03-21-2014
Quote:
Originally Posted by
randomxs
Why would someone continually try to access the https port for months on end 100s of times an hour when clearly they must see they are being denied access to the server?
Iptables is not perfect and even when you use DROP rather than REJECT a port scanner can tell that DROP is in use by doing a SYN scan. If a server is on the port the SYN will get an ACK, otherwise it gets a RST. So the bad guy knows that he is getting nailed by a DROP rule and there is a live server being protected by the DROP rule. So he sets up an infinite loop trying to connect.
He hopes you will someday have a problem, wonder if iptables is causing it, and try dropping iptables just for a few seconds. Or maybe you will change your configuration and do a quick "service iptables restart". Most iptable configs allow ESTABLISHED connections to persist so once he connects... he is in.
This User Gave Thanks to Perderabo For This Post:
9 More Discussions You Might Find Interesting
1. UNIX for Advanced & Expert Users
Please, can someone tell me why my SunBlade would be showing 2 different but similar MAC addresses on the same port on the Switch? The switch shows all other Workstations with 1 MAC on each port, but the SunBlade is showing 2. Thanks in advance for any insight.... (1 Reply)
Discussion started by: GoneCrazy
1 Replies
2. Solaris
Hello i'm newbie in solaris, anybody know how to change five port solaris 10?
exmpe: bge0, bge1, bge2, etc.
anybody can help me with the script implementasi... and logical how solaris work.
thank so much:b: (2 Replies)
Discussion started by: yanto85
2 Replies
3. Cybersecurity
Is there a software solution to stop intruders from changing my port addresses?
Causes IPmap to crash.
Platform is OS/X Leopard. (1 Reply)
Discussion started by: aleatory
1 Replies
4. IP Networking
Hi,
I am trying to configure a transparent squid cache. When I try to use the below option in squid.conf, squid listens on port 80 only for the IP address configured on the system's interface.
http_port 80 transparent
But I want squid to accept connections for any IP address on port 80.... (3 Replies)
Discussion started by: Learner32
3 Replies
5. Cybersecurity
Hi Pals
Consider a case where the network interface is there and it is connected to a network.
Only thing left here is I need to set a static ip/ip though dhcp (though ifconfig)
I heard that it is possible to listen even if the ip address is not set. So is there any possibility of an attack over... (1 Reply)
Discussion started by: sreejithc
1 Replies
6. Solaris
I am trying to install Sun Java Web Server using an ordinary user with no root/sudo rights.
I need to allow this web server to use ports 80 and 443. How can this be done?:confused: (1 Reply)
Discussion started by: emealogistics
1 Replies
7. UNIX for Advanced & Expert Users
hi
i want to open port 9100 and the connect server could not to connect to my application
this my results of netstat tulpn
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 localhost:9100 ... (3 Replies)
Discussion started by: mohammad alshar
3 Replies
8. HP-UX
Hello Experts,
I want to open the port 443 on my HP-UX system.
can you please help ?
Thanks in advance. (1 Reply)
Discussion started by: purushottamaher
1 Replies
9. IP Networking
Hi All,
Can you please help me in understanding the relationship between local and foreign address in the output of netstat -an.
Output 1
----------
162.103.162.37.50224 162.103.162.35.9511 49640 0 49640 0 ESTABLISHED
162.103.162.37.50263 162.103.162.35.9512 49640 0... (1 Reply)
Discussion started by: Girish19
1 Replies
LEARN ABOUT CENTOS
iptables-xml
IPTABLES-XML(1) iptables 1.4.21 IPTABLES-XML(1)
NAME
iptables-xml -- Convert iptables-save format to XML
SYNOPSIS
iptables-xml [-c] [-v]
DESCRIPTION
iptables-xml is used to convert the output of iptables-save into an easily manipulatable XML format to STDOUT. Use I/O-redirection pro-
vided by your shell to write to a file.
-c, --combine
combine consecutive rules with the same matches but different targets. iptables does not currently support more than one target per
match, so this simulates that by collecting the targets from consecutive iptables rules into one action tag, but only when the rule
matches are identical. Terminating actions like RETURN, DROP, ACCEPT and QUEUE are not combined with subsequent targets.
-v, --verbose
Output xml comments containing the iptables line from which the XML is derived
iptables-xml does a mechanistic conversion to a very expressive xml format; the only semantic considerations are for -g and -j targets in
order to discriminate between <call> <goto> and <nane-of-target> as it helps xml processing scripts if they can tell the difference between
a target like SNAT and another chain.
Some sample output is:
<iptables-rules>
<table name="mangle">
<chain name="PREROUTING" policy="ACCEPT" packet-count="63436" byte-count="7137573">
<rule>
<conditions>
<match>
<p>tcp</p>
</match>
<tcp>
<sport>8443</sport>
</tcp>
</conditions>
<actions>
<call>
<check_ip/>
</call>
<ACCEPT/>
</actions>
</rule>
</chain>
</table> </iptables-rules>
Conversion from XML to iptables-save format may be done using the iptables.xslt script and xsltproc, or a custom program using libxsltproc
or similar; in this fashion:
xsltproc iptables.xslt my-iptables.xml | iptables-restore
BUGS
None known as of iptables-1.3.7 release
AUTHOR
Sam Liddicott <azez@ufomechanic.net>
SEE ALSO
iptables-save(8), iptables-restore(8), iptables(8)
iptables 1.4.21 IPTABLES-XML(1)