I have configured a website but it seems not to be accessible and I found that I must open a port of 5250. I searched and I could not find a good way to do it. I am wondering if anyone could advise ?
I was reading that by default it is stored in
vi /etc/sysconfig/iptables
which I only see
# sample configuration for iptables service
# you can edit this manually or use system-config-firewall
# please do not ask us to add additional ports/services to this default configuration
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 8089 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
then I added the following
-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 5250 -j ACCEPT
then I restarted
I also tried to see the firewall status which made me more confused
# systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)
Active: inactive (dead)
Docs: man:firewalld(1)
Related
We need to find port on a server and read info from this port. If we will try to use nmap here - we will be banned. Because iptables config, that blocks scans. What nmap flags can we use for finding this port and not be banned?
first port iptables:
ipset create scanned_ports hash:ip,port family inet hashsize 32768 maxelem 65536 timeout 1
iptables -A INPUT -p tcp -m state --state INVALID -j DROP
iptables -A INPUT -p tcp -m state --state NEW -m set ! --match-set scanned_ports src,dst -m hashlimit --hashlimit-above 1000/hour --hashlimit-burst 1000 --hashlimit-mode srcip --hashlimit-name portscan --hashlimit-htable-expire 10000 -j SET --add-set port_scanners src --exist
iptables -A INPUT -p tcp -m state --state NEW -m set --match-set port_scanners src -j DROP
iptables -A INPUT -p tcp -m state --state NEW -j SET --add-set scanned_ports src,dst
nohup python -mSimpleHTTPServer $_PORT > /dev/null &
second port iptables:
ipset create scanned_ports hash:ip,port family inet hashsize 32768 maxelem 65536 timeout 1
iptables -A INPUT -p tcp -m state --state INVALID -j DROP
iptables -A INPUT -p tcp -m state --state NEW -m set ! --match-set scanned_ports src,dst -m hashlimit --hashlimit-above 1000/hour --hashlimit-burst 1000 --hashlimit-mode srcip --hashlimit-name portscan --hashlimit-htable-expire 10000 -j SET --add-set port_scanners src --exist
iptables -A INPUT -p tcp -m state --state NEW -m set --match-set port_scanners src -j DROP
iptables -A INPUT -p tcp -m state --state NEW -j SET --add-set scanned_ports src,dst
iptables -I INPUT -p tcp --tcp-flags ALL SYN -j REJECT --reject-with tcp-reset --dport $_PORT
nohup python -mSimpleHTTPServer $_PORT > /dev/null &
I'm in IP tables hell, for the first time in ten years!
# Generated by iptables-save v1.6.0 on Fri Jan 10 16:36:24 2020
*nat :PREROUTING ACCEPT [0:0] :INPUT ACCEPT [0:0] :OUTPUT ACCEPT [6:371] :POSTROUTING ACCEPT [6:371]
-A PREROUTING -p tcp -m tcp --dport 3306 -j DNAT --to-destination 172.25.25.50:3306
-A PREROUTING -p tcp -m tcp --dport 3307 -j DNAT --to-destination 172.25.25.226:3306
-A POSTROUTING -d 172.25.25.50/32 -p tcp -m tcp --dport 3306 -j SNAT --to-source 10.128.128.52
-A POSTROUTING -d 172.25.25.226/32 -p tcp -m tcp --dport 3306 -j SNAT --to-source 10.128.128.52 COMMIT
# Completed on Fri Jan 10 16:36:24 2020
Basically I have 2 independent mysql server instances on the end of the line.
Server 1 - 172.25.25.50:3306 can be reached successfully.
Server 2 - 172.25.25.226:3307 cannot be hit at all.
The source is the same for both, it's an LB - 10.128.128.52, which is why Server 1 and Server 2 are using different ports. port 3306/3307 are open on the LB and the machine, I think.
Forwarding is turned on, both on the server OS and the instance settings..
HALP! :D
Simply put up antother VM, and stuck in the following in both.
# Generated by iptables-save v1.6.0 on Fri Jan 10 16:36:24 2020
*nat :PREROUTING ACCEPT [0:0] :INPUT ACCEPT [0:0] :OUTPUT ACCEPT [6:371] :POSTROUTING ACCEPT [6:371]
-A PREROUTING -p tcp -m tcp --dport 3306 -j DNAT --to-destination 172.25.25.50:3306
-A POSTROUTING -d 172.25.25.50/32 -p tcp -m tcp --dport 3306 -j SNAT --to-source 10.128.128.52
I am trying to limit HTTP requests to maximum 20 requests/second if more than that reject but i want to exclusion requests to (.png,.js,.css) files from this rule, I used the following code
iptables -N RATELIMITING
iptables -I INPUT -p tcp --dport 80 -m string --algo bm --string "/" -j RATELIMITING
iptables -A RATELIMITING -p tcp --dport 80 -m string --algo bm --string "\.(jpe?g|png|gif|js|css|woff)$" -j RETURN
iptables -A RATELIMITING -p tcp --dport 80 -m state --state NEW -m recent --set
iptables -A RATELIMITING -p tcp --dport 80 -m state --state NEW -m recent --update --seconds 1 --hitcount 20 -j REJECT --reject-with tcp-reset
iptables -A RATELIMITING -j RETURN
it does block requests more than 20 requests but it doesn't exclusion (.png,.js,.css) files from rule,if I send 20 requests to those files you also get blocked, what am I doing wrong here?
nginx-proxy is a Docker container that acts as a reverse proxy to other containers. It uses the Docker API to detect other containers and automatically proxies traffic to them.
