfix and send me an email to try it out, to my surprise the email reached perfectly without me declaring a rule for the ...
1
vote
1answer
270 views

How to block traffic coming from an “public” WiFi hotspot and going to the LAN (iptables)

I followed this tutorial (http://elinux.org/RPI-Wireless-Hotspot) for an Wifi Hotspot in the guesthouse. This is working fine, but every device on the WiFi network can reach any LAN device in the LAN ...
1
vote
1answer
52 views

Security implications of packets with an invalid state (iptables)

I have been seeing few rules with -m state --state NEW, ESTABLISHED, RELATED. First I thought that was pointless as it was contemplating the three possible states, so there was no need to define -m ...
1
vote
1answer
90 views

Can an attacker detect if I have a TARPIT enabled?

Last thing we want to do is provoke an attacker and offer them challenges or puzzles indirectly to give them a flag to stay and continue to hack rather than move on to other hosts. If possible, I do ...
2
votes
1answer
69 views

Which IPTables chains should I log from a security perspective

So far I've always been logging the INPUT and OUTPUT chains because I only used iptables as host firewall. Now I'm configuring network firewall which uses iptables, but I don't know whether I should ...
4
votes
1answer
4k views

Is it safe to disable connection tracking in iptables?

While reading about NOTRACK target of raw table in iptables, I encountered an article suggesting that for certain traffic you could (or even should) disable connection tracking. The two examples were: ...
3
votes
1answer
104 views

Is it possible to find out what a remote user is trying to do connecting to a closed port?

From my iptables log, I can observe a particular remote IP address trying to connect to my server from port 80 to a private port number: Jul 09 01:24:41 example.com kernel: IPTABLES: IN=eth1 ...
0
votes
1answer
44 views

Utility of Output Chains in IPTABLES when there is no Network Firewall— Is it ok to permit all outgoing connections from a server?

I have a set of INPUT chain rules restricting traffic based on source ip and destination ports.The services are ftp and a job service.The server has a public ip address. The default policy of the ...
2
votes
1answer
169 views

Port Knocking using only Iptables/netfilter

I am using the following iptables rules for port knocking. Everything works well, but it open the port for just a second and then close it. So how to improve this script to accept connection for a 30 ...
0
votes
1answer
279 views

Block specific packets/sequences of packets to remove disturbing client “feature”

Recently, one of my client-server application started to disturb me with some very annoying "notifications". Basically, what happens is that the remote server sends a few packets to my client, which ...
2
votes
5answers
4k views

Logging server compromised (IptabLes and IptabLex)

I am trying to figure out how it was compromised. They installed IptabLes and IptabLex in /boot. They also added /etc/init.d/IptabLes and /etc/init.d/IptabLex which simply call the respective /boot ...
0
votes
3answers
360 views

How to set iptables to drop packets that I'm not listening on?

I've got a Kali Linux box I use for pen testing. I would like to configure my machine to DROP incoming packets, but only when I'm not listening on them. e.g. if I run a netcat listener on port 80, I ...
3
votes
2answers
2k views

Is my ISP doing a port scan on my computer?

I have been logging incoming connections with iptables for a while and I have been observing the following popping up periodically: 11:45:10 my.com kernel: IPTABLES: SRC=220.255.XX.XXY ...
1
vote
1answer
223 views

Allow loopback in Iptables?

I'm trying to write Iptables rules for a small web server. Almost every source I've encountered recommends to allow loopback access to the web server, but doesn't explain why this is necessary. ...
3
votes
4answers
607 views

Find out what Linux software is trying to phone home

I have seen some suspicious outbound communications blocked on my VPS, which hosts a small experimental Web site, and want to find out which application is making the attempt. The server is running ...
0
votes
1answer
328 views

MitM Attacks - Iptables?

I have looked for the answer to this question to no avail, apologies if I missed it. I would like to know how effective iptables would be against MitM attacks - in the following setup: ALLOW INPUT ...
1
vote
0answers
44 views

How to manage security for multiple PC and VM?

