I am trying to setup a CentOS 7 server with Squid as a proxy server. The proxy server is strictly private and doesn't need to be available to anyone other than myself and other 2 servers, therefore I have decided to lock down all ports to the 3 IP addresses. I would also point out I have VNC access to the server in case my IP changes. Here are the IP table rules I am using to lock down the server (where 1.1.1.1 is just an example)...  #!/bin/bash IPTABLES=/sbin/iptables MYIP=1.1.1.1  #start and flush $IPTABLES -F $IPTABLES -t nat -F $IPTABLES -X $IPTABLES -P FORWARD DROP $IPTABLES -P INPUT   DROP $IPTABLES -P OUTPUT  ACCEPT  #HTTP traffic $IPTABLES -A INPUT -p tcp -s $MYIP --dport 80 -j ACCEPT  #SSH traffic $IPTABLES -A INPUT -p tcp -s $MYIP --dport 22 -j ACCEPT  #FTP traffic $IPTABLES -A INPUT -p tcp -s $MYIP --dport 21 -j ACCEPT $IPTABLES -A INPUT -p tcp -s $MYIP --dport 20000:20050 -j ACCEPT  #SQUID traffic $IPTABLES -A INPUT -p tcp -s $MYIP --dport 3128 -j ACCEPT  #loopback $IPTABLES -A INPUT -i lo -p all -j ACCEPT   The problem is when I execute these rules, Squid stops working. It tries connecting but eventually returns a Squid error saying "Connection timeout". Even though all OUTPUT traffic is allowed, yum and wget also stop working so I am guessing it's failing to allow outbound traffic?  Can someone help me where I am going wrong please?
122869
here's my problem:  # iptables -P INPUT DROP # host -t mx gmail.com ;; connection timed out; no servers could be reached # iptables -P INPUT ACCEPT # host -t mx gmail.com gmail.com mail is handled by 20 alt2.gmail-smtp-in.l.google.com. gmail.com mail is handled by 5 gmail-smtp-in.l.google.com. gmail.com mail is handled by 40 alt4.gmail-smtp-in.l.google.com. gmail.com mail is handled by 10 alt1.gmail-smtp-in.l.google.com. gmail.com mail is handled by 30 alt3.gmail-smtp-in.l.google.com.   after setting iptables to drop all input packets unless specified otherwise, I can't resolve hosts and therefore postfix fails to send mails. I think it is crucial to set firewall up - what is the firewall setting that I missed?  here's my current iptables:  # iptables -L INPUT -n -v Chain INPUT (policy ACCEPT 120 packets, 17552 bytes)  pkts bytes target     prot opt in     out     source               destination           2669K  160M fail2ban-ssh-ddos  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 22 2669K  160M fail2ban-ssh  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 22   122 19135 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80   252 27262 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:143     0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:587    46  3191 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:21   264 2459K ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
59767
I am setting up a new server with 18.04 based on instructions written for 14.04. I have got as far as these steps:  /sbin/iptables -A FORWARD -p tcp --destination-port 80 -j ACCEPT /sbin/iptables -t nat -A PREROUTING -j REDIRECT -p tcp --destination-port 80 --to-ports 8080 /sbin/iptables-save # To save permanently (reset-persistent): sudo sh -c "iptables-save &gt; /etc/iptables.rules" # Modify in /etc/network/interfaces # Add this line:     pre-up iptables-restore &lt; /etc/iptables.rules     # As below:  # The loopback network interface auto lo iface lo inet loopback     pre-up iptables-restore &lt; /etc/iptables.rules  # The primary network interface auto eth0 eth1 iface eth0 inet static         address XXX.XXX.XX.XXX         netmask 255.255.255.0         gateway XXX.XXX.XX.1         dns-nameservers 8.8.4.4 8.8.8.8 XXX.XXX.0.3 iface eth1 inet static         address XX.XXX.67.47         netmask 255.255.0.0   But it turns out that 18.04 does things a different way, using something called netplan.   I have found questions and answers related to how to revert back to how things were done in 14.04, but I am wondering whether it is better to do the same thing the new way.   How can I do what is being done the old way using netplan?
