The tag has no wiki summary.

learn more… | top users | synonyms

1
vote
1answer
28 views

Security implications of packets with an invalid state (iptables)

I have been seeing few rules with -m state --state NEW, ESTABLISHED, RELATED. First I thought that was pointless as it was contemplating the three possible states, so there was no need to define -m ...
1
vote
1answer
42 views

Can an attacker detect if I have a TARPIT enabled?

Last thing we want to do is provoke an attacker and offer them challenges or puzzles indirectly to give them a flag to stay and continue to hack rather than move on to other hosts. If possible, I do ...
0
votes
0answers
16 views

Which IPTables chains should I log from a security perspective

So far I've always been logging the INPUT and OUTPUT chains because I only used iptables as host firewall. Now I'm configuring network firewall which uses iptables, but I don't know whether I should ...
2
votes
1answer
694 views

Is it safe to disable connection tracking in iptables?

While reading about NOTRACK target of raw table in iptables, I encountered an article suggesting that for certain traffic you could (or even should) disable connection tracking. The two examples were: ...
3
votes
1answer
73 views

Is it possible to find out what a remote user is trying to do connecting to a closed port?

From my iptables log, I can observe a particular remote IP address trying to connect to my server from port 80 to a private port number: Jul 09 01:24:41 example.com kernel: IPTABLES: IN=eth1 ...
0
votes
1answer
30 views

Utility of Output Chains in IPTABLES when there is no Network Firewall— Is it ok to permit all outgoing connections from a server?

I have a set of INPUT chain rules restricting traffic based on source ip and destination ports.The services are ftp and a job service.The server has a public ip address. The default policy of the ...
2
votes
1answer
94 views

Port Knocking using only Iptables/netfilter

I am using the following iptables rules for port knocking. Everything works well, but it open the port for just a second and then close it. So how to improve this script to accept connection for a 30 ...
0
votes
1answer
59 views

Block specific packets/sequences of packets to remove disturbing client “feature”

Recently, one of my client-server application started to disturb me with some very annoying "notifications". Basically, what happens is that the remote server sends a few packets to my client, which ...
1
vote
5answers
3k views

Logging server compromised (IptabLes and IptabLex)

I am trying to figure out how it was compromised. They installed IptabLes and IptabLex in /boot. They also added /etc/init.d/IptabLes and /etc/init.d/IptabLex which simply call the respective /boot ...
0
votes
3answers
161 views

How to set iptables to drop packets that I'm not listening on?

I've got a Kali Linux box I use for pen testing. I would like to configure my machine to DROP incoming packets, but only when I'm not listening on them. e.g. if I run a netcat listener on port 80, I ...
3
votes
2answers
1k views

Is my ISP doing a port scan on my computer?

I have been logging incoming connections with iptables for a while and I have been observing the following popping up periodically: 11:45:10 my.com kernel: IPTABLES: SRC=220.255.XX.XXY ...
1
vote
1answer
143 views

Allow loopback in Iptables?

I'm trying to write Iptables rules for a small web server. Almost every source I've encountered recommends to allow loopback access to the web server, but doesn't explain why this is necessary. ...
3
votes
4answers
236 views

Find out what Linux software is trying to phone home

I have seen some suspicious outbound communications blocked on my VPS, which hosts a small experimental Web site, and want to find out which application is making the attempt. The server is running ...
0
votes
1answer
229 views

MitM Attacks - Iptables?

I have looked for the answer to this question to no avail, apologies if I missed it. I would like to know how effective iptables would be against MitM attacks - in the following setup: ALLOW INPUT ...
1
vote
0answers
38 views

How to manage security for multiple PC and VM?

I have a firewall VM which creates I have used to setup subnet for different purposes. For example: (fake ips, of course) 1.1.2.1/24 DMZ 1.1.3.1/24 Internal 1.1.5.1/24 security/logging I use ...
1
vote
2answers
192 views

Isolating guest networks

I'm setting up a secondary guest wifi on my router and I want to make sure that it's impossible for clients connected to the guest wifi to access my primary network. Initially, I used IP filtering ...
2
votes
3answers
491 views

iptables: plaintext password protection

I'd like to find a way to block or restrict my access to the web-pages where my password is sent as a plaintext on the internet. Let's assume if I have the same password for all web-pages, is it ...
0
votes
2answers
219 views

Does iptables work in kernel mode? [closed]

I am not sure about that. It should run in kernel mode in order to avoid some user-mode program to kill/suspend the firewall and do its dirty job. The malware would not be able to kill the firewall ...
0
votes
1answer
212 views

How does a website get pass my server firewall and attempt to hotlink to my server resources?

