I tried to add a command like this in my iptables:
sudo iptables -A OUTPUT -p tcp --tcp-flags RST RST -d 2.25.52.5 -dport 6784 -j DROP
And I got
iptables v1.4.21: multiple -d flags not allowed
I'm trying to drop RSTs sent from my machine to 2.25.52.5:6784.
-d is destination address, if you want destination port please use --dport 6784
Hope it helps.
Related
I can set iptables rules to prevent external connection. But can we use iptables to prevent internal connection? For example, I have set iptables to prevent port 5555 port on my machine, but my local APP can still connect with 5555 when running on my machine.
Yes you can block it using iptables.
iptables -A INPUT -d 127.0.0.1 -p tcp --dport 5555 -j DROP
With this command you'll not be able to connect from your own host to your own service. Then you can remove the rule using the opposite to -A append which is -D delete:
iptables -D INPUT -d 127.0.0.1 -p tcp --dport 5555 -j DROP
Hope it helps.
Depends upon how you are blocking the port 5555, if you have a specific INPUT rule with interface and source and/or destination addresses it would match only those. In your case, you could modify your rule to just match tcp destination port 5555 and it will block all packets to tcp destination port 5555. for eg:
iptables -t filter -I INPUT -p tcp --dport 5555 -j DROP
If you just want to block your internal apps and not touch your existing iptables rule then use the incoming interface as lo for eg:
iptables -t filter -I INPUT -i lo -p tcp --dport 5555 -j DROP
Note: If you are using destination ip then use the entire loopback address range rather than just 127.0.0.1 for eg:
iptables -t filter -I INPUT -d 127.0.0.0/8 -p tcp --dport 5555 -j DROP
Before you do any changes you can instead of -j DROP action use -j LOG action to log and confirm the tcp connections this rule will match. You could also skip the action part without specifying the -j option and check how many packets would match your rule with iptables -t filter -L -n -v without causing any harm.
My centos server has an iptables rule.
iptables -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 50 -j REJECT --reject-with tcp-reset
this code is doing the work like firewall but I don't want to block of my server ips.
my server ips:
"127.0.0.1", "my server ip1", "my server ip2", etc.
How do I get them out of this ip tables rule?
Thank you very much!
Just use :
# Loopback
iptables -I INPUT -s 127.0.0.1 -i lo -j ACCEPT
# Repeat for each SERVER_IP
iptables -I INPUT -s SERVER_IP -j ACCEPT
Note that this will open everything for SERVER_IPs. YMMV depending on want you want to allow.
For instance, if you just want to open HTTP port for those IPs :
# Loopback
iptables -I INPUT -s 127.0.0.1 -i lo -j ACCEPT
# Repeat for each SERVER_IP
iptables -I INPUT -s SERVER_IP -p tcp --dport 80 -j ACCEPT
I am trying to find the way to block all web-pages that I browse that use plaintext password for their logins with iptables.
Here is the command I tried, something it wrong with it. How do I enter this command? This is for educational purpose only. Say, if I use "password" for all my logins.
Thanks.
nata#nata-VirtualBox:~$ iptables -A OUTPUT -s match --string "password" --dport 80 -p tcp -j DROP
iptables v1.4.12: unknown option "--string"
Try `iptables -h' or 'iptables --help' for more information.
nata#nata-VirtualBox:~$ iptables -A OUTPUT -m string --string "password" --dport 80 -p tcp -j DROP
string: Could not determine whether revision 1 is supported, assuming it is.
iptables v1.4.12: unknown option "--dport"
Try `iptables -h' or 'iptables --help' for more information.
Try with this:
iptables -A OUTPUT -p tcp --dport 80 -m string --string password --algo bm -j DROP
To get help on a specific match, you can do:
iptables -m Match-Name --help
The following will drop packets which contain the string specified:
iptables -I FORWARD -j DROP -p tcp -s 0.0.0.0/0 -m string --string "therichsheickc#yahoo.com"
The string is one which a botnet spammer uses (from 1000's upon 1000's of ip addresses) to hammer my email servers constantly. This rule is somewhat effective, but doesn't stop the connections. I'd like it to -j DROP the IP as well after a match. Can I do this in iptables without going to userspace?
This particular scanner always greet with EHLO 192.168.2.33. Use these rules to stop them:
iptables -t raw -A PREROUTING -i eth+ -p tcp --dport 25 -m string --string "192.168.2.33" --algo bm -m recent --set --name SBOT
iptables -I INPUT -i eth+ -p tcp --dport 25 -m recent --rcheck --name SBOT -j REJECT --reject-with tcp-reset
or maybe this will help :
iptables -A FORWARD -m string --algo bm --string "therichsheickc#yahoo.com" -j DROP
how do I drop all traffic to smtp, except originating from my IP? This example I found drops traffic for particular IP, I need to deny by default, but allow 1 IP in. Thanks
# iptables -A INPUT -s 65.55.44.100 -p tcp --destination-port 25 -j DROP
iptables -A INPUT -s ! 65.55.44.100 -p tcp --destination-port 25 -j DROP
# iptables -A INPUT -s 65.55.44.100 -p tcp --destination-port 25 -j ACCEPT
# iptables -A INPUT -p tcp --destination-port 25 -j DROP
If you actually want to deny all traffic by default, and only open up holes for specific protocols/addresses/etc., what you want to do is continue to use the rule you have now, and also modify the default policy like so:
# iptables -P INPUT DROP
Otherwise, siposa's answer will drop all SMTP traffic except for the specified IP address, while not affecting other protocols.