Questions tagged [iptables]
An application that allows a user to configure the tables provided by the Linux firewall. iptables is succeeded by nftables as of 2014.
165
questions
0
votes
0
answers
30
views
Writing effective UFW & IpTable rules
I am quite new to UFW and IpTables and I am trying to understand what kind of rules we should look to implement to keep a web-application secure. The current scenario I am testing myself in is that I ...
- 197
0
votes
1
answer
94
views
UFW vs IpTables for web application security
I am trying to better understand measures that can be used to protect a web-application. I'm trying to determine which would be more effective, implementing a UFW or using IpTables.
From my ...
- 197
0
votes
0
answers
31
views
TCP SYN/ACK on INPUT vs FORWARD
Are there any legitimate circumstances under which TCP SYN+ACK packets would arrive at a Linux firewall's INPUT chain, if it did not leave via the OUTPUT chain?
That is, am I correct in assuming that ...
- 111
21
votes
6
answers
4k
views
Do machines without any listening services need a firewall to block incoming connections?
Let's assume we have an example machine connected to the internet. This machine is typically a client one, and it has no services like ssh running on. Does this kind of machines need any firewall to ...
- 563
0
votes
1
answer
104
views
Why is the -L (list) option of iptables not available to non-root users?
Many tools in Linux allow for checking things as a non-root user. For example, at any time, I can check whether a service is running:
$ systemctl status ntp
However, the iptables needs to be used as ...
- 872
1
vote
1
answer
240
views
How do I differentiate a DDoS attack from a DoS attack?
My server is under attack on an specific port but I am confused whether is a DDoS attack or a DoS attack (if it requires a botnet or is using some kind of trick). The entire server is available (...
- 11
1
vote
1
answer
110
views
Is interface spoofing possible?
One commonly used iptables rule for Linux servers is this:
# iptables -A INPUT -i lo -j ACCEPT
Can we assume that this rule will only accept traffic which is sent from the local machine?
Is it ...
- 13
1
vote
3
answers
229
views
How should I configure my firewall using iptables commands to defend against hacking? [closed]
I need to add extra security to my Android device using iptables and a firewall to defend against hackers. My specific goals are to prevent a hacker from remotely breaking into my device to begin with ...
- 19
2
votes
2
answers
784
views
Is it safe to set up your firewall to allow localhost to accept incoming connections?
I have set up a VPN client and I'm using iptables to block all connections not tunneled through the VPN. An example of the iptables rules I am using can be found here.
Unfortunately with this ...
- 495
1
vote
1
answer
138
views
Efficiently handling malicious, single connection attempts to a server?
I wanted to know what efficient way is there to handle malicious attempts to connect to my server by single IPs. The attempts show up logged in /var/log/auth.log as Connection closed by IPaddress port ...
- 145
1
vote
1
answer
613
views
Snort Inline Mode(IPS) Routing Packet Forwarding
I'd like to build an IPS which would be a seperate endpoint than the router and/or protected servers. To achieve this I've installed to my Ubuntu server Snort with DAQ(AFPACKET). The instructions I've ...
- 111
0
votes
0
answers
136
views
Routing a site-to-site VPN through my regular VPN service
currently engaged in live competitive red vs blue team exercises in an enterprise style Windows AD environment. My device runs a modern Debian Linux OS.
cscotun0
We typically connect to the lab/domain ...
- 1,649
1
vote
1
answer
540
views
Is it recommended to drop all traffic by default in iptables after accepting only what is required?
I was told using iptables -P OUTPUT DROP after rules such as iptables -A OUTPUT -p tcp --dport 80 -m state --state NEW -j ACCEPT to accept what is required didn’t do much from a security standpoint. ...
- 169
0
votes
0
answers
94
views
What is the most restrictive way to allow IPv6 ICMP requests on iptables?
This is what I have so far but it is pretty open.
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
-A INPUT -p ipv6-icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A OUTPUT -p ipv6-icmp -j ...
- 169
0
votes
1
answer
100
views
How do you securely give access to a Java App interactive console (Linux/GNU)?
I have a Java App running, which prints out messages into STDOUT and also has an active interactive console (also accepts STDIN), when the server has started up.
How do I securely give access to an ...
- 1,322
0
votes
1
answer
190
views
iptables: force clients to use proxy
My network: 192.168.0.1 server. (enp0s3 NAT, enp0s8 internal) 192.168.0.10-15 clients (enp0s3 internal).
I have a proxysquid for blocking websites,and so on.
My clients can navigate and browse any ...
1
vote
2
answers
5k
views
Block SYN,ACK response with iptables
I have a virtual environment and I am making a SYN flood attack to a Ubuntu Server's port 53 using Kali 2020.
