Firewall rules (iptables)

[labbe5]

Knocker is in your Ubuntu & Debian repositories.

To scan fort open ports : #knocker --host 192.168.xx.x


+-----------------------------------------------------------------------------+
|--=| k n o c k e r -- t h e -- n e t -- p o r t s c a n n e r |=-=[ 0.7.1 ]=-|
+-----------------------------------------------------------------------------+

- started by user root on Wed Oct 24 14:58:47 2018

- hostname to scan: 192.168.xx.x
- resolved host ip: 192.168.xx.x
- - scan from port: 1
- - - scan to port: 1024
- - - - scan type: tcp connect

+=- - - - - - - - - - - - - - - - - - - - - - - - - - - - - s c a n n i n g -

-=[ 53/tcp, domain ]=- * OPEN *
-=[ 80/tcp, http ]=- * OPEN *
-=[ 443/tcp, https ]=- * OPEN *

+=- - - - - - - - - - - - - - - - - - - - - - - - - - - - c o m p l e t e d -

- scanned host name: 192.168.xx.x IP: 192.168.xx.x

- found 3 open ports in a total of 1025 ports scanned.

- port scan completed in 0.34 seconds.

Check your firewall setup if needed.
About ufw : https://ubuntuforums.org/showthread.php?t=1876124

Knocker may crash. If It's the case, you can use netcat, and scan ports :
nc -v -z 127.0.0.1 1-1500 #localhost #1-1500 is port range
nc -v -z 192.168.xx.x 1-1500

Run the command "sudo netstat -plnt" to see a list of which programs are listening on which TCP ports. (Replace "t" with "u" in the options to view UDP ports or use -plntu to see both.)

Here is a discussion about security :
https://ubuntuforums.org/showthread.php?t=1871177

If you utilize all three of these methods; a strong firewall (ufw), mandatory access controls (AppArmor), and browser based addons (NoScript), you will see that we now have a strong 3 layer approach to desktop security. Which is preferable to any one of the approaches by itself. It now gives us three layers of protection a potential attacker has to circumvent. This reduces the odds of an automated attack being successful to almost 0 and greatly reduces the threat of an advanced attacker targeting you.

Good security comes in layers, each layer has to be overcome for an attack to be successful. Don't be the low-hanging fruit.

A website to scan your network for open ports based on nmap :
http://nmap.online-domain-tools.com/

What you care about are open ports. Closed ports and stealth ports are equally secure, in that they are inaccessible to the public.
Source : https://ubuntuforums.org/showthread.php?t=510812

Further reading :
https://teachmehacking.com/nmap-network ... -scanning/
Allow Port Through Firewall
https://linuxhint.com/ubuntu_allow_port_firewall/

[labbe5]

This firewall is for home computers without NAT, and is not intended for servers
NOTE: I assume you already know how to make these rules to be loaded at boot


Yes, Linux is secure, and we all know that. But we shouldn't stop talking about it's default Firewall, Netfilter, and how to properly configure it.

By default, Netfilter and it's front-end Iptables are configured in such way that they accept all incoming/out-going connections. For me this is ridiculous because all it takes is one vulnerable service and "BOOM", there goes the security of your system.
Having this in mind I always configured my Iptables in the safest way possible and in the shortest time possible.

I decided to create a safe setup while at the same time making it possible for any human being to read it. It works, it's safe, and all you need to do is copy/paste the rules I'm going to describe (with your desired changes). Simple, right?

Copy and paste in terminal firewall rules : https://github.com/amarildojr/Firewall/ ... ter/rules2

Source : https://www.wilderssecurity.com/threads ... ng.376935/

Firewall / output-NO-LOG :
https://github.com/amarildojr/Firewall/ ... put-NO-LOG

Further reading :
https://wiki.debian.org/Firewalls

[labbe5]

You can purchase the Armadillo USB firewall for $249.00 NZD from the official website of Globotron.
https://globotron.nz/products/armadillo ... b-firewall

Armadillo is a high-speed USB firewall that everyone can use. It connects between your computer and your USB device, isolating malicious firmware and keeping your computer safe.

Useful to know where to buy such a device.