111647
there are strange things:  on my virtualbox： centos7  Interfaces：  enp0s3: 192.168.10.110/24 lo:0 10.0.3.110/24 (ip alias)   route：  default via 10.0.3.2 dev lo 192.168.10.0/24 dev enp0s3  enp0s3 is plugged in 10.0.3.0/24   I have enabled the ip_forward (net.ipv4.ip_forward = 1)    My Question：  ping 10.0.3.2 works，but why?  tcpdump can't get packets on enp0s3，but does get packets on lo.  The default route is lo; why does ping 10.0.3.2 work? Why can't I get packets on enp0s3?
109826
The following IP address is for my network interface  $ nmap 192.168.0.142  Starting Nmap 7.60 ( https://nmap.org ) at 2019-03-09 11:33 EST Nmap scan report for ocean (192.168.0.142) Host is up (0.00047s latency). Not shown: 996 closed ports PORT     STATE SERVICE 22/tcp   open  ssh 80/tcp   open  http 111/tcp  open  rpcbind 3306/tcp open  mysql  Nmap done: 1 IP address (1 host up) scanned in 0.97 seconds   Are those services shown below but not above exactly those that are closed to the outside but open within my local machine?   Are the services whose security that I should worry about exactly those listed above?  Thanks.  $ nmap localhost  Starting Nmap 7.60 ( https://nmap.org ) at 2019-03-09 11:34 EST Nmap scan report for localhost (127.0.0.1) Host is up (0.00046s latency). Other addresses for localhost (not scanned): Not shown: 993 closed ports PORT     STATE SERVICE 22/tcp   open  ssh 80/tcp   open  http 111/tcp  open  rpcbind 631/tcp  open  ipp 3306/tcp open  mysql 5432/tcp open  postgresql 9050/tcp open  tor-socks  Nmap done: 1 IP address (1 host up) scanned in 0.16 seconds
53906
I have a firewall with these simple rules:  iptables -A INPUT -p tcp -s 127.0.0.1/32 --dport 6000 -j ACCEPT iptables -A INPUT -p tcp -s 192.168.16.20/32 --dport 6000 -j ACCEPT iptables -A INPUT -p tcp --dport 6000 -j REJECT   Now, suppose I am using TCPDUMP like this:  tcpdump port 6000   And I have host 192.168.16.21 trying to connect to port 6000.  Will/should tcpdump output some packets coming from 192.168.16.21?
24572
Well, I installed Squid3 the other day and then installed Quintolabs, but I discovered this program squidguard that looks much easier to work with and configure and it looks like it would serve as a more adequate web filter for my needs.   I installed squidguard seemingly without a problem and I am following .  I am at the part when I just finished installing the blacklist and now I am trying to do a test run of squidguard with output to stderr using the command squidGuard -d (I am a total newbie with linux and am not that familiar with any commands or the file system or anything being used to Windows for so long).  This is what shows in the terminal which includes the error:  administrator@LinuxWebFilter:~$ squidGuard -d squidGuard: error while loading shared libraries: libdb-4.8.so: cannot open shared object file: No such file or directory   I have no idea what to do or how to fix this.  Can someone please help with this?
82670
I did the following:  ufw default deny outgoing, sudo ufw allow out 80 which I thought would let me use the Internet but didn't can y'all help?  Also are there any other ports used by Ubuntu for which I should allow outgoing traffic for? I hear these 20, 21, 53, 123, 443 are some what do you all think?  Thanks
54418
I have a web service running on debian 7 and listening on port 8080. I want to redirect 80 to 8080 for inbound connections and allow only port 80. Here is my iptables configuration:  root@localhost:~# iptables -v -L --line-numbers Chain INPUT (policy DROP 76 packets, 6266 bytes) num   pkts bytes target     prot opt in     out     source               destination          1       90  8898 ACCEPT     all  --  lo     any     anywhere             anywhere             2        0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:http 3     4515 3113K ACCEPT     all  --  any    any     anywhere             anywhere             state RELATED,ESTABLISHED  Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) num   pkts bytes target     prot opt in     out     source               destination           Chain OUTPUT (policy ACCEPT 4858 packets, 587K bytes) num   pkts bytes target     prot opt in     out     source               destination        and nat table:  root@localhost:~# iptables -L -n -v -t nat Chain PREROUTING (policy ACCEPT 14 packets, 2288 bytes)  pkts bytes target     prot opt in     out     source               destination              0     0 REDIRECT   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80 redir ports 8080     0     0 REDIRECT   udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:80 redir ports 8080  Chain INPUT (policy ACCEPT 0 packets, 0 bytes)  pkts bytes target     prot opt in     out     source               destination           Chain OUTPUT (policy ACCEPT 841 packets, 53415 bytes)  pkts bytes target     prot opt in     out     source               destination           Chain POSTROUTING (policy ACCEPT 841 packets, 53415 bytes)  pkts bytes target     prot opt in     out     source               destination    i can't establish a connection from outside on port 80. What are likely deficiencies?
