28 votes
Accepted

Has a remote rogue DNS client managed to slip through the first iptables rule of a Linux DNS server?

pktstat sniffs on packets before iptables filtering takes place, which I doubt is possible This is what happens. pktstat, tcpdump etc get the unfiltered data on the interface. See also Does tcpdump ...
Steffen Ullrich's user avatar
28 votes
Accepted

Do machines without any listening services need a firewall to block incoming connections?

This is close to ask whether a shutdown computer needs updates. The answer is not if and only if you are sure that it will always stay off. Your question should receive a similar answer: if you are ...
Serge Ballesta's user avatar
11 votes
Accepted

Connection to ports 2000 and 5060 successful despite filtering

There is something between the scanner and the target that is responding on behalf of the target, spoofing its source address so as to appear to be the target itself. When you ran the Nmap scan as ...
bonsaiviking's user avatar
  • 11.6k
10 votes
Accepted

Why can't iptables drop arp requests

ARP and TCP/IP are different layers in the networking technology stack. If you have read about the OSI model, that applies here. ARP is a protocol at layer 2 dealing with connecting the host to the ...
schroeder's user avatar
  • 129k
10 votes

Do machines without any listening services need a firewall to block incoming connections?

Does a machine with no listening services strictly need a firewall? Not really. Does a machine with no listening services exist in practice? Not really, if we're talking about the more common desktop &...
Polynomial's user avatar
  • 135k
8 votes

Why can't iptables drop arp requests

Because iptables deals with TCP/IP. ARP is not TCP/IP. You can install arptables, and use that for filtering arp requests. On a debian-related distro sudo apt install arptables should do the trick. ...
vidarlo's user avatar
  • 16k
7 votes

Nmap - Intense vs Quick result

First, let's correct some assumptions and terminology which will make understanding the results a lot easier: The -F option is a "quick" scan because it scans only 100 ports. It is the equivalent of -...
bonsaiviking's user avatar
  • 11.6k
7 votes
Accepted

ARP spoofing with Scapy. How does Scapy reroute traffic?

Scapy does not route the traffic, nor does it touch the traffic at all in this scenario. When you enable IP forwarding on a host, it becomes a router. When the host receives a packet not destined for ...
multithr3at3d's user avatar
6 votes

Do machines without any listening services need a firewall to block incoming connections?

It depends on the risk profile and the stakes involved (these in turn depend on what the machine is used for). Just a few reasons why you MAY need a firewall: A lurking vulnerability in the machine's ...
fraxinus's user avatar
  • 3,558
5 votes

What are the security implications of net.ipv4.conf.eth0.route_localnet=1 / route_localnet?

The documentation for this options shows the following: route_localnet - BOOLEAN Do not consider loopback addresses as martian source or destination while routing. This enables the use of 127/...
hspaans's user avatar
  • 356
5 votes
Accepted

Blocking all incoming traffic, will it still accept a response from a request I initiated?

Stateful firewalls are mindful of incoming connections that are part of a circuit that was previously established. iptables can certainly do this. The short answer is that you need a firewall rule ...
schroeder's user avatar
  • 129k
5 votes
Accepted

Network Defense- White listing IPs/Ports

Assuming that your side initiates every communication, then yes, blocking every connection to your machine from IP addresses you didn't connect to is a good idea. But note that this is firewall ...
Out of Band's user avatar
  • 9,293
5 votes
Accepted

Why am I receiving hits with SPT=443 on IPv6?

It seems your server is connecting to that IPv6 address, which is assigned to Google, on HTTPS and this is the reply from that server, as you can see by the SYN and ACK flag. My guess would be that ...
Teun Vink's user avatar
  • 6,918
4 votes

What are the security implications of net.ipv4.conf.eth0.route_localnet=1 / route_localnet?

One possible security implication of this settings is that, if a service listens on localhost as a security measure (i.e. it relies on 127.0.0.1 not being addressable by machines other than the one it'...
Rory McCune's user avatar
  • 62.2k
4 votes
Accepted

Building a malicious captive portal

However, when an HTTPS connection comes in, it refuses to accept my certificate. That's expected. You are trying to man in the middle a TLS connection with a certificate which is either not issued ...
Steffen Ullrich's user avatar
4 votes

Dealing with the dangers of self-hosting a webserver?