I have a firewall VM which creates I have used to setup subnet for different purposes. For example: (fake ips, of course) 1.1.2.1/24 DMZ 1.1.3.1/24 Internal 1.1.5.1/24 security/logging I use ...
1
vote
2answers
293 views

Isolating guest networks

I'm setting up a secondary guest wifi on my router and I want to make sure that it's impossible for clients connected to the guest wifi to access my primary network. Initially, I used IP filtering ...
2
votes
3answers
682 views

iptables: plaintext password protection

I'd like to find a way to block or restrict my access to the web-pages where my password is sent as a plaintext on the internet. Let's assume if I have the same password for all web-pages, is it ...
0
votes
2answers
294 views

Does iptables work in kernel mode? [closed]

I am not sure about that. It should run in kernel mode in order to avoid some user-mode program to kill/suspend the firewall and do its dirty job. The malware would not be able to kill the firewall ...
0
votes
1answer
288 views

How does a website get pass my server firewall and attempt to hotlink to my server resources?

I was stumped when I saw the following lines on my Apache server error log this morning: [authz_core:error] [client ::1:37317] AH01630: client denied by server configuration: ...
1
vote
0answers
199 views

forcing a traffic redirect?

I am trying to get my machines to be force through a MiTM and the MiTM to redirect them to a server of my choice (which happens to be the MiTM on port 17002) I am running ip tables: sudo iptables -t ...
1
vote
1answer
835 views

Bridge Firewall vs Routing Firewall

What is the difference between bridge and routing firewall ? How they both works and what are the security advantages/disadvantages for both scenario ?
2
votes
1answer
891 views

ufw, system-config-firewall-tui, or firewalld vs iptables

Is there any advantage (other than usability) to using ufw, system-config-firewall-tui, or firewalld rather than just using iptables? My understanding is that these other programs just simplify ...
2
votes
2answers
252 views

Are there “LAN IPs” on the internet?

I have a home-made web application and thought that an easy way to secure it's administration interface would be to simply reject all IPs that arent from 192.168... Is this viable? is it possible for ...
1
vote
0answers
260 views

Throttling DropBox behind a firewall

Our office network bandwidth gets choked when an employee copies a large file into her DropBox, since it gets downloaded on several machines (of other employees). LAN Sync is an option, but needs to ...
2
votes
4answers
1k views

How can I block bots that consistently hit the same URLs?

I am getting slammed hard by bots, and I am not sure how to stop them without blocking my legitimate traffic. I created some iptables rules that say, if X connections in X seconds, block, but that ...
1
vote
2answers
165 views

How secure is a Windows PC that is routed through a Linux PC?

I have a Dual PC setup. Two PC's are networked together via crossover cable. The Windows PC is running Windows 7 SP1 64-bit and the Linux PC is running Slackware 14 64-bit with iptables. My firewall ...
-1
votes
2answers
160 views

Linux: Blocking outside attempts at attacking computer

in the past when I wanted to block outsiders from attempting to start connections with my Linux machine's various TCP services, what I was told to do was to add this line to /etc/hosts.deny: ...
2
votes
2answers
2k views

Benefits of REJECT over DROP on a single PC

Recently I learned about the difference between DROP and REJECT in a firewall. I understand that REJECT is better because it closes the connection immediately instead of waiting for timeout as DROP ...
2
votes
2answers
209 views

Hide logging server from DMZ

I have a server on my DMZ whichs relays syslog and OcsInventory messages to a server on a vlan for logging servers. In order to allow the packets to go through I must allow port 80 (OcsInventory) and ...
0
votes
1answer
360 views

How could `iptables -F` lock me out of the server? [closed]

I was just configuring IPtables and whilst doing so, had the default chain policies set to ACCEPT, but when happy with the generated rules I changed that to DROP for all chains. I did not run ...
3
votes
3answers
577 views

Make OSSEC ban ip on remote firewall

I am deploying OSSEC architecture agent-server mode. I want the server to ban ip not only on agent but also on a remote firewall (dedicated iptables server). I've seached on the OSSEC's ...