Hi, I am relatively new to firewalls and netfilter. I have a Debian Stretch router box running dnsmasq, connected to a VPN. Occasionally dnsmasq polls all of the desired DNS servers to select the fastest. When it does this it responds to replies of the non-selected DNS servers with a icmp type three or "host unreachable". My firewall is very strict (I was hacked) and I am controlling sockets. I would like to respond to the DNS servers with this icmp message. I have tried many, many ways but none work, the message keeps on getting dropped. Here is an example rule set for one of the DNS servers:
Here is the rule script:
Here is the resulting script from the firewall log:
To me the firewall is not seeing the icmp rule for some reason. Can anyone see the problem? Thanks for you help!
---------- Post updated at 06:04 PM ---------- Previous update was at 05:36 PM ----------
Well, I'm replying to my own post 10 minutes after writing it. All I needed was a "RELATED" on the state. I was hesitant to use this state as it seems to open a can of worms on some web sites...
I'm trying to insert multiple new lines of text into an iptables script using sed in a while loop. I'm not sure if this is the most effective way. Searching the forums has helped me come up with a good beginning but it's not 100%. I'd like it to search out a unique line in my current iptables file... (2 Replies)
Hi
I have small home network and I want to block some forums on web
When I use this
iptables -A INPUT -s forum -j DROP
rules is applied but when I restart some of PC rules are not present any more also I tried to save firewall settings
iptables-save > /root/dsl.fw
but how to... (2 Replies)
Hello,
I was playing around with iptables to setup an isolated system. On a SLES10 system, I ran the below to setup my first draft of rules. I noticed that the rules come into effect immediately and do not require any restart of iptables.
iptables -A INPUT -j ACCEPT
iptables -A OUTPUT -m... (4 Replies)
Could someone help me with writing rules for iptables?
I need a dos attacks protection for a game server.
port type udp
ports 27015:27030
interface: eth0
Accept all packets from all IPs
Chek if IP sent more than 50 packets per second
Drop all packets from this IP for 5 minutes
I would be... (0 Replies)
Hi Gurus,
I need to add Multicast Port = xyz
Multicast Address = 123.134.143 ( example) to my firewall rules. Can you please guide me with the lines I need to update my iptables files with. (0 Replies)
Hi Champs
i am new in Iptables and trying to write rules for my Samba server.I took some help from internet, created one script and run from rc.local :
#Allow loopback
iptables -I INPUT -i lo -j ACCEPT
# Accept packets from Trusted network
iptables -A INPUT -s my-network/subnet -j... (0 Replies)
Hello,
I have iptables service running on my CentOS5 server. It has approx 50 rules right now.
The problem I am facing now is as follows -
I have to define a new chain in the filter table, say DOS_RULES & add all rules in this chain starting from index number 15 in the filter table.
... (1 Reply)
Hi,
I've been struggling with this all morning and seem to have a blind spot on what the problem is. I'm trying to use iptables to block traffic on a little cluster of raspberry pi's but to allow ssh and ping traffic within it.
The cluster has a firewall server with a wifi card connecting to... (4 Replies)
Hello,
I did 2 scripts. The second one is, I hope, more secure.
What do you think?
Basic connection (no server, no router, no DHCP and the Ipv6 is disabled)
#######script one
####################
iptables -F
iptables -X -t filter
iptables -P INPUT DROP
iptables -P FORWARD... (6 Replies)
Discussion started by: Thomas342
6 Replies
LEARN ABOUT DEBIAN
lockout
LOCKOUT(1) lockout LOCKOUT(1)NAME
lockout - avoid slacking and impose productivity and discipline on yourself
WARNING
This program is VERY DANGEROUS. If it fails, you may end up not knowing the root password to your own computer (in which case you need to
boot into single-user mode). There are no known reports of this actually happening, but we don't know how stupid you are. Also, you
should probably not run this on a multi-user system.
SYNOPSIS
lockout lock HhMm | Hh | Mm
lockout lock HH:MM
lockout lock HH:MMam | HH:MMpm
lockout lock HHam | HHpm
lockout lock
lockout unlock [force]
lockout status
DESCRIPTION
Lockout is a tool that imposes discipline on you so that you get some work done. For example, lockout can be used to install a firewall
that does not let you browse the Web. Lockout changes the root password for a specified duration; this prevents you from secretly ripping
down the firewall and then browsing the Web anyway. In case of an emergency, you can reboot your computer to undo the effects of lockout
and to restore the original root password.