I realized that a countermeasure for this attack is to limit or block the responses to ...
- 11
3
votes
0
answers
136
views
smb iptables configuration not working with vpn killswitch
my main goal is to setup iptables that work as a VPN killswitch for my openvpn connection. Thanks to a post from forest, this was pretty straight forward: OpenVPN kill switch on Linux . So. everything ...
- 31
-1
votes
1
answer
161
views
Does this iptables entry indicate someone's trying to break in?
Two days ago I built a Debian 10 server in the United States for use as a file server for my web application. When I created the server, I installed the fail2ban package and configured a basic, ...
- 119
1
vote
1
answer
455
views
Local Burp Proxy not showing routed packets
I created a hotspot on wlp2s0 and connected an android device, whose IP is 10.42.0.62.
I am trying to route my all packets from my wlp2s0 interface to burp proxy which running on 8080 and I also ...
- 217
2
votes
0
answers
867
views
TCP reset attack / forged TCP reset prevention
How do you prevent someone from doing an TCP reset attack between client and host without having acess to host?
I am trying to solve a CTF for fun and learning purposes.
In one of the challenges I ...
- 121
11
votes
1
answer
3k
views
Has a remote rogue DNS client managed to slip through the first iptables rule of a Linux DNS server?
Ubuntu 20.04
iptables 1.8.4-1
I experienced a situation where a remote system seemed to be able to slip through the first iptables rule of a Linux server located behind a NAT router:
-A INPUT -s <...
0
votes
1
answer
381
views
MITM setup using airmon-ng, iptables, and isc-dhcp server
I want to set up a MITM-scenario as an exercise for myself. My setup looks like this:
Internet <--------> Laptop <----------> Client
At this stage I just want to route the traffic from my AP ...
- 1
1
vote
1
answer
235
views
Why am I receiving hits with SPT=443 on IPv6?
I block most everything with my firewall, what I don't get is why would I constantly receive hits to connect on random ports from port 443.
[iptables] reject_ipv6: IN=eno1 OUT= MAC=...
SRC=2607:...
- 872
0
votes
1
answer
431
views
How to block all inbound traffic from a specific Internet address or subnet using TomatoUSB router software (LINUX based)
I'm not trained in Linux, but I think I found the solution to my problem documented, but it is not working as expected. I am NOT an iptables guru, I'm learning as I go.
A Russian IP is trying to ...
- 171
0
votes
1
answer
126
views
Even though my firewall is active, is it protecting me fully given that the 'rules' are not active?
Even though my firewall is active, is it protecting me fully given that the 'rules' are not active?
Output shows:
host based firewall active, empty rules
iptables modules loaded, but no rules ...
- 13
1
vote
2
answers
1k
views
How does TLS traffic impact firewalls?
If I have an open port on a firewall it means that I can receive traffic on that port. If it's unencrypted I assume that the raw data is just allowed through.
If TLS is being used, does firewall ...
- 13
2
votes
2
answers
259
views
How are my iptables rules circumvented?
I'm using ufw on a debian server and apparently an attacker is able to circumvent the filtering rules. ufw uses iptables.
The server host http and mail services, and has an ssh port. I use a non-...
- 141
4
votes
2
answers
6k
views
Why can't iptables drop arp requests
I was trying to hide my laptop from my phone's network scan app. The app is using arp requests to find devices on the network. I tried everything on iptables. It doesn't work, even if i set all the ...
- 353
3
votes
0
answers
248
views
Experimenting with SSLStrip+ on the same machine
I am trying to play around to understand how SSLStrip+ works by:
$ cat /proc/sys/net/ipv4/ip_forward
1
$ sudo iptables --flush
$ sudo iptables --flush -t nat
$ sudo iptables -t nat -A PREROUTING -p ...
- 143
1
vote
1
answer
1k
views
watch DNS queries while using OpenVPN.-
I want to monitor/sniff the DNS queries I make while I'm using a VPN connection with my OpenVPN client.
My initial motivation was to check if I'm leaking DNS queries; then using this page it seems I'm ...
- 13
1
vote
0
answers
74
views
Are parts of my system susceptible to IP based malicious attack even with effective IPtables rules?
Yesterday I installed Cent OS 6 and had to flush the default IPtables rules (IPtables -F) in order to access a web app via my browser.
Having very little experience with Linux/Network security this ...
- 111
2
votes
2
answers
2k
views
Dealing with the dangers of self-hosting a webserver?
Assuming for a self-hosted webserver:
the webserver only hosts a static html website
iptables is used to reject every IP except a few known ones
only Port 443 is forwarded and the website requires ...
