Questions tagged [iptables]
An application that allows a user to configure the tables provided by the Linux firewall. iptables is succeeded by nftables as of 2014.
141
questions
23
votes
2answers
10k views
Reject IP packets with an ICMP error, or just drop them?
Consider an internet-facing host (the outer firewall). What should be done with undesired traffic: just drop it, or send back an ICMP error such as port unreachable? (In Linux terms: iptables -P DROP ...
16
votes
4answers
39k views
Tips for a secure iptables config to defend from attacks. (client side!)
Own examples:
###############
# KERNEL PARAMETER CONFIGURATION
# PREVENT YOU SYSTEM FROM ANSWERING ICMP ECHO REQUESTS
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all
# DROP ICMP ECHO-REQUEST ...
15
votes
2answers
780 views
Fully transparent proxy
By default mitmproxy will use its own local IP address for its server-side connections. What I want instead is mitmproxy to use the client’s IP address for server-side connections.
The following ...
12
votes
1answer
23k views
Is it safe to disable connection tracking in iptables?
While reading about NOTRACK target of raw table in iptables, I encountered an article suggesting that for certain traffic you could (or even should) disable connection tracking. The two examples were: ...
8
votes
2answers
23k views
Test firewall rules (Linux)
I have a question about how to test the firewall rules. To be more specific, for academic purpose I have to set up a machine which will accept all kind of packets o a specific interface.
I added an ...
8
votes
1answer
2k views
Nmap - Intense vs Quick result
I inherited a small network and currently am assessing its security performance.
I started port scanning a host (lets call it Weirdo) in that small network and from my perspective, it seems that that ...
8
votes
1answer
5k views
Connection to ports 2000 and 5060 successful despite filtering
I run my own (Ubuntu based) router and have iptables configured to drop all incoming packets by default. To my surprise, running an nmap scan (from the WAN side) shows two open ports related to VOIP:
...
7
votes
4answers
1k views
SIP UDP request breaking through iptables
I have been investigating a few instances recently where SIP UDP traffic has been somehow evading the ruleset defined in iptables leading me to suspect that there is a hole in our rules so i'm looking ...
6
votes
5answers
2k views
Firewall demo - iptables
I have to make a demonstration about firewalls in my class as a student(university).
It should be implemented using iptables on Linux. I am reading all the theories around them but I can't figure out ...
6
votes
2answers
5k views
How web application firewalls protect application from DDoS attacks?
How to protect a web application from DDoS by the implementation of Web Application firewalls?
How effective is this method?
6
votes
1answer
220 views
System-Level Network Security (Packet Classification and etc.) - SELinux and Libnftnl
I read that Libnftnl is a userspace library providing a low-level netlink programming interface to the in-kernel nf_tables subsystem and it uses NFTables.
Since it's a kernel related topic, at the ...
5
votes
4answers
2k views
what is a good public available iptables script for ddos mitigation?
what is a good public available iptables script for ddos mitigation?
5
votes
3answers
858 views
Does blocking an IP with IP Tables protect you from a DOS (not DDOS) attack?
I am fairly new to network security, and I just learned about the Fail2Ban framework you can use for automated exploit detection/prevention. It says that you can protect yourself from DOS attacks by ...
5
votes
1answer
553 views
SSL MITM on the WAN side of my router
Hi
I would like to try to sniff a typical CWMP conversation that my router does to his Auto Configuration Server (see TR-069 crash course: https://www.iol.unh.edu/sites/default/files/knowledgebase/...
5
votes
1answer
817 views
How to prevent ARP poisoning with hostapd and iptables?
I have a raspberry pi and hostapd and iptables are running on my pi. However iptables cannot block the wifi clients from communicating with each other, thus I cannot prevent them from sending out ARP ...
4
votes
5answers
3k views
How can I block bots that consistently hit the same URLs?
I am getting slammed hard by bots, and I am not sure how to stop them without blocking my legitimate traffic. I created some iptables rules that say, if X connections in X seconds, block, but that ...
4
votes
3answers
1k views
iptables rule to ban and redirect malicious traffic
I'm running Apache 2 and after analysing the access_log I discovered that my website is visited more than 800 times a day (today 924) from majestic.co.uk bot.
