Tag Info

New answers tagged

0

For outgoing connections, e.g.: sudo iptables -I OUTPUT -p tcp -m tcp --dport 22 -m state --state NEW,ESTABLISHED -j LOG --log-prefix "Outgoing SSH connection " Check the log entries: less /var/log/kern.log If you reboot, your iptables configuration disappears. Save your configuration with: sudo iptables-save > /etc/iptables.rules sudo nano ...


1

No, iptables does not support jitter simulation.


0

You can Enhance your security by enable roundcube section Roundcube does have captcha plugins available which will mitigate this, but users will complain if they have to type in a captcha to login for mail. Fail2ban provides an easy solution for this. First up, we need to add roundcube into /etc/fail2ban/jail.conf [roundcube] enabled = false port = ...


1

Use the iptables-save command instead. Firewall rules should never go into rc.local script. rc.local is the last thing to be executed. If a block rule has been placed into rc.local there is a small time frame where an attacker can exploit a rule not being in place. While it probably doesn't matter with this situation, it is still best to not get into a bad ...


1

You ask 4 questions. I can answer 3 of them. Any required module will be loaded automatically by iptables when it is required. Some years ago, modules had to be specifically loaded. Some critical applications still force load the modules, so that there is no delay when iptables realizes it needs the module. Now, the issue with your MAC related iptables ...


0

This: sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE Should be this: sudo iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE


1

You do not need to depend on the NAT in the DSL modem, you can still do it on the Ubuntu router box, even with a dynamic public IP address. You wouldn't want to do it unless you are confident in the security of your iptables rule set. Sometimes DSL modem/routers have no option to turn off the router (NAT) stuff, in which case what you are doing is fine. And ...


2

Use double quotes: iptables -A INPUT -i em1 -j LOG --log-prefix="iptables1: " iptables -t nat -A PREROUTING -i em1 -j LOG --log-prefix="iptables2: " What log-prefix mean: --log-prefix - When logging, put this text before the log message. Use double quotes around the text to use. Source


1

You cannot specify an aliased interface name with iptables, only an actual interface name. The trick is to add the destination IP address as an additional condition. Also you do not need the -m tcp part. So if you wanted to accept traffic to port 80 on both aliased interfaces, the rules would be: -A INPUT -i venet0 -d xx.xx.xx.xx -p tcp --dport 80 -j ACCEPT ...


0

Please be more precise about your Internet-Connection. First of all the tutorial uses a normal internal network on eth0 with a private subnet. Your's is set to dhcp. Are you sure you can get into the internet at all? Does eth0 on the gw machine get an ip address? Check this with ip a if it does, then try to ping and resolve google on the gw machine ...


0

I found out reason why it was not working. The reason was absence of xt_recent in the kernel. So solution was: modprobe xt_recent


0

If you do have a lot of rules you should also consider using ipset in conjunction with iptables. Ipset uses an indexed database table and is a lot faster than iptables when looking up an address to decide whether to accept or deny. http://ipset.netfilter.org/index.html


1

This is the content of your sudoers file? www-data ALL=(ALL) NOPASSWD: /sbin/iptables Make sure to pass the full path of the executable. Here is code in python: #!/usr/bin/env python3 import subprocess as sp sp.call(['sudo', '/sbin/iptables' , '-S']) Here is someone who encountered a similar problem in PHP: ...



Top 50 recent answers are included