Obviously, lockout lock and lockout unlock can only be run by root. lockout status can be run by any user.
lockout without any parameters shows a brief help message.
lockout lock takes one optional parameter. If no parameter is given, you are dropped in interactive mode and asked for the duration of the
lock or the time at which the lock should be lifted. You can also supply this as a parameter on the command line. Lockout understands
various time formats. You can specify a delay, e.g., 3h (3 hours), 1h30m (1 hour and 30 minutes), or 90m (1 hour and 30 minutes), or you
can specify absolute time, e.g., 2pm, 2:30am, 15:30, etc. You will be asked to confirm the time at which lockout will unlock your system.
If you type "yes", lockout executes /etc/lockout/lock.sh and changes the root password to something completely random. /etc/lock-
out/lock.sh is a shell script that you write. It takes measures to make sure you stop slacking. For example, it could install a firewall
that prevents outgoing connections to port 80. See the "EXAMPLES" section below.
lockout unlock takes an optional force parameter. Without any parameters, lockout lock will check whether it is time to unlock the system
and, if so, executes /etc/lockout/unlock.sh, which is a shell script that you write. It should undo the effects of /etc/lockout/lock.sh,
executed when the system was locked. If you pass the force parameter to lockout unlock, lockout will forcibly unlock your system, whether
it was really time for that or not. lockout unlock should be called every minute by cron. See "CONFIGURATION".
lockout status will print out the time at which the system is going to be unlocked.
CONFIGURATION
/etc/cron.d/lockout must contain the following two entries:
*/1 * * * * root /usr/bin/lockout unlock >/dev/null 2>&1
@reboot root /usr/bin/lockout unlock force >/dev/null 2>&1
The examples that follow assume you are using sudo(8) and you have a file, /etc/lockout/sudoers.normal which is the normal /etc/sudoers
file, and /etc/lockout/sudoers.lock, which is the /etc/sudoers file when lockout locks your computer. This example also assumes you are
using iptables(8). /var/lib/iptables/active should contain your default firewall rules, and /var/lib/iptables/work should contain the
firewall rules that enforce discipline. See below for an example.
/etc/lock/lock.sh imposes discipline. For example:
#!/bin/sh
/etc/init.d/iptables load work
cp /etc/lockout/sudoers.lock /etc/sudoers
/etc/init.d/sudo stop
/etc/init.d/sudo start
/etc/lock/unlock.sh undoes these effects. For example:
#!/bin/sh
/etc/init.d/iptables restart
cp /etc/lockout/sudoers.normal /etc/sudoers
/etc/init.d/sudo stop
/etc/init.d/sudo start
Your /var/lib/iptables/work may look something like this:
*filter
:INPUT ACCEPT [1047:99548]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1104:120792]
# allow incoming packets from localhost, ntp,
# and existing connections
-A INPUT -i lo -j ACCEPT
-A INPUT -p udp -m udp --source-port ntp -m state --state ESTABLISHED -j ACCEPT
-A INPUT -m state --state ESTABLISHED -j ACCEPT
-A INPUT -p tcp -j DROP
-A INPUT -p udp -j DROP
# allow outgoing connections for email and DNS
-A OUTPUT -d 127.0.0.1/8 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport smtp -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport domain -j ACCEPT
-A OUTPUT -p udp -m udp --dport domain -j ACCEPT
-A OUTPUT -j DROP
COMMIT
EXAMPLES
lockout lock 2h30m [locks out for 2h and 30m]
lockout lock 90m [locks out for 1h and 30m]
lockout lock 3pm [locks out until 3pm]
lockout lock 3:20am [locks out until 3:20am]
lockout lock 15:20 [locks out until 3:20pm]
lockout status [shows when the system is going to be unlocked]
FILES
/etc/lockout/lock.sh: executed when running lockout lock
/etc/lockout/unlock.sh: executed when running lockout unlock
SEE ALSO usermod(8), iptables(8), passwd(1), cron(8), crontab(1)BUGS
Arguably, a program that changes the root password to something random with the possibility of never recovering the original password might
be considered a bug by itself. Other than that, no known bugs.
AUTHOR
Thomer M. Gil, http://thomer.com/lockout/
lockout 2004-09-08 LOCKOUT(1)