The bot use this range of IP addresses:
...
4
votes
2answers
8k views
Benefits of REJECT over DROP on a single PC
Recently I learned about the difference between DROP and REJECT in a firewall.
I understand that REJECT is better because it closes the connection immediately instead of waiting for timeout as DROP ...
4
votes
1answer
2k views
ARP spoofing with Scapy. How does Scapy reroute traffic?
Background:
I understand that in order to ARP spoof a victim in a network using Scapy, we need to send ARP reply packets to the victim and the gateway router with the correct destination and Source ...
4
votes
2answers
1k views
Executing arbitrary commands through iptables-restore input
During a pentest I found a way to add arbitrary iptables firewall rules to a server. These rules get applied by way of the iptables-restore command, and I've been wondering whether there is any way to ...
4
votes
2answers
3k views
What are the security implications of net.ipv4.conf.eth0.route_localnet=1 / route_localnet?
sudo sysctl -w net.ipv4.conf.eth0.route_localnet=1
What are the security implications of route_localnet?
4
votes
1answer
489 views
SSL Strip on Fedora24
I want to perform a MITM attack on my own network, and followed several tutorials on how to use sslstrip, iptables and arpspoof.
But every time I perform the attack, I lose the connection on the ...
4
votes
4answers
1k views
Find out what Linux software is trying to phone home
I have seen some suspicious outbound communications blocked on my VPS, which hosts a small experimental Web site, and want to find out which application is making the attempt. The server is running ...
3
votes
3answers
944 views
Make OSSEC ban ip on remote firewall
I am deploying OSSEC architecture agent-server mode.
I want the server to ban ip not only on agent but also on a remote firewall (dedicated iptables server).
I've seached on the OSSEC's ...
3
votes
2answers
3k views
Is my ISP doing a port scan on my computer?
I have been logging incoming connections with iptables for a while and I have been observing the following popping up periodically:
11:45:10 my.com kernel: IPTABLES: SRC=220.255.XX.XXY DST=192.168.1....
3
votes
1answer
516 views
What are the requirements to sniff UDP packets in a Wireless Ad-Hoc network?
In a wireless Ad-Hoc network, I have two computers which communicates in UDP together from 192.168.1.3 to 192.168.1.5
I have a third computer (192.168.1.6) which wants to listen to the packets which ...
3
votes
2answers
1k views
Firewall egress filtering / quick whitelisting
Suppose your Aunt or Uncle is easily fooled by phishing attempts and their computer has multiple root kits and key loggers running. Assume their computing habits will never change.
Looking at his ...
3
votes
1answer
189 views
Blocking all incoming traffic, will it still accept a response from a request I initiated?
I am a 'newbie' when it comes to firewalls, but I am trying to launch some machines that will connect to Facebook's Graphs API. I only want these machines to contact Facebook and nothing else. By this ...
3
votes
2answers
6k views
How to configure iptables for must open ports?
On my machine there are web services which can be accessed from any PC connected to the same network segment (WiFi for example). I want to use IPtables on the machine to prevent any web services from ...
3
votes
2answers
338 views
Can ipopts be used to circumvent a pf or iptables firewall source IP based blocking?
Can one use ipopts, and in particular IP source routing, to circumvent source-based blocking in pf or iptables?
For example, with OpenBSD's pf:
block in all # default deny
block out all
pass in on ...
3
votes
2answers
946 views
Should I block outbound TCP RST (on closed ports)?
I have a range of inbound TCP ports open on the firewall, but usually closed on the host machine. I see a handful of unknown connection attempts each day, for which the server returns TCP RST. I ...
3
votes
1answer
174 views
Is it possible to find out what a remote user is trying to do connecting to a closed port?
From my iptables log, I can observe a particular remote IP address trying to connect to my server from port 80 to a private port number:
Jul 09 01:24:41 example.com kernel: IPTABLES: IN=eth1 MAC=xx:...
3
votes
1answer
2k views
ufw, system-config-firewall-tui, or firewalld vs iptables
Is there any advantage (other than usability) to using ufw, system-config-firewall-tui, or firewalld rather than just using iptables?
My understanding is that these other programs just simplify ...
