Networking :: Apply A NAT With Source Restrictions At Iptables?
Jul 22, 2010
I have a computer with two interfaces (eth0 and eth1), eth0 is connected with a local network and eth1 is connected to the internet, also it implements a NAT in the interface eth1. Nevertheless, I'm trying to create spoofed packets with sockets raw in the computer that runs the NAT and send the packets to the interface eth1. The problem is that the NAT is changing the IP source to the real one before send the packets. So, anyone have any idea how can I implements the NAT in eth1 but only apply the NAT to the packets that are from/to eth0? I was thinking in something like (I am really newbie with iptables):
iptables -t nat -A POSTROUTING -o eth1 -i eth0 -j MASQUERADE
Well, it didn't work.
View 1 Replies
ADVERTISEMENT
May 22, 2011
I added a few rules to my /etc/iptables.rules file and then used sudo iptables-restore < /etc/iptables.rules but i got an error saying "iptables-restore: line 29 failed".But the only word on that line.
View 1 Replies
View Related
Jul 11, 2010
so the firewall rules I am currently using are displayed below.
Code:
# DROP ALL FORWARDED PACKETS
iptables -P FORWARD DROP # DROP ALL PACKETS
# ALLOW DHCP THROUGH THE FIREWALL
[code]....
View 6 Replies
View Related
May 18, 2010
This isn't exactly of critical importance, but is there any way to block two entirely different addresses in the one rule, rather than writing individual rules for each of them? For example, if the addresses were 1.1.1.1 and 8.8.8.8, and I only wanted to block these two.
Or alternatively, if I wanted to block two subnets, say 1.1.1.0/24 and 8.8.8.0/24? Can this be done in one rule?
View 2 Replies
View Related
Oct 25, 2010
Here is a glimpse of my IPTABLES
http://pastebin.com/WvHAC46A
I see in the column of sources the addresses being resolved to domain names is there a way I can stop this?
View 4 Replies
View Related
Jul 16, 2010
Question (and Google results aren't making this clear): Ubuntu has both iptables & ip6tables installed. 1. If I set a rule in iptables, does that rule also apply to ipv6, or just ipv4?
2. If "no" to above, then it would be prudent to *also* set ip6tables rules as well if I want to maintain an active firewall, correct?
3. Does ip6tables rules have the same syntax and behavior (more or less) to iptables rules - i.e. can I just copy my iptables rules & change "iptables" to "ip6tables"?
4. Any gotchas or issues that I should be aware of?
View 9 Replies
View Related
May 31, 2011
I have a work network of about 20 boxes most of which are running Windows 7 and one of them is a file server using linux and another is Windows server 2003. Now the local IP is distributed by the router, and no regulation of internet access is done by any of the servers.What I need to do is restrict internet access to select domains, which would probably need DHCP through linux(I think, not really sure), and I need something simple like a 'blabla.conf' file with the allowed websites that I can edit. need to know how to regulate IP addresses through the linux box (all details if possible, I never tried to do that before), and how to restrict internet access also through linux.
View 4 Replies
View Related
Jun 22, 2011
While I successfully configured an IPsec-VPN (I use a similar tho modified setup like this:[URL].. I am now stuck on the next steps. While I can connect to everything I want, I need to configure "access-groups" and/or "users".
The scenario is similar to this: Lets say Host A, B and C allow SSH-Connections and some weird non-standard UDP-Connection from Host-VPN, and are also accessible on other ports with public IP's (like http).
I now want to limit, that an admin-user has access to all of them, while trainee-admin only can access everything on Host B and C, and CEO only can connect via telnet to Host C - and all users can be roadwarriors
(I made this example up to give you an idea what i'm trying to do - hope it makes sense). Now my question is, if someone can point me towards a direction, as I'm quite clueless at the current moment as to what to try. I know that commercial IPsec-Implementations can do this, but can OpenSWAN/... give me something similar?
