An application that allows a user to configure the tables provided by the Linux firewall. iptables is succeeded by nftables as of 2014.

learn more… | top users | synonyms

0
votes
0answers
3 views

nfqueues and arp spoofing iptables [migrated]

I am ARP poisoning and DNS spoofing my home network for learning purposes. When I get the victim to send their packets to my attacking computer, which rule do I have to create so I can intercept the ...
0
votes
0answers
21 views

EVIL AP - Internet connection bridging issue [migrated]

I've been trying to create an EVIL AP scenario in my test lab for a couple of days, but I always face the same issue. I can connect to the WIFI adapter and I receive an IP address etc, via dhcp. ...
4
votes
1answer
51 views

IPtables Linux Firewall and IPsec traffic

Can iptables filter out incoming datagrams that are IPSec-tunneled packets going to port 25?
0
votes
0answers
17 views

airbase-ng: How to apply `iptables` rule to packets on `at0` tap-interface

airbase-ng: How to apply iptables rule to packets on at0 tap-interface Reading a tutorial on the net, I see this iptables command used with the tap-interface at0, created by airbase-ng. iptables ...
1
vote
1answer
35 views

Nmap scan giving different result to my iptables configuration

I am running a simple webserver on a VPS, the only ports I have open are 80 - for HTTP (webserver) 12345 - an unusual port for SSH connection to administer server. I wanted to see how my ...
3
votes
1answer
54 views

Blocking all incoming traffic, will it still accept a response from a request I initiated?

I am a 'newbie' when it comes to firewalls, but I am trying to launch some machines that will connect to Facebook's Graphs API. I only want these machines to contact Facebook and nothing else. By this ...
2
votes
0answers
61 views

CPU load of iptables to deny IPs during DDoS event [closed]

If a server has an external IP address protected with an iptables whitelist rule to reject all by default except from 3 ip addresses ip1, ip2 and ip3. If someone identifies this external IP address, ...
1
vote
2answers
315 views

Limit Packets Per Second

Since last week I have been seeing something fishy and it seems to be worsening. I tried many firewalls and they seem to be useless. I blocked all unwanted ports and only few ports are open so I found ...
1
vote
0answers
146 views

IPtables accepting SMTP without being configured?

While setting up the IPtables rules for a new server, I set up Postfix and send an email to try it out. To my surprise the email arrived without me declaring a rule for the port in IPtables. ...
4
votes
2answers
80 views

Should I block outbound TCP RST (on closed ports)?

I have a range of inbound TCP ports open on the firewall, but usually closed on the host machine. I see a handful of unknown connection attempts each day, for which the server returns TCP RST. I ...
0
votes
1answer
82 views
1
vote
1answer
176 views

Host-based security architecture for web server network

I am begining with network security and after studying for a while about often used technologies I got to this architecture for my home server (sorry it is not in english). I considered 3 basic ...
1
vote
0answers
30 views

iptable ip_conntrack_max testing

I was trying to understand how ip_conntrack_max works so i have created two VM and set ip_conntrack_max to 10000 I used hping to open 10000 udp connection on VM using following command hping --udp ...
3
votes
3answers
396 views

iptables rule to ban and redirect malicious traffic

I'm running Apache 2 and after analysing the access_log I discovered that my website is visited more than 800 times a day (today 924) from majestic.co.uk bot. The bot use this range of IP addresses: ...
1
vote
1answer
173 views

How to bypass DNS spoofing protection

I know that SSL certificates prevent DNS spoofing, but I was wondering why it is not possible after ARP cache poisoning to set up iptables rules and redirect the origin destination to fake page?
1
vote
0answers
57 views

Iptables and PSAD [closed]

I had a configuration error with PSAD that deals with the logging of all traffic on my server. I fixed the configuration error by placing the logging rules at the end of the whole chain (filter ...
2
votes
1answer
661 views

ARP - forwarding or dropping with IPtables

I've been trying to ARP poison my home computer and router (intended to learn and discover the networks behavior). And with success. The whole time I've been using: with ...
2
votes
5answers
2k views

How can I block bots that consistently hit the same URLs?

I am getting slammed hard by bots, and I am not sure how to stop them without blocking my legitimate traffic. I created some iptables rules that say, if X connections in X seconds, block, but that ...
5
votes
2answers
11k views

Test firewall rules (Linux)

I have a question about how to test the firewall rules. To be more specific, for academic purpose I have to set up a machine which will accept all kind of packets o a specific interface. I added an ...
0
votes
1answer
92 views

Is it worth it to use sshguard when only allowing ssh login from specific IP?

I'm running a VPS (under ArchLinux) and was wondering if sshguard was useful in the following case. My iptables rule for SSH in looks like this : iptables -A INPUT -p tcp --source $Trusted --dport ...
0
votes
2answers
496 views

Opening port 53 on server Risks?

I looked about but couldn't find a similar enough question. I have some remote servers positioned on clients networks, which provide various services (raspberry pi) - and their firewall config is as ...
0
votes
2answers
237 views

Preventing ARP spoofing in DMZ

Is there any possible way to implement a defence mechanism in a firewall to be able to prevent ARP spoofing in a DMZ. Our DMZ server consist of two webservers and a database (which should be available ...
2
votes
1answer
80 views

Which IPTables chains should I log from a security perspective

So far I've always been logging the INPUT and OUTPUT chains because I only used iptables as host firewall. Now I'm configuring network firewall which uses iptables, but I don't know whether I should ...
1
vote
1answer
131 views

How does DROP rule work in iptables?

I'm working with iptables in order to close one or two open ports. So I tried this rule in order to change the default policy. # iptables -A INPUT -p tcp --dport 3333 -j DROP Then I checked the ...
3
votes
2answers
331 views

Firewall egress filtering / quick whitelisting

Suppose your Aunt or Uncle is easily fooled by phishing attempts and their computer has multiple root kits and key loggers running. Assume their computing habits will never change. Looking at his ...
1
vote
4answers
6k views

Ignoring broadcasts to 10.0.0.255 using iptables

I'm trying to drop logging packets that are destined for 10.0.0.255 by using the following rules: $IPTABLES -A OUTPUT -d 10.0.0.255 -j DROP $IPTABLES -A FORWARD -d 10.0.0.255 -j DROP It ...
0
votes
1answer
241 views

How to prevent outgoing UDP attacks?

My server has been the target from hackers 3 times in the last month, and the attack seem to follow the same pattern. The attack another site from my server using UDP connection. The report from my ...
2
votes
1answer
1k views

Using Linux iptables to implement a stateless, packet filtering firewall

When I began my career in network security, almost a decade back, the industry standard was stateful firewalls that even had the ability to inspect some application layer protocols. I had only heard ...
0
votes
1answer
537 views

iptables intercept received packet with proxy and then forward to destination

Lets say I receive internet through my eth1 port and share it via hotspot to other devices (wlan0 port) [internet]----(eth1)[my computer](wlan0 hotspot) | ...
3
votes
2answers
699 views

How web application firewalls protect application from DDoS attacks?

How to protect a web application from DDoS by the implementation of Web Application firewalls? How effective is this method?
1
vote
1answer
483 views

How to block traffic coming from an “public” WiFi hotspot and going to the LAN (iptables)

I followed this tutorial (http://elinux.org/RPI-Wireless-Hotspot) for an Wifi Hotspot in the guesthouse. This is working fine, but every device on the WiFi network can reach any LAN device in the LAN ...
3
votes
3answers
668 views

Make OSSEC ban ip on remote firewall

I am deploying OSSEC architecture agent-server mode. I want the server to ban ip not only on agent but also on a remote firewall (dedicated iptables server). I've seached on the OSSEC's ...
1
vote
1answer
64 views

Security implications of packets with an invalid state (iptables)

I have been seeing few rules with -m state --state NEW, ESTABLISHED, RELATED. First I thought that was pointless as it was contemplating the three possible states, so there was no need to define -m ...
1
vote
1answer
160 views

Can an attacker detect if I have a TARPIT enabled?