- 51
1
vote
1
answer
872
views
Building a malicious captive portal
So I'm trying to build a malicious captive portal but I'm stuck on the part where you need to know stuff.
Anytime a HTTP request comes in, everything works fine. However, when an HTTPS connection ...
- 1,421
1
vote
1
answer
246
views
Is iptables and vpn tunneling enough? [closed]
What is the best approach to secure connection between two devices over the internet (public IP)?
if there is a firewall on my public IP address deny access all incoming connection, can the hacker ...
- 29
2
votes
1
answer
100
views
What are the methods by which an attacker can distinguish between DROP on IPtables and a Nullroute or non-allocated IP?
Let's say we have a server set up with set to:
iptables -P INPUT DROP
Without any other rules on the input chain.
Ignoring accessibility issues outside of physical server access, what are the ...
13
votes
1
answer
16k
views
Connection to ports 2000 and 5060 successful despite filtering
I run my own (Ubuntu based) router and have iptables configured to drop all incoming packets by default. To my surprise, running an nmap scan (from the WAN side) shows two open ports related to VOIP:
...
- 233
1
vote
0
answers
164
views
Intercept data after sslstrip
I am able to use sslstrip successfully as shown here https://moxie.org/software/sslstrip/
What I want to do though is be able to use sslstrip with another proxy/script to modify requests/responses ...
- 11
1
vote
0
answers
132
views
IPSec and traffic mirroring [closed]
I have a VoIP server on which several SIP clients are connected to through IPSec tunnels.
This is kind of an automated attendant so I both have RTP and SIP signalling flows.
I need to be able to ...
- 19
21
votes
2
answers
1k
views
Fully transparent proxy
By default, mitmproxy will use its own local IP address for its server-side connections. What I want instead is mitmproxy to use the client’s IP address for server-side connections.
The following ...
- 311
7
votes
4
answers
2k
views
SIP UDP request breaking through iptables
I have been investigating a few instances recently where SIP UDP traffic has been somehow evading the ruleset defined in iptables leading me to suspect that there is a hole in our rules so i'm looking ...
- 201
0
votes
1
answer
4k
views
Can't connect to fake AP with airbase-ng
I use kali-rolling on a virutal machine and I try to set up a fake access point using airbase-ng, but my devices won't connect to it whatsoever. My steps are:
I put my wirless adapter in monitor mode ...
- 1
5
votes
3
answers
2k
views
Does blocking an IP with IP Tables protect you from a DOS (not DDOS) attack?
I am fairly new to network security, and I just learned about the Fail2Ban framework you can use for automated exploit detection/prevention. It says that you can protect yourself from DOS attacks by ...
- 53
6
votes
1
answer
3k
views
ARP spoofing with Scapy. How does Scapy reroute traffic?
Background:
I understand that in order to ARP spoof a victim in a network using Scapy, we need to send ARP reply packets to the victim and the gateway router with the correct destination and Source ...
- 335
0
votes
1
answer
869
views
What is the iptables rule to block all https traffic except to a single ip?
I'm trying to configure a microservice for my web application, which is hosted at ip address X.X.X.X. The microservice should only accept https connections from this web app.
I've tested the ...
- 603
2
votes
1
answer
638
views
Security Onion VMWare + OpenWRT IPTables Mirroring
I'm trying to set up SO in my home network to lab and see if I can monitor all ingress/egress traffic from my SOHO router. I don't have a switch with SPAN ports, or a network tap so I'm using OpenWRT ...
- 21
0
votes
1
answer
1k
views
Can iptables be hacked / circumvented
We currently have a server that blocks all connections using iptables, and we have to whitelist an IP expressly in order to be able to access the server remotely.
Essentially, the first rule allows ...
- 75
2
votes
1
answer
400
views
Iptables DROPS SSH after port knock rules, but nmap shows it as OPEN
I setup port knocking rules on CentOS 7, iptables as follow:
-I INPUT -p tcp --dport 1 -m recent --set --rsource --name KNOCK1 -m limit --limit 5/min -j LOG --log-prefix "knock 1" --log-level 7
-I ...
- 81
1
vote
0
answers
319
views
Exploit vulnerabilty in embedded Linux network stack to disable iptables
I own a D-Link DCS-7110 HD POE network camera.
It features an apparently iptables based access list configuration where you can allow/disallow certain networks and addresses from accessing the camera....
- 143
0
votes
1
answer
245
views
Captive Portal Security Measures
I am currently working on a Captive Portal solution, which can be distributed in an device that has an ethernet and wlan port. In short, I use iptables to restrict access to all devices unless they ...
