Questions tagged [iptables]
An application that allows a user to configure the tables provided by the Linux firewall. iptables is succeeded by nftables as of 2014.
160
questions
23
votes
2answers
11k views
Reject IP packets with an ICMP error, or just drop them?
Consider an internet-facing host (the outer firewall). What should be done with undesired traffic: just drop it, or send back an ICMP error such as port unreachable? (In Linux terms: iptables -P DROP ...
20
votes
2answers
1k views
Fully transparent proxy
By default, mitmproxy will use its own local IP address for its server-side connections. What I want instead is mitmproxy to use the client’s IP address for server-side connections.
The following ...
16
votes
4answers
41k views
Tips for a secure iptables config to defend from attacks. (client side!)
Own examples:
###############
# KERNEL PARAMETER CONFIGURATION
# PREVENT YOU SYSTEM FROM ANSWERING ICMP ECHO REQUESTS
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all
# DROP ICMP ECHO-REQUEST ...
12
votes
1answer
26k views
Is it safe to disable connection tracking in iptables?
While reading about NOTRACK target of raw table in iptables, I encountered an article suggesting that for certain traffic you could (or even should) disable connection tracking. The two examples were: ...
11
votes
1answer
3k views
Has a remote rogue DNS client managed to slip through the first iptables rule of a Linux DNS server?
Ubuntu 20.04
iptables 1.8.4-1
I experienced a situation where a remote system seemed to be able to slip through the first iptables rule of a Linux server located behind a NAT router:
-A INPUT -s <...
11
votes
1answer
11k views
Connection to ports 2000 and 5060 successful despite filtering
I run my own (Ubuntu based) router and have iptables configured to drop all incoming packets by default. To my surprise, running an nmap scan (from the WAN side) shows two open ports related to VOIP:
...
8
votes
2answers
25k views
Test firewall rules (Linux)
I have a question about how to test the firewall rules. To be more specific, for academic purpose I have to set up a machine which will accept all kind of packets o a specific interface.
I added an ...
8
votes
1answer
3k views
Nmap - Intense vs Quick result
I inherited a small network and currently am assessing its security performance.
I started port scanning a host (lets call it Weirdo) in that small network and from my perspective, it seems that that ...
7
votes
4answers
2k views
SIP UDP request breaking through iptables
I have been investigating a few instances recently where SIP UDP traffic has been somehow evading the ruleset defined in iptables leading me to suspect that there is a hole in our rules so i'm looking ...
6
votes
5answers
2k views
Firewall demo - iptables
I have to make a demonstration about firewalls in my class as a student(university).
It should be implemented using iptables on Linux. I am reading all the theories around them but I can't figure out ...
6
votes
1answer
2k views
ARP spoofing with Scapy. How does Scapy reroute traffic?
Background:
I understand that in order to ARP spoof a victim in a network using Scapy, we need to send ARP reply packets to the victim and the gateway router with the correct destination and Source ...
6
votes
2answers
6k views
How web application firewalls protect application from DDoS attacks?
How to protect a web application from DDoS by the implementation of Web Application firewalls?
How effective is this method?
5
votes
3answers
5k views
What are the security implications of net.ipv4.conf.eth0.route_localnet=1 / route_localnet?
sudo sysctl -w net.ipv4.conf.eth0.route_localnet=1
What are the security implications of route_localnet?
5
votes
4answers
3k views
what is a good public available iptables script for ddos mitigation?
what is a good public available iptables script for ddos mitigation?
5
votes
3answers
1k views
Does blocking an IP with IP Tables protect you from a DOS (not DDOS) attack?
I am fairly new to network security, and I just learned about the Fail2Ban framework you can use for automated exploit detection/prevention. It says that you can protect yourself from DOS attacks by ...
5
votes
1answer
723 views
SSL MITM on the WAN side of my router
Hi
I would like to try to sniff a typical CWMP conversation that my router does to his Auto Configuration Server (see TR-069 crash course: https://www.iol.unh.edu/sites/default/files/knowledgebase/...
5
votes
1answer
227 views
System-Level Network Security (Packet Classification and etc.) - SELinux and Libnftnl
I read that Libnftnl is a userspace library providing a low-level netlink programming interface to the in-kernel nf_tables subsystem and it uses NFTables.