I was stumped when I saw the following lines on my Apache server error log this morning: [authz_core:error] [client ::1:37317] AH01630: client denied by server configuration: ...
1
vote
0answers
135 views

forcing a traffic redirect?

I am trying to get my machines to be force through a MiTM and the MiTM to redirect them to a server of my choice (which happens to be the MiTM on port 17002) I am running ip tables: sudo iptables -t ...
0
votes
1answer
501 views

Bridge Firewall vs Routing Firewall

What is the difference between bridge and routing firewall ? How they both works and what are the security advantages/disadvantages for both scenario ?
2
votes
1answer
475 views

ufw, system-config-firewall-tui, or firewalld vs iptables

Is there any advantage (other than usability) to using ufw, system-config-firewall-tui, or firewalld rather than just using iptables? My understanding is that these other programs just simplify ...
2
votes
2answers
243 views

Are there “LAN IPs” on the internet?

I have a home-made web application and thought that an easy way to secure it's administration interface would be to simply reject all IPs that arent from 192.168... Is this viable? is it possible for ...
1
vote
0answers
177 views

Throttling DropBox behind a firewall

Our office network bandwidth gets choked when an employee copies a large file into her DropBox, since it gets downloaded on several machines (of other employees). LAN Sync is an option, but needs to ...
2
votes
4answers
704 views

How can I block bots that consistently hit the same URLs?

I am getting slammed hard by bots, and I am not sure how to stop them without blocking my legitimate traffic. I created some iptables rules that say, if X connections in X seconds, block, but that ...
0
votes
2answers
144 views

How secure is a Windows PC that is routed through a Linux PC?

I have a Dual PC setup. Two PC's are networked together via crossover cable. The Windows PC is running Windows 7 SP1 64-bit and the Linux PC is running Slackware 14 64-bit with iptables. My firewall ...
-1
votes
2answers
148 views

Linux: Blocking outside attempts at attacking computer

in the past when I wanted to block outsiders from attempting to start connections with my Linux machine's various TCP services, what I was told to do was to add this line to /etc/hosts.deny: ...
2
votes
2answers
714 views

Benefits of REJECT over DROP on a single PC

Recently I learned about the difference between DROP and REJECT in a firewall. I understand that REJECT is better because it closes the connection immediately instead of waiting for timeout as DROP ...
2
votes
2answers
147 views

Hide logging server from DMZ

I have a server on my DMZ whichs relays syslog and OcsInventory messages to a server on a vlan for logging servers. In order to allow the packets to go through I must allow port 80 (OcsInventory) and ...
0
votes
1answer
272 views

How could `iptables -F` lock me out of the server? [closed]

I was just configuring IPtables and whilst doing so, had the default chain policies set to ACCEPT, but when happy with the generated rules I changed that to DROP for all chains. I did not run ...
3
votes
3answers
403 views

Make OSSEC ban ip on remote firewall

I am deploying OSSEC architecture agent-server mode. I want the server to ban ip not only on agent but also on a remote firewall (dedicated iptables server). I've seached on the OSSEC's ...
1
vote
1answer
227 views

fail2ban and iptables

Should fail2ban be the master of iptables rules? For example, should I setup my firewall rules along side the fail2ban rules, or should I have all my services configured and managed by fail2ban? ...
2
votes
0answers
100 views

Shorewall stopped policies - routeback

Here goes a very specific question about the insides of Shorewall and Iptables in general. Shorewall supports configuration of "Stopped Policies" using the file routestopped, which defines the ...
2
votes
2answers
503 views

Mixing stateless and stateful firewall rules

I have been advised that mixing firewall rules that are both stateful and stateless can lead to trouble when it comes to troubleshooting. Is there any truth in this? Take the following two rule sets ...
1
vote
2answers
167 views

IPTable Security between two servers

Is using IPTables to only allow traffic between two servers considered an acceptable practice? For example TCP traffic on a defined port. I realize this is referred to as an ACL but how secure is ...
3
votes
1answer
150 views

What are the requirements to sniff UDP packets in a Wireless Ad-Hoc network?

