I am running the latest ubuntu. Sometimes it randomly stops accepting ssh connections, afp/smb connections, and even stops responding to pinging. It is connected via WIFI.
I go over to the desktop and use the browser, and the internet still works fine. Then after a while, it starts accepting incoming traffic again.
My laptop has become very sluggish. So I loaded firestarter firewall. It is reporting loads of incoming UDP traffic. I only use this machine for Skype and Firefox based work as most of my stuff is kept on the cloud. Is it safe to stop all this UDP traffic? It would free up my CPU I guess. It seems port 56095 is getting hammered.
View 8 Replies View RelatedI have a ubuntu computer set up as bridge between gateway and lan, with the lan connected to eth0 and gateway on eth1.
I'm trying to get it to basically block everything incoming except for the ports i specify, but also allow outgoing traffic. I've found, tried, modified som examples i found on the web, but still it wont block incoming traffic (ie, im still able to reach my webserver)
These are the rules, and i can't figure out why it wont block:
Code:
#!/bin/bash
iptables -F
iptables -X
iptables -I INPUT -i eth1 -j DROP
[Code].....
I need to configure iptables to block incoming traffic (except specific ports), but allows all outgoing traffic.
I am able to block incoming traffic, but doing so also prevents outgoing traffic (tested by telnet [URL] 80)
The following was used:
iptables -A INPUT -p tcp --dport ssh -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -I INPUT 1 -i lo -j ACCEPT
iptables -A INPUT -j DROP
Also, even allowing NOT SYN requests still prevents outgoing traffic.
iptables -I INPUT 1 -p tcp ! --syn -j ACCEPT
Another point:
# modinfo ipt_state
modinfo: could not open /lib/modules/2.6.18-028stab070.14/modules.dep
How to install ipt_state module on ubuntu?
Before explaining the problem, I have to draw the environment. Because of post size limitations, I'll have to break this post in more than one entry.
Physical view
Code:
+--------+ +---+
|storage1|-----| |
+--------+ | s |
| w |
+--------+ | i | +-------+
|router2 |-----| t |-----|router1|--->Internet
+--------+ | c | +-------+
| h |
+--------+ | 8 |
|router3 |-----| |
+--------+ +---+
Device details
[Code]....
assist me in using the iptables firewall to block all incoming mail traffic (SMTP port 25) except that of a certain IP(s)? the situation is that we have a server that we only want to receive mail from a particular sender.
View 1 Replies View RelatedI have set up a Virtual machine on a dedicated server from 1and1. I hoped to use a bridge to give the vm direct access to the internet but 1and1 do mac filtering and so the only option is to use NAT.
I used Virtual Machine Manager on my Ubuntu 10.04 machine at home to install Debain Lenny on the vm on the server using KVM and all went well. I put it on a virtual network 192.168.100.0 and i can access it from the host and i can access the internet from the guest using NAT that libvirt set-up.
I bought another ip address from 1and1 with the hope of forwarding packets to the new ip address 11.22.33.02 to the guest vm.
I have tried all sorts of routing rules using iptables without any success.
my virtual network is on virbr1 the guest ip is 192.168.100.50 my external network device is ip say 11.22.33.01 on eth0 with the secondary ip say 11.22.33.02 on eth0:1
Here are the latest rules i tried:
Quote:
iptables -t nat -A PREROUTING -d 11.22.33.02 -i eth0 -j DNAT --to-destination 192.168.100.50
iptables -t nat -A POSTROUTING -s 192.168.100.50 -o eth0 -j SNAT --to-source 11.22.33.02
iptables -A FORWARD -p tcp -i eth0 -o virbr1 -d 192.168.100.50 -m state --state NEW -j ACCEPT
iptables -A FORWARD -t filter -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
[Code].....
OS : CentOS 5.3 64bit How to trace incoming and outgoing network traffic for a give user? User 'A' logs in to the system and does various network connectivity As root user need to find what are the outgoing and incoming connection that are related with user 'A'. basically need to check the connection flow. netstat will show ESTABLISHED, LISTEN etc.. need something like tcpdump
Eg:- --user option for tcpdump tcpdump -vv -nn -i eth0 host 10.200.2.1 and tcp dst port 8080 --user A Can someone tell me any tool which can do such thing? Even if it can show the process ID of the client application which is trying to establish network connectivity will do.
I have set up an openvpn server on ubuntu via port tcp 443. The server use a public network and almost every ports are blocked (not 443) So when a client connect to the server, if it send traffic needing a blocked port, the connection cannot been etablished of course. So i d like to know if it is possible to redirect all incoming traffic on the server to an other unblocked port (like 443) to bypass firewall.
I dont think openvpn offer this possibility but maybe with linux it is possible..
a good IPTABLES protocol to reject all incoming ssh trafiic except for a single IP or IP range?
View 4 Replies View RelatedI need to set up my centOS computer as a firewall in my home network. Ive got 2 interfaces, eth0 and eth1. I want to allow and forward all traffic on eth0 and block all traffic on eth1 except ssh, ping(icmp) and DNS. How do I do this? Ive tried some editing in /etc/sysconfig/iptables but no luck.
View 1 Replies View RelatedI wanted to tell my server to block all traffic but US only traffic. So i followed this guide:[URL].. Now I know, it's the best way to help prevent hackers/crackers (doesn't matter to me what they are called. I just have to stop them). My server only deals with US clients anyways so might as well just start right there for my server's security before getting into the brute force and injection preventions. So I got it all done compiled everything moved to the proper directory. I then started to setup my iptables. Like so
Code: iptables -F INPUT
iptables -F OUTPUT
iptables -I INPUT 1 -s *.*.*.* -p tcp --dport 22 -j ACCEPT
iptables -I INPUT 2 -s *.*.*.* -p tcp -j ACCEPT
[Code]...
After seeing that i went digging in the code and figured it was something todo with memory allocation.
Recently I notice that when I'm connected to an vpn server (pptpd) and I'm using it as a default gateway my download and upload speed decreases almost to the half of the usual speed. I made a test using iptables in order to count how much GRE packets are generated (except the real traffic itself) in that way:
Code:
iptables -I INPUT -p gre -j ACCEPT
iptables -I OUTPUT -p gre -j ACCEPT
iptables -I FORWARD -s 172.16.10.101 -j ACCEPT
iptables -I FORWARD -d 172.16.10.101 -j ACCEPT
The first 2 rules match all GRE packets between the pptpd server and client, and the next rules - the traffic between the server and the client.
When I turn the counters to zero and begin to generate traffic (to browse, to download etc.) I see that the GRE packets are even more than these in the FORWARD chain.
So, my question is first of all is my test correct and is it true that so much gre traffic is being generated during the browsing (it becames clear that the traffic is double than if the pptpd wasn't used as a gateway) and if yes - can that traffic be reduced?
I have wireless connection between my router and PC. It is the only computer connected. Sometimes Firestarter blocks ports 1900 and 6771 from 192.168.1.100 IP address and sometimes port 68 from 192.168.1.1 IP. I'm a bit confused because 192.168.1.100 is the IP addres i use to open ports in router and 192.168.1.1 is used to access the router settings..
View 7 Replies View RelatedI've just started using ufw with the frontend gufw. I've configured it like this:
Accept everything in and out as default Block incoming FTP connections from a certain IPv4 address (brute-force for days)
Today I noticed that IPv6 connections don't work anymore. The connection to two hosts (IPv6 only) times out. As soon as I disable ufw entirely, the connections work again. The host I want to connect to is:
2001:638:a00:f00b:200:1cff:fedb:d38f port 7337
2001:638:a00:f00b:a00:6ff:fe07:cda2 port 7337
These are small telnet servers that print out a number (temperature nearby) and close again. I'm logging those values in a database.
Is ufw not IPv6-capable and blocks things it's not supposed to?
Update: ufw seems complete garbage to me... You can't even configure it while it's disabled! How am I supposed to safely activate it when the first thing it does is blocking all communications? I can't even configure it to let me in before I configure it to keep me out... And then, even if I explicitly let it pass port 7337, it still blocks it through IPv6.
I'm using Linux Mint 8 KDE, which is essentially kubuntu karmic.
Been trying to set up bittorrent (tried several different apps), have followed all the usual steps, forwarded ports on both Guarddog and my router, but still no incoming connections. Then tried disabling the firewall in Guarddog - still no incoming connections. Never had any problems configuring my router before so can only think that there must be something else blocking ports in linux other than iptables.Also had same problem just using ufw and gufw
I have Ubuntu 9.10 installed as a dual boot on my Acer 5810T notebook. My problem is this, when I am connected to my home wifi connection (no internet, just used for printing) and to my mobile broadband (at&t tethered) neither chrome or firefox will download a web page. As soon as I disconnect from my wifi network, I can browse the internet fine. If I re-connect to my wifi network again the next time I click on a link nothing happens. Can I prioritize the connections so that the browsers look at the mobile broadband connection first?
View 1 Replies View RelatedI Installed a game server on my ubuntu desktop which is on port 7777. I can join the gameserver without any problems on my local network but when I'm trying to join using my external IP address its not working.
This is what I did:I Forwarded my port inside my router but it still didn't work.
I Removed UFW from my ubuntu machine
I Tried portforwarding with an other machine (iMac) and it's working there
Is there any Security on Ubuntu Desktop that's blocking my gameserver
I Got 2 Network cards in my Ubuntu PC
1. Is A Ethernet card that I use to connect my iMac to the Ubuntu PC (Internet Sharing on my iMac) For fast file transfers.
2. Is A WLAN card that I use to connect my Ubuntu PC to our network.
I'd like to find some sort of program which can tell me how much incoming data I've had in the last 24 hours. It goes by hours, not by days, but anything that's simple and that can display this will do. Is there any sort of program that does this? Something that would fit well with Ubuntu's style wouldn't hurt, but I'm not that worried about it as long as it does the job.
View 1 Replies View RelatedI have a bunch of Ubuntu boxes on one subnet, 192.168.1.0. I have a Windows 7 box on another subnet, 192.168.2.0. I am able to ping and SSH to all servers on the .1 subnet except for one server, which I will call PITA. I will attempt to SSH to PITA, and it won't respond, nor does it respond to pings. I will the SSH to PITA from another of the test servers, successfully connect, and then when I SSH from my Windows 7 machine I can connect successfully. If I first connect via console to PITA and send some pings out (to anywhere, like 4.2.2.2), I can also connect from my Windows 7 machine. I've never seen anything like this.
One of the weird things is that I used PITA to create an image that I then used to create many of the other test servers, and they work fine, so I'm not sure what the problem is. I've checked /var/log/messages and syslog and there's nothing in them that indicates a problem. I've rebooted this server, restarted SSH, changed the IP in case it was conflicting with something else, forced an ARP update in case it was cached (since I had bonded the interfaces), cleared the ARP cache on my own machine, verified Network Manager is not installed...and I still have this issue.
Here are some network-related config:
/etc/network/interfaces
Quote:
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).
# The loopback network interface
[code]....
I have a router which makes two ppp connections. PPP0 is my default route and is an uncapped ADSL. PPP1 is a Local Only (South Africa) account which has DNS resolving to its IP. PPP1 allows certain connections in. I want all packets coming in on PPP1 to be marked so that after they have been routed through our local servers they can go back out over PPP1. Both connections use dynamically assigned ip addresses. I want to use PPP0 to make a connection to one of our stores, but when our stores connect to us they will be using PPP1. All packets from these incoming connections will need to be routed back over PPP1.
View 14 Replies View RelatedI have a iptable as firewall, I want to open incoming of port 8080 so I use "# Allow forwarding of incoming Port 8080 traffic" but it didn't work? how can I open just incoming of port 8080?