Sounds like you've done a good job doing taking care of the usual suspects. How good is your web development skills? In my work experience, misconfigured web servers are the most common threat vector ...
bashCypher's user avatar
  • 1,885
4 votes

Do machines without any listening services need a firewall to block incoming connections?

In short, no. Using firewalls for this is really a bad practice (a form of treating the network layer as access control, a big Considered Harmful), which inevitably leads to bad things like insecure ...
R.. GitHub STOP HELPING ICE's user avatar
3 votes

How to set iptables to drop packets that I'm not listening on?

What you want to do is simply drop outgoing RST's and ICMP unreachable messages. That way your machine will simply end up ignoring unknown traffic, while SYN packets to open ports will be answered. ...
scriptjunkie's user avatar
3 votes
Accepted

how to block pop up with iptables

Is it possible to configure iptables in a way that such incoming connections are blocked? When browsing the web there are no incoming connections. All connections originate locally at the browser ...
Steffen Ullrich's user avatar
3 votes

MAC filtering the internet traffic?

As others have already noted, filtering by MAC doesn't work because MAC addresses are not routable, only IP adresses are. Filtering by MAC address wouldn't really work, anyway, because MAC addresses ...
Out of Band's user avatar
  • 9,293
3 votes
Accepted

Is a Captive Portal Wifi AP as insecure as an open unencrypted Wifi?

Yes, wireless networks protected only by a captive portal are unsecured. They work by denying access to websites other than the captive portal until the connected device, identified by MAC address, ...
tlng05's user avatar
  • 10.4k
3 votes
Accepted

Can iptables be hacked / circumvented

Your INPUT chain is largely useless as it forwards all packets from all interfaces to the ALLOW chain anyway - you could've just implemented the ALLOW chain rules in the INPUT chain. With the rules ...
Polynomial's user avatar
  • 135k
3 votes
Accepted

Does blocking an IP with IP Tables protect you from a DOS (not DDOS) attack?

My question is, if all you are doing is rejecting their requests, then they still have access to try to send information on that port. Can they not still overload your server with requests? Yes, ...
Slartibartfast's user avatar
3 votes
Accepted

What are the methods by which an attacker can distinguish between DROP on IPtables and a Nullroute or non-allocated IP?

One can play around with the TTL (or hop limit with IPv6) of packets send to the destination to figure out where the packets gets lost. The idea is that a router will discard a packet if the TTL is ...
Steffen Ullrich's user avatar
3 votes

Block SYN,ACK response with iptables

Blocking the SYN,ACK response is not the right way to go about SYN flooding. Every TCP 3-way-handshake starts with a SYN. If you block the SYN,ACK response, no client will be able to successfully ...
Demento's user avatar
  • 7,465
3 votes

Is it recommended to drop all traffic by default in iptables after accepting only what is required?

Let me be blunt: "default deny" is the best practice. The concept is that the firewall blocks all traffic, and only allows the specific traffic that is approved. But wait! What could those ...
schroeder's user avatar
  • 129k
3 votes
Accepted

Efficiently handling malicious, single connection attempts to a server?

... should I even bother to block these attempts? If you are sure that none of these attempts will ever succeed (for example because password based authentication is not allowed anyway, only key ...
Steffen Ullrich's user avatar
2 votes
Accepted

IPtables Linux Firewall and IPsec traffic

Assuming that you mean "can host X, which terminates the IPSec tunnel, apply iptables filters to the de-tunneled traffic?" then the answer is yes. Here's a Server Fault Q&A on this exact topic - ...
gowenfawr's user avatar
  • 72.8k
2 votes
Accepted

Nmap scan giving different result to my iptables configuration

I wanted to see how my firewall appears to the rest of the internet so I did an nmap scan... Which means that you did not really scan solely your VPS, but that you have checked out the combination of ...
Steffen Ullrich's user avatar
2 votes

Limit Packets Per Second

I am somewhat suspicious of your diagnosis of the cause of freezes, however if this is the case, then the question is off topic here and my first choice for a remedial action would be to look for a ...
symcbean's user avatar
  • 18.6k

Only top scored, non community-wiki answers of a minimum length are eligible