Skip to main content

Questions tagged [iptables]

An application that allows a user to configure the tables provided by the Linux firewall. iptables is succeeded by nftables as of 2014.

Filter by
Sorted by
Tagged with
1 vote
1 answer
555 views

Do I have to block IPv4-mapped IP addresses in my IPv6 firewall?

I am writing the iplock tool to help me setup my Linux firewall. For the most part, my current strategy, since I don't yet use IPv6 much, is to pretty block everything IPv6 ("simple"). I ...
1 vote
1 answer
707 views

MITM setup using airmon-ng, iptables, and isc-dhcp server

I want to set up a MITM-scenario as an exercise for myself. My setup looks like this: Internet <--------> Laptop <----------> Client At this stage I just want to route the traffic from my AP ...
2 votes
1 answer
2k views

Snort Inline Mode(IPS) Routing Packet Forwarding

I'd like to build an IPS which would be a seperate endpoint than the router and/or protected servers. To achieve this I've installed to my Ubuntu server Snort with DAQ(AFPACKET). The instructions I've ...
2 votes
2 answers
817 views

Local Burp Proxy not showing routed packets

I created a hotspot on wlp2s0 and connected an android device, whose IP is 10.42.0.62. I am trying to route my all packets from my wlp2s0 interface to burp proxy which is running on 8080. I also ...
0 votes
0 answers
108 views

Fail2ban not resulting in any update of IPTables

I have: Installed Fail2ban Created a local jail file. Changed lines within /etc/fail2ban/jail.local where enabled is mentioned x2 to true. Added enabled = true to the Asterisk section of the jail....
1 vote
2 answers
3k views

Bridge Firewall vs Routing Firewall

What is the difference between bridge and routing firewall ? How they both works and what are the security advantages/disadvantages for both scenario ?
0 votes
1 answer
134 views

iptables Policy Set to DROP or Create Rules to DROP?

I found this site: In it, the author created default rules: # Setting default filter policy iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP But in this video @15:24, it's ...
4 votes
2 answers
3k views

Should I block outbound TCP RST (on closed ports)?

I have a range of inbound TCP ports open on the firewall, but usually closed on the host machine. I see a handful of unknown connection attempts each day, for which the server returns TCP RST. I ...
1 vote
1 answer
240 views

Why doesn't iptables command take effect on my embeded Linux?

I'm running an embedded Linux system, whose kernel is 3.18.21, with some applications on top it on MIPS. When I run iptables & ip6tables on the Linux, such as the following: iptables -A INPUT -p ...
0 votes
1 answer
308 views

How to prevent a port being detected by Nessus scan

I'm running an Embedded Linux (kernal 3.8.21) with some applications on it on MIPS. I use iptables & ip6tables to block some ports, like the following: iptables -A INPUT -p tcp --dport 139 -j ...
1 vote
0 answers
154 views

Unauthorized firewall rules on SSH bastion servers

Yesterday I found that a few firewall rules (iptables on Ubuntu 20.04 OS) have been added to an SSH bastion server that allow SSH access on a custom SSH port number. All IPs are from Vietnam. AFAIK ...
3 votes
3 answers
7k views

IPTables default security rules for a gateway/router?

On a router such as dd-wrt or tomato, what would be some default iptables rules? I am asking for rules on a router/gateway - For example; blocking SYN flood attacks, or XMAS attacks. The basic ...
1 vote
5 answers
2k views

How to set iptables to drop packets that I'm not listening on?

I've got a Kali Linux box I use for pen testing. I would like to configure my machine to DROP incoming packets, but only when I'm not listening on them. e.g. if I run a netcat listener on port 80, I ...
1 vote
2 answers
2k views

Is it recommended to drop all traffic by default in iptables after accepting only what is required?

I was told using iptables -P OUTPUT DROP after rules such as iptables -A OUTPUT -p tcp --dport 80 -m state --state NEW -j ACCEPT to accept what is required didn’t do much from a security standpoint. ...
0 votes
1 answer
2k views

UFW vs IpTables for web application security

I am trying to better understand measures that can be used to protect a web-application. I'm trying to determine which would be more effective, implementing a UFW or using IpTables. From my ...
1 vote
1 answer
314 views

How do I differentiate a DDoS attack from a DoS attack?

My server is under attack on an specific port but I am confused whether is a DDoS attack or a DoS attack (if it requires a botnet or is using some kind of trick). The entire server is available (...
2 votes
2 answers
2k views

Is it safe to set up your firewall to allow localhost to accept incoming connections?

