29 votes
Accepted

Has a remote rogue DNS client managed to slip through the first iptables rule of a Linux DNS server?

pktstat sniffs on packets before iptables filtering takes place, which I doubt is possible This is what happens. pktstat, tcpdump etc get the unfiltered data on the interface. See also Does tcpdump ...
user avatar
27 votes
Accepted

Do machines without any listening services need a firewall to block incoming connections?

This is close to ask whether a shutdown computer needs updates. The answer is not if and only if you are sure that it will always stay off. Your question should receive a similar answer: if you are ...
user avatar
14 votes

Is it safe to disable connection tracking in iptables?

The short answer Usually you will only need connection tracking for outbound connections. If any local device makes a connection to the Internet, the firewall records that this specific IP and port ...
user avatar
  • 336
10 votes
Accepted

Connection to ports 2000 and 5060 successful despite filtering

There is something between the scanner and the target that is responding on behalf of the target, spoofing its source address so as to appear to be the target itself. When you ran the Nmap scan as ...
user avatar
  • 11.3k
10 votes

Do machines without any listening services need a firewall to block incoming connections?

Does a machine with no listening services strictly need a firewall? Not really. Does a machine with no listening services exist in practice? Not really, if we're talking about the more common desktop &...
user avatar
  • 131k
9 votes

iptables rule to ban and redirect malicious traffic

The Majestic project is a distributed web crawler, which explains why you get such a lot of different source IP addresses. It is not malicious, that is it does not attack your site and it does not ...
user avatar
9 votes
Accepted

Why can't iptables drop arp requests

ARP and TCP/IP are different layers in the networking technology stack. If you have read about the OSI model, that applies here. ARP is a protocol at layer 2 dealing with connecting the host to the ...
user avatar
  • 123k
7 votes
Accepted

Is my ISP doing a port scan on my computer?

Which version of linux are you using and how is your iptables configure that is causing these messages to be logged? I can offer an alternative possible explanation. In the packets there seems to be ...
user avatar
  • 236
7 votes
Accepted

How web application firewalls protect application from DDoS attacks?

You might want to clarify if you're looking for DoS or DDoS protection. See this answer for more details. In a typical web-application architecture, the WAF stands in front of your web-application, ...
user avatar
  • 2,718
7 votes

Nmap - Intense vs Quick result

First, let's correct some assumptions and terminology which will make understanding the results a lot easier: The -F option is a "quick" scan because it scans only 100 ports. It is the equivalent of -...
user avatar
  • 11.3k
7 votes
Accepted

ARP spoofing with Scapy. How does Scapy reroute traffic?

Scapy does not route the traffic, nor does it touch the traffic at all in this scenario. When you enable IP forwarding on a host, it becomes a router. When the host receives a packet not destined for ...
user avatar
7 votes

Why can't iptables drop arp requests

Because iptables deals with TCP/IP. ARP is not TCP/IP. You can install arptables, and use that for filtering arp requests. On a debian-related distro sudo apt install arptables should do the trick. ...
user avatar
  • 12.6k
6 votes

Do machines without any listening services need a firewall to block incoming connections?

It depends on the risk profile and the stakes involved (these in turn depend on what the machine is used for). Just a few reasons why you MAY need a firewall: A lurking vulnerability in the machine's ...
user avatar
  • 3,395
5 votes

How to bypass DNS spoofing protection

SSL does not prevent DNS spoofing itself but it prevents that it can be successfully used. If the certificate of the site does not match the name given the URL the certificate validation will fail. ...
user avatar
5 votes
Accepted

Blocking all incoming traffic, will it still accept a response from a request I initiated?

Stateful firewalls are mindful of incoming connections that are part of a circuit that was previously established. iptables can certainly do this. The short answer is that you need a firewall rule ...
user avatar
  • 123k
5 votes

What are the security implications of net.ipv4.conf.eth0.route_localnet=1 / route_localnet?

The documentation for this options shows the following: route_localnet - BOOLEAN Do not consider loopback addresses as martian source or destination while routing. This enables the use of 127/...
user avatar
  • 346
5 votes
Accepted

Network Defense- White listing IPs/Ports

Assuming that your side initiates every communication, then yes, blocking every connection to your machine from IP addresses you didn't connect to is a good idea. But note that this is firewall ...
user avatar
  • 9,095
5 votes
Accepted

Why am I receiving hits with SPT=443 on IPv6?

It seems your server is connecting to that IPv6 address, which is assigned to Google, on HTTPS and this is the reply from that server, as you can see by the SYN and ACK flag. My guess would be that ...
user avatar
  • 6,768
4 votes

Using Linux iptables to implement a stateless, packet filtering firewall

For a stateless firewall, you can either accept or drop a packet based on its protocol, port number and origin ip address. For example, the rule below accepts all TCP packets from the 192.168.1.x ...
user avatar
  • 3,914
4 votes

Should I block outbound TCP RST (on closed ports)?

Whether you want to take the trouble to do this largely depends on your own threat model and the effort required to make the change. The effect of filtering access to closed ports is that it makes it ...
user avatar
  • 60.6k
4 votes
Accepted

Building a malicious captive portal

However, when an HTTPS connection comes in, it refuses to accept my certificate. That's expected. You are trying to man in the middle a TLS connection with a certificate which is either not issued ...
user avatar
4 votes

Dealing with the dangers of self-hosting a webserver?

Sounds like you've done a good job doing taking care of the usual suspects. How good is your web development skills? In my work experience, misconfigured web servers are the most common threat vector ...
user avatar
  • 1,839
4 votes

Do machines without any listening services need a firewall to block incoming connections?

In short, no. Using firewalls for this is really a bad practice (a form of treating the network layer as access control, a big Considered Harmful), which inevitably leads to bad things like insecure ...
user avatar
3 votes

Firewall egress filtering / quick whitelisting

DNS management is the modern way to do this for the non-technical. Managed DNS services keep track of valid and non-valid entries in an effort to protect the non-technical in this way. Yes, you lose ...
user avatar
  • 123k
3 votes
Accepted

Firewall egress filtering / quick whitelisting

The problem with a outbound filtering solution of the nature suggested is that modern web applications and software contact a bewildering array of servers on the Internet and it would be very ...
user avatar
  • 60.6k
3 votes

How to prevent outgoing UDP attacks?

Your firewall rules look good to me. In particular, the "default deny" for outbound packets means that it should be blocking the packets in the report from your ISP. Are you sure your server is the ...
user avatar
  • 34.4k
3 votes

How to set iptables to drop packets that I'm not listening on?

What you want to do is simply drop outgoing RST's and ICMP unreachable messages. That way your machine will simply end up ignoring unknown traffic, while SYN packets to open ports will be answered. ...
user avatar
3 votes
Accepted

Is it possible to find out what a remote user is trying to do connecting to a closed port?

If I'm reading that log correctly, you're seeing backscatter from a spoofed-packet denial-of-service attack (possibly a SYN flood) against a webserver running on abc.a.b.c. The constant destination ...
user avatar
  • 34.4k
3 votes

Port Knocking using only Iptables/netfilter

It looks like you are using this howto. You may want to look at this howto instead. The key issue here is that you're using the --set parameter in conjunction with -m recent, whereas the linked howto ...
user avatar
3 votes

How to set iptables to drop packets that I'm not listening on?

If never seen this done without a script, so here is a baseline script for you to accomplish this: checkht="lsof -c httpd | awk '{print $1}' | uniq | grep h" if [ -n "$checkht" ]; then echo "...
user avatar
  • 8,652

Only top scored, non community-wiki answers of a minimum length are eligible