I just set up my firewall following the wiki, just the basics down to the knocking section.After I restarted my connection Firefox works which is great, although so does Transmission.. This leads me to think maybe my firewall is not working correctly, as the only ports I opened were 80 and 53.
I have the following rule,which i believe will restrict icmp packets to 1/s.
I'm currently trying to get a little better understanding of iptables, and I am reading through the wiki page for Simple Stateful Firewall athttps://wiki.archlinux.org/index.php/Si … l_firewall , which is full of great examples.On this wiki, they create two user-defined chains, TCP, and UDP:iptables -N TCP
iptables -N UDPIt appears that they send new incoming tcp or udp traffic to these user-
I'd like to allow mail through iptables and DROP policy but this script doesn't work what it is wrong here:
## FLUSH de reglas
iptables -F
iptables -X
iptables -Z
iptables -t nat -F
## policy
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP
# localhost
iptables -A INPUT -i lo -j ACCEPT
# Allow my ip
iptables -A INPUT -s MY_IP -j ACCEPT
# 80 port
iptables -A I
For the following iptables rule:
iptables -A INPUT -p icmp -m icmp --icmp-type 255 -j ACCEPT
I am not sure what the point of "-m" is given that "-p" is already present. Does it serve any purpose in this case?
What's the practical difference between:
iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
and
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
Which one is best to use?
Thank you.
In my iptables script I have been experimenting with writing as finely grained rules as possible. I limit which users are allowed to use which services, partly for security and partly as a learning exercise.
Using iptables v1.4.16.2 on Debian 6.0.6 running the 3.6.2 kernel.
However I've hit an issue I don't quite understand yet.. .
outgoing ports for all users
This works perfectly fine.
Exercise:
Protection of WEB and DNS servers using the context-free rules for packet filtering:
- Protect your WEB-server, so that would be for him can be accessed by browsers, and could go to dns.
- Protect your primary DNS-server so that it could be to contact clients and secondary servers.
- Allow ICMP ping to / from your site (s).
- the rest is declined.
My solution that:
Code:
Hi
I'm having some problems with my VPS running Ubuntu Server 11.04 x64.
Email this page
