assist me in using the iptables firewall to block all incoming mail traffic (SMTP port 25) except that of a certain IP(s)? the situation is that we have a server that we only want to receive mail from a particular sender.
View 1 RepliesI have a ubuntu computer set up as bridge between gateway and lan, with the lan connected to eth0 and gateway on eth1.
I'm trying to get it to basically block everything incoming except for the ports i specify, but also allow outgoing traffic. I've found, tried, modified som examples i found on the web, but still it wont block incoming traffic (ie, im still able to reach my webserver)
These are the rules, and i can't figure out why it wont block:
Code:
#!/bin/bash
iptables -F
iptables -X
iptables -I INPUT -i eth1 -j DROP
[Code].....
I need to configure iptables to block incoming traffic (except specific ports), but allows all outgoing traffic.
I am able to block incoming traffic, but doing so also prevents outgoing traffic (tested by telnet [URL] 80)
The following was used:
iptables -A INPUT -p tcp --dport ssh -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -I INPUT 1 -i lo -j ACCEPT
iptables -A INPUT -j DROP
Also, even allowing NOT SYN requests still prevents outgoing traffic.
iptables -I INPUT 1 -p tcp ! --syn -j ACCEPT
Another point:
# modinfo ipt_state
modinfo: could not open /lib/modules/2.6.18-028stab070.14/modules.dep
How to install ipt_state module on ubuntu?
I need to set up my centOS computer as a firewall in my home network. Ive got 2 interfaces, eth0 and eth1. I want to allow and forward all traffic on eth0 and block all traffic on eth1 except ssh, ping(icmp) and DNS. How do I do this? Ive tried some editing in /etc/sysconfig/iptables but no luck.
View 1 Replies View RelatedI wanted to tell my server to block all traffic but US only traffic. So i followed this guide:[URL].. Now I know, it's the best way to help prevent hackers/crackers (doesn't matter to me what they are called. I just have to stop them). My server only deals with US clients anyways so might as well just start right there for my server's security before getting into the brute force and injection preventions. So I got it all done compiled everything moved to the proper directory. I then started to setup my iptables. Like so
Code: iptables -F INPUT
iptables -F OUTPUT
iptables -I INPUT 1 -s *.*.*.* -p tcp --dport 22 -j ACCEPT
iptables -I INPUT 2 -s *.*.*.* -p tcp -j ACCEPT
[Code]...
After seeing that i went digging in the code and figured it was something todo with memory allocation.
My laptop has become very sluggish. So I loaded firestarter firewall. It is reporting loads of incoming UDP traffic. I only use this machine for Skype and Firefox based work as most of my stuff is kept on the cloud. Is it safe to stop all this UDP traffic? It would free up my CPU I guess. It seems port 56095 is getting hammered.
View 8 Replies View RelatedBefore explaining the problem, I have to draw the environment. Because of post size limitations, I'll have to break this post in more than one entry.
Physical view
Code:
+--------+ +---+
|storage1|-----| |
+--------+ | s |
| w |
+--------+ | i | +-------+
|router2 |-----| t |-----|router1|--->Internet
+--------+ | c | +-------+
| h |
+--------+ | 8 |
|router3 |-----| |
+--------+ +---+
Device details
[Code]....
I am running the latest ubuntu. Sometimes it randomly stops accepting ssh connections, afp/smb connections, and even stops responding to pinging. It is connected via WIFI.
I go over to the desktop and use the browser, and the internet still works fine. Then after a while, it starts accepting incoming traffic again.
I have set up a Virtual machine on a dedicated server from 1and1. I hoped to use a bridge to give the vm direct access to the internet but 1and1 do mac filtering and so the only option is to use NAT.
I used Virtual Machine Manager on my Ubuntu 10.04 machine at home to install Debain Lenny on the vm on the server using KVM and all went well. I put it on a virtual network 192.168.100.0 and i can access it from the host and i can access the internet from the guest using NAT that libvirt set-up.
I bought another ip address from 1and1 with the hope of forwarding packets to the new ip address 11.22.33.02 to the guest vm.
