We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [iptables]

An application that allows a user to configure the tables provided by the Linux firewall. iptables is succeeded by nftables as of 2014.

Filter by
Sorted by
Tagged with
1
vote
3answers
134 views

How to prevent DDoS to cause stored data inconveniences?

Let's assume there are no vulnerabilities in the application layer, one disk, and no physical firewall (just iptables rules in the server itself), hence in this case all the DDoS attack does is to ...
0
votes
1answer
163 views

Which chain of the iptables receives the sniffed packets

Host C is using wireshark to sniff packets from Host A to Host B. I am able to see those packets from wireshark but I am not able to find them in the PREROUTING chain of iptables. When Host C ...
3
votes
1answer
785 views

How to prevent ICMP redirection produced by a man-in-the-middle

How can I prevent my route to be redirected with redirecting ICMP packets from a man-in-the-middle? I am specifically looking to avoid someone using ettercap with the -M icmp option. From man ...
0
votes
2answers
137 views

Using IPTables over a network [closed]

I recently found out how to "block" an IP address from your computer, with this command: sudo iptables -A INPUT -s 210.1.193.49 -j DROP #Blocks 210.1.193.49 from your computer I was wondering, how ...
2
votes
1answer
152 views

Which set of rules is more restrictive when allowing SSH in iptables?

I have seen two set of rules to allow SSH communication: Set A: iptables -A INPUT -p tcp --dport 22 -j ACCEPT iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT Set B: iptables -A INPUT -m state --...
2
votes
2answers
3k views

MAC filtering the internet traffic?

I was trying to build a firewall where in the access to my LAN from internet should be allowed only if it matches the predefined MAC address of the device i.e,. MAC filtering, but later i found out ...
0
votes
1answer
102 views

Network Defense- White listing IPs/Ports

If I had a typical home user machine (google, email, youtube, no ssh/ftp, etc...) that had a dynamic iptables white-list that was dynamically updated with IP addresses that have been legitimately been ...
1
vote
1answer
217 views

Is the Mirai malware attacks related to the TR-069 is a classic port attack?

Refering to the following topic: http://arstechnica.com/security/2016/11/notorious-iot-botnets-weaponize-new-flaw-found-in-millions-of-home-routers/?utm_content=buffer8f018&utm_medium=social&...
3
votes
1answer
2k views

Setting up a fake AP - problem with iptables and DNS server

Im trying to set up a fake AP using aircrack-ng suite, DHCP server & iptables. After creating the fake AP: airmon-ng start wlan1 airbase-ng -c 11 -e "freewifi" wlan1mon running iptables ...
1
vote
2answers
240 views

how to block pop up with iptables

Although I have enabled the pop up blocker in firefox, there are many websites that are able to circumvent this feature. (for example movie streaming sites like kinox.to). My question is not really ...
0
votes
1answer
5k views

Iptables rules to prevent IP Spoofing

We had following below iptables rules that exist in our web front-end boxes to prevent IP Spoofing: -A INPUT -s 255.0.0.0/8 -j LOG --log-prefix "Spoofed source IP" -A INPUT -s 255.0.0.0/8 -j ...
2
votes
0answers
746 views

Is there anyway to customize the --reject-with answer in the iptables? [closed]

Is there any way to customize the answers that can be given with the --reject-with option of the REJECT of IPTABLES? I was reading in the man of the IPTABLES the part of the REJECT and the only ...
0
votes
1answer
136 views

how much traffic can a packet filtering firewall _ implemented with iptables _can handle? [closed]

I am trying to build a packet filtering firewall, that supposed to serve in a network consisting of almost 100 host. Can a firewall build with iptables do such a task? What is the best linux ...
16
votes
4answers
39k views

Tips for a secure iptables config to defend from attacks. (client side!)

