28
votes
Accepted
Has a remote rogue DNS client managed to slip through the first iptables rule of a Linux DNS server?
pktstat sniffs on packets before iptables filtering takes place, which I doubt is possible
This is what happens. pktstat, tcpdump etc get the unfiltered data on the interface. See also Does tcpdump ...
- 206k
28
votes
Accepted
Do machines without any listening services need a firewall to block incoming connections?
This is close to ask whether a shutdown computer needs updates. The answer is not if and only if you are sure that it will always stay off. Your question should receive a similar answer: if you are ...
- 26.8k
12
votes
Accepted
Connection to ports 2000 and 5060 successful despite filtering
There is something between the scanner and the target that is responding on behalf of the target, spoofing its source address so as to appear to be the target itself. When you ran the Nmap scan as ...
- 11.7k
10
votes
Accepted
Why can't iptables drop arp requests
ARP and TCP/IP are different layers in the networking technology stack. If you have read about the OSI model, that applies here.
ARP is a protocol at layer 2 dealing with connecting the host to the ...
- 132k
10
votes
Do machines without any listening services need a firewall to block incoming connections?
Does a machine with no listening services strictly need a firewall? Not really.
Does a machine with no listening services exist in practice? Not really, if we're talking about the more common desktop &...
- 136k
8
votes
Accepted
ARP spoofing with Scapy. How does Scapy reroute traffic?
Scapy does not route the traffic, nor does it touch the traffic at all in this scenario. When you enable IP forwarding on a host, it becomes a router. When the host receives a packet not destined for ...
- 13.1k
8
votes
Why can't iptables drop arp requests
Because iptables deals with TCP/IP. ARP is not TCP/IP.
You can install arptables, and use that for filtering arp requests. On a debian-related distro sudo apt install arptables should do the trick.
...
- 16.9k
7
votes
Nmap - Intense vs Quick result
First, let's correct some assumptions and terminology which will make understanding the results a lot easier:
The -F option is a "quick" scan because it scans only 100 ports. It is the equivalent of -...
- 11.7k
6
votes
Do machines without any listening services need a firewall to block incoming connections?
It depends on the risk profile and the stakes involved (these in turn depend on what the machine is used for).
Just a few reasons why you MAY need a firewall:
A lurking vulnerability in the machine's ...
- 3,568
5
votes
Accepted
Network Defense- White listing IPs/Ports
Assuming that your side initiates every communication, then yes, blocking every connection to your machine from IP addresses you didn't connect to is a good idea.
But note that this is firewall ...
- 9,283
5
votes
What are the security implications of net.ipv4.conf.eth0.route_localnet=1 / route_localnet?
The documentation for this options shows the following:
route_localnet - BOOLEAN
Do not consider loopback addresses as martian source or destination
while routing. This enables the use of 127/...
- 356
5
votes
Dealing with the dangers of self-hosting a webserver?
Sounds like you've done a good job doing taking care of the usual suspects.
How good is your web development skills? In my work experience, misconfigured web servers are the most common threat vector ...
- 1,905
5
votes
Accepted
Why am I receiving hits with SPT=443 on IPv6?
It seems your server is connecting to that IPv6 address, which is assigned to Google, on HTTPS and this is the reply from that server, as you can see by the SYN and ACK flag.
My guess would be that ...
- 6,948
4
votes
What are the security implications of net.ipv4.conf.eth0.route_localnet=1 / route_localnet?
One possible security implication of this settings is that, if a service listens on localhost as a security measure (i.e. it relies on 127.0.0.1 not being addressable by machines other than the one it'...
- 62.5k
4
votes
Accepted
Building a malicious captive portal
However, when an HTTPS connection comes in, it refuses to accept my certificate.
That's expected. You are trying to man in the middle a TLS connection with a certificate which is either not issued ...
- 206k
4
votes
Do machines without any listening services need a firewall to block incoming connections?
In short, no. Using firewalls for this is really a bad practice (a form of treating the network layer as access control, a big Considered Harmful), which inevitably leads to bad things like insecure ...
3
votes
Accepted
Can iptables be hacked / circumvented
Your INPUT chain is largely useless as it forwards all packets from all interfaces to the ALLOW chain anyway - you could've just implemented the ALLOW chain rules in the INPUT chain.
With the rules ...
- 136k
3
votes
Accepted
Is a Captive Portal Wifi AP as insecure as an open unencrypted Wifi?
Yes, wireless networks protected only by a captive portal are unsecured. They work by denying access to websites other than the captive portal until the connected device, identified by MAC address, ...
- 10.4k
3
votes
How to set iptables to drop packets that I'm not listening on?
What you want to do is simply drop outgoing RST's and ICMP unreachable messages. That way your machine will simply end up ignoring unknown traffic, while SYN packets to open ports will be answered. ...
- 31
3
votes
MAC filtering the internet traffic?
As others have already noted, filtering by MAC doesn't work because MAC addresses are not routable, only IP adresses are.
Filtering by MAC address wouldn't really work, anyway, because MAC addresses ...
- 9,283
3
votes
Accepted
how to block pop up with iptables
Is it possible to configure iptables in a way that such incoming connections are blocked?
When browsing the web there are no incoming connections. All connections originate locally at the browser ...
- 206k
3
votes
Accepted
Does blocking an IP with IP Tables protect you from a DOS (not DDOS) attack?
My question is, if all you are doing is rejecting their requests,
then they still have access to try to send information on that port.
Can they not still overload your server with requests?
Yes, ...
- 266
3
votes
Accepted
What are the methods by which an attacker can distinguish between DROP on IPtables and a Nullroute or non-allocated IP?
One can play around with the TTL (or hop limit with IPv6) of packets send to the destination to figure out where the packets gets lost. The idea is that a router will discard a packet if the TTL is ...
- 206k
3
votes
Block SYN,ACK response with iptables
Blocking the SYN,ACK response is not the right way to go about SYN flooding. Every TCP 3-way-handshake starts with a SYN. If you block the SYN,ACK response, no client will be able to successfully ...
- 7,545
3
votes
Is it recommended to drop all traffic by default in iptables after accepting only what is required?
Let me be blunt: "default deny" is the best practice. The concept is that the firewall blocks all traffic, and only allows the specific traffic that is approved.
But wait! What could those ...
- 132k
3
votes
Accepted
Efficiently handling malicious, single connection attempts to a server?
... should I even bother to block these attempts?
If you are sure that none of these attempts will ever succeed (for example because password based authentication is not allowed anyway, only key ...
- 206k
2
votes
Accepted
Setting up a fake AP - problem with iptables and DNS server
You have different problems here. I think access point and dhcp are ok. Let's talk about iptables and sslstrip.
on sslstrip, you are using arguments -f -p -k 10000 but it makes no sense... port 10000 ...
- 5,335
2
votes
Iptables as vpn killswitch but access to internal network
I had the same problem and a couple of similar ones so here's my complete iptables OUTPUT chain which is all I use and should solve your problem and then some.
-A OUTPUT -d 192.168.1.0/24 -j ACCEPT
-...
- 21
2
votes
What are the security implications of net.ipv4.conf.eth0.route_localnet=1 / route_localnet?
I think the main implication is, that firewall rules (distribution or custom) which allow communication for 127/8 might no longer be effective Iff they fail to specify the ingress interface. If rules ...
- 982
Only top scored, non community-wiki answers of a minimum length are eligible