Questions tagged [iptables]
An application that allows a user to configure the tables provided by the Linux firewall. iptables is succeeded by nftables as of 2014.
2
votes
0answers
121 views
Experimenting with SSLStrip+ on the same machine
I am trying to play around to understand how SSLStrip+ works by:
$ cat /proc/sys/net/ipv4/ip_forward
1
$ sudo iptables --flush
$ sudo iptables --flush -t nat
$ sudo iptables -t nat -A PREROUTING -p ...
0
votes
1answer
127 views
watch DNS queries while using OpenVPN.-
I want to monitor/sniff the DNS queries I make while I'm using a VPN connection with my OpenVPN client.
My initial motivation was to check if I'm leaking DNS queries; then using this page it seems I'm ...
1
vote
0answers
36 views
Are parts of my system susceptible to IP based malicious attack even with effective IPtables rules?
Yesterday I installed Cent OS 6 and had to flush the default IPtables rules (IPtables -F) in order to access a web app via my browser.
Having very little experience with Linux/Network security this ...
1
vote
2answers
148 views
Dealing with the dangers of self-hosting a webserver?
Assuming for a self-hosted webserver:
the webserver only hosts a static html website
iptables is used to reject every IP except a few known ones
only Port 443 is forwarded and the website requires ...
0
votes
1answer
210 views
Building a malicious captive portal
So I'm trying to build a malicious captive portal but I'm stuck on the part where you need to know stuff.
Anytime a HTTP request comes in, everything works fine. However, when an HTTPS connection ...
0
votes
0answers
33 views
Forwarding VPN traffic to proxyVM in QubesOS
TLDR
I'm trying to create a proxyVM with VPN, which I could use as "Network VM" in AppVMs.
Previous attempts
Adding following rule in sys-net and setting VPN in sys-net I am able to connect.
[sys-...
1
vote
1answer
98 views
Is iptables and vpn tunneling enough? [closed]
What is the best approach to secure connection between two devices over the internet (public IP)?
if there is a firewall on my public IP address deny access all incoming connection, can the hacker ...
2
votes
1answer
36 views
What are the methods by which an attacker can distinguish between DROP on IPtables and a Nullroute or non-allocated IP?
Let's say we have a server set up with set to:
iptables -P INPUT DROP
Without any other rules on the input chain.
Ignoring accessibility issues outside of physical server access, what are the ...
0
votes
0answers
50 views
SSL Strip failing [duplicate]
I am trying to learn how SSL strip is used. I have Kali Linux machine as attacker, a windows machine as target, and an access point. All my machines are physical machines and not VMs.
I've done the ...
7
votes
1answer
2k views
Connection to ports 2000 and 5060 successful despite filtering
I run my own (Ubuntu based) router and have iptables configured to drop all incoming packets by default. To my surprise, running an nmap scan (from the WAN side) shows two open ports related to VOIP:
...
1
vote
0answers
92 views
Intercept data after sslstrip
I am able to use sslstrip successfully as shown here https://moxie.org/software/sslstrip/
What I want to do though is be able to use sslstrip with another proxy/script to modify requests/responses ...
1
vote
0answers
66 views
IPSec and traffic mirroring [closed]
I have a VoIP server on which several SIP clients are connected to through IPSec tunnels.
This is kind of an automated attendant so I both have RTP and SIP signalling flows.
I need to be able to ...
6
votes
0answers
306 views
Fully transparent proxy
By default mitmproxy will use its own local IP address for its server-side connections. What I want instead is mitmproxy to use the client’s IP address for server-side connections.
The following ...
7
votes
4answers
940 views
SIP UDP request breaking through iptables
I have been investigating a few instances recently where SIP UDP traffic has been somehow evading the ruleset defined in iptables leading me to suspect that there is a hole in our rules so i'm looking ...
0
votes
1answer
1k views
Can't connect to fake AP with airbase-ng
I use kali-rolling on a virutal machine and I try to set up a fake access point using airbase-ng, but my devices won't connect to it whatsoever. My steps are:
I put my wirless adapter in monitor mode ...
5
votes
3answers
619 views
Does blocking an IP with IP Tables protect you from a DOS (not DDOS) attack?
I am fairly new to network security, and I just learned about the Fail2Ban framework you can use for automated exploit detection/prevention. It says that you can protect yourself from DOS attacks by ...
4
votes
1answer
1k views
ARP spoofing with Scapy. How does Scapy reroute traffic?
Background:
I understand that in order to ARP spoof a victim in a network using Scapy, we need to send ARP reply packets to the victim and the gateway router with the correct destination and Source ...
