The iptables tag has no wiki summary.
0
votes
0answers
27 views
How to manage security for multiple PC and VM?
I have a firewall VM which creates I have used to setup subnet for different purposes.
For example: (fake ips, of course)
1.1.2.1/24 DMZ
1.1.3.1/24 Internal
1.1.5.1/24 security/logging
I use ...
1
vote
2answers
108 views
Isolating guest networks
I'm setting up a secondary guest wifi on my router and I want to make sure that it's impossible for clients connected to the guest wifi to access my primary network.
Initially, I used IP filtering ...
2
votes
3answers
288 views
iptables: plaintext password protection
I'd like to find a way to block or restrict my access to the web-pages where my password is sent as a plaintext on the internet.
Let's assume if I have the same password for all web-pages, is it ...
0
votes
2answers
113 views
Does iptables work in kernel mode? [closed]
I am not sure about that. It should run in kernel mode in order to avoid some user-mode program to kill/suspend the firewall and do its dirty job.
The malware would not be able to kill the firewall ...
0
votes
1answer
109 views
How does a website get pass my server firewall and attempt to hotlink to my server resources?
I was stumped when I saw the following lines on my Apache server error log this morning:
[authz_core:error] [client ::1:37317] AH01630: client denied by server
configuration: ...
0
votes
0answers
46 views
forcing a traffic redirect?
I am trying to get my machines to be force through a MiTM and the MiTM to redirect them to a server of my choice (which happens to be the MiTM on port 17002)
I am running ip tables:
sudo iptables -t ...
0
votes
1answer
137 views
Bridge Firewall vs Routing Firewall
What is the difference between bridge and routing firewall ?
How they both works and what are the security advantages/disadvantages for both scenario ?
2
votes
0answers
232 views
ufw, system-config-firewall-tui, or firewalld vs iptables
Is there any advantage (other than usability) to using ufw, system-config-firewall-tui, or firewalld rather than just using iptables?
My understanding is that these other programs just simplify ...
2
votes
2answers
219 views
Are there “LAN IPs” on the internet?
I have a home-made web application and thought that an easy way to secure it's administration interface would be to simply reject all IPs that arent from 192.168... Is this viable? is it possible for ...
0
votes
0answers
119 views
Throttling DropBox behind a firewall
Our office network bandwidth gets choked when an employee copies a large file into her DropBox, since it gets downloaded on several machines (of other employees).
LAN Sync is an option, but needs to ...
2
votes
4answers
287 views
How can I block bots that consistently hit the same URLs?
I am getting slammed hard by bots, and I am not sure how to stop them without blocking my legitimate traffic. I created some iptables rules that say, if X connections in X seconds, block, but that ...
0
votes
2answers
118 views
How secure is a Windows PC that is routed through a Linux PC?
I have a Dual PC setup. Two PC's are networked together via crossover cable. The Windows PC is running Windows 7 SP1 64-bit and the Linux PC is running Slackware 14 64-bit with iptables.
My firewall ...
-1
votes
2answers
131 views
Linux: Blocking outside attempts at attacking computer
in the past when I wanted to block outsiders from attempting to start connections with my Linux machine's various TCP services, what I was told to do was to add this line to /etc/hosts.deny:
...
2
votes
2answers
199 views
Benefits of REJECT over DROP on a single PC
Recently I learned about the difference between DROP and REJECT in a firewall.
I understand that REJECT is better because it closes the connection immediately instead of waiting for timeout as DROP ...
2
votes
2answers
107 views
Hide logging server from DMZ
I have a server on my DMZ whichs relays syslog and OcsInventory messages to a server on a vlan for logging servers.
In order to allow the packets to go through I must allow port 80 (OcsInventory) and ...
0
votes
1answer
144 views
How could `iptables -F` lock me out of the server? [closed]
I was just configuring IPtables and whilst doing so, had the default chain policies set to ACCEPT, but when happy with the generated rules I changed that to DROP for all chains.
I did not run ...
2
votes
3answers
170 views
Make OSSEC ban ip on remote firewall
I am deploying OSSEC architecture agent-server mode.
I want the server to ban ip not only on agent but also on a remote firewall (dedicated iptables server).
I've seached on the OSSEC's ...
1
vote
1answer
175 views
fail2ban and iptables
Should fail2ban be the master of iptables rules? For example, should I setup my firewall rules along side the fail2ban rules, or should I have all my services configured and managed by fail2ban?
...
1
vote
0answers
71 views
Shorewall stopped policies - routeback
Here goes a very specific question about the insides of Shorewall and Iptables in general.
Shorewall supports configuration of "Stopped Policies" using the file routestopped, which defines the ...
2
votes
2answers
357 views
Mixing stateless and stateful firewall rules
I have been advised that mixing firewall rules that are both stateful and stateless can lead to trouble when it comes to troubleshooting. Is there any truth in this?
Take the following two rule sets ...
