iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

0
votes
0answers
12 views

MySQL on LAN not working when IPTables enabled

I have two Centos VM. The IP Addresses are as follows : VM_1 => 10.99.0.10 VM_2 => 10.99.0.12 Apache and PHP are in VM_1 and MySQL is in VM_2. Both are having iptables rules. VM_2 is working ...
1
vote
2answers
18 views

Is it safe to move “ACCEPT state RELATED,ESTABLISHED” to the top?

I've the following iptables configuration: Chain INPUT (policy DROP 11 packets, 604 bytes) num pkts bytes target prot opt in out source destination 1 127 11093 ...
0
votes
0answers
7 views

Use ip6tables to direct port 443 to 8443 on CentOS 5? [duplicate]

I am running CentOS 5, running Kernel version 2.6.18 & ip6tables v1.3.5. IPv6 is enabled. I would like to use ip6tables to direct traffic from port 443 to the internal port 8443. We did this on ...
0
votes
1answer
22 views

Linux - Disable routing but allow bridging

I have a Linux server that is running the KVM hypervisor. I have multiple bridges on this server (that are on different VLANS). Is there an "easy" way to make sure that bridge hoping (i.e. routing ...
0
votes
0answers
11 views

Ubuntu can't connect as IPSec L2TP client

Goog afternoon, I have a corporate local network located behind NAT. There is another NAT in this local network for the corprorate server on Ubunit 12.04. So if clients connect to that server ...
0
votes
0answers
8 views

Setting up iptables for port forwarding of incoming requests over a OpenVPN Client on a Router

I have a Router that runs DD-WRT and a OpenVPN Client that connects and redirects every request over the VPN. My VPN provider supports port forwards, the problem is my router does not forward ...
0
votes
0answers
14 views

HowTo: Let ufw block single IPs when default policy is ALLOW

I want to be able to block certain IPs from accessing my server. As I don't really know what services are running on what port on the machine, I decided to quick&dirty let ufw's default policy be ...
0
votes
1answer
13 views

how to run pptp over redsocks proxy

I have one (virtual) Linux box in Ubuntu, that has redsocks set up done. Inside the machine, I could confirm that the the redsocks did work (use wget to check the external IP). Now, I want other ...
0
votes
1answer
40 views

iptables not allowing ssh

This is my iptable configuration. But I cannot connect with ssh with these rules. What am I doing wrong? I want to block all traffic except ssh coming from x.x.x.x ip address. iptables -F iptables -X ...
0
votes
1answer
16 views

DNAT packet after decryption of ipsec

how to DNAT packet decrypted by ipsec. encrypted packet is: sourceIP: 192.168.4.6 destIP 10.10.0.100: If i simply : iptables -t nat -A PREROUTING d 10.10.0.100 -j DNAT --to-destination 10.0.0.5 ...
0
votes
0answers
8 views

centos 6, vsftpd,user access

Is there a way to block users access to particular server interface? I have a server with three interfaces, eth0, eth1, eth2, and would like to block access to eth0 for particular user. For example ...
0
votes
1answer
41 views

How to determine what traffic is being dropped / blocked base on iptables log

I have followed the example for iptable logging from https://help.ubuntu.com/community/IptablesHowTo#More_detailed_Logging sudo iptables -I INPUT 5 -m limit --limit 5/min -j LOG --log-prefix ...
-2
votes
0answers
18 views

squid transparent vs non transparent, browser setting vs iptables routing [on hold]

whats the diff between settings a and b. where a) squid setting http_port 3128 settings in firefox proxy ip and port 3128 user can browse through proxy using this settings and b) squid setting ...
0
votes
0answers
21 views

Why is the first of two post-up commands for routing in interfaces configuration not automatically processed

We managed to connect our servers to two distinct networks and everything works fine. We use routing rules that ensure that server responds to the right network. I followed the instructions under ...
0
votes
0answers
38 views

iptables, nat for only one interface?

