Issue was solved by following instructions here: https://ch1p.io/lineageos-run-shell-script-at-boot-as-root/ The main issue turned out to be missing full path of executables, e.g.: /system/bin/iptables instead of iptables

This is close to ask whether a shutdown computer needs updates. The answer is not if and only if you are sure that it will always stay off. Your question should receive a similar answer: if you are sure that no listening services are active and will never be you do not need to block incoming connections. But in real world, no network service at all is hard to achieve. At least XWindow is a network oriented protocol and many services are installed and are active by default on a newly installed system. Furthermore, a firewall should not be limited to blocking incoming connections, but should also control which outgoing connections are allowed. Doing so can prevent that a user just downloads or receives by mail (through legitimate outgoing connections...) in infected application that later will try to leak private informations or even worse will open a tunnel giving the attacker a local access. The stricter the outgoing filter the harder it will be for the attacker.

For "reports" Simple means in your case:sudo iptables -v -t nat -A POSTROUTING -s 192.168.0.0/24 -d 81.19.82.8 -j MASQUERADE sudo iptables -v -t nat -A POSTROUTING -s 192.168.0.0/24 -d 81.19.82.9 -j MASQUERADE sudo iptables -v -t nat -A POSTROUTING -s 192.168.0.0/24 -d 81.19.82.10 -j MASQUERADE sudo iptables -v -t nat -A POSTROUTING -s 192.168.0.0/24 -d 81.19.82.11 -j MASQUERADE Or create a new sign::ALLOW2NET - DROP [0:0] -A ALLOW2NET -d 81.19.82.9 -j MASQUERADE -A ALLOW2NET -d 81.19.82.8 -j MASQUERADE -A ALLOW2NET -d 81.19.82.11 -j MASQUERADE -A ALLOW2NET -d 81.19.82.10 -j MASQUERADE And write a rule. -A POSTROUTING -s 192.168.0.0/24 -j ALLOW2NETEither using the module ipsetSet ipset first;Create a grid create allow2net hash:netAdd addressesipset add allow2net 81.19.82.9/32 ipset add allow2net 81.19.82.8/32 ipset add allow2net 81.19.82.10/32 ipset add allow2net 81.19.82.11/32 Write -A PREROUTING -s 192.168.0.0/24 -m set --match-set allow2net dst -j MASQUERADEThe last two options suggest that you have a file with iptables that are stored when the car is downloaded. The ipset version requires the same nuclear module. xt_set (ipt_set) ♪

INPUT are incoming packages that go directly to you. You're gonna need a line for the ForWARD.Well, it's better to scream the bags off the server, but go to the server.

You're using a rule to redirect bags from port 53 to 9053, but you don't have a rule to permit incoming server bags. Any answers from 9053? Then you need that rule... -A INPUT -p udp --dport 9053 -j ACCEPTAbout HTTPS, this protocol uses port 443, and you only have packages from the 80th port (HTTP). Add your rule to this: -A INPUT -p tcp -m multiport --dports 22,80,443,8888,8889 -j ACCEPTSupplement: Didn't work for DNS? What about HTTPS? Is he in trouble? And you tried to use the transaction log? For example, designate LOG_ACCEPT/LOG_REJECT and then describe them in approximately:-A LOG_ACCEPT -j LOG --log-prefix "INPUT:ACCEPT:" --log-level 6 --log-uid -A LOG_ACCEPT -j ACCEPT-A LOG_REJECT -j LOG --log-prefix "INPUT:REJECT:" --log-level 6 --log-uid -A LOG_REJECT -j REJECT( tastes)

This is where the issue of certificates begins, i.e. the google certificate checks with the house lock, and there's a mistake of inconsistency... How to avoid such a problem?I don't know how much I know, because that's the point of the interconnection: No. Couldn't have touched a real website.♪Probably the fairest way. bypass the problem is simply the rejection of such connections ( https://serverfault.com/a/157376/292034 in terms netfilter-aSo that the browser immediately informs the user of something like " unable to access the server " .Even https://ru.wikipedia.org/wiki/Captive_portal This point is noted (as I have done):Since the captive portal scenario only leads to the browser when applied to non-https websiteProblems may be encountered in redirecting users from non-recognizable captive portals and opening sites for use https (e.g. with HSTS included technology). According to Chrome manufacturers, about 5 per cent of SSL/TLS error reports are due to Captive Portals.

