Questions tagged [iptables]

An application that allows a user to configure the tables provided by the Linux firewall. iptables is succeeded by nftables as of 2014.

Filter by
Sorted by
Tagged with
1
vote
0answers
205 views

Why is Skype traffic not passing through the NAT table of the PREROUTING chain in iptables?

I have successfully performed a MITM attack and have managed to view the HTTP/HTTPS packets of the victim passing through the nat table of the PREROUTING chain of my iptables.(using -j LOG) However, ...
8
votes
1answer
3k views

Nmap - Intense vs Quick result

I inherited a small network and currently am assessing its security performance. I started port scanning a host (lets call it Weirdo) in that small network and from my perspective, it seems that that ...
0
votes
1answer
212 views

Which chain of the iptables receives the sniffed packets

Host C is using wireshark to sniff packets from Host A to Host B. I am able to see those packets from wireshark but I am not able to find them in the PREROUTING chain of iptables. When Host C ...
0
votes
2answers
151 views

Using IPTables over a network [closed]

I recently found out how to "block" an IP address from your computer, with this command: sudo iptables -A INPUT -s 210.1.193.49 -j DROP #Blocks 210.1.193.49 from your computer I was wondering, how ...
2
votes
1answer
174 views

Which set of rules is more restrictive when allowing SSH in iptables?

I have seen two set of rules to allow SSH communication: Set A: iptables -A INPUT -p tcp --dport 22 -j ACCEPT iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT Set B: iptables -A INPUT -m state --...
1
vote
3answers
141 views

How to prevent DDoS to cause stored data inconveniences?

Let's assume there are no vulnerabilities in the application layer, one disk, and no physical firewall (just iptables rules in the server itself), hence in this case all the DDoS attack does is to ...
2
votes
2answers
4k views

MAC filtering the internet traffic?

I was trying to build a firewall where in the access to my LAN from internet should be allowed only if it matches the predefined MAC address of the device i.e,. MAC filtering, but later i found out ...
0
votes
1answer
110 views

Network Defense- White listing IPs/Ports

If I had a typical home user machine (google, email, youtube, no ssh/ftp, etc...) that had a dynamic iptables white-list that was dynamically updated with IP addresses that have been legitimately been ...
5
votes
1answer
719 views

SSL MITM on the WAN side of my router

Hi I would like to try to sniff a typical CWMP conversation that my router does to his Auto Configuration Server (see TR-069 crash course: https://www.iol.unh.edu/sites/default/files/knowledgebase/...
3
votes
1answer
4k views

Networking in Qubes OS [closed]

I've started recently to use Qubes OS and I want to set up a virtual IDS and IPS in separate VMs, but I can't figure out how the communications between different VMs works here. Each VM should be ...
1
vote
2answers
349 views

how to block pop up with iptables

Although I have enabled the pop up blocker in firefox, there are many websites that are able to circumvent this feature. (for example movie streaming sites like kinox.to). My question is not really ...
3
votes
1answer
2k views

Setting up a fake AP - problem with iptables and DNS server

Im trying to set up a fake AP using aircrack-ng suite, DHCP server & iptables. After creating the fake AP: airmon-ng start wlan1 airbase-ng -c 11 -e "freewifi" wlan1mon running iptables ...
0
votes
1answer
1k views

Iptables as vpn killswitch but access to internal network

currently I'm using iptables as a kill-switch for my VPN connection. Therefore I only have one rule : -A OUTPUT -o eth0 -m owner --uid-owner 1000 -j DROP everything else is accepted. Now the ...
1
vote
1answer
6k views

Iptables rules to prevent IP Spoofing

We had following below iptables rules that exist in our web front-end boxes to prevent IP Spoofing: -A INPUT -s 255.0.0.0/8 -j LOG --log-prefix "Spoofed source IP" -A INPUT -s 255.0.0.0/8 -j ...
5
votes
1answer
227 views

System-Level Network Security (Packet Classification and etc.) - SELinux and Libnftnl

I read that Libnftnl is a userspace library providing a low-level netlink programming interface to the in-kernel nf_tables subsystem and it uses NFTables. Since it's a kernel related topic, at the ...
2
votes
0answers
1k views

Is there anyway to customize the --reject-with answer in the iptables? [closed]

Is there any way to customize the answers that can be given with the --reject-with option of the REJECT of IPTABLES? I was reading in the man of the IPTABLES the part of the REJECT and the only ...
3
votes
1answer
1k views

How to prevent ICMP redirection produced by a man-in-the-middle

How can I prevent my route to be redirected with redirecting ICMP packets from a man-in-the-middle? I am specifically looking to avoid someone using ettercap with the -M icmp option. From man ...
1
vote
1answer
241 views

Is the Mirai malware attacks related to the TR-069 is a classic port attack?