3
votes
2answers
814 views
Dedicated OS vs Debian for SOHO Firewall? [closed]
I want to set up a firewall for a small office. I have a server on which I can install an OS of my choice. I was thinking of trying pfSense but ran into some testing problems and tried IPFIre (Linux ...
3
votes
1answer
3k views
IPtables Linux Firewall and IPsec traffic
Can iptables filter out incoming datagrams that are IPSec-tunneled packets going to port 25?
3
votes
1answer
118 views
Which IPTables chains should I log from a security perspective
So far I've always been logging the INPUT and OUTPUT chains because I only used iptables as host firewall.
Now I'm configuring network firewall which uses iptables, but I don't know whether I should ...
3
votes
1answer
3k views
Networking in Qubes OS [closed]
I've started recently to use Qubes OS and I want to set up a virtual IDS and IPS in separate VMs, but I can't figure out how the communications between different VMs works here.
Each VM should be ...
3
votes
1answer
764 views
How to prevent ICMP redirection produced by a man-in-the-middle
How can I prevent my route to be redirected with redirecting ICMP packets from a man-in-the-middle?
I am specifically looking to avoid someone using ettercap with the -M icmp option. From man ...
3
votes
0answers
147 views
Experimenting with SSLStrip+ on the same machine
I am trying to play around to understand how SSLStrip+ works by:
$ cat /proc/sys/net/ipv4/ip_forward
1
$ sudo iptables --flush
$ sudo iptables --flush -t nat
$ sudo iptables -t nat -A PREROUTING -p ...
2
votes
2answers
6k views
IPTables default security rules for a gateway/router?
On a router such as dd-wrt or tomato, what would be some default iptables rules?
I am asking for rules on a router/gateway - For example; blocking SYN flood attacks, or XMAS attacks. The basic ...
2
votes
2answers
351 views
Are there “LAN IPs” on the internet?
I have a home-made web application and thought that an easy way to secure it's administration interface would be to simply reject all IPs that arent from 192.168... Is this viable? is it possible for ...
2
votes
3answers
2k views
iptables: plaintext password protection
I'd like to find a way to block or restrict my access to the web-pages where my password is sent as a plaintext on the internet.
Let's assume if I have the same password for all web-pages, is it ...
2
votes
2answers
96 views
How are my iptables rules circumvented?
I'm using ufw on a debian server and apparently an attacker is able to circumvent the filtering rules. ufw uses iptables.
The server host http and mail services, and has an ssh port. I use a non-...
2
votes
2answers
3k views
MAC filtering the internet traffic?
I was trying to build a firewall where in the access to my LAN from internet should be allowed only if it matches the predefined MAC address of the device i.e,. MAC filtering, but later i found out ...
2
votes
2answers
1k views
Limit Packets Per Second
Since last week I have been seeing something fishy and it seems to be worsening. I tried many firewalls and they seem to be useless. I blocked all unwanted ports and only few ports are open so I found ...
2
votes
1answer
521 views
Port Knocking using only Iptables/netfilter
I am using the following iptables rules for port knocking. Everything works well, but it open the port for just a second and then close it. So how to improve this script to accept connection for a 30 ...
2
votes
4answers
5k views
Logging server compromised (IptabLes and IptabLex)
I am trying to figure out how it was compromised. They installed IptabLes and IptabLex in /boot.
They also added /etc/init.d/IptabLes and /etc/init.d/IptabLex which simply call the respective /boot ...
2
votes
2answers
616 views
Isolating guest networks
I'm setting up a secondary guest wifi on my router and I want to make sure that it's impossible for clients connected to the guest wifi to access my primary network.
Initially, I used IP filtering ...
2
votes
1answer
261 views
Consequences of using -s and -d arguments in iptables
We are studying iptables for a Computer Systems Security course. We are confused as to what happens when the -s and -d arguments are both used in the same rule, such as:
iptables -A OUTPUT -s 10.7.53....
2
votes
1answer
44 views
What are the methods by which an attacker can distinguish between DROP on IPtables and a Nullroute or non-allocated IP?
Let's say we have a server set up with set to:
iptables -P INPUT DROP
Without any other rules on the input chain.
Ignoring accessibility issues outside of physical server access, what are the ...