On my dom0 I have got 4 domUs running, but only 3 of them have different public ips. On the domU without a public I would like to forward all trafic, but if I add nat rules the whole traffic from ...
1
vote
0answers
33 views

NAT for IPSEC access?

Please help to understand if the following configuration can be created. I have IPSEC connection with my customer. It is site2site vpn between customer network and my network 10.102.103.0/28. This ...
0
votes
0answers
37 views

How can I log and maybe even block IPs that send lots of incoming UDP traffic?

we run a voice / teamspeak server which receives legitmate traffic on port 9987 from many ips. Sometimes we get DDoSed. So people use single Servers and send 1-3 Gbits of UDP Floods to that port. This ...
-1
votes
1answer
25 views

openvpn client port forwarding? [closed]

I'm running on a linode and trying to open a port to the client. I've run the following commands and it isn't working... iptables -t nat -A PREROUTING -p tcp --dport 47201 -i tap0 -j DNAT ...
-2
votes
0answers
29 views

Many output tcp connections in SYN_SENT status showed up [duplicate]

I manage some Linux servers, I find a strange phenomenon since last month. When I'm running netstat command, it shows me too many tcp connections point to specific ports like 22 or 80 of different ...
-1
votes
0answers
20 views

Running standard (GUI) vpn pptp with the rules in iptables [closed]

To connect to the vpn I use a standard pptp (GUI). Ubuntu 14.04 http://i.cubeupload.com/xe7TL3.png I pre-configured iptables so that would be the internet connection was only TOR (debian-tor). ...
0
votes
1answer
23 views

open all traffic on the pptp interface iptables [closed]

I set up a PPTP client in Ubuntu. Filter iptables denies network access to everything except TOR and PPTP client. *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT DROP [0:0] -A OUTPUT -d ...
0
votes
1answer
23 views

iptables with sticky forwarding/routing

My iptables is sticking. I have a DNS server behind IPTables and down a NAT'ed OpenVPN pipe. Using tcpdump I see DNS packets hit the outside router but it takes 4 or 5 DNS query attempts before the ...
3
votes
1answer
73 views

Change source IP address based on the system user

I would like to make a certain user have a specific source IP address. For this purpose, I added a secondary IP address to the network interface and tried to enforce the source IP using ip6tables and ...
-1
votes
1answer
29 views

restrict access to ssh by hostname with iptables

I want to allow connecting via ssh only for a certain domain sub.example.com. How can I do this via iptables?
0
votes
2answers
64 views

IP rules misconfigured, lost access to server

I have to give my IP rule like, DROP if source is not from 127.0.0.1 AND destination is 9200 But unfortunately, I gave it like, DROP if source is not from 127.0.0.1 (missed the port) So I lost ...
0
votes
1answer
36 views

Keep source port for outgoing packets

I have 2 interfaces eth0(192.168.0.1) and eth1(10.1.1.15). And I do nat for all packets in this way. iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j MASQUERADE Now I want to keep source port ...
0
votes
4answers
58 views

Using iptables without root privileges [closed]

When running the following script as user ec2-user, I get the error message iptables v1.4.18: can't initialize iptables table filter: Permission denied (you must be root) Script: #!/bin/sh # ...
0
votes
1answer
54 views

OpenVPN-Connection as default gateway for another host in the same subnet

I would like to achieve to use my openvpn-connection as default gateway for another host in the same subnet. I have 2 Hosts in the same subnet, both of them with Ubuntu Server 14.04. Host A runs ...
-1
votes
1answer
64 views

need to load xt_tcpudp module in Debian 7 Wheezy with OpenVZ kernel. Error: 'could not open'

I followed this guide IPTABLES inside container guide @ openvz.org I'm running Debian 7 Wheezy x64 which was dist-updgrade'd before installing OpenVZ. The container is Debian7 x64 minimal. It's ...
0
votes
1answer
30 views

What can explain my port forwarding not working?