I have set up a VPN client and I'm using iptables to block all connections not tunneled through the VPN. An example of the iptables rules I am using can be found here. Unfortunately with this ...
22 votes
6 answers
5k views

Do machines without any listening services need a firewall to block incoming connections?

Let's assume we have an example machine connected to the internet. This machine is typically a client one, and it has no services like ssh running on. Does this kind of machines need any firewall to ...
0 votes
1 answer
576 views

How to block all inbound traffic from a specific Internet address or subnet using TomatoUSB router software (LINUX based)

I'm not trained in Linux, but I think I found the solution to my problem documented, but it is not working as expected. I am NOT an iptables guru, I'm learning as I go. A Russian IP is trying to ...
0 votes
1 answer
186 views

Why is the -L (list) option of iptables not available to non-root users?

Many tools in Linux allow for checking things as a non-root user. For example, at any time, I can check whether a service is running: $ systemctl status ntp However, the iptables needs to be used as ...
1 vote
1 answer
188 views

Is interface spoofing possible?

One commonly used iptables rule for Linux servers is this: # iptables -A INPUT -i lo -j ACCEPT Can we assume that this rule will only accept traffic which is sent from the local machine? Is it ...
1 vote
3 answers
487 views

How should I configure my firewall using iptables commands to defend against hacking? [closed]

I need to add extra security to my Android device using iptables and a firewall to defend against hackers. My specific goals are to prevent a hacker from remotely breaking into my device to begin with ...
1 vote
1 answer
247 views

Efficiently handling malicious, single connection attempts to a server?

I wanted to know what efficient way is there to handle malicious attempts to connect to my server by single IPs. The attempts show up logged in /var/log/auth.log as Connection closed by IPaddress port ...
0 votes
0 answers
199 views

Routing a site-to-site VPN through my regular VPN service

currently engaged in live competitive red vs blue team exercises in an enterprise style Windows AD environment. My device runs a modern Debian Linux OS. cscotun0 We typically connect to the lab/domain ...
6 votes
1 answer
4k views

ARP spoofing with Scapy. How does Scapy reroute traffic?

Background: I understand that in order to ARP spoof a victim in a network using Scapy, we need to send ARP reply packets to the victim and the gateway router with the correct destination and Source ...
0 votes
0 answers
194 views

What is the most restrictive way to allow IPv6 ICMP requests on iptables?

This is what I have so far but it is pretty open. *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT DROP [0:0] -A INPUT -p ipv6-icmp -j ACCEPT -A INPUT -i lo -j ACCEPT -A OUTPUT -p ipv6-icmp -j ...
0 votes
1 answer
138 views

How do you securely give access to a Java App interactive console (Linux/GNU)?

I have a Java App running, which prints out messages into STDOUT and also has an active interactive console (also accepts STDIN), when the server has started up. How do I securely give access to an ...
7 votes
3 answers
9k views

What are the security implications of net.ipv4.conf.eth0.route_localnet=1 / route_localnet?

sudo sysctl -w net.ipv4.conf.eth0.route_localnet=1 What are the security implications of route_localnet?
0 votes
1 answer
602 views

iptables: force clients to use proxy

My network: 192.168.0.1 server. (enp0s3 NAT, enp0s8 internal) 192.168.0.10-15 clients (enp0s3 internal). I have a proxysquid for blocking websites,and so on. My clients can navigate and browse any ...
1 vote
2 answers
9k views

Block SYN,ACK response with iptables

I have a virtual environment and I am making a SYN flood attack to a Ubuntu Server's port 53 using Kali 2020. I realized that a countermeasure for this attack is to limit or block the responses to ...
3 votes
0 answers
182 views

smb iptables configuration not working with vpn killswitch

my main goal is to setup iptables that work as a VPN killswitch for my openvpn connection. Thanks to a post from forest, this was pretty straight forward: OpenVPN kill switch on Linux . So. everything ...
-1 votes
1 answer
206 views

Does this iptables entry indicate someone's trying to break in?

Two days ago I built a Debian 10 server in the United States for use as a file server for my web application. When I created the server, I installed the fail2ban package and configured a basic, ...
22 votes
2 answers
2k views

Fully transparent proxy

By default, mitmproxy will use its own local IP address for its server-side connections. What I want instead is mitmproxy to use the client’s IP address for server-side connections. The following ...
2 votes
0 answers
1k views

TCP reset attack / forged TCP reset prevention

How do you prevent someone from doing an TCP reset attack between client and host without having acess to host? I am trying to solve a CTF for fun and learning purposes. In one of the challenges I ...
11 votes
1 answer
3k views

Has a remote rogue DNS client managed to slip through the first iptables rule of a Linux DNS server?

Ubuntu 20.04 iptables 1.8.4-1 I experienced a situation where a remote system seemed to be able to slip through the first iptables rule of a Linux server located behind a NAT router: -A INPUT -s <...
1 vote
1 answer
416 views

Why am I receiving hits with SPT=443 on IPv6?

I block most everything with my firewall, what I don't get is why would I constantly receive hits to connect on random ports from port 443. [iptables] reject_ipv6: IN=eno1 OUT= MAC=... SRC=2607:...
0 votes
1 answer
160 views

Even though my firewall is active, is it protecting me fully given that the 'rules' are not active?

Even though my firewall is active, is it protecting me fully given that the 'rules' are not active? Output shows: host based firewall active, empty rules iptables modules loaded, but no rules ...
0 votes
1 answer
6k views

Can't connect to fake AP with airbase-ng

I use kali-rolling on a virutal machine and I try to set up a fake access point using airbase-ng, but my devices won't connect to it whatsoever. My steps are: I put my wirless adapter in monitor mode ...
1 vote
2 answers
2k views

How does TLS traffic impact firewalls?

If I have an open port on a firewall it means that I can receive traffic on that port. If it's unencrypted I assume that the raw data is just allowed through. If TLS is being used, does firewall ...
2 votes
2 answers
354 views

How are my iptables rules circumvented?

I'm using ufw on a debian server and apparently an attacker is able to circumvent the filtering rules. ufw uses iptables. The server host http and mail services, and has an ssh port. I use a non-...
5 votes
2 answers
10k views

Why can't iptables drop arp requests

I was trying to hide my laptop from my phone's network scan app. The app is using arp requests to find devices on the network. I tried everything on iptables. It doesn't work, even if i set all the ...
6 votes
1 answer
1k views

SSL MITM on the WAN side of my router

Hi I would like to try to sniff a typical CWMP conversation that my router does to his Auto Configuration Server (see TR-069 crash course: https://www.iol.unh.edu/sites/default/files/knowledgebase/...
3 votes
0 answers
303 views

Experimenting with SSLStrip+ on the same machine

I am trying to play around to understand how SSLStrip+ works by: $ cat /proc/sys/net/ipv4/ip_forward 1 $ sudo iptables --flush $ sudo iptables --flush -t nat $ sudo iptables -t nat -A PREROUTING -p ...
13 votes
1 answer
31k views

Is it safe to disable connection tracking in iptables?

While reading about NOTRACK target of raw table in iptables, I encountered an article suggesting that for certain traffic you could (or even should) disable connection tracking. The two examples were: ...
1 vote
1 answer
2k views

watch DNS queries while using OpenVPN.-

I want to monitor/sniff the DNS queries I make while I'm using a VPN connection with my OpenVPN client. My initial motivation was to check if I'm leaking DNS queries; then using this page it seems I'm ...
13 votes
1 answer
23k views

Connection to ports 2000 and 5060 successful despite filtering

I run my own (Ubuntu based) router and have iptables configured to drop all incoming packets by default. To my surprise, running an nmap scan (from the WAN side) shows two open ports related to VOIP: ...
7 votes
4 answers
3k views

SIP UDP request breaking through iptables

I have been investigating a few instances recently where SIP UDP traffic has been somehow evading the ruleset defined in iptables leading me to suspect that there is a hole in our rules so i'm looking ...
5 votes
1 answer
303 views

System-Level Network Security (Packet Classification and etc.) - SELinux and Libnftnl

I read that Libnftnl is a userspace library providing a low-level netlink programming interface to the in-kernel nf_tables subsystem and it uses NFTables. Since it's a kernel related topic, at the ...
1 vote
0 answers
105 views

Are parts of my system susceptible to IP based malicious attack even with effective IPtables rules?

Yesterday I installed Cent OS 6 and had to flush the default IPtables rules (IPtables -F) in order to access a web app via my browser. Having very little experience with Linux/Network security this ...
3 votes
2 answers
3k views

Dealing with the dangers of self-hosting a webserver?

Assuming for a self-hosted webserver: the webserver only hosts a static html website iptables is used to reject every IP except a few known ones only Port 443 is forwarded and the website requires ...