106157
What do the [368:102354], [0:0] and [92952:20764374] in my iptables output file mean?  :INPUT ACCEPT [368:102354] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [92952:20764374]
50682
I'm trying to telnet into port 25 on a CentOS server that runs PostFix to test sending email messages from the server.  When I try to telnet in from another CentOS box on the same network I get the message below:   Unable to connect to remote host: Connection refused   SELinux is disabled and I've opened port 25 in iptables...what else should I be looking at?
104019
I have some questions about SNAT with iptables. Assume there is one router who plays DHCP server for assign private IPs in my LAN and NAT for the hosts in my LAN can access the public internet.  The router has two interfaces, one "eth0" with dynamic public IP and the other "eth1" with private IP 192.168.0.1 and the subnet is 192.168.0.0/24. Assume the ipv4 packet forwarding is enable on that router. I know I have to set one rule in NAT table for masquerading the source IP of the packet to the public internet from the hosts in my LAN. This rule may looks like the one under.  iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -o eth0 -j MASQUERADE  I understand why I need the rule since the packet from my LAN needs a public IP for internet routing.  But I do not understand why I do not need set another rule in PREROUTING chain for the response packets in order to modify their destination IP addresses.  Is the modification of destination address of those response packets a default behavior of the MASQUERADE rule I just set?  And another question is that how iptable know which packets should be modified?  Thank You.
106572
I am trying to use FirewallD to restrict access to a CentOS server from other machines on the network. It has a single network interface and it is operating in the public zone. Lets say that the ip address of this server 10.10.1.20.  What I want to do is to allow only machines with IP addresses 10.10.1.125 and 10.10.1.126 to be able to connect (ssh and https) to this server. None of the other ip addresses should be able to connect to this server (or even know that it exists).  I tried using FirewallD's rich rules as follows (on 10.10.1.20)  sudo firewall-cmd --add-rich-rule 'rule family="ipv4" source address="10.10.1.0/24" drop'  sudo firewall-cmd --add-rich-rule 'rule family="ipv4" source address="10.10.1.125" accept'  sudo firewall-cmd --add-rich-rule 'rule family="ipv4" source address="10.10.1.126" accept'   But it doesn't seem to work. I cannot make ssh connections to 10.10.1.20 from 10.10.1.125 or 10.10.1.126.  I tried entering the rules in the reverse order, but it still does not work.  Can someone help me out here? Do I need to change the zone from public to a more restrictive one like drop before the rules I wrote above can be applied?
84692
Most of my visits are from baidu spiders. I don't think it helps search engines at all so I'm thinking of how to block them. Could this be done via iptables? I'm using nginx as my webserver.
12702
We have a transparent proxy setup. I tried looking for traffic shaping in Linux, and all I could find online was to limit traffic by interface (eth0/eth1...).  I need to limit the bandwidth (never exceeding a specific limit) by IP address or IP ranges and I can't find a way to do that.  Is there any way to do that?
94622
I have written an app which will run on a server. I have little experience with network configuration and such things.  Now I have set-up the server and everything works how I want however I want 2 things   set the ip of my server to a static ip ideally be able to acces the server with a url like mytestserver.test or something like that   I do have experience with command line linux and windows but never needed to do anything with networks as I usually work with embedded systems  e\ my distribution is debian on the raspberry pi
112962
How I can allow only my own ip to login for my ubuntu server ? Yesterday got 1500 unwanted failed login attempts.  Allowing only my own IP, could be the most secure from hackers ? I use Postfix only for sending, so that wont need to allow any incoming connections.
92875
I'm learning about private/public IPs, port forwarding and NAT, and still fail to see the answer to a simple question:  Suppose two users on the same network are communicating with a single server outside their network (say, me &amp; my wife send http requests to yahoo.com).  The server sees both users as a single public ip, and often - as in this case - communicating on the same port.  How does the router route the packets according to the two different connections? Is there any routing info inside the packet beyond ip/port?  Is there some 'session table' maintained somewhere? By whom and what exactly does it include?