Security :: Drop Inbound Traffic To Port 80 (http) From Source Ports Less Than 1024?

Feb 1, 2011

I'm simply trying to make a little restriction on www packets under two rules:

1. Allow inbound/outbound www packets (works!)

2. DROP inbound traffic to port 80 from source ports less than 1024. (DOES NOT WORK!)

Now, technically, when i use hping to test my rules, hping3 192.168.100.100 -S -p80 -s 1023 I should NOT receive any packets. However, i still receive packets, which means my rule that says less than 1024 does not work. (see below)

And this is my iptables rules in shell-script so far:

#!/bin/sh
DEFAULT_NIC=eth0
SERVER_IP="192.168.100.100"
ALLOWED_WWW_PORT=80
IPT="/sbin/iptables"

[Code].....

View 1 Replies


ADVERTISEMENT

Security :: Firewall Deny Traffic Inbound Destination Port 53372 & 53375?

May 5, 2010

I have a question, on my firewall at work I am seeing a constant flow of denies from many different source IP addresses, of tcp/udp destination port 53372 & 53375.What in the world is that, and why these two ports over and over

View 1 Replies View Related

Security :: Updates: Specify Source Port For Traffic?

Dec 14, 2010

I've a server, and I want to drop all the traffic going out with other source port than 80 (apache) and 22(ssh). The reason is I want to prevent my machine sending packets I don't know (i.e. my server scanning networks or making DDOS attacks without my knowledge). The problem are the updates. If I do what I've said, the updates will not work. I want to allow updates, so I need to let DNS traffic (port 53) and the traffic of the updates to go out.

The problem is the source port. This traffic uses a dynamic port (I think like HTTP). Is there any way to specify a source port to do this? If a have a static port to do this, I would drop all the traffic going out with other port than 22,53,80 and this port.

View 3 Replies View Related

Security :: SELinux Allow Non Root User Bind To Port <1024?

Oct 24, 2010

My understanding is SELinux adds type enforcement to standard Linux. This means that both the standard Linux and enhanced SELinux access controls must be satisfied to access an object. Which means that thing that is prevented to do in the normal standard Linux will be also prevented in the SELinux System? Does SELinux make it possible to run a non-root software to bind to a port < 1024? something that standard Linux won't allow? If not, what other suggestions do you have for allowing a program to run as non-root but able to bind to privileged ports? I know all about using the port re-direction such as ipchains, iptables.

View 4 Replies View Related

Ubuntu Security :: Reject Versus Drop For Outbound Traffic

Apr 15, 2011

I understand the difference between Reject vs Drop for incoming traffic, but are there any differences between reject and drop for Outbound Traffic? Are there reasons to pick one over the other or are they functionally identical when talking about Outbound traffic?

View 6 Replies View Related

Security :: Iptables: Verify Traffic On Port To Check If It Is Legitimate For That Port?

Apr 18, 2011

Is there any way to verify if packets being trafficked over a certain port are valid for the service you want to use this port for?

One obvious example that probably clarifies my question:
When I open port 443 (outgoing or incoming) for https/ssl traffic, I don't want this port to be used for say openvpn traffic.
Thus: when someone wants to surf to a website with https, it should be ok but if someone wants to connect to his home openvpn server over that same port, it should be blocked.

View 5 Replies View Related

General :: How To Enable Inbound Traffic

Jul 20, 2010

1. It is definitely my system and not the router. I had been accepting these connections just fine on my Fedora 6 system, but upgraded to FC11 and haven't been able to get these inbound connections working. I still have the drive with the FC6 system and whenever I put the old drive in the system, the connections work fine. So, the hardware, wiring, etc is identical between the FC6 and FC11 systems.

2. The system's firewall is disabled. iptables, and ip6tables are turned off both at startup (e.g., chkconfig iptables off) and using "service iptables stop". (Note--my router also works as a firewall)

3. sshd and httpd are both on and listening on all interfaces. "nmap -P0 -p 22,80 127.0.0.1" shows both ports open, as does 192.168.1.80. But when I use the same command looping through the external IP, the ports are filtered:

Host is up.
PORT STATE SERVICE
22/tcp filtered ssh
80/tcp filtered http

4. hosts.deny is empty.

5. The messages and secure logs do not show anything in response to the nmap scans.

Again, I'd have sworn this was my router, except that it cleanly allows the traffic when I swap the drives in my system.

View 9 Replies View Related

Ubuntu Security :: Drop Igmp Port 0 Packets With Iptables Rule?

Jan 3, 2011

how can i drop igmp port 0 packets with iptables rule? my log file is full of this router advertisement.

View 2 Replies View Related

Ubuntu Security :: Iptables To Redirect Traffic Back To Its Source

May 3, 2011

I'm currently using a homemade Python script to parse script kiddie IP addresses from logfiles.To this point, I've simply been DROPping any requests from these IPs using iptables.I thought it might be fun to redirect their traffic back to them, but as I am not an expert at iptables, I was wondering if I should use FORWARD or PREROUTING.

View 7 Replies View Related

Software :: Using Squid/Iptables To Redirect Inbound Web Traffic To Url/IP

Jan 13, 2010

We host a web server in which we are hoping to implement some form of traffic redirection based on source IP address, and I am wondering whether the squid proxy built on iptables would be capable of managing this task? Essentially we are trying to redirect traffic from specific set of source IP ranges to a "Your IP has been restricted" type of page at a different IP/FQDN.

View 2 Replies View Related

Software :: Allow Non Root Users To Bind To Ports Less Than 1024?

Aug 2, 2011

Have a program, erlang, that needs to bind to a port lower than 1024, as a non-root user. How do you allow that on a system?

View 1 Replies View Related

Fedora Networking :: Root Can Not Bind Socket On Lower Ports (<1024)?

May 9, 2010

I am encountering a wierd problem in FC12. When I try to lunch a program that listens to a lower port such as 80 or any one that is less than 1024, I always get "Permission denied" error message (I am running it as root!).Then I try starting httpd service daemon that listens to 80, no errors, the daemon started and listend to 80.PS: I checked selinux, it has been disabled.Do you have any knowledge on this case? BTW, the kernel version is:2.6.31.5-127.fc12.i686.PAE #1 SMP Sat Nov 7 21:25:57 EST 2009 i686 i686 i386 GNU/Linux

View 5 Replies View Related

General :: Listing All Ports Less Then 1024 On Current Machine Which Are In Listening State

Oct 23, 2010

I'm trying to list all ports less then 1024 on my current machine which are open in the listening state, one port per line

View 1 Replies View Related

Server :: Sendmail For Inbound Mail And Redirecting Them Internally To Other Port?

Mar 22, 2011

I have configured a sendmail MTA for incoming mails in a network and by using IPtables i have redirected the traffic internally to other port where one more SMTP by a application is running.Iptables rule:

iptables -A INPUT -i eth0 -p tcp --dport 25 -j ACCEPT
iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 25 -j REDIRECT --to-port 25000

My sendmail config is as below.

Sendmail.mc
define(`SMART_HOST', `relay:host.subdomain.mydomain.com')dnl
dnl # define(`RELAY_MAILER',`esmtp')dnl

[code]...

View 2 Replies View Related

Networking :: IPTables - Setting Output To Drop And Add Traffic

Feb 21, 2011

I need to set OUTPUT to DROP, and add the outgoing traffic one by one, but I couldn't do it. My current config is as follows:

Code:
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
:RH-Firewall-1-OUTPUT - [0:0]
-A INPUT -j RH-Firewall-1-OUTPUT
#previously ESTABLISHED,RELATED comm is ok
-A RH-Firewall-1-INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
#80 is ok from all
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT

If I change OUTPUT to DROP in :OUTPUT ACCEPT [0:0], I don't get any response from a server running in that box. I am using RHEL 5.5. Now, asking Red Hat is not an option: I have the license but I don't have support license.

View 3 Replies View Related

Ubuntu Security :: 10.10 - Inbound Connections And Firestarter

Apr 6, 2011

I am running Ubuntu 10.10 I have an question about the firewall Firestarter, when checking the firewall it told me there are 9 serious incoming connections what must I do with this info. Inbound is normally blocked as standard i have also see that someone with port 1234 and 12345 have trying to attempt mine system but failed all trojan ports are fully blocked.

View 2 Replies View Related

Security :: Adjust Iptables To Only Inbound Syn Connections

Apr 7, 2011

I'm trying to adjust the firewall to only inbound syn connections.

To Allow all home subnets access to port 53 both tcp/udp but deny the rest.

View 1 Replies View Related

Networking :: Opening Ports In Debian For Local Net Traffic

Apr 24, 2010

I have a fairly clean install of Debian 5.04 on a G5 tower and am having some local network sharing problems. The machine linuxG5 has an address of 192.168.1.4 and when I am logged into that machine I get the following output

silver@linuxG5:~$ nmap localhost
Starting Nmap 4.62 ( http://nmap.org ) at 2010-04-24 10:19 EDT
Interesting ports on localhost (127.0.0.1):
Not shown: 1706 closed ports
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
25/tcp open smtp
[Code]...

View 2 Replies View Related

General :: Configure Iptables For Only HTTP And HTTPS Traffic

Aug 11, 2011

I am trying to configure iptables for only HTTP and HTTPS traffic. I start by blocking all traffic, which works, via:

Code:
iptables -F
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

I then try to allow HTTP and HTTPS on eth0 with these commands, which does not work:

Code:
iptables -A INPUT -i eth0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT

Code:
iptables -A INPUT -i eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT After these commands I should be able to access the internet. Does anyone know why this is not working?

View 4 Replies View Related

Server :: Duplicating Http-traffic For Testing Purposes?

Jan 3, 2011

is any apache-module out there that allows duplicating traffic?