Since it's a kernel related topic, at the ...
5
votes
1answer
1k views
How to prevent ARP poisoning with hostapd and iptables?
I have a raspberry pi and hostapd and iptables are running on my pi. However iptables cannot block the wifi clients from communicating with each other, thus I cannot prevent them from sending out ARP ...
4
votes
5answers
3k views
How can I block bots that consistently hit the same URLs?
I am getting slammed hard by bots, and I am not sure how to stop them without blocking my legitimate traffic. I created some iptables rules that say, if X connections in X seconds, block, but that ...
4
votes
3answers
1k views
iptables rule to ban and redirect malicious traffic
I'm running Apache 2 and after analysing the access_log I discovered that my website is visited more than 800 times a day (today 924) from majestic.co.uk bot.
The bot use this range of IP addresses:
...
4
votes
2answers
8k views
Benefits of REJECT over DROP on a single PC
Recently I learned about the difference between DROP and REJECT in a firewall.
I understand that REJECT is better because it closes the connection immediately instead of waiting for timeout as DROP ...
4
votes
2answers
2k views
Executing arbitrary commands through iptables-restore input
During a pentest I found a way to add arbitrary iptables firewall rules to a server. These rules get applied by way of the iptables-restore command, and I've been wondering whether there is any way to ...
4
votes
1answer
578 views
SSL Strip on Fedora24
I want to perform a MITM attack on my own network, and followed several tutorials on how to use sslstrip, iptables and arpspoof.
But every time I perform the attack, I lose the connection on the ...
4
votes
4answers
1k views
Find out what Linux software is trying to phone home
I have seen some suspicious outbound communications blocked on my VPS, which hosts a small experimental Web site, and want to find out which application is making the attempt. The server is running ...
3
votes
2answers
4k views
Why can't iptables drop arp requests
I was trying to hide my laptop from my phone's network scan app. The app is using arp requests to find devices on the network. I tried everything on iptables. It doesn't work, even if i set all the ...
3
votes
3answers
974 views
Make OSSEC ban ip on remote firewall
I am deploying OSSEC architecture agent-server mode.
I want the server to ban ip not only on agent but also on a remote firewall (dedicated iptables server).
I've seached on the OSSEC's ...
3
votes
2answers
3k views
Is my ISP doing a port scan on my computer?
I have been logging incoming connections with iptables for a while and I have been observing the following popping up periodically:
11:45:10 my.com kernel: IPTABLES: SRC=220.255.XX.XXY DST=192.168.1....
3
votes
1answer
538 views
What are the requirements to sniff UDP packets in a Wireless Ad-Hoc network?
In a wireless Ad-Hoc network, I have two computers which communicates in UDP together from 192.168.1.3 to 192.168.1.5
I have a third computer (192.168.1.6) which wants to listen to the packets which ...
3
votes
2answers
1k views
Firewall egress filtering / quick whitelisting
Suppose your Aunt or Uncle is easily fooled by phishing attempts and their computer has multiple root kits and key loggers running. Assume their computing habits will never change.
Looking at his ...
3
votes
1answer
295 views
Blocking all incoming traffic, will it still accept a response from a request I initiated?
I am a 'newbie' when it comes to firewalls, but I am trying to launch some machines that will connect to Facebook's Graphs API. I only want these machines to contact Facebook and nothing else. By this ...
3
votes
2answers
6k views
How to configure iptables for must open ports?
On my machine there are web services which can be accessed from any PC connected to the same network segment (WiFi for example). I want to use IPtables on the machine to prevent any web services from ...
3
votes
2answers
346 views
Can ipopts be used to circumvent a pf or iptables firewall source IP based blocking?
Can one use ipopts, and in particular IP source routing, to circumvent source-based blocking in pf or iptables?
For example, with OpenBSD's pf:
block in all # default deny
block out all
pass in on ...
3
votes
2answers
1k views
Should I block outbound TCP RST (on closed ports)?
I have a range of inbound TCP ports open on the firewall, but usually closed on the host machine. I see a handful of unknown connection attempts each day, for which the server returns TCP RST. I ...
3
votes
1answer
175 views
Is it possible to find out what a remote user is trying to do connecting to a closed port?