Maybe help filtering the contents of the bags. See. http://manpages.org/iptables-extensions/8 module string♪iptables -A INPUT -p tcp --dport 2710 -m string --algo bm --string 'Host: site.ru' -j REJECT --reject-with tcp-reset iptables -A INPUT -p udp --dport 2710 -m string --algo bm --string 'Host: site.ru' -j REJECT --reject-with icmp-port-unreachable These rules filter all packages entering port 2710 and containing the line "Host: site.ru." Optical --from and --to You can reduce the search area, but in this case, I don't think it's necessary.Naturally, if there is no information on the requested site in the package, the server cannot distinguish requests from different domain names. Protocol http://www. The server ' s home name is specified (this is used for virtual hosts). So for the browser, the filter has to work, but it's not going to work immediately (the socket opens) and when the house name of the host is transferred. Po udp I'm guessing it's possible to collate data in any format, http://www. with heading Hostif it's over udp Another protocol is used, the filter will pass.

With help tcpdump Determine what's going on with requests.Check if this applies only to HTTP queries or all traffic (e.g. ICMP).Depending on the results obtained in 1 and 2, the relevant subsystems need to be developed (indicate the results on the question and I'll finish what to do next).

if for the table filter Policy ACCEPT (line) :INPUT ACCEPT in conclusion iptables-save) and There are no other rules in the table, approximately:$ sudo iptables -A INPUT -p tcp \! -s ip-адрес --dport порт -j REJECT i.e., reject all packages under the protocol. tcp Not c/ ip-адреса for which порт♪But in your particular case, considering that the chain INPUT to rule with directive REJECT (line) -A INPUT -j REJECT ... in conclusion iptables-saveadd this rule netfilter-a (amending his logic to the opposite) should not end the chain. INPUT What a team does. -Aand somewhere above the final rule, for example, at the very beginning of the chain. -I without argument:$ sudo iptables -I INPUT -p tcp -s ip-адрес --dport порт -j ACCEPT I mean. ♪ Authorization All packages under protocol tcp c/ ip-адреса for which порт♪

Two things:Use it. -I instead -AThen you guarantee that the rule is added to the beginning of the chain, and nothing prevents it.Control the chain ' s performance through the rule -j LOG at the end, not by tcpdump♪tcpdump No. in principle Show me what he's doing. iptables♪ Because he works on the interface (between canal and network) and the traffic begins to process iptables/netfilter later.Otherwise, it's all right.

Not mentioned https://en.wikipedia.org/wiki/Resolv.conf It's probably his thing.The file retains the information necessary to transform the domain names into the ip address (and back).at a minimum, the shape of the species shall be present:nameserver ip-адрес where ip-адрес - That's the address. https://ru.wikipedia.org/wiki/DNS-%D1%81%D0%B5%D1%80%D0%B2%D0%B5%D1%80 which, in fact, will be achieved (when approached by your system) by the above transformation (e.g., ya.ru , 93.158.134.3)The sooner the name server is located, the sooner the answer is received from him, you can take the address from a similar file from the second computer or use some public information:8.8.8.8♪ 8.8.4.4 (sighs) https://ru.wikipedia.org/wiki/Google_Public_DNS )77.88.8.8♪ 77.88.8.1 (sighs) https://ru.wikipedia.org/wiki/%D0%AF%D0%BD%D0%B4%D0%B5%D0%BA%D1%81.DNS )

We need to add to the virtual host configuration about the following lines, if you want to do it through NGINX.location / { allow 100.23.45.14; ## IP которому нужно разрешить доступ allow 100.23.45.15; ## IP которому нужно разрешить доступ deny all; } If you want to do this through Iptables, you need to write the following lines:iptables -I INPUT -s <allowed_ip> -p tcp --dport 80 -i eth0 -j ACCEPT iptables -A INPUT -j DROP -p tcp -i eth0 --dport 80 The first line needs to be repeated as many times as IP needs to be added to the authorized list. Consider iptables:I: Opening of the ruleA: Put the rule at the ends: IP address of sourcej: Implement if the package conforms to the current rule (ACCEPT accept the package, DROP blocking the package)p. Protocoldport: Port through which the package is expectedi: Interface

I didn't want to get the team.$ sudo iptables -t nat -A PREROUTING -p tcp -j REDIRECT --to-port 6000 Remove the rule by replacing the option -A (add) at -D (delete). All other options/parameters shall be exactly the same:$ sudo iptables -t nat -D PREROUTING -p tcp -j REDIRECT --to-port 6000

Get in the server management collar like a root ssh.>ssh roor@ip_servera and open the right port for nodejs.>iptables -I INPUT -p tcp --dport PORT -m state --state NEW -j ACCEPT / Inside PORT indicate the appropriate port, e.g. 3,000maintain data>service iptables save reboot iptables>service iptables restart If you're under the Win, use it as a ssh client, like PuTTY. You can do the same through the vesta panel, just pointing out the right port.for nodejsserver.listen(3000);

http://www.fail2ban.org/wiki/index.php/Main_Page Maybe help. It's a tool that automatically bans the iptables of nodes suspected of evil activity based on the analysis of the logs. Ban can be permanent or temporary - fail2ban can and can ban them in a while. Flexible designs, everyone use.In order to analyse attempts to enter WordPress, it will be necessary https://wordpress.org/plugins/wp-fail2ban/ so that the searches are recorded in syslog. https://bjornjohansen.no/using-fail2ban-with-wordpress (in English)

I want to get 10.10.1.3:554 I can get RTSP flow.Two rules should be added in a car with a ip address 10.10.1.3. netfilter-a - dnat and for snatapproximately:$ iptables -A PREROUTING -i tun0 -p tcp -m tcp --dport 554 -j DNAT --to-destination 192.168.1.254 $ iptables -A POSTROUTING -o eth0 -p tcp -m tcp -j SNAT --to-source 192.168.1.2 meaning dnat-Regulation that the packages entering the tun0 interface, port 554, should be replaced by the destination address of 192.168.1.254.These packages will be moving through the eth0 interface, where it will already work. snat- The rule that replaces the source &apos; s address is 192.168.1.2. the sense of this rule is that when the ip-camera sends back packages, it salvaged them to that address. netfilter will replace the destination and source addresses to the &quot; origin &quot; , so that the package is in the right direction and with the right address.Oh, yes, it should be mentioned that the same car should allow the transfer of packages between the interfaces. https://ru.stackoverflow.com/a/525245/178576 ♪

Whatever you and these bags do serverThey'll be there anyway. Do♪And they're gonna shut down the channel.in such a situation, &quot; spas &quot; can only filter such packages into prior to routing points, for example, at your network service provider.

I understand it means the traffic that comes to the interface. vmbr0 addressed to x.x.x.x♪These rules should be &quot; brought to the common denominator &quot; :iptables -A PREROUTING -t nat -i vmbr0 -p tcp -d 'x.x.x.x --dport 443 -j DNAT --to 192.168.0.200:443 iptables -A PREROUTING -t nat -i vmbr0 -p tcp -d 'x.x.x.x --dport 80 -j DNAT --to 192.168.0.1:80 If a target virtual machine has a ip address 192.168.0.200the second rule should include this ip address.and this rule should be removed:iptables -t nat -A POSTROUTING -o vmbr1 -j SNAT --to-source 192.168.0.1 A default lock should be assigned to a dedicated virtual car by a ip- address, which is assigned to a network interface (in a car with a netfilter-and-and-in question) to look at the local network. I understand. 192.168.0.1♪

Not through iptables.Several other web-based systems are described: two servers connected to the Internet independently.In your case (when the second car has a default lock number one), this is quite feasible: https://ru.stackoverflow.com/q/528595/178576 But a more flexible solution I think will be to process. ssl in the first of the vehicles (Slue). http://www.s- I'm gonna need you to know the whole house name and cover it. http-- (grunts) http://www.s♪() Packages for necessary http-servers inside your network, and these servers can be accepted and processed. http-- (grunts) http://www.s♪traffic.to make these servers understand that https used, available https://en.wikipedia.org/wiki/List_of_HTTP_header_fields#Common_non-standard_request_fields and these servers will then be able to inform the websites of this fact (e.g. some cms have a habit of redirecting. httpsif &quot; found &quot; what is used http://www.e.g. for authorizing users.how to deal with this title apachewritten, for example, https://habrahabr.ru/post/142363/ :<VirtualHost ...> ServerName ... ... SetEnvIf X-Forwarded-Proto https HTTPS=on ... </VirtualHost> how to deal with this title nginxwritten, for example, https://forum.nginx.org/read.php?2,11794,11794 :server { ... set_scheme_from ip-адрес-шлюза; real_scheme_header X-Forwarded-Proto; ... }

Out of the commentaryOne option to cover ports from scanning and unauthorized connections is a mechanism https://en.wikipedia.org/wiki/Port_knocking ♪ The point is that the initial port of the protected service is closed by a firewall, demon port knocking'a expects to receive packages for certain ports in a given sequence, after which the port of service opens for external access.Manuals in construction: https://wiki.archlinux.org/index.php/Port_knocking http://ashep.org/2010/zashhita-sistemy-pri-pomoshhi-port-knocking/ The advantages/inadequacy of port knocking is a matter under discussion, but in any case, this mechanism should be considered as part of the security system rather than its only element.Major inconveniences in the use of:A client is required to pre-record the sequence of the packages before the connection.There is no direct support in Linux Yacht (although there are options for the whole iptables solution). Demon port knocking'a is the point of rejection, the problem of the demon's functioning will lead to problems with access to protected services.It's recommended that the sequence of "stacks" be changed periodically.