I want to test an new Application Server by duplicating the traffic from the old production system. Answers of the new will be DROPped ...

View 1 Replies View Related

General :: Block All Ports Except SSH / HTTP In Ipchains And Iptables?

Jun 15, 2010

How can I block all ports except

ssh (port 22)
httpd (port 80)

using iptables and iphains?

View 1 Replies View Related

Server :: Will Squid Work To Reverse Proxy Non-HTTP Traffic?

Aug 2, 2011

I have searched and searched for a reverse proxy solution for non-website traffic. TCP but not http, on ports other than 80, 443, 8080, etc. Basically I just need a TCP forwarder that works with multiple TCP servers, WITHOUT webpage caching features. I do not need or want any webpage caching. Can squid work as a reverse proxy for TCP traffic without http? The other program I came across in searching was HAproxy. Both programs are for http but I am curious if they would work for TCP servers that do not serve webpages.

View 2 Replies View Related

Ubuntu Networking :: Redirect All Http/https/ftp Traffic Through The Remote Proxy?

Apr 6, 2011

I need to redirect all http/https/ftp traffic through the remote proxy, but when I changes connection settings in browser or in System->Preferences->Network Proxy it doesn't work well: instead of getting page content browser asks for saving some short (8 bytes) file with the same content for all requested pages. It happens in Chrome/Opera/Firefox. This proxy requires authorization and works on computer with Windos XP. It worked well when I was using Windows 7 and Proxifier, now I have Ubuntu 9.10 with all available updates.

View 3 Replies View Related

Server :: Will Squid Or HAproxy Work To Reverse Proxy Non-http Traffic

Apr 19, 2011

Will squid or HAproxy work to reverse proxy non-http traffic? I have searched and searched for a reverse proxy solution for non-website traffic. TCP but not http, on ports other than 80, 443, 8080, etc. Basically I just need a TCP forwarder that works with multiple TCP servers, WITHOUT webpage caching features. I do not need or want any webpage caching. Can squid work as a reverse proxy for TCP traffic without http? The other program I came across in searching was HAproxy. Both programs are for http but I am curious if they would work for TCP servers that do not serve webpages.

View 4 Replies View Related

Server :: Monitoring Tool (like Ntop) To Preserve Statistics For Http Traffic?

Jun 17, 2010

I'm looking for a monitoring tool like ntop, but can preserve statistics for http traffic.

View 1 Replies View Related

OpenSUSE Network :: Internet Freezes \ It Allows Only Connections To Dst Ports Tcp 80 (http), Udp 53 (dns) And No Frags?

May 19, 2010

I have troubels with internet, on different Linux x64 systems on my laptop(Lenovo ThinkPad sl510), but if I load WindowsPE all is OK ( what coud it be? where to search?There is an hardwere firewall/nat/gateway in my local network, it allows only connections to dst ports tcp 80 (http), udp 53 (dns) and no frags, no icmp, deny in and etc. But Windows Internet (the same Firefox) works fine , and under Linux sites doesn't loding full or "connetion timed out"...But if I have can start downloading any file it would be downloaded full (I have downloaded DVD iso of SuSe)Dns throu nslookup responce not evry time...Decreasing of MTU to 1372 didn't help (( Deactivating ip v6 also....What coud it be? What is different betwin Windows and Linux in DNS clients is any alternative dns client in SuSe? Is the trouble only in DNS?

View 1 Replies View Related

CentOS 5 Networking :: Check If Clamav Is Scanning HTTP Traffic Squid Proxy Server?

May 21, 2011

I'm trying to setup a Centos 5.6 Squid Proxy Server with Content Filtering & Antivirus Scanning Incoming HTTP Traffic from the Internet

I then proceeded to setup an configure the Proxy Server, i was able to test and confirm that Squid and Dansguardian Content Filter is working, however i dont know if Clamav is scanning HTTP traffic before it hits the client/server. Is there a way i can check if the Antivirus scanning is working.. is there some log file or real world test i can i can do to confirm that Clamav is scanning incoming traffic or even blocking potential viruses ??

Anyone who has squid proxy server with Clamav configured and its working can share there settings/setup with me and how they tested it ??

View 1 Replies View Related

General :: What Is Source / Destination Ports

Mar 9, 2011

I want to know what is a source port and what is a destination port.

View 7 Replies View Related

Ubuntu :: Open Source Web Traffic Monitor?

Jan 20, 2010

Does anyone knows of any open source proxy/web traffic monitoring application so I can run reports on users web browsing for Linux? Something equivalent to websense? but free I'm not really concern about blocking any traffic only running reports.

View 2 Replies View Related

Networking :: Get To Accept Traffic On A Given Port?

Oct 13, 2010

I've got a Slackware 12.2 system that I'm trying to get to accept traffic on a given port, let's say 34521. When I use canyouseeme.org, to see if that port is responding, it is not.

I've put in an iptables entry to accept traffic on that port, is there anything else I need to do?

View 6 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved