Questions tagged [iptables]

An application that allows a user to configure the tables provided by the Linux firewall. iptables is succeeded by nftables as of 2014.

Filter by
Sorted by
Tagged with
1
vote
1answer
87 views

Local Burp Proxy not showing routed packets

I created a hotspot on wlp2s0 and connected an android device, whose IP is 10.42.0.62. I am trying to route my all packets from my wlp2s0 interface to burp proxy which running on 8080 and I also ...
0
votes
0answers
4 views

How to change rule on ipfilter [migrated]

How can I change rule on iptables on my router from Chain ipfilter (1 references) target prot opt source destination DROP all -- anywhere anywhere ...
0
votes
1answer
73 views

How to block all inbound traffic from a specific Internet address or subnet using TomatoUSB router software (LINUX based)

I'm not trained in Linux, but I think I found the solution to my problem documented, but it is not working as expected. I am NOT an iptables guru, I'm learning as I go. A Russian IP is trying to ...
-1
votes
1answer
87 views

Does this iptables entry indicate someone's trying to break in?

Two days ago I built a Debian 10 server in the United States for use as a file server for my web application. When I created the server, I installed the fail2ban package and configured a basic, ...
20
votes
2answers
1k views

Fully transparent proxy

By default, mitmproxy will use its own local IP address for its server-side connections. What I want instead is mitmproxy to use the client’s IP address for server-side connections. The following ...
1
vote
4answers
961 views

How to set iptables to drop packets that I'm not listening on?

I've got a Kali Linux box I use for pen testing. I would like to configure my machine to DROP incoming packets, but only when I'm not listening on them. e.g. if I run a netcat listener on port 80, I ...
2
votes
0answers
350 views

TCP reset attack / forged TCP reset prevention

How do you prevent someone from doing an TCP reset attack between client and host without having acess to host? I am trying to solve a CTF for fun and learning purposes. In one of the challenges I ...
0
votes
1answer
116 views

MITM setup using airmon-ng, iptables, and isc-dhcp server

I want to set up a MITM-scenario as an exercise for myself. My setup looks like this: Internet <--------> Laptop <----------> Client At this stage I just want to route the traffic from my AP ...
11
votes
1answer
3k views

Has a remote rogue DNS client managed to slip through the first iptables rule of a Linux DNS server?

Ubuntu 20.04 iptables 1.8.4-1 I experienced a situation where a remote system seemed to be able to slip through the first iptables rule of a Linux server located behind a NAT router: -A INPUT -s <...
1
vote
1answer
70 views

Why am I receiving hits with SPT=443 on IPv6?

I block most everything with my firewall, what I don't get is why would I constantly receive hits to connect on random ports from port 443. [iptables] reject_ipv6: IN=eno1 OUT= MAC=... SRC=2607:...
0
votes
1answer
59 views

Even though my firewall is active, is it protecting me fully given that the 'rules' are not active?

Even though my firewall is active, is it protecting me fully given that the 'rules' are not active? Output shows: host based firewall active, empty rules iptables modules loaded, but no rules ...
0
votes
0answers
34 views

Iptables ruleset changes when running a native vpn application

Is it ok for a native linux vpn application (from a famous brand among the vpn providers) changing your iptables ruleset each time the vpn activated? Consider that one of the rules which always ...
0
votes
1answer
3k views

Can't connect to fake AP with airbase-ng

I use kali-rolling on a virutal machine and I try to set up a fake access point using airbase-ng, but my devices won't connect to it whatsoever. My steps are: I put my wirless adapter in monitor mode ...
1
vote
2answers
389 views

How does TLS traffic impact firewalls?

If I have an open port on a firewall it means that I can receive traffic on that port. If it's unencrypted I assume that the raw data is just allowed through. If TLS is being used, does firewall ...
2
votes
2answers
127 views

How are my iptables rules circumvented?

I'm using ufw on a debian server and apparently an attacker is able to circumvent the filtering rules. ufw uses iptables. The server host http and mail services, and has an ssh port. I use a non-...
2
votes
2answers
2k views

Why can't iptables drop arp requests

I was trying to hide my laptop from my phone's network scan app. The app is using arp requests to find devices on the network. I tried everything on iptables. It doesn't work, even if i set all the ...
5
votes
1answer
648 views

SSL MITM on the WAN side of my router

Hi I would like to try to sniff a typical CWMP conversation that my router does to his Auto Configuration Server (see TR-069 crash course: https://www.iol.unh.edu/sites/default/files/knowledgebase/...
3
votes
0answers
167 views

Experimenting with SSLStrip+ on the same machine

I am trying to play around to understand how SSLStrip+ works by: $ cat /proc/sys/net/ipv4/ip_forward 1 $ sudo iptables --flush $ sudo iptables --flush -t nat $ sudo iptables -t nat -A PREROUTING -p ...
12
votes
1answer
24k views

Is it safe to disable connection tracking in iptables?

