LinuxQuestions.org
Latest LQ Deal: Linux Power User Bundle
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 04-05-2013, 02:57 PM   #1
Animisparati
LQ Newbie
 
Registered: Nov 2012
Posts: 2

Rep: Reputation: Disabled
Egress Filter


I would like to set up an Egress filter that cross references a list of IP addresses and domains i have in a text file and emails me if a machine talks to one. I would prefer the system be transparent.
Can this be done natively with IPtables? Or does it require additional utilities, like PSAD or Snort?
How would you do it?
Thanks for any help!
 
Old 04-06-2013, 09:50 PM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,353
Blog Entries: 55

Rep: Reputation: 3541Reputation: 3541Reputation: 3541Reputation: 3541Reputation: 3541Reputation: 3541Reputation: 3541Reputation: 3541Reputation: 3541Reputation: 3541Reputation: 3541
Quote:
Originally Posted by Animisparati View Post
I would like to set up an Egress filter that cross references a list of IP addresses and domains i have in a text file
If you use 'ipset' then you need only one iptables rule to block several IP addresses in one go. Due to how Netfilter works (quite efficiently) one caveat is that when a rule gets parsed a FQDN gets translated to IP address(es). Just saying because a host name may not resolve back to the FQDN, one host name may have multiple addresses and many host names may resolve to just one IP address. It may be interesting to know why you're doing this BTW.


Quote:
Originally Posted by Animisparati View Post
and emails me if a machine talks to one.
If you're not going to do something with those emails stat then a logging rule would be less of a strain / risk and more efficient?..
 
Old 04-08-2013, 08:43 AM   #3
Animisparati
LQ Newbie
 
Registered: Nov 2012
Posts: 2

Original Poster
Rep: Reputation: Disabled
Thanks for the quick response. I will look into ipset. I'm actually not looking to block outgoing traffic to the list of IPs and domains. I just want to be informed if and when a machine or application communicates with any IP or domain on the list.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Shaping egress upload problem benji_pl Linux - Networking 1 10-11-2009 12:27 PM
Ssh tunnel + DNAT on egress interface reticent Linux - Networking 1 09-29-2009 04:08 PM
Dansguardian - Won't filter new addresses added to filter list TechnoBod Linux - Software 1 01-08-2008 01:40 AM
Intercept 802.3 packets on egress and redirect until tagged jogress Linux - Wireless Networking 1 07-27-2006 05:32 PM
Egress filtering scorbett Linux - Security 2 11-03-2004 11:15 AM


All times are GMT -5. The time now is 08:35 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration