2
votes
1answer
81 views

Is it safe to disable connection tracking in iptables?

While reading about NOTRACK target of raw table in iptables, I encountered an article suggesting that for certain traffic you could (or even should) disable connection tracking. The two examples were: ...
1
vote
0answers
18 views

Should my server ever need to directly communicate with the NAT gateway? [migrated]

What I mean by ``directly communicate'' Does it ever need to receive packets with the gateway's IP address as the source IP address, or send packets with the gateway's IP address as the destination ...
0
votes
3answers
95 views

How to set iptables to drop packets that I'm not listening on?

I've got a Kali Linux box I use for pen testing. I would like to configure my machine to DROP incoming packets, but only when I'm not listening on them. e.g. if I run a netcat listener on port 80, I ...
3
votes
4answers
177 views

Find out what Linux software is trying to phone home

I have seen some suspicious outbound communications blocked on my VPS, which hosts a small experimental Web site, and want to find out which application is making the attempt. The server is running ...
0
votes
1answer
137 views

MitM Attacks - Iptables?

I have looked for the answer to this question to no avail, apologies if I missed it. I would like to know how effective iptables would be against MitM attacks - in the following setup: ALLOW INPUT ...
0
votes
2answers
183 views

Does iptables work in kernel mode? [closed]

I am not sure about that. It should run in kernel mode in order to avoid some user-mode program to kill/suspend the firewall and do its dirty job. The malware would not be able to kill the firewall ...
-1
votes
2answers
144 views

Linux: Blocking outside attempts at attacking computer

in the past when I wanted to block outsiders from attempting to start connections with my Linux machine's various TCP services, what I was told to do was to add this line to /etc/hosts.deny: ...
0
votes
1answer
231 views

How could `iptables -F` lock me out of the server? [closed]

I was just configuring IPtables and whilst doing so, had the default chain policies set to ACCEPT, but when happy with the generated rules I changed that to DROP for all chains. I did not run ...
2
votes
0answers
86 views

Shorewall stopped policies - routeback

Here goes a very specific question about the insides of Shorewall and Iptables in general. Shorewall supports configuration of "Stopped Policies" using the file routestopped, which defines the ...
2
votes
2answers
441 views

Mixing stateless and stateful firewall rules

I have been advised that mixing firewall rules that are both stateful and stateless can lead to trouble when it comes to troubleshooting. Is there any truth in this? Take the following two rule sets ...
4
votes
2answers
503 views

Executing arbitrary commands through iptables-restore input

During a pentest I found a way to add arbitrary iptables firewall rules to a server. These rules get applied by way of the iptables-restore command, and I've been wondering whether there is any way to ...
2
votes
2answers
5k views

Test firewall rules (Linux)

I have a question about how to test the firewall rules. To be more specific, for academic purpose I have to set up a machine which will accept all kind of packets o a specific interface. I added an ...
2
votes
1answer
179 views

Consequences of using -s and -d arguments in iptables

We are studying iptables for a Computer Systems Security course. We are confused as to what happens when the -s and -d arguments are both used in the same rule, such as: iptables -A OUTPUT -s ...
1
vote
2answers
697 views

How is iptables useful to prevent attacks against a LAN?

I need some advice securing a LAN using iptables. I've found lots of examples on how to secure single host with iptables, including scanning ports, attacking using ICMP-flood and TCP-flood. These ...
5
votes
4answers
19k views

Tips for a secure iptables config to defend from attacks. (client side!)

Own examples: ############### # KERNEL PARAMETER CONFIGURATION # PREVENT YOU SYSTEM FROM ANSWERING ICMP ECHO REQUESTS echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all # DROP ICMP ECHO-REQUEST ...
1
vote
2answers
3k views

IPTables default security rules for a gateway/router?

On a router such as dd-wrt or tomato, what would be some default iptables rules? I am asking for rules on a router/gateway - For example; blocking SYN flood attacks, or XMAS attacks. The basic ...