trimstray / iptables-essentials

Iptables Essentials: Common Firewall Rules and Commands.

Hi!

I'm a System and Network Administrator. I post my ongoing research at blkcipher.pl.

Some of my blog posts ^[PL]

• Czym jest i jakie znaczenie ma średnie obciążenie systemu?
• TLS: Jaki rozmiar powinien mieć klucz prywatny?
• Co jeśli kill -9 nie działa?
• NGINX: Usprawnienie zamykania procesów roboczych
• Dlaczego pamięć SWAP jest nadal istotna?
• Negocjacja wersji TLS i pakiet szyfrów sygnalizacyjnych

iptables-essentials's Issues

link broken: Error 404 - pusher.com

Manuals/Howtos/Tutorials

----->Per-IP rate limiting with iptables

https://pusher.com/
Error 404
Page not found

link broken: Error 404 - pusher.com

Doesn't seems right

It said allow incoming but the rules allow both INPUT and OUTPUT connection, is it necessary to open both chain?

Using proxies

I have two proxies running on 8083 and 80 I'm using iptables -t nat -A OUTPUT -p tcp --dport 8083 -j DNAT --to-destination :80 and using curl 127.0.0.1:8083 to verify the outgoing traffic goes to proxy on port 80 I also want to capture the traffic on port 8083 but my proxy isn't showing that traffic on port 8083

Blocking packets from private subnets

I have seen a rule that says it blocks packets from spoofed sources and I was wondering how that works.
I only want to communicate with devices that are actually connected to my network that I can see in my router page.

I was wondering how I would apply these rules using iptables here is some information that may help you

Linux kali 5.18.0-kali5-amd64 #1 SMP PREEMPT_DYNAMIC Debian 5.18.5-1kali6 (2022-07-07) x86_64 GNU/Linux
iptables v1.8.8 (nf_tables)

Here are my rules

Chain INPUT (policy ACCEPT 2 packets, 130 bytes)
pkts bytes target prot opt in out source destination
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 21,22,23,5555,5037 state NEW
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 21,22,23,5555,5037 state ESTABLISHED
0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 REJECT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID reject-with icmp-port-unreachable
0 0 REJECT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED reject-with icmp-port-unreachable
0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 MAC 2c:54:91:95:3b:3a reject-with icmp-port-unreachable

Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 1 packets, 82 bytes)
pkts bytes target prot opt in out source destination
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 21,22,23,5555,5037 state NEW
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 21,22,23,5555,5037 state ESTABLISHED
0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 REJECT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID reject-with icmp-port-unreachable
0 0 REJECT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED reject-with icmp-port-unreachable
Zeroing chain INPUT' Zeroing chain FORWARD'
Zeroing chain `OUTPUT'

The same as rule

Bad / incorrect example: "Only Block Incoming Traffic"

The title "Only Block Incoming Traffic" and provided code make no sense together. The code clearly ACCEPTS all incoming traffic. All outbound traffic is allowed as well.

https://github.com/trimstray/iptables-essentials#only-block-incoming-traffic

I'd offer an alternative, but it's not clear what the author had intended.