0
votes
1answer
112 views
What is the iptables rule to block all https traffic except to a single ip?
I'm trying to configure a microservice for my web application, which is hosted at ip address X.X.X.X. The microservice should only accept https connections from this web app.
I've tested the ...
2
votes
1answer
266 views
Security Onion VMWare + OpenWRT IPTables Mirroring
I'm trying to set up SO in my home network to lab and see if I can monitor all ingress/egress traffic from my SOHO router. I don't have a switch with SPAN ports, or a network tap so I'm using OpenWRT ...
0
votes
0answers
128 views
Debian automatic dnsbl
Watching requests log, I see some IPs, considered Black List.
For example:
91.224.217.74 - - [06/Dec/2017:11:12:54 +0000] "GET / HTTP/1.1" 200 10951 "-" "curl/7.17.1 (mips-unknown-linux-gnu) libcurl/...
0
votes
1answer
301 views
Can iptables be hacked / circumvented
We currently have a server that blocks all connections using iptables, and we have to whitelist an IP expressly in order to be able to access the server remotely.
Essentially, the first rule allows ...
0
votes
0answers
218 views
iptables: Is an iptables interface filter sufficient to prevent IP spoofing?
Is a router's iptables firewall with an interface-filter as shown in the example below sufficient to prevent the internal network from spoofed IPs?
As I understand it, the packages with spoofed IPs ...
2
votes
1answer
220 views
Iptables DROPS SSH after port knock rules, but nmap shows it as OPEN
I setup port knocking rules on CentOS 7, iptables as follow:
-I INPUT -p tcp --dport 1 -m recent --set --rsource --name KNOCK1 -m limit --limit 5/min -j LOG --log-prefix "knock 1" --log-level 7
-I ...
1
vote
0answers
172 views
Exploit vulnerabilty in embedded Linux network stack to disable iptables
I own a D-Link DCS-7110 HD POE network camera.
It features an apparently iptables based access list configuration where you can allow/disallow certain networks and addresses from accessing the camera....
0
votes
1answer
119 views
Captive Portal Security Measures
I am currently working on a Captive Portal solution, which can be distributed in an device that has an ethernet and wlan port. In short, I use iptables to restrict access to all devices unless they ...
0
votes
1answer
173 views
What ports should I filter on a default Magento installation
I have recently installed a Magento on Ubuntu 14.04 on Digital Ocean and I'm wondering what ports should I filter to keep it safe. Well, actually the question should be: what ports I keep open to the ...
1
vote
0answers
60 views
How should I manage wireless connections if using iptables?
I am implementing some modest iptables on xubuntu 17.04 and came across this blurb from IptablesHowTo Ubuntu
WARNING: Iptables and NetworkManager can conflict. Also if you are
concerned enough ...
1
vote
1answer
585 views
MitM-Position with bridged network and iptables
I'm currently trying to get my setup to work.
[ victim ] --- [ mitm ] --- [ net ]
IPs:
net: 10.0.0.0/24
victim: 10.0.0.1
mitm: 10.0.0.2
gateway: 10.0.0.254
setup:
ip l a name br0 type bridge
ip l ...
0
votes
1answer
268 views
How to block an application with iptable which use random port
Scenario:
My goal was to allow TeamViewer to connect to my home workstation from my laptop only. So I have tried to bind my laptop's MAC with an IPtables rule as following,
[arif@arif:~]$ sudo ...
0
votes
0answers
155 views
Restrict OpenVPN client to one (some) website(s)
I want to provide a VPN service with OpenVPN to an acquaintance through my server only to access (a) specific website(s). In fact, even though I trust them to the point of granting them access to my ...
1
vote
0answers
965 views
Creating a rogue AP with Kali Linux
so i have for the last 2 days going through this task of setting up a Rogue AP on my Kali linux running in my VM.... i am using the 64bit version and the wifi adapter is TP link TL WN722N, so my ...
0
votes
0answers
627 views
How to redirect traffic to gateway after it has been redirect to another port?
I programmed an arpspoof program in Python which is working fine. I can see all the traffic from my other pc (lets call it the "victim") on my pc using Wireshark. Now what I'm trying to do is redirect ...
-1
votes
1answer
282 views
What is the most secure communication between firewall, and DMZ
I have 2 virtual machines. (Vmware esxi 6)
They are both opensuse 42.3 (tumbleweed)
Firewall (iptables,ipset,dhcpd,dns only)
mail/web server. (apache,dovecot,postfix)
The web server can not ...
