Posts by Drigo

$ sudo service nftables status

● nftables.service - nftables

Loaded: loaded (/lib/systemd/system/nftables.service; enabled; vendor preset: enabled)

Active: failed (Result: exit-code) since Mon 2017-10-23 14:29:43 CEST; 16min ago

Docs: man:nft(8)

http://wiki.nftables.org

Process: 319 ExecStart=/usr/sbin/nft -f /etc/nftables.conf (code=exited, status=255)

Main PID: 319 (code=exited, status=255)




Okt 23 14:29:42 caodb systemd[1]: Starting nftables...

Okt 23 14:29:43 caodb systemd[1]: nftables.service: Main process exited, code=exited, status=255/n/a

Okt 23 14:29:43 caodb systemd[1]: Failed to start nftables.

Okt 23 14:29:43 caodb systemd[1]: nftables.service: Unit entered failed state.

Okt 23 14:29:43 caodb systemd[1]: nftables.service: Failed with result 'exit-code'.

#!/usr/bin/nft -t





table inet filter {

chain input {

type filter hook input priority 0;




# allow established/related connections

ct state {established, related} accept




# early drop of invalid connections

ct state invalid drop




# allow from loopback

iifname lo accept




# allow icmp

ip protocol icmp accept

ip6 nexthdr icmpv6 accept




# allow ssh,http

tcp dport {ssh} accept




# everything else

reject with icmp type port-unreachable

}

chain forward {

type filter hook forward priority 0;

drop

}

chain output {

type filter hook output priority 0;

}


}

Reading package lists... Done

Building dependency tree

Reading state information... Done

Suggested packages:

mailx monit

The following NEW packages will be installed:

fail2ban

0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.

Need to get 0 B/288 kB of archives.

After this operation, 1,321 kB of additional disk space will be used.

Selecting previously unselected package fail2ban.

(Reading database ... 35222 files and directories currently installed.)

Preparing to unpack .../fail2ban_0.9.6-2_all.deb ...

Unpacking fail2ban (0.9.6-2) ...

Setting up fail2ban (0.9.6-2) ...

Job for fail2ban.service failed because the control process exited with error code.

See "systemctl status fail2ban.service" and "journalctl -xe" for details.

invoke-rc.d: initscript fail2ban, action "start" failed.

● fail2ban.service - Fail2Ban Service

Loaded: loaded (/lib/systemd/system/fail2ban.service; enabled; vendor preset: enabled)

Active: activating (auto-restart) (Result: exit-code) since Thu 2017-10-19 08:35:50 UTC; 59ms ago

Docs: man:fail2ban(1)

Process: 2716 ExecStart=/usr/bin/fail2ban-client -x start (code=exited, status=255)




Oct 19 08:35:50 raspberrypi systemd[1]: Failed to start Fail2Ban Service.

Oct 19 08:35:50 raspberrypi systemd[1]: fail2ban.service: Unit entered failed state.

Oct 19 08:35:50 raspberrypi systemd[1]: fail2ban.service: Failed with result 'exit-code'.

dpkg: error processing package fail2ban (--configure):

subprocess installed post-installation script returned error exit status 1

Processing triggers for systemd (232-25+deb9u1) ...

Processing triggers for man-db (2.7.6.1-2) ...

Errors were encountered while processing:

fail2ban

E: Sub-process /usr/bin/dpkg returned an error code (1)

$

echo "Als erstes alle Regeln zurücksetzen"

sudo iptables -F

sudo iptables -X

sudo iptables -t nat -F

sudo iptables -t nat -X

sudo iptables -t mangle -F

sudo iptables -t mangle -X

sudo iptables -P INPUT ACCEPT

sudo iptables -P FORWARD ACCEPT

sudo iptables -P OUTPUT ACCEPT

echo "Alle lokalen Verbindungen auf dem Loopback akzeptieren"

sudo iptables -A INPUT -i lo -j ACCEPT

echo "Komische aussehende Pakete verwerfen (oft fuer Angriffe benutzt)"

sudo iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP

sudo iptables -A INPUT -f -j DROP

sudo iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP

sudo iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP

echo "Datenverkehr akzeptieren der zu einer bereits geöffneten Verbindung gehört"

sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

echo "SSH erlauben"

sudo iptables -A INPUT -p tcp --dport 33 -j ACCEPT

echo "MySQL4 erlauben"

sudo iptables -A INPUT -p tcp --dport 3306 -j ACCEPT

echo "Alle anderen Verbindungen ablehnen"

sudo iptables -A INPUT -j REJECT

sudo sh -c "iptables-save > /etc/network/iptables"