Firewall (iptables) - Revision history

Porcelinux: /* Firewalld */

2022-09-20T20:47:55Z

Firewalld

← Older revision		Revision as of 20:47, 20 September 2022
Line 68:		Line 68:
	FedoraServer		FedoraServer

			* change zone of an interface
			firewall-cmd --zone=home --change-interface=eth0

	* add port		* add port

2022-01-20T22:06:28Z

@@ Line 58: / Line 58: @@
   iptables -A PREROUTING -d HOSTONE -p tcp -m tcp --dport 80 -j DNAT --to-destination HOSTWO:80
   iptables -A POSTROUTING -d HOSTWO -j SNAT --to-source HOSTONE
 == UFW ==

2022-01-20T15:43:16Z

UFW

← Older revision		Revision as of 15:43, 20 January 2022
Line 109:		Line 109:
	* routing from ''eth1'' to ''eth2''		* routing from ''eth1'' to ''eth2''
	ufw route allow in on eth1 out on eth2		ufw route allow in on eth1 out on eth2

			* a UDP port on any interface from specific IP
			ufw allow proto udp from 107.172.59.23 to any port 8288

2021-06-25T22:00:04Z

linux powerful firewall

← Older revision		Revision as of 22:00, 25 June 2021
Line 6:		Line 6:
	* print out the configuration running:		* print out the configuration running:
	iptables -L		iptables -L
	* or better (this will print all ~~tables and chains)~~		* or better this will print all input table rules
	iptables-save		iptables-save

Line 26:		Line 26:
	REJECT all -- anywhere anywhere reject-with icmp-host-prohibited		REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
	----		----
	* ~~add~~ a rule to accept connections on port 5901 (vncserver)		* apend a rule (to the end of the table) to accept connections on port 5901 (vncserver)
	iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 5901 -j ACCEPT		iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 5901 -j ACCEPT

			* show NAT table
			iptables -t nat -L
			iptables -t nat -L -n -v \| grep 'IP or anything'
			iptables -t nat -L -n -v

			*: netstat-nat, software to display nat connections
			netstat-nat -n

			* show SNAT connections, run:
			netstat-nat -S

			* show DNAT connections, type:
			netstat-nat -D

	== saving configuration in a file ==		== saving configuration in a file ==

2021-06-11T14:00:14Z

UFW

@@ Line 54: / Line 54: @@
   ufw status numbered
   ufw deny from 10.0.0.42
   ufw deny in on eth0 from 10.0.0.42

2021-06-11T13:55:03Z

UFW

← Older revision		Revision as of 13:55, 11 June 2021
Line 48:		Line 48:

	''The Ubuntu Firewall''		''The Ubuntu Firewall''

			* status
			ufw status
			* ...with line numbers
			ufw status numbered

	ufw deny from 10.0.0.42		ufw deny from 10.0.0.42
	ufw deny in on eth0 from 10.0.0.42		ufw deny in on eth0 from 10.0.0.42

			* allow ssh's
	ufw allow ssh		ufw allow ssh
	ufw allow 22		ufw allow 22
	ufw allow from 10.0.0.0/24 to any port 22		ufw allow from 10.0.0.0/24 to any port 22
			ufw allow from 10.0.0.20 to 10.0.0.10 port 22
	ufw allow from 10.0.0.0~~/24 to any~~ port ~~873~~		* web ports

	ufw allow http		ufw allow http
	ufw allow 80		ufw allow 80
Line 62:		Line 68:
	ufw allow 443		ufw allow 443
	ufw allow proto tcp from any to any port 80,443		ufw allow proto tcp from any to any port 80,443
			* some dbs
	Allow MySQL from Specific IP Address or Subnet		Allow MySQL from Specific IP Address or Subnet
	ufw allow from 10.0.0.0/24 to any port 3306		ufw allow from 10.0.0.0/24 to any port 3306
Line 68:		Line 75:
	PostgreSQL from Specific IP Address or Subnet		PostgreSQL from Specific IP Address or Subnet
	ufw allow from 10.0.0.0/24 to any port 5432		ufw allow from 10.0.0.0/24 to any port 5432

			* routing from ''eth1'' to ''eth2''
			ufw route allow in on eth1 out on eth2

2018-01-21T15:07:10Z

UFW

← Older revision		Revision as of 15:07, 21 January 2018
Line 48:		Line 48:

	''The Ubuntu Firewall''		''The Ubuntu Firewall''
			ufw deny from 10.0.0.42
	ufw deny from 15.15.15.51		ufw deny in on eth0 from 10.0.0.42
	ufw deny in on eth0 from 15.15.15.51

	ufw allow ssh		ufw allow ssh
	ufw allow 22		ufw allow 22
	ufw allow from 15.15.15.0/24 to any port 22		ufw allow from 10.0.0.0/24 to any port 22

	ufw allow from 15.15.15.0/24 to any port 873		ufw allow from 10.0.0.0/24 to any port 873

	ufw allow http		ufw allow http
Line 64:		Line 63:
	ufw allow proto tcp from any to any port 80,443		ufw allow proto tcp from any to any port 80,443
	Allow MySQL from Specific IP Address or Subnet		Allow MySQL from Specific IP Address or Subnet
	ufw allow from 15.15.15.0/24 to any port 3306		ufw allow from 10.0.0.0/24 to any port 3306
	Allow MySQL to Specific Network Interface		Allow MySQL to Specific Network Interface
	ufw allow in on eth1 to any port 3306		ufw allow in on eth1 to any port 3306
	PostgreSQL from Specific IP Address or Subnet		PostgreSQL from Specific IP Address or Subnet
	ufw allow from 15.15.15.0/24 to any port 5432		ufw allow from 10.0.0.0/24 to any port 5432

2018-01-21T13:42:08Z

from a specified port to an host

← Older revision		Revision as of 13:42, 21 January 2018
Line 45:		Line 45:
	iptables -A POSTROUTING -d HOSTWO -j SNAT --to-source HOSTONE		iptables -A POSTROUTING -d HOSTWO -j SNAT --to-source HOSTONE

	== UFW == ''Ubuntu Firewall''		== UFW ==

			''The Ubuntu Firewall''

	ufw deny from 15.15.15.51		ufw deny from 15.15.15.51

2018-01-21T13:41:36Z

@@ Line 3: / Line 3: @@
 Network Address Translation [[NAT]]
-== linux powerfull firewall ==
+== linux powerful firewall ==
-* see the configuration running:
+* print out the configuration running:
   iptables -L
-* or
+* or better (this will print all tables and chains)
   iptables-save
@@ Line 44: / Line 44: @@
   iptables -A PREROUTING -d HOSTONE -p tcp -m tcp --dport 80 -j DNAT --to-destination HOSTWO:80
   iptables -A POSTROUTING -d HOSTWO -j SNAT --to-source HOSTONE

2013-09-06T16:34:02Z

saving configuration in a file

← Older revision		Revision as of 16:34, 6 September 2013
Line 32:		Line 32:
	iptables-save > backup_iptables		iptables-save > backup_iptables

	== restore conf from a file:		== restore conf from a file ==
	iptables-restore < backup_iptables		iptables-restore < backup_iptables
	* this will only enable the configuration while iptables process is restarted, to avoid this, we need to save the configuration:		* this will only enable the configuration while iptables process is restarted, to avoid this, we need to save the configuration:
	/etc/init.d/iptables save		/etc/init.d/iptables save
	* now we can restart/reboot		* now we can restart/reboot


	== redirecting connections ==		== redirecting connections ==