I have a simple nginx-proxy setup: (where subdomain.example.com is replaced with my domain)
docker run -d -p 80:80 -v /var/run/docker.sock:/tmp/docker.sock:ro jwilder/nginx-proxy
docker run -e VIRTUAL_HOST=subdomain.example.com kdelfour/cloud9-docker
It works with no problem when I have my firewall off. When I have my firewall on, I get a 504 Gateway Time-out error from nginx. This means that I'm able to see nginx on port 80, but my firewall rules seem to be restricting container-to-container and/or Docker API traffic.
I created a GitHub issue, but the creator of nginx-proxy said he had never run into this issue.
These are the "firewall off" rules: (these work)
iptables -F
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
These are my "firewall on" rules: (these don't work)
# Based on tutorial from http://www.thegeekstuff.com/scripts/iptables-rules / http://www.thegeekstuff.com/2011/06/iptables-rules-examples/
# Delete existing rules
iptables -F
# Set default chain policies
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP
# Allow loopback access
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
# Allow inbound/outbound SSH
iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
# Allow inbound/outbound HTTP
iptables -A INPUT -i eth0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
# Allow inbound/outbound HTTPS
iptables -A INPUT -i eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
# Ping from inside to outside
iptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
# Ping from outside to inside
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT
# Allow outbound DNS
iptables -A OUTPUT -p udp -o eth0 --dport 53 -j ACCEPT
iptables -A INPUT -p udp -i eth0 --sport 53 -j ACCEPT
# Allow outbound NTP
iptables -A OUTPUT -p udp -o eth0 --dport 123 -j ACCEPT
iptables -A INPUT -p udp -i eth0 --sport 123 -j ACCEPT
# This bit is from https://blog.andyet.com/2014/09/11/docker-host-iptables-forwarding
# Docker Rules: Forward chain between docker0 and eth0.
iptables -A FORWARD -i docker0 -o eth0 -j ACCEPT
iptables -A FORWARD -i eth0 -o docker0 -j ACCEPT
ip6tables -A FORWARD -i docker0 -o eth0 -j ACCEPT
ip6tables -A FORWARD -i eth0 -o docker0 -j ACCEPT
iptables-save > /etc/network/iptables.rules
Why won't the proxy work when I have my firewall on?
Thanks to advice by Joel C (see the comments above), there was a problem on the FORWARD chain which I fixed like so:
iptables -A FORWARD -i docker0 -j ACCEPT
Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
Closed 8 years ago.
Improve this question
I have set up several iptables rules , and at the end I set The Policies to Drop
But It will Drop every thing even my rules
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A INPUT -p tcp -s 127.0.0.1 --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -d 127.0.0.1 --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -s x.x.x.x --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -s 127.0.0.1 -p tcp -m state --state NEW,ESTABLISHED -m multiport --sports 110,25,143 -j ACCEPT
iptables -A INPUT -p tcp -s x.x.x.x --dport 3690 -j ACCEPT
iptables -A OUTPUT -p tcp -s 127.0.0.1 --sport 3690 -j ACCEPT
iptables -A INPUT -p tcp -s 0/0 --sport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -s x.x.x.x --sport 22 --dport 22 -j ACCEPT
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
but I cant access my website or ssh . Please help, thanks in advance
Iptables -nvL :
Chain INPUT (policy ACCEPT 3158 packets, 285K bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT tcp -- * * 127.0.0.1 0.0.0.0/0
tcp dpt:3306 state NEW,ESTABLISHED
0 0 ACCEPT tcp -- * * 82.115.26.145 0.0.0.0/0 tcp dpt:3306 state NEW,ESTABLISHED
0 0 ACCEPT tcp -- * * 82.115.26.145 0.0.0.0/0 tcp dpt:3690
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:80 state NEW,ESTABLISHED
0 0 ACCEPT tcp -- * * 82.115.26.145 0.0.0.0/0 tcp spt:22 dpt:22
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 1152 packets, 160K bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * lo 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT tcp -- * * 0.0.0.0/0 127.0.0.1 tcp dpt:3306 state NEW,ESTABLISHED
0 0 ACCEPT tcp -- * * 127.0.0.1 0.0.0.0/0 state NEW,ESTABLISHED multiport sports 110,25,143
0 0 ACCEPT tcp -- * * 127.0.0.1 0.0.0.0/0 tcp spt:3690
but assume the policy is DROP for all chains
You have the fundamentals there but they are a little mixed up. INPUT needs a source ip and destination port and OUTPUT needs a destination ip and source port. Traffic coming in will be NEW or ESTABLISHED and traffic going out from server services (in a client/server design) will be ESTABLISHED.
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A INPUT -p tcp -s x.x.x.x --dport 3306 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -d x.x.x.x --sport 3306 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -s x.x.x.x --dport 3690 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -d x.x.x.x --sport 3690 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -s x.x.x.x --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -d x.x.x.x --sport 22 -m state --state ESTABLISHED -j ACCEPT
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP