Security :: Anyway To NOT Log Dropped Ports 137 / 138 In Iptables?

Mar 30, 2011

We do NOT support samba on our Unbuntu servers but still zillions of windows machines are constantly trying to connect on the SMB ports. I've added a rule that drops access to destination ports 137-138 and that seems to work. But it creates many many log entries documenting that the packet has been dropped. I've been researching and cannot come up with a way to suppress logging for these drops.

View 4 Replies


Ubuntu Security :: Block All Ports Except Pop And Smtp In NAT Through Iptables?

Jan 20, 2010

how to block all ports except pop,pop3,smtp in nat using iptables in squid on redhat A3

View 2 Replies View Related

Networking :: Cant Open Any Ports In Iptables?

May 14, 2009

Since there was no response on my other post which i spent about a hour writing, ill go for something simpler. I run this on my server

# set default policy for the NAT table
iptables -t nat -P PREROUTING ACCEPT


View 9 Replies View Related

Networking :: Forwarding Ports With Iptables?

Dec 23, 2010

I am running a server with ssh and a vpn server set up. It is behind a debian router with a firewall which uses iptables. i have it set up to forward ports 22 and 443 to ssh on a computer within the LAN(so when on a restricted network i can still ssh into my network) and forward anything to 1723(for my vpn) to that box also. However, the only port that gets successfully forwarded is port 22. The other two appear closed. here is what the script looks like:



View 2 Replies View Related

Security :: Logging DROPPED And INVALID Packets

Oct 18, 2010

I am trying to figure out what command to use to show the number of DROPPED and INVALID packets that the firewall is handling.I'm going to put these commands into a log analyzer script which will run every 15 minutes with cron. The firewall is running and operating the way I want it to. I'm running CentOS 5.4.

View 2 Replies View Related

Fedora Networking :: Iptables On Bridge Ports?

Apr 21, 2011

I'd like to pass all traffic between bridge ports via the FORWARDING chain, so I changed following sysctl parameters:

net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1


View 1 Replies View Related

Networking :: Set Any Ports On Iptables For One Specific Host Only?

Feb 16, 2011

I like to set in iptables to allow access from one host to my server on any ports.

Currently the iptables have been configured to deny all and to allow access only to those I've specified.

Can anyone advice on the command to achieve this?

View 1 Replies View Related

Networking :: Iptables - Portforward To External IP And Ports?

Jun 30, 2011

I want to portforward client connections from an ubuntu lts server to another external server. btw i am a noob on iptables. i have tryed using the basic commands for iptables with no success. For example:iptables -A PREROUTING -t nat -i eth1 -p tcp --dport 7878 -j DNAT --to -A FORWARD -p tcp -i eth1 -o eth0 -d --dport 7878 -j ACCEPTso basically i just want a rediraction for from one ip to another. Example: A client tries to connect to ip on port 7878 and the server forwards him to ip xx.xx.xx.xx on port 7878, meaning that xx.xx.xx.xx is the actual server with services. Server with ip is only forwarding the client to external ip... how can this be done in a simple command?

View 7 Replies View Related

Software :: Configure IPTABLES To Allow Certain IP Ranges To Ports 25 And 465?

Feb 16, 2011

I have a mail server with IPTABLES enabled.I want to allow access to:


View 7 Replies View Related

Software :: Open Ports Using Iptables From Shell?

Sep 18, 2009

I am trying to open VNC ports(5901,5902) on my RHLinux machine using iptables. I am able to do it from GUI system-config-security. Go to the Administration > Security Level and Firewall, then select "other ports" at the bottom and enter the portNum 5901 to open and select tcp, then click OK and OK again to save your settings. From my windows m/n iam able to open vncsession using vncviewer on 5901 port.But when I am trying to do it from command line:#iptables -A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 5901 -j ACCEPTThis command added the entry in /etc/sysconfig/iptables and listed in iptables -L command.Then I saved and restarted the iptables.#service iptables save
#service iptables restartWhen I am trying to open the VNC session from vncviewer, it is giving me error and session not opened.Is there some thing I missed here? where can I check the logs for this? I definetly need

View 3 Replies View Related

OpenSUSE Network :: Block All Ports But Port 80 With Iptables (DMZ)?

Jun 25, 2010

I have a Suse 10.3 router with 4 network cards. 1 is to connect to the big network and thereby also the internet, 2 are for 'client' subnets and I want to use the last one as a DMZ. In this DMZ will be a web server which has to be accessible from the other 2 subnets and from the big network. I could do it with a few simple clicks in Yast firewall, but I have some issues with this firewall and there for I want to use it as minimal as possible, using Iptables.

So now I'm struggling a bit with Iptables. Basicly what I'm looking for is how to block all ports but 80 in this last subnet with iptables.

View 5 Replies View Related

General :: Block All Ports Except SSH / HTTP In Ipchains And Iptables?

Jun 15, 2010

How can I block all ports except

ssh (port 22)
httpd (port 80)

using iptables and iphains?

View 1 Replies View Related

Ubuntu Servers :: Iptables Allow Ports To A Specific Ip Or Domain Name?

Jul 23, 2010

How to configure iptables to allow only 22,80,3306 ports for only a dynamic public ip/dyn dns domain name on a ubuntu server?

View 9 Replies View Related

Ubuntu Networking :: Set Any Ports On Iptables For One Specific Host Only?

Feb 15, 2011

I like to set in iptables to allow access from one host to my server on any ports.Currently the iptables have been configured to deny all and to allow access only to those I've specified.

View 2 Replies View Related

Networking :: Configuring Iptables To Locally Translate Some Ports?

Apr 27, 2011

Because my ISP is blocking every IP port under 1000, I'd like my local nat'ed server to be able to translate incoming and outgoing traffic from some port above 1000 to the default server port locally.Example :

To connect to my IMAP server (default port : 143) from the outside,I'd connect to my public IP, port 1143 (opened and nat'ed to the right server on my router) and the server would translate this port to 143 on the same machine.I wish I could simply configure my router to do that but sadly Linksys doesn't permit such setting... I also could modify the listening port of my server but I prefear to keep the default port inside my network.I think that iptables is the right tool to do that and I never used it and I must say that this tool is not so easy to configure at first sigh

View 5 Replies View Related

Networking :: SQUID Intercept IPtables - Whitelisting Ports And Sites

Jul 6, 2011

I'm having some issues settings up a transparent proxy server, which should allow only regular web browsing (port 80), any other port (including HTTPS (443)) has to be blocked, as well as any other port. Right now, I'm using Debian 6 and Squid3. The server only has one NIC. The topology is like this:
Clients <-> Proxy Server + DHCP Server <-> Internet

With this setup, the network does have internet access and the websites I whitelisted are the only ones accesible via browser, however port block is not working, every port is open, hence why trying to access blacklisted websites through HTTPS is possible. Seems to me Squid3 is doing it's job fine, however IPTABLES for some reason seems to be redirecting all the trafic to port 3128 (Squid3 port). I could be wrong, but I've been unable to do anything related to ports with squid3 (either whitelisting or blacklisting).

For Iptables I used:
iptables -A PREROUTING -t nat -i eth0 -p tcp -j REDIRECT --dport 80 --to-port 3128
iptables -A INPUT -i eth0 -m tcp -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -i eth0 -m tcp -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -i eth0 -m tcp -p tcp --dport 3128 -j ACCEPT
iptables -A INPUT -i eth0 -m tcp -p tcp --dport 443 -j DROP

Squid3 config:
acl manager proto cache_object
acl localhost src ::1
acl to_localhost dst ::1
acl Safe_ports port 80 # http
acl whitelist dstdomain "/etc/squid3/whitelist"
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny !whitelist
http_access allow localhost
http_access allow all
http_port 3128 intercept
hierarchy_stoplist cgi-bin

View 2 Replies View Related

CentOS 5 :: Edit The Iptables To Include Some Ports/ip For Openfire Server?

Jun 16, 2010

I am trying to edit the iptables to include some ports/ip for openfire server. The problem is the computer is very locked down with permissions...I logged in as ROOT with ID 0.Now the iptables has ROOT for permission BUT ID 1 which reflects BIN.As root i cant edit or chmod/chown the iptables. Here is what i tried:

1. change password of BIN - successfully changed with no errors BUT still cant su BIN with the new password...

2. tried changing the ID of ROOT to 1 but I dont have permission to use the command....

so anything i can do here??? I dont have permission with Shadow either...

View 3 Replies View Related

Fedora Security :: Logging Dropped Packets With System-config-firewall?

Sep 1, 2009

I switched over to Fedora a couple of days ago. I'm using the built-in firewall shipped with it but I can't find out how to enable logging of dropped packets. Among others I'd like to use psad that needs firewall logging. Is there an easy way to do this? I'm not an iptables "expert".

View 6 Replies View Related

Security :: Get Around Isp Blocked Ports?

Sep 21, 2010

Is there anyway i can ssh/rdp/telnet into my server from the outside bypassing comcast ALL blocked ports

View 1 Replies View Related

Fedora Security :: How To Filter Ports

Apr 28, 2011

I have open ports on my computer for vsftpd, pptpd, and I need help to filter this ports because they aper as open ports on internet, and this is pretty risky

View 3 Replies View Related

Ubuntu Security :: Ufw Not Blocking Ports?

Apr 1, 2010

After reading a lot about networking and security I decided to check the security of my own ubuntu box. So I went installing Nmap and discovered that port 139 was "open". Since I 'd read how to use ufw I created a deny rule for port 139. After a second scan with Nmap it still said that port 139 was open as shown below.


View 9 Replies View Related

Ubuntu Security :: What Ports Are Open And Why

Jul 27, 2010

I'm locking down my laptop. I know I can use a firewall to ensure nothing gets through that I didn't catch, and I certainly plan on using one, but in the meantime, I want to know what exactly is running on my system.

nmap localhost returns:
james@james-linux:~$ nmap localhost
Starting Nmap 5.00 ( ) at 2010-07-26 23:33 CDT
Warning: Hostname localhost resolves to 2 IPs. Using
Interesting ports on localhost (
Not shown: 994 closed ports
25/tcp open smtp
111/tcp open rpcbind
139/tcp open netbios-ssn
445/tcp open microsoft-ds
631/tcp open ipp
2049/tcp open nfs
Nmap done: 1 IP address (1 host up) scanned in 0.18 seconds

However, I know that localhost goes back to the loopback interface, So, to see what was really open, I ran nmap, which is my laptop's IP at the moment.

james@james-linux:~$ nmap
Starting Nmap 5.00 ( ) at 2010-07-26 23:33 CDT
Interesting ports on
Not shown: 996 closed ports
111/tcp open rpcbind
139/tcp open netbios-ssn
445/tcp open microsoft-ds
2049/tcp open nfs
Nmap done: 1 IP address (1 host up) scanned in 0.14 seconds

Now if I understand correctly, I can attribute 139 and 445 to my Samba share. That I'm okay with. What I don't know is 111 and 2049. Does anyone know what these ports are, what's running on them, and how I could turn them off, supposing that they are a security risk?

View 9 Replies View Related

Ubuntu Security :: Ports 21 / 110 And 143 Are Open?

Mar 18, 2011

I'm getting heat from the head networking office that ports 21, 110, and 143 are open. I can telnet to those ports from a remote machine (not localhost) and get a prompt. There does not seem to be anything listening on those ports according to netstat. I've tried using iptables to discard all traffic to a from those ports but I can still telnet to them. This is a lucid desktop machine.

View 4 Replies View Related

Security :: Strange Ports On Public Ip?

Dec 2, 2010

looking at my router logs i've noticed for the past while a range of source ports from 60000 to about 65000 from my source external ip to destination external ip always on port 80. I have 3 boxes on this network and this only seems to happen when i connect the one laptop. I even reinstalled the distro downloaded from trusted source but the router is still logging this.. netstat -ntulp shows nothing operating in this range. chkrootkit shows nothing.. Was thinking maybe someone was spoofing the external address but it's been happening on network startup for a month now

View 4 Replies View Related

Security :: UFW Block On Legitimate Ports

Jun 30, 2010

I enabled ufw yesterday, and am finding log entries like:

Jun 30 13:07:51 xxxx kernel: [15702368.296557] [UFW BLOCK] IN=eth1 OUT= MAC=00:22:19:5e:8f:23:00:0c:db:fc:8b:00:08:00 SRC=xx.xx.xx.xx DST=xx.xx.xx.xx LEN=40 TOS=0x00 PREC=0x00 TTL=55 ID=47632 PROTO=TCP SPT=58875 DPT=80 WINDOW=65535 RES=0x00 ACK FIN URGP=0

What is puzzling is I did the command: ufw allow 80.

View 5 Replies View Related

Fedora Security :: Close Ports 443,80,22 & 23 Without Success?

Dec 8, 2009

have tried to close ports 443,80,22 & 23 without success.Does anybody have any idea how to do this. I close them in a terminal and their still opened. I closed them in services and their still open what am I not doing right?

View 14 Replies View Related

Ubuntu Security :: 9.10 - No Open Ports In System

Apr 10, 2010

I installed Ubuntu 9.10 recently. I heard that there will be no open ports in the system unless I specifically open one. How do I scan to find a open port in my system.

View 9 Replies View Related

Ubuntu Security :: Ufw Doesn't Open Ports?

Jul 6, 2010

when i enable my ufw it completely shuts me out and closed my internet connection. i installed firewall configuraiton interface and through it defined rules to accept incoming internet connections on port 80, i can see the rules are there but when i enable my firewall it just shuts me out completely again.
when i do(with my firewall enabled):

$ sudo ufw status
it gives me:
Status: active


I also messed around with fwbuilder and iptables but since then deleted fwbuilder(besides i just compiled firewall policy and never actually installed it because of errors while trying to install it. Iptables I cleared with:

$ sudo iptables -F

View 9 Replies View Related

Ubuntu Security :: Keeping All Ports Stealthed?

Sep 26, 2010

I know how to forward ports in my router. Now I need to open a port to help with testing a project and no matter what I've tried, every port under 1055 shows up as stealthed (with 1-71 closed) according to Shields Up! I'm happy to run it at a port > 1024, but whatever I try also shows up stealthed. I even tried (briefly) turning on DMZ and still the same thing. My ISP swears that they only block port 80, 21 and 25, none of which I'm trying to use. UFW status reports inactive and I'm not using firestarter. I'm not running any other server (apache, light speed etc). If it's not my router and it's not my ISP, and there's no other server apps running, then that kind of leaves Ubuntu as far as I can see,

View 8 Replies View Related

Ubuntu Security :: What Ports Does Firefox Use To Connect To The Internet

Apr 24, 2010

What ports does Firefox use to connect to the Internet?

View 9 Replies View Related

Copyrights 2005-15, All rights reserved