View 1 Replies
View Related
Jul 23, 2010
Now I managed to get iptables to work with my OpenVZ configurations and everything seems to work as it should. However when I run iptables -L I can only see source for the second SSH rule, why isn't the first ones source/IP shown? Also if you have any comments about the setup feel free. I'm running SSH, Apache and local MySQL
The xxx.xxx is simply to hide my IP's
Code:
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP
iptables -F
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
iptables -F -t mangle
iptables -X
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -d 127.0.0.0/8 -j REJECT
iptables -A INPUT -p tcp --dport 22 -s 77.213.xxx.xxx -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -s 62.198.xxx.xxx -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -m state --state INVALID -j REJECT
iptables -A INPUT -j REJECT
iptables -A INPUT -j DROP
View 6 Replies
View Related
Jun 13, 2011
I think I'll need to install a newer version of IPtables for my CentOS 5.6 since I updated the kernel to 2.6.32.41 and iptables-1.4.6 seems to be the older version that matches this kernel but CentOS 5.6 is shipped with 1.3.5 (this distro and it's 10 years old packages is starting to bore me...).
So I need to update iptables but I don't find good howtos on this subject...
So my question would be : how to build iptables from source and does it change anything to the procedure that I already have 1.3.5 installed ?
View 3 Replies
View Related
May 3, 2011
I'm currently using a homemade Python script to parse script kiddie IP addresses from logfiles.To this point, I've simply been DROPping any requests from these IPs using iptables.I thought it might be fun to redirect their traffic back to them, but as I am not an expert at iptables, I was wondering if I should use FORWARD or PREROUTING.
View 7 Replies
View Related
Mar 7, 2011
I am using squid 2.6 on my cent os 5.We r using 4 Mb/s link. I want to assign bandwidth allowcation to my boss like 512 Kb/s and 256 kb/s to its assistant.both are using class c IP address. How can I allocate bandwidth of their IP address.
View 1 Replies
View Related
Jul 13, 2010
I am trying to use my tmobile 8320 blackberry as a modem I hook it up through the USB and the phone is recognized I go into network manager to enter the settings for my Apn and Number to dial to and when I try to enter the Network to connect to the apply button goes away and it won't let me go past that point is this something screwed up in Ubuntu
View 1 Replies
View Related
Nov 19, 2010
I installed all the necessary packages for the networkmanager-openvpn function to function. The openvpn-connection-setting are successfully imported into the networkmanger via the conf file but the apply button is grayed out, so that actually saving and using the connection isn't possible? Does anyone know, where the problem is? It's a fresh install of Ubuntu 10.10 after the upgrade from 10.04 sent the networkmanger down the drain.
View 2 Replies
View Related
Jan 1, 2011
I try to understand the reasons for restricting DVD and MP3. My conclusion so far is that DVD is restricted due to software patents (and the DMCA). The software decoding DVD is open software, though. What is the situation regarding MP3? It is also restricted. Is it due to the same kind of software patents? As I understand, the MP3 codecs are not free software (like DVD)?
View 2 Replies
View Related
Jun 15, 2010
I just installed Ubuntu using WUI. It went OK. I am able to launch it, etc.
However I cannot manually enter my static IP information. I go to Edit Connections > IP4 settings > I then change the tab from DHCP to manual and then the "apply" button turns to a light darkish color and is non-selectable.
I also cannot save any network config note using gedit. It says I don't have permissions. I checked and changed my account type to Administrator and checked all the boxes then rebooted and still nothing.
View 5 Replies
View Related
Sep 5, 2010
How can I get rid of all policykit restrictions that fedora 13 has? I just upgraded from fedora 10 and of course my freenx sessions are again unable to do anything useful like mounting a drive. Difference is no GUI now to help fix this. So I would like to get rid of all restrictions.
View 6 Replies
View Related
Jul 6, 2010
I'm working with Opensuse 11.2 and KDE 4.3.5. I tried to restrict the run command (with Alt-F2) in the kdeglobals file:
~/.kde4/share/config/kdeglobals
[KDE Action Restrictions]
run_command=false
But there is no effect. With Opensuse 10.3 and KDE 3.5 it works fine.
View 3 Replies
View Related
Jun 3, 2011
I usually use .htaccess to restrict access to directories. But what if I just wanted to secure a single php file? Is there some sort of code that would allow me to say ONLY THIS IP can access this PHP file?
View 3 Replies
View Related
Aug 20, 2010
I have a server with two active network interfaces. On one, I need ssh open for all users (it's running LTSP, and as I learned the hard way today, blocking ssh kills LDM access).
On the other interface (which connects to the rest of the network), I only want to allow a few administrative users to connnect.
Is there a way to do this cleanly using sshd_config or PAM? I don't want to do something hacky like running dropbear.
View 3 Replies
View Related
Sep 26, 2010
I have an Apache, PureFTPd, PHP5, and MySQL server setup and running. I'm running several scripts that require folder access of "var/www" in order to accomplish the scripts duty. How do I remove and/or work around the security measure?