Own examples: ############### # KERNEL PARAMETER CONFIGURATION # PREVENT YOU SYSTEM FROM ANSWERING ICMP ECHO REQUESTS echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all # DROP ICMP ECHO-REQUEST ...
2
votes
1answer
547 views

Protect against virus and malware attacks from website ads with iptables

Lots of websites spread malware by publishing advertisements that distribute malware. Even YouTube's ad network has been compromised in the past. Browser ad blockers and related plugins have there own ...
1
vote
0answers
117 views

Enabling specific access with iptables on Debian

I am running a Debian server that hosts several Docker containers but also works as my router and internet gateway. I am having trouble getting SSH access from outside (specific ipaddresses) working ...
3
votes
2answers
830 views

Dedicated OS vs Debian for SOHO Firewall? [closed]

I want to set up a firewall for a small office. I have a server on which I can install an OS of my choice. I was thinking of trying pfSense but ran into some testing problems and tried IPFIre (Linux ...
0
votes
1answer
1k views

MitM Attacks - Iptables?

I have looked for the answer to this question to no avail, apologies if I missed it. I would like to know how effective iptables would be against MitM attacks - in the following setup: ALLOW INPUT {...
2
votes
1answer
522 views

Port Knocking using only Iptables/netfilter

I am using the following iptables rules for port knocking. Everything works well, but it open the port for just a second and then close it. So how to improve this script to accept connection for a 30 ...
2
votes
3answers
2k views

iptables: plaintext password protection

I'd like to find a way to block or restrict my access to the web-pages where my password is sent as a plaintext on the internet. Let's assume if I have the same password for all web-pages, is it ...
0
votes
1answer
858 views

Forwarding traffic to SSLSplit from Android

I want to forward non HTTP traffic to SSLSplit in order to do a MITM attack. How would I forward the traffic to SSLSplit from my Android?
2
votes
1answer
158 views

Why would someone upload many iptables files during a security breach and are they a cause for concern?

My workplace had multiple unauthorized access security failures over the last month. Since then, most computers have been scrubbed and user accounts purged. Data was recovered from offsite backups and ...
1
vote
1answer
2k views

Arp spoofing blocks internet [duplicate]

I work on a fresh Kali install running in a VM. I have an external Wi-Fi NIC used only by the VM (I try to not use the internet connection of the host). The network is protected (hum) by WEP, with ...
1
vote
1answer
482 views

In iptables and conntrack is ESTABLISHED, RELATED the same as RELATED, ESTABLISHED when default policy is drop?

My default policy for all chains is drop. I'm trying to understand if there is a difference between the order of ESTABLISHED,RELATED and RELATED,ESTABLISHED when conntrack is entered into a rule ...
0
votes
1answer
383 views

How does SSLStrip grab traffic?

In Marlinspike's description on how to set up SSLStrip, he says to enable forwarding echo "1" > /proc/sys/net/ipv4/ip_forward then redirect traffic from port 80 to the SSLStrip listen port ...
3
votes
1answer
3k views

IPtables Linux Firewall and IPsec traffic

Can iptables filter out incoming datagrams that are IPSec-tunneled packets going to port 25?
1
vote
1answer
297 views

Nmap scan giving different result to my iptables configuration

I am running a simple webserver on a VPS, the only ports I have open are 80 - for HTTP (webserver) 12345 - an unusual port for SSH connection to administer server. I wanted to see how my ...
3
votes
1answer
202 views

Blocking all incoming traffic, will it still accept a response from a request I initiated?

I am a 'newbie' when it comes to firewalls, but I am trying to launch some machines that will connect to Facebook's Graphs API. I only want these machines to contact Facebook and nothing else. By this ...
2
votes
0answers
364 views

CPU load of iptables to deny IPs during DDoS event [closed]

If a server has an external IP address protected with an iptables whitelist rule to reject all by default except from 3 ip addresses ip1, ip2 and ip3. If someone identifies this external IP address, ...
2
votes
2answers
1k views

Limit Packets Per Second

Since last week I have been seeing something fishy and it seems to be worsening. I tried many firewalls and they seem to be useless. I blocked all unwanted ports and only few ports are open so I found ...
1
vote
0answers
255 views

IPtables accepting SMTP without being configured?

While setting up the IPtables rules for a new server, I set up Postfix and send an email to try it out. To my surprise the email arrived without me declaring a rule for the port in IPtables. ...
3
votes
2answers
983 views

Should I block outbound TCP RST (on closed ports)?

I have a range of inbound TCP ports open on the firewall, but usually closed on the host machine. I see a handful of unknown connection attempts each day, for which the server returns TCP RST. I ...
0
votes
1answer
625 views

How to detect arp spoofing using iptable? [closed]

How can I set iptables to detect arp spoofing on linux?
1
vote
1answer
1k views

Host-based security architecture for web server network

I am begining with network security and after studying for a while about often used technologies I got to this architecture for my home server (sorry it is not in english). I considered 3 basic ...
1
vote
0answers
83 views

iptable ip_conntrack_max testing

I was trying to understand how ip_conntrack_max works so i have created two VM and set ip_conntrack_max to 10000 I used hping to open 10000 udp connection on VM using following command hping --udp -...
4
votes
3answers
1k views

iptables rule to ban and redirect malicious traffic

I'm running Apache 2 and after analysing the access_log I discovered that my website is visited more than 800 times a day (today 924) from majestic.co.uk bot. The bot use this range of IP addresses: ...
1
vote
1answer
895 views

How to bypass DNS spoofing protection

I know that SSL certificates prevent DNS spoofing, but I was wondering why it is not possible after ARP cache poisoning to set up iptables rules and redirect the origin destination to fake page?
1
vote
1answer
4k views

ARP - forwarding or dropping with IPtables

I've been trying to ARP poison my home computer and router (intended to learn and discover the networks behavior). And with success. The whole time I've been using: with open('/proc/sys/net/ipv4/...
4
votes
5answers
3k views

How can I block bots that consistently hit the same URLs?

I am getting slammed hard by bots, and I am not sure how to stop them without blocking my legitimate traffic. I created some iptables rules that say, if X connections in X seconds, block, but that ...
8
votes
2answers
24k views

Test firewall rules (Linux)

I have a question about how to test the firewall rules. To be more specific, for academic purpose I have to set up a machine which will accept all kind of packets o a specific interface. I added an ...
0
votes
1answer
467 views

Is it worth it to use sshguard when only allowing ssh login from specific IP?

I'm running a VPS (under ArchLinux) and was wondering if sshguard was useful in the following case. My iptables rule for SSH in looks like this : iptables -A INPUT -p tcp --source $Trusted --dport ...
0
votes
2answers
4k views

Opening port 53 on server Risks?

I looked about but couldn't find a similar enough question. I have some remote servers positioned on clients networks, which provide various services (raspberry pi) - and their firewall config is as ...
0
votes
2answers
691 views

Preventing ARP spoofing in DMZ

Is there any possible way to implement a defence mechanism in a firewall to be able to prevent ARP spoofing in a DMZ. Our DMZ server consist of two webservers and a database (which should be available ...
3
votes
1answer
120 views

Which IPTables chains should I log from a security perspective

So far I've always been logging the INPUT and OUTPUT chains because I only used iptables as host firewall. Now I'm configuring network firewall which uses iptables, but I don't know whether I should ...
1
vote
1answer
707 views

How does DROP rule work in iptables?

I'm working with iptables in order to close one or two open ports. So I tried this rule in order to change the default policy. # iptables -A INPUT -p tcp --dport 3333 -j DROP Then I checked the ...
3
votes
2answers
1k views

Firewall egress filtering / quick whitelisting

Suppose your Aunt or Uncle is easily fooled by phishing attempts and their computer has multiple root kits and key loggers running. Assume their computing habits will never change. Looking at his ...
1
vote
4answers
16k views

Ignoring broadcasts to 10.0.0.255 using iptables

I'm trying to drop logging packets that are destined for 10.0.0.255 by using the following rules: $IPTABLES -A OUTPUT -d 10.0.0.255 -j DROP $IPTABLES -A FORWARD -d 10.0.0.255 -j DROP It doesn'...
1
vote
1answer
1k views

How to prevent outgoing UDP attacks?

My server has been the target from hackers 3 times in the last month, and the attack seem to follow the same pattern. The attack another site from my server using UDP connection. The report from my ...
2
votes
1answer
6k views

Using Linux iptables to implement a stateless, packet filtering firewall

When I began my career in network security, almost a decade back, the industry standard was stateful firewalls that even had the ability to inspect some application layer protocols. I had only heard ...
0
votes
1answer
4k views

iptables intercept received packet with proxy and then forward to destination

Lets say I receive internet through my eth1 port and share it via hotspot to other devices (wlan0 port) [internet]----(eth1)[my computer](wlan0 hotspot) | ...