The iptables tag has no wiki summary.
1
vote
0answers
8 views
How To Find Out What Software is Trying to 'Phone Home'?
I have seen some suspicious outbound communications blocked on my VPS, which hosts a small experimental Web site, and am wanting to find out which application is making the attempt. The server is ...
-1
votes
1answer
37 views
Isolate smart tv with iptables [closed]
I have an LG Smart TV at home which I set up with a static IP address (192.168.0.20). I read about what kind of data my TV sends home to LG, which worries me. I use dd-wrt on my router which allows me ...
0
votes
1answer
58 views
MitM Attacks - Iptables?
I have looked for the answer to this question to no avail, apologies if I missed it.
I would like to know how effective iptables would be against MitM attacks - in the following setup:
ALLOW INPUT ...
1
vote
0answers
29 views
How to manage security for multiple PC and VM?
I have a firewall VM which creates I have used to setup subnet for different purposes.
For example: (fake ips, of course)
1.1.2.1/24 DMZ
1.1.3.1/24 Internal
1.1.5.1/24 security/logging
I use ...
1
vote
2answers
119 views
Isolating guest networks
I'm setting up a secondary guest wifi on my router and I want to make sure that it's impossible for clients connected to the guest wifi to access my primary network.
Initially, I used IP filtering ...
2
votes
3answers
322 views
iptables: plaintext password protection
I'd like to find a way to block or restrict my access to the web-pages where my password is sent as a plaintext on the internet.
Let's assume if I have the same password for all web-pages, is it ...
0
votes
2answers
142 views
Does iptables work in kernel mode? [closed]
I am not sure about that. It should run in kernel mode in order to avoid some user-mode program to kill/suspend the firewall and do its dirty job.
The malware would not be able to kill the firewall ...
0
votes
1answer
137 views
How does a website get pass my server firewall and attempt to hotlink to my server resources?
I was stumped when I saw the following lines on my Apache server error log this morning:
[authz_core:error] [client ::1:37317] AH01630: client denied by server
configuration: ...
1
vote
0answers
60 views
forcing a traffic redirect?
I am trying to get my machines to be force through a MiTM and the MiTM to redirect them to a server of my choice (which happens to be the MiTM on port 17002)
I am running ip tables:
sudo iptables -t ...
0
votes
1answer
195 views
Bridge Firewall vs Routing Firewall
What is the difference between bridge and routing firewall ?
How they both works and what are the security advantages/disadvantages for both scenario ?
2
votes
1answer
267 views
ufw, system-config-firewall-tui, or firewalld vs iptables
Is there any advantage (other than usability) to using ufw, system-config-firewall-tui, or firewalld rather than just using iptables?
My understanding is that these other programs just simplify ...
2
votes
2answers
224 views
Are there “LAN IPs” on the internet?
I have a home-made web application and thought that an easy way to secure it's administration interface would be to simply reject all IPs that arent from 192.168... Is this viable? is it possible for ...
1
vote
0answers
134 views
Throttling DropBox behind a firewall
Our office network bandwidth gets choked when an employee copies a large file into her DropBox, since it gets downloaded on several machines (of other employees).
LAN Sync is an option, but needs to ...
2
votes
4answers
355 views
How can I block bots that consistently hit the same URLs?
I am getting slammed hard by bots, and I am not sure how to stop them without blocking my legitimate traffic. I created some iptables rules that say, if X connections in X seconds, block, but that ...
0
votes
2answers
123 views
How secure is a Windows PC that is routed through a Linux PC?
I have a Dual PC setup. Two PC's are networked together via crossover cable. The Windows PC is running Windows 7 SP1 64-bit and the Linux PC is running Slackware 14 64-bit with iptables.
My firewall ...
-1
votes
2answers
139 views
Linux: Blocking outside attempts at attacking computer
in the past when I wanted to block outsiders from attempting to start connections with my Linux machine's various TCP services, what I was told to do was to add this line to /etc/hosts.deny:
...
2
votes
2answers
278 views
Benefits of REJECT over DROP on a single PC
Recently I learned about the difference between DROP and REJECT in a firewall.
I understand that REJECT is better because it closes the connection immediately instead of waiting for timeout as DROP ...
2
votes
2answers
115 views
Hide logging server from DMZ
I have a server on my DMZ whichs relays syslog and OcsInventory messages to a server on a vlan for logging servers.
In order to allow the packets to go through I must allow port 80 (OcsInventory) and ...
0
votes
1answer
169 views
How could `iptables -F` lock me out of the server? [closed]
I was just configuring IPtables and whilst doing so, had the default chain policies set to ACCEPT, but when happy with the generated rules I changed that to DROP for all chains.
I did not run ...
2
votes
3answers
215 views
Make OSSEC ban ip on remote firewall
I am deploying OSSEC architecture agent-server mode.
I want the server to ban ip not only on agent but also on a remote firewall (dedicated iptables server).
I've seached on the OSSEC's ...
1
vote
1answer
188 views
fail2ban and iptables
Should fail2ban be the master of iptables rules? For example, should I setup my firewall rules along side the fail2ban rules, or should I have all my services configured and managed by fail2ban?
...
2
votes
0answers
77 views
Shorewall stopped policies - routeback
Here goes a very specific question about the insides of Shorewall and Iptables in general.