In a wireless Ad-Hoc network, I have two computers which communicates in UDP together from 192.168.1.3 to 192.168.1.5 I have a third computer (192.168.1.6) which wants to listen to the packets which ...
4
votes
2answers
559 views

Executing arbitrary commands through iptables-restore input

During a pentest I found a way to add arbitrary iptables firewall rules to a server. These rules get applied by way of the iptables-restore command, and I've been wondering whether there is any way to ...
0
votes
1answer
498 views

Securing my firewall (both dedicated and iptables-based) [closed]

I have an ASA-5510, but I also intend to maintain strict IP tables on my server (Ubuntu 12.04.2), so that there are two layers of "protection". My iptables look like this: *filter # Allows all ...
0
votes
3answers
504 views

How can i reject connection from LAN and WAN to some ports?

Scanning with nmap, I discovered that there are 3 open ports on my server. I want to deny any access to these ports from any machine, regardless of whether it is on the same LAN or via WAN. How do I ...
2
votes
2answers
6k views

Test firewall rules (Linux)

I have a question about how to test the firewall rules. To be more specific, for academic purpose I have to set up a machine which will accept all kind of packets o a specific interface. I added an ...
2
votes
2answers
5k views

How to configure iptables for must open ports?

On my machine there are web services which can be accessed from any PC connected to the same network segment (WiFi for example). I want to use IPtables on the machine to prevent any web services from ...
0
votes
1answer
2k views

icmp packets not able to reach the firewall despite of adding a specific rule, why?

I am using iptables to allow the icmp traffic in/out of my host. Please find below are the entries from my firewall (linux based):- [root@localhost ~]# iptables -L Chain INPUT (policy DROP) target ...
0
votes
3answers
403 views

Some issues with iptables and nmap

When I scan my pc with nmap I see only one open port. I didn't define any rule in iptables so if I'm not mistaken, all connections should be denied by default. However I can use HTTP or SSH, so that ...
2
votes
1answer
187 views

Consequences of using -s and -d arguments in iptables

We are studying iptables for a Computer Systems Security course. We are confused as to what happens when the -s and -d arguments are both used in the same rule, such as: iptables -A OUTPUT -s ...
1
vote
2answers
759 views

How is iptables useful to prevent attacks against a LAN?

I need some advice securing a LAN using iptables. I've found lots of examples on how to secure single host with iptables, including scanning ports, attacking using ICMP-flood and TCP-flood. These ...
1
vote
1answer
215 views

IPtables - Accept Arbitrary Packets

I've achieved a lot on blocking attacks on GameServers but I'm stuck on something. I've blocked major requests of game-server which it aceepts in the form "\xff\xff\xff\xff" which can be followed by ...
1
vote
3answers
4k views

Ignoring broadcasts to 10.0.0.255 using iptables

I'm trying to drop logging packets that are destined for 10.0.0.255 by using the following rules: $IPTABLES -A OUTPUT -d 10.0.0.255 -j DROP $IPTABLES -A FORWARD -d 10.0.0.255 -j DROP It ...
3
votes
2answers
265 views

Can ipopts be used to circumvent a pf or iptables firewall source IP based blocking?

Can one use ipopts, and in particular IP source routing, to circumvent source-based blocking in pf or iptables? For example, with OpenBSD's pf: block in all # default deny block out all pass in on ...
6
votes
4answers
21k views

Tips for a secure iptables config to defend from attacks. (client side!)

Own examples: ############### # KERNEL PARAMETER CONFIGURATION # PREVENT YOU SYSTEM FROM ANSWERING ICMP ECHO REQUESTS echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all # DROP ICMP ECHO-REQUEST ...
1
vote
2answers
3k views

IPTables default security rules for a gateway/router?

On a router such as dd-wrt or tomato, what would be some default iptables rules? I am asking for rules on a router/gateway - For example; blocking SYN flood attacks, or XMAS attacks. The basic ...