View 7 Replies
View Related
Apr 21, 2010
I set some restrictions in /etc/pam.d/system-auth, but they don't seem to be affecting anything.
/etc/pam.d/passwd:
Code:
password required pam_cracklib.so retry=3 minlen=8
password required pam_unix.so md5 shadow use_authtok
/etc/pam.d/system-auth:
Code:
auth required pam_env.so
auth sufficient pam_unix.so likeauth nullok
auth required pam_deny.so
[code]....
View 3 Replies
View Related
Jan 14, 2010
I dont want to allow the user winny on saturday and sundays. I added the following line in the /etc/security/time.conf file.
login;*;winny;!SaSu0000-2400
Then i added the following line in the /etc/pam.d/login file.
account required pam_time.so
this is the first line of that login file. But if i tried to login with the username winny it allows me to get log in. Is anything has to be change?
View 14 Replies
View Related
Mar 25, 2011
i have jsut setup a kvm virtual machine on my server. to connect to the VM from outside of the network i use ssh tunneling. what i would liek to know is if there is any way to create a new user with jsut ssh access. i dont want people to be able to edit files in ~/ or such. jsut need the user to estabilish the connection to the server
View 1 Replies
View Related
Nov 24, 2009
I have searched for days on Google and can't find a clear answer to my question. I have a NT4 PDC which I am migrating to Samba 3 (Version 3.4.2-47.fc12) on FC12 with kernel(2.6.31.5-127.fc12.i686). I am using tdbsam as my passdb backend.I setup Samba as a BDC and then joined to NT4 Domain succesfully. When I go to vampire the accounts I get lots of errors and some user accounts get transfered over. It turns that all the user accounts that transfer are those that don't have a capital letter in their username on the NT4 domain server. Most do and don't get transfered. There seems to be errors with my groups and Computer accounts.Is there a way to change the requirements in Fedora 12 for username, groups and computernames?
View 1 Replies
View Related
Dec 22, 2009
I have Fedora 10 installed. I want my users to be able to use any password they want. So I edited /etc/pam.d/system-auth, the password section.
Was:
Code:
password requisite pam_cracklib.so try_first_pass retry=3
password sufficient pam_unix.so md5 shadow nullok try_first_pass use_authtok
password required pam_deny.so
Become:
[Code].....
View 2 Replies
View Related
Jun 3, 2010
I've got Ubuntu server 10.04 set up and I wanted to make a few restrictions. It's pretty much just acting as a VMware server at the moment, and there are some users I've created who I only want to be able to be able to log into the VMware infrastructure web interface. I want to make sure these users can't log in via SSH, FTP, or the console itself. I understand how to block them from logging in via SSH by using DenyUsers, and I added these users to the /etc/ftpusers file to lock them out of FTP, but how can I block them from logging in at the console itself?
I tried locking the user out by editing the /etc/passwd file, but the problem is that by doing this, it also prevents the user from being able to log into the VMware web interface.
The user's entry in /etc/passwd looks like this: bsmith:*:1005:1005:Bob Smith,,,:/home/bsmith:/bin/bash
View 3 Replies
View Related
Nov 7, 2010
does anyone know how to set restrictions on the commands a user can run as sudo? i want to make it so they can only halt the system.
View 1 Replies
View Related
Dec 30, 2010
I am using internet web control through squid... All is working fine only some little bit issues.
(1) Sometime when i tried to open google.com or any site I got message (The requested URL could not be retrieved) Screen Shot Attached.) but again after sometimes same websites will open.
url
(2) I would like to block word 'sex'.. So I have edit squid.conf with the following acl
acl Blockword url_regex sex
http_access deny Blockword
but problem occur in some websites where 'sensex' word found in url. Then squid block 'sensex' url content website also..
View 2 Replies
View Related
Jan 17, 2010
I have a user that has already used up a demo 24hr trial on my website. At present, I only check the customer id and the IP address to search for duplicates. On the whole this works but it's not foolproof. We now have 1 user from China that is changing their IP address everyday to get access to the free trial. Any options on what to do? I thought of downloading a cookie to their computer that the website could pick up - again not foolproff but most people don't disable cookies. Any other options?
I could ban China temporarily until the user gives up but if they find another proxy to chain then their IP address will be different again.
View 14 Replies
View Related