While reading about NOTRACK target of raw table in iptables, I encountered an article suggesting that for certain traffic you could (or even should) disable connection tracking. The two examples were: ...
0
votes
1answer
505 views

watch DNS queries while using OpenVPN.-

I want to monitor/sniff the DNS queries I make while I'm using a VPN connection with my OpenVPN client. My initial motivation was to check if I'm leaking DNS queries; then using this page it seems I'm ...
9
votes
1answer
8k views

Connection to ports 2000 and 5060 successful despite filtering

I run my own (Ubuntu based) router and have iptables configured to drop all incoming packets by default. To my surprise, running an nmap scan (from the WAN side) shows two open ports related to VOIP: ...
7
votes
4answers
2k views

SIP UDP request breaking through iptables

I have been investigating a few instances recently where SIP UDP traffic has been somehow evading the ruleset defined in iptables leading me to suspect that there is a hole in our rules so i'm looking ...
6
votes
1answer
223 views

System-Level Network Security (Packet Classification and etc.) - SELinux and Libnftnl

I read that Libnftnl is a userspace library providing a low-level netlink programming interface to the in-kernel nf_tables subsystem and it uses NFTables. Since it's a kernel related topic, at the ...
1
vote
0answers
43 views

Are parts of my system susceptible to IP based malicious attack even with effective IPtables rules?

Yesterday I installed Cent OS 6 and had to flush the default IPtables rules (IPtables -F) in order to access a web app via my browser. Having very little experience with Linux/Network security this ...
1
vote
2answers
631 views

Dealing with the dangers of self-hosting a webserver?

Assuming for a self-hosted webserver: the webserver only hosts a static html website iptables is used to reject every IP except a few known ones only Port 443 is forwarded and the website requires ...
1
vote
1answer
505 views

Building a malicious captive portal

So I'm trying to build a malicious captive portal but I'm stuck on the part where you need to know stuff. Anytime a HTTP request comes in, everything works fine. However, when an HTTPS connection ...
1
vote
1answer
154 views

Is iptables and vpn tunneling enough? [closed]

What is the best approach to secure connection between two devices over the internet (public IP)? if there is a firewall on my public IP address deny access all incoming connection, can the hacker ...
2
votes
1answer
49 views

What are the methods by which an attacker can distinguish between DROP on IPtables and a Nullroute or non-allocated IP?

Let's say we have a server set up with set to: iptables -P INPUT DROP Without any other rules on the input chain. Ignoring accessibility issues outside of physical server access, what are the ...
2
votes
1answer
2k views

How to block traffic coming from an “public” WiFi hotspot and going to the LAN (iptables)

I followed this tutorial (http://elinux.org/RPI-Wireless-Hotspot) for an Wifi Hotspot in the guesthouse. This is working fine, but every device on the WiFi network can reach any LAN device in the LAN ...
5
votes
1answer
2k views

ARP spoofing with Scapy. How does Scapy reroute traffic?

Background: I understand that in order to ARP spoof a victim in a network using Scapy, we need to send ARP reply packets to the victim and the gateway router with the correct destination and Source ...
1
vote
0answers
125 views

Intercept data after sslstrip

I am able to use sslstrip successfully as shown here https://moxie.org/software/sslstrip/ What I want to do though is be able to use sslstrip with another proxy/script to modify requests/responses ...
1
vote
0answers
223 views

Exploit vulnerabilty in embedded Linux network stack to disable iptables

I own a D-Link DCS-7110 HD POE network camera. It features an apparently iptables based access list configuration where you can allow/disallow certain networks and addresses from accessing the camera....
1
vote
0answers
75 views

IPSec and traffic mirroring [closed]

I have a VoIP server on which several SIP clients are connected to through IPSec tunnels. This is kind of an automated attendant so I both have RTP and SIP signalling flows. I need to be able to ...
-1
votes
1answer
329 views

What is the most secure communication between firewall, and DMZ

I have 2 virtual machines. (Vmware esxi 6) They are both opensuse 42.3 (tumbleweed) Firewall (iptables,ipset,dhcpd,dns only) mail/web server. (apache,dovecot,postfix) The web server can not ...
1
vote
0answers
1k views

Creating a rogue AP with Kali Linux

so i have for the last 2 days going through this task of setting up a Rogue AP on my Kali linux running in my VM.... i am using the 64bit version and the wifi adapter is TP link TL WN722N, so my ...
5
votes
3answers
994 views

Does blocking an IP with IP Tables protect you from a DOS (not DDOS) attack?