View 3 Replies View RelatedI'm using postfix on Ubuntu 9.10 and all I need is to occasionally send automated emails from perl or php scripts when data processing errors occur. In other words, I want to reject any connection attempts from remote clients and otherwise allow nothing except outgoing emails from one particular account.f I add this line to the default main.cf, will it do the trick or is it more complicated?
Code:
smtpd_sender_restrictions reject
i'm attemping to re-route incoming traffic of https to one of my servers. (a windows xp with subversion on it)
problem is if i do that ALL https traffic from other pc's is stopped. meaning i can't get any reply from any url with https;
We have something on our network that is reaking havoc with our content filter. I am trying to track it down, but so far I have been unsuccessful. We have approximately 500 devices in 100+ different locations spread across 9 states. Looking at each computer is not really feasible.
I need a machine that can sit in between our network and our internet connection and graphically monitor in real time and logs how much traffic each device is sending and receiving. It would need to sit inline so it has to have two nics and be able to pass traffic. The machine also needs to be transparent. Reconfiguration of our routers or workstations is not an option.
I have used ethereal and wireshark before. Ethereal may be a viable option, but wireshark seems to provide lots of information, but no practical way to make use of it. how to set up the box to be a transparent device on the network that will allow internet bound traffic to flow (freely)?
Everytime I use Transmission for torrent download, even if I only have a single torrent, my firefox is unable to access the internet. I assume this cannot be a bandwidth problem, so what is it.
View 5 Replies View RelatedWhen I start downloading torrent via transmission, utorrent, deluge every time I get disconnected network which can be fixed with restarting DSL modem, I've never had the problem in Win7 an WinXP.
View 8 Replies View RelatedI am attempting to connect my new Brother HL-2230 printer over CUPS. However, when I try to log in to http://localhost:631/admin it asks me for authentication. When I enter the user name for my administrator account (limao) and password, it reprompts me for my username and password again. using
Code:
# lppasswd -a limao
Enter password:
[code]...
I am still new to ubuntu and I use firestarter as my firewall tool and I was told that its just ufw in a gui. Well anyways I noticed a connection to 174.129.241.144 using https and python, I didn't have any scripts running and my browser was closed, I read the man files for ufw and it said to do something like deny from 174.129.0.0/12 and I want to block all incoming and outgoing connections to this IP range and I was wondering how to do that, I heard of iptables that it would be able to do this but I dont know anything about it. What I should learn so I can handle these kinds of situation in the future and how I can block this ip subnet or also what does the /8, /12, and /16 stand for?
View 7 Replies View RelatedPinging out from my netbook (over wifi, to any host) gets ~0% packet loss. Pinging into it (from any host) gets about 50% packet loss.
The router is a Dlink-DIR615 (rev d, running DD-WRT v24-sp2) but all other hosts on it ping eachother fine. I've tried changing routing, disabling IPv6, using older kernels and using wicd, all with no luck. The wireless connections is at 100% most of the time. This could be a new problem with Maverick, but I may not have noticed it before. I believe this is causing web browsing to be really slow and causing SSH timeouts.
I haven't tried madwifi drivers or nsidwrapper yet.
Edit: just booted into Windows and it has the same problem. Could it be a hardware issue? Also tried with a static IP, with no change.
Strangely, a normal ping gets 50% packet loss, but ping -A gets < 1% loss.
Edit 2: no packet loss at all on eth0.
Code:
# uname -a
Linux hulbert-laptop 2.6.35-23-generic #36-Ubuntu SMP Tue Oct 26 17:03:18 UTC 2010 i686 GNU/Linux
Code:
# ifconfig wlan0
wlan0 Link encap:Ethernet HWaddr 00:25:d3:1a:bc:4b
inet addr:192.168.0.102 Bcast:192.168.0.255 Mask:255.255.255.0
inet6 addr: fe80::225:d3ff:fe1a:bc4b/64 Scope:Link
[Code]....