Last thing we want to do is provoke an attacker and offer them challenges or puzzles indirectly to give them a flag to stay and continue to hack rather than move on to other hosts. If possible, I do ...
2
votes
5answers
4k views

Logging server compromised (IptabLes and IptabLex)

I am trying to figure out how it was compromised. They installed IptabLes and IptabLex in /boot. They also added /etc/init.d/IptabLes and /etc/init.d/IptabLex which simply call the respective /boot ...
5
votes
1answer
8k views

Is it safe to disable connection tracking in iptables?

While reading about NOTRACK target of raw table in iptables, I encountered an article suggesting that for certain traffic you could (or even should) disable connection tracking. The two examples were: ...
2
votes
1answer
267 views

Port Knocking using only Iptables/netfilter

I am using the following iptables rules for port knocking. Everything works well, but it open the port for just a second and then close it. So how to improve this script to accept connection for a 30 ...
3
votes
1answer
122 views

Is it possible to find out what a remote user is trying to do connecting to a closed port?

From my iptables log, I can observe a particular remote IP address trying to connect to my server from port 80 to a private port number: Jul 09 01:24:41 example.com kernel: IPTABLES: IN=eth1 ...
0
votes
1answer
72 views

Utility of Output Chains in IPTABLES when there is no Network Firewall— Is it ok to permit all outgoing connections from a server?

I have a set of INPUT chain rules restricting traffic based on source ip and destination ports.The services are ftp and a job service.The server has a public ip address. The default policy of the ...
0
votes
1answer
522 views

Block specific packets/sequences of packets to remove disturbing client “feature”

Recently, one of my client-server application started to disturb me with some very annoying "notifications". Basically, what happens is that the remote server sends a few packets to my client, which ...
4
votes
4answers
1k views

Find out what Linux software is trying to phone home

I have seen some suspicious outbound communications blocked on my VPS, which hosts a small experimental Web site, and want to find out which application is making the attempt. The server is running ...
0
votes
3answers
489 views

How to set iptables to drop packets that I'm not listening on?

I've got a Kali Linux box I use for pen testing. I would like to configure my machine to DROP incoming packets, but only when I'm not listening on them. e.g. if I run a netcat listener on port 80, I ...
3
votes
2answers
2k views

Is my ISP doing a port scan on my computer?

I have been logging incoming connections with iptables for a while and I have been observing the following popping up periodically: 11:45:10 my.com kernel: IPTABLES: SRC=220.255.XX.XXY ...
1
vote
1answer
261 views

Allow loopback in Iptables?

I'm trying to write Iptables rules for a small web server. Almost every source I've encountered recommends to allow loopback access to the web server, but doesn't explain why this is necessary. ...
2
votes
1answer
1k views

ufw, system-config-firewall-tui, or firewalld vs iptables

Is there any advantage (other than usability) to using ufw, system-config-firewall-tui, or firewalld rather than just using iptables? My understanding is that these other programs just simplify ...
0
votes
1answer
519 views

MitM Attacks - Iptables?

I have looked for the answer to this question to no avail, apologies if I missed it. I would like to know how effective iptables would be against MitM attacks - in the following setup: ALLOW INPUT ...
2
votes
3answers
856 views

iptables: plaintext password protection

I'd like to find a way to block or restrict my access to the web-pages where my password is sent as a plaintext on the internet. Let's assume if I have the same password for all web-pages, is it ...
1
vote
0answers
48 views

How to manage security for multiple PC and VM?

I have a firewall VM which creates I have used to setup subnet for different purposes. For example: (fake ips, of course) 1.1.2.1/24 DMZ 1.1.3.1/24 Internal 1.1.5.1/24 security/logging I use ...
6
votes
5answers
1k views

Firewall demo - iptables

I have to make a demonstration about firewalls in my class as a student(university). It should be implemented using iptables on Linux. I am reading all the theories around them but I can't figure out ...
1
vote
2answers
389 views

Isolating guest networks

I'm setting up a secondary guest wifi on my router and I want to make sure that it's impossible for clients connected to the guest wifi to access my primary network. Initially, I used IP filtering ...