I am fairly new to network security, and I just learned about the Fail2Ban framework you can use for automated exploit detection/prevention. It says that you can protect yourself from DOS attacks by ...
2
votes
1answer
441 views

Security Onion VMWare + OpenWRT IPTables Mirroring

I'm trying to set up SO in my home network to lab and see if I can monitor all ingress/egress traffic from my SOHO router. I don't have a switch with SPAN ports, or a network tap so I'm using OpenWRT ...
0
votes
1answer
332 views

What is the iptables rule to block all https traffic except to a single ip?

I'm trying to configure a microservice for my web application, which is hosted at ip address X.X.X.X. The microservice should only accept https connections from this web app. I've tested the ...
5
votes
2answers
4k views

What are the security implications of net.ipv4.conf.eth0.route_localnet=1 / route_localnet?

sudo sysctl -w net.ipv4.conf.eth0.route_localnet=1 What are the security implications of route_localnet?
1
vote
1answer
366 views

PREROUTING interfaces SSL MITM

I'm trying to make SSL MITM attack but do not really understand how to configure my interfaces to preroute traffic. I have a laptop, connected to a PC via Ethernet, the PC is connected to the rest of ...
0
votes
1answer
738 views

Can iptables be hacked / circumvented

We currently have a server that blocks all connections using iptables, and we have to whitelist an IP expressly in order to be able to access the server remotely. Essentially, the first rule allows ...
5
votes
1answer
1k views

How to prevent ARP poisoning with hostapd and iptables?

I have a raspberry pi and hostapd and iptables are running on my pi. However iptables cannot block the wifi clients from communicating with each other, thus I cannot prevent them from sending out ARP ...
2
votes
1answer
279 views

Iptables DROPS SSH after port knock rules, but nmap shows it as OPEN

I setup port knocking rules on CentOS 7, iptables as follow: -I INPUT -p tcp --dport 1 -m recent --set --rsource --name KNOCK1 -m limit --limit 5/min -j LOG --log-prefix "knock 1" --log-level 7 -I ...
0
votes
1answer
174 views

Captive Portal Security Measures

I am currently working on a Captive Portal solution, which can be distributed in an device that has an ethernet and wlan port. In short, I use iptables to restrict access to all devices unless they ...
0
votes
1answer
312 views

What ports should I filter on a default Magento installation

I have recently installed a Magento on Ubuntu 14.04 on Digital Ocean and I'm wondering what ports should I filter to keep it safe. Well, actually the question should be: what ports I keep open to the ...
4
votes
1answer
523 views

SSL Strip on Fedora24

I want to perform a MITM attack on my own network, and followed several tutorials on how to use sslstrip, iptables and arpspoof. But every time I perform the attack, I lose the connection on the ...
6
votes
5answers
2k views

Firewall demo - iptables

I have to make a demonstration about firewalls in my class as a student(university). It should be implemented using iptables on Linux. I am reading all the theories around them but I can't figure out ...
1
vote
0answers
84 views

How should I manage wireless connections if using iptables?

I am implementing some modest iptables on xubuntu 17.04 and came across this blurb from IptablesHowTo Ubuntu WARNING: Iptables and NetworkManager can conflict. Also if you are concerned enough ...
1
vote
1answer
1k views

MitM-Position with bridged network and iptables

I'm currently trying to get my setup to work. [ victim ] --- [ mitm ] --- [ net ] IPs: net: 10.0.0.0/24 victim: 10.0.0.1 mitm: 10.0.0.2 gateway: 10.0.0.254 setup: ip l a name br0 type bridge ip l ...
0
votes
1answer
332 views

How to block an application with iptable which use random port

Scenario: My goal was to allow TeamViewer to connect to my home workstation from my laptop only. So I have tried to bind my laptop's MAC with an IPtables rule as following, [arif@arif:~]$ sudo ...