I have tried all sorts of routing rules using iptables without any success.
my virtual network is on virbr1 the guest ip is 192.168.100.50 my external network device is ip say 11.22.33.01 on eth0 with the secondary ip say 11.22.33.02 on eth0:1
Here are the latest rules i tried:
Quote:
iptables -t nat -A PREROUTING -d 11.22.33.02 -i eth0 -j DNAT --to-destination 192.168.100.50
iptables -t nat -A POSTROUTING -s 192.168.100.50 -o eth0 -j SNAT --to-source 11.22.33.02
iptables -A FORWARD -p tcp -i eth0 -o virbr1 -d 192.168.100.50 -m state --state NEW -j ACCEPT
iptables -A FORWARD -t filter -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
[Code].....
OS : CentOS 5.3 64bit How to trace incoming and outgoing network traffic for a give user? User 'A' logs in to the system and does various network connectivity As root user need to find what are the outgoing and incoming connection that are related with user 'A'. basically need to check the connection flow. netstat will show ESTABLISHED, LISTEN etc.. need something like tcpdump
Eg:- --user option for tcpdump tcpdump -vv -nn -i eth0 host 10.200.2.1 and tcp dst port 8080 --user A Can someone tell me any tool which can do such thing? Even if it can show the process ID of the client application which is trying to establish network connectivity will do.
I am still new to ubuntu and I use firestarter as my firewall tool and I was told that its just ufw in a gui. Well anyways I noticed a connection to 174.129.241.144 using https and python, I didn't have any scripts running and my browser was closed, I read the man files for ufw and it said to do something like deny from 174.129.0.0/12 and I want to block all incoming and outgoing connections to this IP range and I was wondering how to do that, I heard of iptables that it would be able to do this but I dont know anything about it. What I should learn so I can handle these kinds of situation in the future and how I can block this ip subnet or also what does the /8, /12, and /16 stand for?
View 7 Replies View RelatedI want to use iptables to automatically block all IP addresses who send UDP packets with length 11 more than 3 times per 10 seconds.
View 1 Replies View RelatedI'm using postfix on Ubuntu 9.10 and all I need is to occasionally send automated emails from perl or php scripts when data processing errors occur. In other words, I want to reject any connection attempts from remote clients and otherwise allow nothing except outgoing emails from one particular account.f I add this line to the default main.cf, will it do the trick or is it more complicated?
Code:
smtpd_sender_restrictions reject
i need is to have http and https allowed, together with mail server (incoming and outgoing) and ftp, ftps and ssh. all other ports have to be closed.
View 3 Replies View RelatedI have two nagging problems on one network which I do not have on another elsewhere, both using uptodate Debian servers. The server is on the private subnet behind a router/adsl modem. The symptoms of the one which does not work
1) Users cannot access their web site from lan. If they try, they get to the router web interface, same as if they entered http:10.0.0.138 which is the router's lan address.
2) Users cannot access smtp or pop3 service using the domain name, they can access it only using the servers LAN address.
I fear that I might have not set up the router properly because appart from that the two servers are almost identical but I do not know where I might have made an error.
Mail going to invalid email addresses are being forwarded to postmaster@domain instead of being bounced. How can I fix this? postconf -d | grep mail_version gives the following: mail_version = 2.2.5
View 4 Replies View Relateda good IPTABLES protocol to reject all incoming ssh trafiic except for a single IP or IP range?
View 4 Replies View RelatedI need some suggestions on software. I would like to offer remote desktop support to some of our clients, but some of them are using ISP's that block incoming connections so, VNC is out of the question. I was wondering if there is something similar to logmein for ubuntu?
View 1 Replies View RelatedI'm trying to block an incoming URL. My ISP is hijacking 404 pages and annoyingly changing the URL line in the browser and flashing all sorts of popup ads. I just need it for incoming URLs which my router doesn't seem to handle. I'd prefer something packaged with Ubuntu 8.04, but anything simple will do. I know in KDE I could edit the kdeglobals file with:
[KDE URL Restrictions]
rule_1=open,,,,[URL],,false
rule_count=1
I have set up an openvpn server on ubuntu via port tcp 443. The server use a public network and almost every ports are blocked (not 443) So when a client connect to the server, if it send traffic needing a blocked port, the connection cannot been etablished of course. So i d like to know if it is possible to redirect all incoming traffic on the server to an other unblocked port (like 443) to bypass firewall.
