ServerBuddies Support Blog

Adding comments to iptables.

comment

Allows you to add comments (up to 256 characters) to any rule.

–comment comment

Example:

Using iptables to block incomming traffic but not effect outgoing traffic.

Solution:

The below command permits incomming packets only if they are part of established outgoing connections.

Using iptables to reject spoofing.

If you have a Linux machine acting as a firewall for an internal network 192.168.0.* with two network interface.

Solution:

*The Linux firewall can refuse packets in two manager - iptables call them DROP and REJECT.

Enabling Source Address Verification

To prevent remote host from spofing incoming packets as if they had come from the local machine.

Solution:

Trun on source address verification in the Linux kernel.

A quick method is to add this line to /etc/sysctl.conf

And then run the sysctl command to read the configuration.

DESCRIPTION

sysctl is used to modify kernel parameters at runtime. The parameters available are those listed under /proc/sys/. Procfs is required for sysctl support in Linux. You can use sysctl to both read and write sysctl data.

EXAMPLES

-w Use this option when you want to change a sysctl setting.

-p Load in sysctl settings from the file specified or /etc/sysctl.conf if none given. Specifying - as filename means reading data from standard input.

-a Display all values currently available.

-A Display all values currently available in table form.

The simplest way to open up port 10000 is to use one of the Webmin firewall management modules, such as Linux Firewall, BSD Firewall or IPFilter Firewall. However, to access this you’ll need to run a brower on the same system as Webmin, and access it via the URL http://localhost:10000/.

The alternative is to login as root via SSH, and manually edit the firewall configuration file. On Redhat and derived systems, this is /etc/sysconfig/iptables, while on Debian it is /var/lib/iptables. The line you need to add is :

Once this line has been added, you will need to apply the firewall configuration. This is typically done with the command