Refering to the following topic: http://arstechnica.com/security/2016/11/notorious-iot-botnets-weaponize-new-flaw-found-in-millions-of-home-routers/?utm_content=buffer8f018&utm_medium=social&...
1
vote
1answer
385 views

PREROUTING interfaces SSL MITM

I'm trying to make SSL MITM attack but do not really understand how to configure my interfaces to preroute traffic. I have a laptop, connected to a PC via Ethernet, the PC is connected to the rest of ...
4
votes
1answer
578 views

SSL Strip on Fedora24

I want to perform a MITM attack on my own network, and followed several tutorials on how to use sslstrip, iptables and arpspoof. But every time I perform the attack, I lose the connection on the ...
0
votes
1answer
150 views

how much traffic can a packet filtering firewall _ implemented with iptables _can handle? [closed]

I am trying to build a packet filtering firewall, that supposed to serve in a network consisting of almost 100 host. Can a firewall build with iptables do such a task? What is the best linux ...
5
votes
3answers
5k views

What are the security implications of net.ipv4.conf.eth0.route_localnet=1 / route_localnet?

sudo sysctl -w net.ipv4.conf.eth0.route_localnet=1 What are the security implications of route_localnet?
2
votes
1answer
790 views

inetsim installation perlipq/libipq error

I am trying to install inetsim on Ubuntu 14.04 where I have been following instructions from several blogs and the inetsim.org documentation itself at: inetsim download and installation Now one of ...
5
votes
1answer
1k views

How to prevent ARP poisoning with hostapd and iptables?

I have a raspberry pi and hostapd and iptables are running on my pi. However iptables cannot block the wifi clients from communicating with each other, thus I cannot prevent them from sending out ARP ...
1
vote
0answers
122 views

Enabling specific access with iptables on Debian

I am running a Debian server that hosts several Docker containers but also works as my router and internet gateway. I am having trouble getting SSH access from outside (specific ipaddresses) working ...
3
votes
2answers
889 views

Dedicated OS vs Debian for SOHO Firewall? [closed]

I want to set up a firewall for a small office. I have a server on which I can install an OS of my choice. I was thinking of trying pfSense but ran into some testing problems and tried IPFIre (Linux ...
0
votes
1answer
969 views

Forwarding traffic to SSLSplit from Android

I want to forward non HTTP traffic to SSLSplit in order to do a MITM attack. How would I forward the traffic to SSLSplit from my Android?
2
votes
1answer
166 views

Why would someone upload many iptables files during a security breach and are they a cause for concern?

My workplace had multiple unauthorized access security failures over the last month. Since then, most computers have been scrubbed and user accounts purged. Data was recovered from offsite backups and ...
2
votes
1answer
612 views

Protect against virus and malware attacks from website ads with iptables

Lots of websites spread malware by publishing advertisements that distribute malware. Even YouTube's ad network has been compromised in the past. Browser ad blockers and related plugins have there own ...
1
vote
1answer
3k views

Arp spoofing blocks internet [duplicate]

I work on a fresh Kali install running in a VM. I have an external Wi-Fi NIC used only by the VM (I try to not use the internet connection of the host). The network is protected (hum) by WEP, with ...
1
vote
1answer
529 views

In iptables and conntrack is ESTABLISHED, RELATED the same as RELATED, ESTABLISHED when default policy is drop?

My default policy for all chains is drop. I'm trying to understand if there is a difference between the order of ESTABLISHED,RELATED and RELATED,ESTABLISHED when conntrack is entered into a rule ...
0
votes
1answer
422 views

How does SSLStrip grab traffic?

In Marlinspike's description on how to set up SSLStrip, he says to enable forwarding echo "1" > /proc/sys/net/ipv4/ip_forward then redirect traffic from port 80 to the SSLStrip listen port ...
3
votes
1answer
3k views

IPtables Linux Firewall and IPsec traffic

Can iptables filter out incoming datagrams that are IPSec-tunneled packets going to port 25?
1
vote
1answer
395 views

Nmap scan giving different result to my iptables configuration

I am running a simple webserver on a VPS, the only ports I have open are 80 - for HTTP (webserver) 12345 - an unusual port for SSH connection to administer server. I wanted to see how my ...
3
votes
1answer
294 views

Blocking all incoming traffic, will it still accept a response from a request I initiated?

I am a 'newbie' when it comes to firewalls, but I am trying to launch some machines that will connect to Facebook's Graphs API. I only want these machines to contact Facebook and nothing else. By this ...
2
votes
0answers
453 views

CPU load of iptables to deny IPs during DDoS event [closed]

If a server has an external IP address protected with an iptables whitelist rule to reject all by default except from 3 ip addresses ip1, ip2 and ip3. If someone identifies this external IP address, ...
3
votes
2answers
1k views

Should I block outbound TCP RST (on closed ports)?

I have a range of inbound TCP ports open on the firewall, but usually closed on the host machine. I see a handful of unknown connection attempts each day, for which the server returns TCP RST. I ...
0
votes
1answer
682 views

How to detect arp spoofing using iptable? [closed]

How can I set iptables to detect arp spoofing on linux?
1
vote
0answers
90 views

iptable ip_conntrack_max testing

I was trying to understand how ip_conntrack_max works so i have created two VM and set ip_conntrack_max to 10000 I used hping to open 10000 udp connection on VM using following command hping --udp -...
4
votes
3answers
1k views

iptables rule to ban and redirect malicious traffic

I'm running Apache 2 and after analysing the access_log I discovered that my website is visited more than 800 times a day (today 924) from majestic.co.uk bot. The bot use this range of IP addresses: ...
2
votes
1answer
1k views

How to bypass DNS spoofing protection

I know that SSL certificates prevent DNS spoofing, but I was wondering why it is not possible after ARP cache poisoning to set up iptables rules and redirect the origin destination to fake page?
1
vote
1answer
1k views

Host-based security architecture for web server network

I am begining with network security and after studying for a while about often used technologies I got to this architecture for my home server (sorry it is not in english). I considered 3 basic ...
1
vote
1answer
505 views

Is it worth it to use sshguard when only allowing ssh login from specific IP?

I'm running a VPS (under ArchLinux) and was wondering if sshguard was useful in the following case. My iptables rule for SSH in looks like this : iptables -A INPUT -p tcp --source $Trusted --dport ...
0
votes
2answers
5k views

Opening port 53 on server Risks?

I looked about but couldn't find a similar enough question. I have some remote servers positioned on clients networks, which provide various services (raspberry pi) - and their firewall config is as ...
0
votes
2answers
714 views

Preventing ARP spoofing in DMZ

Is there any possible way to implement a defence mechanism in a firewall to be able to prevent ARP spoofing in a DMZ. Our DMZ server consist of two webservers and a database (which should be available ...
1
vote
1answer
778 views

How does DROP rule work in iptables?

I'm working with iptables in order to close one or two open ports. So I tried this rule in order to change the default policy. # iptables -A INPUT -p tcp --dport 3333 -j DROP Then I checked the ...
3
votes
2answers
1k views

Firewall egress filtering / quick whitelisting

Suppose your Aunt or Uncle is easily fooled by phishing attempts and their computer has multiple root kits and key loggers running. Assume their computing habits will never change. Looking at his ...
1
vote
1answer
5k views

ARP - forwarding or dropping with IPtables

I've been trying to ARP poison my home computer and router (intended to learn and discover the networks behavior). And with success. The whole time I've been using: with open('/proc/sys/net/ipv4/...
1
vote
1answer
1k views

How to prevent outgoing UDP attacks?

My server has been the target from hackers 3 times in the last month, and the attack seem to follow the same pattern. The attack another site from my server using UDP connection. The report from my ...
2
votes
2answers
1k views

Limit Packets Per Second

Since last week I have been seeing something fishy and it seems to be worsening. I tried many firewalls and they seem to be useless. I blocked all unwanted ports and only few ports are open so I found ...