Shorewall supports configuration of "Stopped Policies" using the file routestopped, which defines the ...
2
votes
2answers
380 views
Mixing stateless and stateful firewall rules
I have been advised that mixing firewall rules that are both stateful and stateless can lead to trouble when it comes to troubleshooting. Is there any truth in this?
Take the following two rule sets ...
1
vote
2answers
131 views
IPTable Security between two servers
Is using IPTables to only allow traffic between two servers considered an acceptable practice? For example TCP traffic on a defined port. I realize this is referred to as an ACL but how secure is ...
3
votes
1answer
130 views
What are the requirements to sniff UDP packets in a Wireless Ad-Hoc network?
In a wireless Ad-Hoc network, I have two computers which communicates in UDP together from 192.168.1.3 to 192.168.1.5
I have a third computer (192.168.1.6) which wants to listen to the packets which ...
4
votes
2answers
438 views
Executing arbitrary commands through iptables-restore input
During a pentest I found a way to add arbitrary iptables firewall rules to a server. These rules get applied by way of the iptables-restore command, and I've been wondering whether there is any way to ...
0
votes
1answer
293 views
Securing my firewall (both dedicated and iptables-based) [closed]
I have an ASA-5510, but I also intend to maintain strict IP tables on my server (Ubuntu 12.04.2), so that there are two layers of "protection".
My iptables look like this:
*filter
# Allows all ...
0
votes
3answers
375 views
How can i reject connection from LAN and WAN to some ports?
Scanning with nmap, I discovered that there are 3 open ports on my server. I want to deny any access to these ports from any machine, regardless of whether it is on the same LAN or via WAN. How do I ...
1
vote
2answers
3k views
Test firewall rules (Linux)
I have a question about how to test the firewall rules. To be more specific, for academic purpose I have to set up a machine which will accept all kind of packets o a specific interface.
I added an ...
1
vote
2answers
3k views
How to configure iptables for must open ports?
On my machine there are web services which can be accessed from any PC connected to the same network segment (WiFi for example). I want to use IPtables on the machine to prevent any web services from ...
0
votes
1answer
1k views
icmp packets not able to reach the firewall despite of adding a specific rule, why?
I am using iptables to allow the icmp traffic in/out of my host. Please find below are the entries from my firewall (linux based):-
[root@localhost ~]# iptables -L
Chain INPUT (policy DROP)
target ...
0
votes
3answers
352 views
Some issues with iptables and nmap
When I scan my pc with nmap I see only one open port. I didn't define any rule in iptables so if I'm not mistaken, all connections should be denied by default.
However I can use HTTP or SSH, so that ...
2
votes
1answer
166 views
Consequences of using -s and -d arguments in iptables
We are studying iptables for a Computer Systems Security course. We are confused as to what happens when the -s and -d arguments are both used in the same rule, such as:
iptables -A OUTPUT -s ...
1
vote
2answers
614 views
How is iptables useful to prevent attacks against a LAN?
I need some advice securing a LAN using iptables.
I've found lots of examples on how to secure single host with iptables, including scanning ports, attacking using ICMP-flood and TCP-flood. These ...
1
vote
1answer
201 views
IPtables - Accept Arbitrary Packets
I've achieved a lot on blocking attacks on GameServers but I'm stuck on something. I've blocked major requests of game-server which it aceepts in the form "\xff\xff\xff\xff" which can be followed by ...
1
vote
3answers
3k views
Ignoring broadcasts to 10.0.0.255 using iptables
I'm trying to drop logging packets that are destined for 10.0.0.255 by using the following rules:
$IPTABLES -A OUTPUT -d 10.0.0.255 -j DROP
$IPTABLES -A FORWARD -d 10.0.0.255 -j DROP
It ...
3
votes
2answers
255 views
Can ipopts be used to circumvent a pf or iptables firewall source IP based blocking?
Can one use ipopts, and in particular IP source routing, to circumvent source-based blocking in pf or iptables?
For example, with OpenBSD's pf:
block in all # default deny
block out all
pass in on ...
5
votes
4answers
17k views
Tips for a secure iptables config to defend from attacks. (client side!)
Own examples:
###############
# KERNEL PARAMETER CONFIGURATION
# PREVENT YOU SYSTEM FROM ANSWERING ICMP ECHO REQUESTS
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all
# DROP ICMP ECHO-REQUEST ...
1
vote
2answers
2k views
IPTables default security rules for a gateway/router?
On a router such as dd-wrt or tomato, what would be some default iptables rules?
I am asking for rules on a router/gateway - For example; blocking SYN flood attacks, or XMAS attacks. The basic ...
4
votes
4answers
1k views
what is a good public available iptables script for ddos mitigation?
what is a good public available iptables script for ddos mitigation?
6
votes
5answers
877 views
Firewall demo - iptables
I have to make a demonstration about firewalls in my class as a student(university).
It should be implemented using iptables on Linux. I am reading all the theories around them but I can't figure out ...
12
votes
2answers
3k views
Reject IP packets with an ICMP error, or just drop them?
Consider an internet-facing host (the outer firewall). What should be done with undesired traffic: just drop it, or send back an ICMP error such as port unreachable? (In Linux terms: iptables -P DROP ...