2
votes
1answer
759 views
Is a Captive Portal Wifi AP as insecure as an open unencrypted Wifi?
As far as I understand, the captive portal is implemented by some sort of iptable firewall rules. Since there is no handshake established during the initial association with the AP(As no passphrase is ...
1
vote
0answers
155 views
Why is Skype traffic not passing through the NAT table of the PREROUTING chain in iptables?
I have successfully performed a MITM attack and have managed to view the HTTP/HTTPS packets of the victim passing through the nat table of the PREROUTING chain of my iptables.(using -j LOG) However, ...
9
votes
1answer
1k views
Nmap - Intense vs Quick result
I inherited a small network and currently am assessing its security performance.
I started port scanning a host (lets call it Weirdo) in that small network and from my perspective, it seems that that ...
0
votes
1answer
112 views
Which chain of the iptables receives the sniffed packets
Host C is using wireshark to sniff packets from Host A to Host B. I am able to see those packets from wireshark but I am not able to find them in the PREROUTING chain of iptables. When Host C ...
0
votes
2answers
123 views
Using IPTables over a network [closed]
I recently found out how to "block" an IP address from your computer, with this command:
sudo iptables -A INPUT -s 210.1.193.49 -j DROP #Blocks 210.1.193.49 from your computer
I was wondering, how ...
2
votes
1answer
122 views
Which set of rules is more restrictive when allowing SSH in iptables?
I have seen two set of rules to allow SSH communication:
Set A:
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT
Set B:
iptables -A INPUT -m state --...
1
vote
3answers
114 views
How to prevent DDoS to cause stored data inconveniences?
Let's assume there are no vulnerabilities in the application layer, one disk, and no physical firewall (just iptables rules in the server itself), hence in this case all the DDoS attack does is to ...
3
votes
2answers
1k views
MAC filtering the internet traffic?
I was trying to build a firewall where in the access to my LAN from internet should be allowed only if it matches the predefined MAC address of the device i.e,. MAC filtering, but later i found out ...
0
votes
1answer
98 views
Network Defense- White listing IPs/Ports
If I had a typical home user machine (google, email, youtube, no ssh/ftp, etc...) that had a dynamic iptables white-list that was dynamically updated with IP addresses that have been legitimately been ...
6
votes
1answer
420 views
SSL MITM on the WAN side of my router
Hi
I would like to try to sniff a typical CWMP conversation that my router does to his Auto Configuration Server (see TR-069 crash course: https://www.iol.unh.edu/sites/default/files/knowledgebase/...
3
votes
1answer
2k views
Networking in Qubes OS [closed]
I've started recently to use Qubes OS and I want to set up a virtual IDS and IPS in separate VMs, but I can't figure out how the communications between different VMs works here.
Each VM should be ...
1
vote
2answers
204 views
how to block pop up with iptables
Although I have enabled the pop up blocker in firefox, there are many websites that are able to circumvent this feature. (for example movie streaming sites like kinox.to). My question is not really ...
3
votes
1answer
1k views
Setting up a fake AP - problem with iptables and DNS server
Im trying to set up a fake AP using aircrack-ng suite, DHCP server & iptables.
After creating the fake AP:
airmon-ng start wlan1
airbase-ng -c 11 -e "freewifi" wlan1mon
running iptables ...
0
votes
1answer
909 views
Iptables as vpn killswitch but access to internal network
currently I'm using iptables as a kill-switch for my VPN connection. Therefore I only have one rule :
-A OUTPUT -o eth0 -m owner --uid-owner 1000 -j DROP
everything else is accepted.
Now the ...
0
votes
1answer
3k views
Iptables rules to prevent IP Spoofing
We had following below iptables rules that exist in our web front-end boxes to prevent IP Spoofing:
-A INPUT -s 255.0.0.0/8 -j LOG --log-prefix "Spoofed source IP"
-A INPUT -s 255.0.0.0/8 -j ...
0
votes
0answers
313 views
udp port 1194 forward through from gateway to LAN server through DMZ
my iptables rules don't seem to work, I do not understand what's wrong.
could somebody be kind enough to give me a hint ? thanks in advance
iptables -t nat -A PREROUTING -d $INET_IP -p udp --dport ...
7
votes
1answer
213 views
System-Level Network Security (Packet Classification and etc.) - SELinux and Libnftnl
I read that Libnftnl is a userspace library providing a low-level netlink programming interface to the in-kernel nf_tables subsystem and it uses NFTables.
Since it's a kernel related topic, at the ...