I dont think openvpn offer this possibility but maybe with linux it is possible..
What is the absolute quickest or easiest way to block an incoming connection by their IP address? I'm running an apache2 LAMP server on Ubuntu 8.10. For example, let's say I'm watching my server error logs and I see someone using a script to check for phpmyadmin and other such folders. Right away I know this is a hack attempt. Firestarter does not allow ANY way to block an incoming connection by IP (to my disappointment) and adding the IP to an apache configuration file requires an apache restart (way too much trouble and time).
View 5 Replies View Relatednow I have managed my rsyslogd to log the firewall into a separate file I would like to use a script which looks into this file for intruders which for example try to ping, telnet, ssh, rdp etc into my dsl connection.And then use a kind of app or firewall on my ubuntu server to block them.Yes my firewall logs them but does not block them if the policy is enabled, so they have access on through the firewall and the connect to my server but I only want some known IP addresses have access through it and this I cannot program in the firewall so I have to use some extras.Or am I thinking way to far and is there a better solution with IPtables or app?Is it possible to watch tcp connections between the firewall from outside IP addresses and the ubuntu server?
View 7 Replies View RelatedI am setting up a server that is to serve websites and host mail.I have run into a problem regarding the mail server. The server is completely set up but for some reason it is not receiving the e-mails I am trying to send to it. When i mail to the associated mail address from internal by the "mail" command it works fine. But when I try from an external mail server, the mail never gets through. And I do not receive a bounce e-mail.
It says that the port 25 IS open for TCP connections (in iptables - I opened it myself). And surely when I telnet to it on that port from inside the server, I get an connection. But when I telnet from an external network I get a refused connection. It would sound that the port is in fact not really open for external use, in my mind, but it is. Is there possibly anything else I might have neglected to check in this mystery
I'm trying to set up my laptop to be as anonymous as possible with Tor. I want to block all non-Tor traffic from leaving the computer. I was looking to find an firewall that filters by PID, so only Tor can send traffic out. Does something like this exist?
I also considered setting up some kind of TUN/TAP interface that tunneled through Tor's SOCKS proxy, but couldn't find anything that does this.
i'm using Thunderbird as mailclient.n i receive a new mail, i want TB to run an application (which blinks my notebook-keyboardlight ).Is there a way to do that?And btw. does someone know, how to minimize TB 3 in the systray of gnome (Fedora 12)?to get the mailnotification icon in the systray?
View 2 Replies View RelatedI'm running SuSE 11 with sendmail and dovecot.I'm sending and receiving mail. But as soon as someone sends me a mail with an attachment over 1mg it seems to fail. I have no problem sending big attachments.
View 7 Replies View RelatedI plan to make a script for the console server via mail, but I find difficulties in the reading of email applications, to email me using the mail command, but how to read the incoming mail
View 1 Replies View RelatedI installed a new server running CentOS 5.2. I have iptables and SELinux off. The new server will not accept incoming mail. It will send out fine.Our mail server redirects mail for it.help to it.[url]...- [url]....is this server. Any messages sent to this address get stuck in a deferred queue. The error message on each one (from the mail server admin console) is "connection to[url]... [10.9.10.202] - connection refused". I can ping [url].... from the mail server.
This seems like a firewall issue, but it is off. Is there some configuration file I need to change to allow incoming mail? Or is there some test I can run on the new server to further troubleshoot what is going on
I'm trying to set up my Thunderbird 3.1.8 (running on Ubuntu 10.04 LTS) to play a .wav file of my choice when new mail arrives. The file I've chosen is 8,8 KB in size and lasts 3 seconds. I've selected the "Play a sound" + "Use the following sound file" options in my Preferences, but only the first second (if that) of the sound gets played - both when I click the "Play" button in the Preferences menu to test it, as well as when receiving mail. Restarting the program with my new settings doesn't help.
Actual question(s):
- Is there a limit on the size/duration of the sound one can use for such a signal in this program?
- Is there any way to modify this limit?
I have computers in the DMZ (192.168.1.0/24) .. How to block traffic initiated from computers in the DMZ?
View 3 Replies View Related