1
vote
2answers
121 views
IPTable Security between two servers
Is using IPTables to only allow traffic between two servers considered an acceptable practice? For example TCP traffic on a defined port. I realize this is referred to as an ACL but how secure is ...
3
votes
1answer
121 views
What are the requirements to sniff UDP packets in a Wireless Ad-Hoc network?
In a wireless Ad-Hoc network, I have two computers which communicates in UDP together from 192.168.1.3 to 192.168.1.5
I have a third computer (192.168.1.6) which wants to listen to the packets which ...
4
votes
2answers
414 views
Executing arbitrary commands through iptables-restore input
During a pentest I found a way to add arbitrary iptables firewall rules to a server. These rules get applied by way of the iptables-restore command, and I've been wondering whether there is any way to ...
0
votes
1answer
274 views
Securing my firewall (both dedicated and iptables-based) [closed]
I have an ASA-5510, but I also intend to maintain strict IP tables on my server (Ubuntu 12.04.2), so that there are two layers of "protection".
My iptables look like this:
*filter
# Allows all ...
0
votes
3answers
352 views
How can i reject connection from LAN and WAN to some ports?
Scanning with nmap, I discovered that there are 3 open ports on my server. I want to deny any access to these ports from any machine, regardless of whether it is on the same LAN or via WAN. How do I ...
1
vote
2answers
3k views
Test firewall rules (Linux)
I have a question about how to test the firewall rules. To be more specific, for academic purpose I have to set up a machine which will accept all kind of packets o a specific interface.
I added an ...
1
vote
2answers
3k views
How to configure iptables for must open ports?
On my machine there are web services which can be accessed from any PC connected to the same network segment (WiFi for example). I want to use IPtables on the machine to prevent any web services from ...
0
votes
1answer
1k views
icmp packets not able to reach the firewall despite of adding a specific rule, why?
I am using iptables to allow the icmp traffic in/out of my host. Please find below are the entries from my firewall (linux based):-
[root@localhost ~]# iptables -L
Chain INPUT (policy DROP)
target ...
0
votes
3answers
340 views
Some issues with iptables and nmap
When I scan my pc with nmap I see only one open port. I didn't define any rule in iptables so if I'm not mistaken, all connections should be denied by default.
However I can use HTTP or SSH, so that ...
2
votes
1answer
160 views
Consequences of using -s and -d arguments in iptables
We are studying iptables for a Computer Systems Security course. We are confused as to what happens when the -s and -d arguments are both used in the same rule, such as:
iptables -A OUTPUT -s ...
1
vote
2answers
580 views
How is iptables useful to prevent attacks against a LAN?
I need some advice securing a LAN using iptables.
I've found lots of examples on how to secure single host with iptables, including scanning ports, attacking using ICMP-flood and TCP-flood. These ...
1
vote
1answer
197 views
IPtables - Accept Arbitrary Packets
I've achieved a lot on blocking attacks on GameServers but I'm stuck on something. I've blocked major requests of game-server which it aceepts in the form "\xff\xff\xff\xff" which can be followed by ...
1
vote
3answers
3k views
Ignoring broadcasts to 10.0.0.255 using iptables
I'm trying to drop logging packets that are destined for 10.0.0.255 by using the following rules:
$IPTABLES -A OUTPUT -d 10.0.0.255 -j DROP
$IPTABLES -A FORWARD -d 10.0.0.255 -j DROP
It ...
3
votes
2answers
253 views
Can ipopts be used to circumvent a pf or iptables firewall source IP based blocking?
Can one use ipopts, and in particular IP source routing, to circumvent source-based blocking in pf or iptables?
For example, with OpenBSD's pf:
block in all # default deny
block out all
pass in on ...
5
votes
4answers
16k views
Tips for a secure iptables config to defend from attacks. (client side!)
Own examples:
###############
# KERNEL PARAMETER CONFIGURATION
# PREVENT YOU SYSTEM FROM ANSWERING ICMP ECHO REQUESTS
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all
# DROP ICMP ECHO-REQUEST ...
1
vote
2answers
2k views
IPTables default security rules for a gateway/router?
On a router such as dd-wrt or tomato, what would be some default iptables rules?
I am asking for rules on a router/gateway - For example; blocking SYN flood attacks, or XMAS attacks. The basic ...
4
votes
4answers
1k views
what is a good public available iptables script for ddos mitigation?
what is a good public available iptables script for ddos mitigation?
6
votes
5answers
852 views
Firewall demo - iptables
I have to make a demonstration about firewalls in my class as a student(university).
It should be implemented using iptables on Linux. I am reading all the theories around them but I can't figure out ...
12
votes
2answers
3k views
Reject IP packets with an ICMP error, or just drop them?
Consider an internet-facing host (the outer firewall). What should be done with undesired traffic: just drop it, or send back an ICMP error such as port unreachable? (In Linux terms: iptables -P DROP ...