From my iptables log, I can observe a particular remote IP address trying to connect to my server from port 80 to a private port number:
Jul 09 01:24:41 example.com kernel: IPTABLES: IN=eth1 MAC=xx:...
3
votes
1answer
2k views
ufw, system-config-firewall-tui, or firewalld vs iptables
Is there any advantage (other than usability) to using ufw, system-config-firewall-tui, or firewalld rather than just using iptables?
My understanding is that these other programs just simplify ...
3
votes
1answer
2k views
Setting up a fake AP - problem with iptables and DNS server
Im trying to set up a fake AP using aircrack-ng suite, DHCP server & iptables.
After creating the fake AP:
airmon-ng start wlan1
airbase-ng -c 11 -e "freewifi" wlan1mon
running iptables ...
3
votes
2answers
890 views
Dedicated OS vs Debian for SOHO Firewall? [closed]
I want to set up a firewall for a small office. I have a server on which I can install an OS of my choice. I was thinking of trying pfSense but ran into some testing problems and tried IPFIre (Linux ...
3
votes
1answer
3k views
IPtables Linux Firewall and IPsec traffic
Can iptables filter out incoming datagrams that are IPSec-tunneled packets going to port 25?
3
votes
1answer
120 views
Which IPTables chains should I log from a security perspective
So far I've always been logging the INPUT and OUTPUT chains because I only used iptables as host firewall.
Now I'm configuring network firewall which uses iptables, but I don't know whether I should ...
3
votes
1answer
4k views
Networking in Qubes OS [closed]
I've started recently to use Qubes OS and I want to set up a virtual IDS and IPS in separate VMs, but I can't figure out how the communications between different VMs works here.
Each VM should be ...
3
votes
1answer
1k views
How to prevent ICMP redirection produced by a man-in-the-middle
How can I prevent my route to be redirected with redirecting ICMP packets from a man-in-the-middle?
I am specifically looking to avoid someone using ettercap with the -M icmp option. From man ...
3
votes
0answers
70 views
smb iptables configuration not working with vpn killswitch
my main goal is to setup iptables that work as a VPN killswitch for my openvpn connection. Thanks to a post from forest, this was pretty straight forward: OpenVPN kill switch on Linux . So. everything ...
3
votes
0answers
185 views
Experimenting with SSLStrip+ on the same machine
I am trying to play around to understand how SSLStrip+ works by:
$ cat /proc/sys/net/ipv4/ip_forward
1
$ sudo iptables --flush
$ sudo iptables --flush -t nat
$ sudo iptables -t nat -A PREROUTING -p ...
2
votes
2answers
6k views
IPTables default security rules for a gateway/router?
On a router such as dd-wrt or tomato, what would be some default iptables rules?
I am asking for rules on a router/gateway - For example; blocking SYN flood attacks, or XMAS attacks. The basic ...
2
votes
2answers
438 views
Are there “LAN IPs” on the internet?
I have a home-made web application and thought that an easy way to secure it's administration interface would be to simply reject all IPs that arent from 192.168... Is this viable? is it possible for ...
2
votes
3answers
2k views
iptables: plaintext password protection
I'd like to find a way to block or restrict my access to the web-pages where my password is sent as a plaintext on the internet.
Let's assume if I have the same password for all web-pages, is it ...
2
votes
2answers
1k views
Dealing with the dangers of self-hosting a webserver?
Assuming for a self-hosted webserver:
the webserver only hosts a static html website
iptables is used to reject every IP except a few known ones
only Port 443 is forwarded and the website requires ...
2
votes
1answer
1k views
How to bypass DNS spoofing protection
I know that SSL certificates prevent DNS spoofing, but I was wondering why it is not possible after ARP cache poisoning to set up iptables rules and redirect the origin destination to fake page?
2
votes
4answers
18k views
Ignoring broadcasts to 10.0.0.255 using iptables
I'm trying to drop logging packets that are destined for 10.0.0.255 by using the following rules:
$IPTABLES -A OUTPUT -d 10.0.0.255 -j DROP
$IPTABLES -A FORWARD -d 10.0.0.255 -j DROP
It doesn'...
2
votes
2answers
173 views
How are my iptables rules circumvented?
I'm using ufw on a debian server and apparently an attacker is able to circumvent the filtering rules. ufw uses iptables.
The server host http and mail services, and has an ssh port. I use a non-...