I am trying to forward port 443 to a different server using iptables. What can explain this not working? I've enabled net.ipv4.ip_forward. This is the code I use. I have no other iptables rules: ...
-1
votes
3answers
58 views

Make sure all users in network use my DNS server

I'm running a router with DNS server and I would like to make sure that everybody in my network is actually using my DNS. What are the necessary iptables (?) to redirect all DNS-related traffic to my ...
0
votes
1answer
49 views

Iptables fails to redirect traffic to transparent proxy

My goal was to use ubuntu as a router, with Redsocks serving as a transparent SOCKS proxy redirector. Each machine on my network would have its TCP/UDP traffic redirected to a different port where ...
0
votes
0answers
32 views

Prerouting to services with private IP necessary?

I have a server which has a WAN IP and a LAN IP. Without me messing with iptables, any server on the LAN can connect to my ElasticSearch instance on port 9200. But I cannot access the same service on ...
0
votes
1answer
24 views

Proxmox with iptables nat is not available

I got an issue with iptables on my virtual machines. I installed proxmox 3.1-21 on my rootserver. I have around 6 IPs linked to my rootserver so i created new 'CT's. The problem is i need to ...
-2
votes
0answers
28 views

can't reach a specific website

I have a basic linux centos 6.5 box with basic NAT and dhcp server and i am facing a rather odd problem. Turns out nating works just fine users can browse websites BUT there is just one website that ...
0
votes
0answers
22 views

Google Computer Engine Firewall and IpTables

I am very new to to server administration and just discovered that I can use Google Compute Engine to host my website similar to way it works with Linode or Digital Ocean. I am unsure on the following ...
-1
votes
0answers
21 views

debug tcp packets to validate iptables rules [duplicate]

I am on coreos writing iptables rules to manually connect docker containers manually. I wonder how one could debug iptables rules. I want to see where packets are going and see by which rules packets ...
1
vote
2answers
45 views

In which order are rules of custom iptables chains evaluated?

I am fairly new to iptables. The picture below shows the order in which chains are evaluated based on my current understanding. If that impression is wrong please let me know. My question is where ...
1
vote
2answers
70 views

OpenVPN route remote traffic depending of the subnet

I achieved to setup an OpenVPN to route all the traffic through a remote openvpn server. The OpenVPN server have two interfaces : eth0 -> Internet access eth1 -> Private network : 192.168.1.0/24 ...
0
votes
1answer
53 views

Local port access blocked by iptables

Although experienced with Linux, I'm new to iptables, having set it up following a Rackspace virtual server setup guide. Using port scans and checking remote access to required ports, I can see all ...
0
votes
2answers
47 views

Is there a way to allow acess to an specific device that is out of my network? [closed]

I’m trying to allow my mobile device to connect from everywhere, Wi-Fi or not to an specific port of my Linux server which is running a webmin service. I’m using iptables to set some rules to which ...
1
vote
1answer
26 views

Upgrade network Class vs Virtualized LAN

We operate on one class C network, let's say 192.168.1.0/24 But the problem is we have 262 devices! I propose upgrading the network to a class B. The opposition proposes purchasing new hardware and ...
0
votes
0answers
22 views

NUMIPTENT is too low to add 5333 rules (CSF firewall error)

The VPS iptables rule limit (numiptent) is too low to add 5333 rules (19469/24000) CSF stopped working spontaneously today. Saying it can't start because it can't add 5333 rules to an apparent ...
0
votes
0answers
25 views

OpenVPN won't connect from remote location [migrated]

I set up OpenVPN on a linux machine in my basement. I'm able to connect from my Windows 8.1 machine without an issue when I'm connected to the local network. In this instance, I set the config file ...
1
vote
1answer
19 views

AWS EC2 IPTables converts source/dest subnet into ec2.internal hostname?

I have a Debian 6.0.7 x64 AWS EC2 server that I'm running a couple QEMU virtual machines on (don't ask.. long story). I have some IPTables rules to NAT/Forward any traffic (on ports 8080 and 8081) ...
0
votes
1answer
60 views

Failed to ping through gateway which is not default gateway

I have the following network interface configuration, eth0: 192.168.78.1/24 eth1: 192.168.254.76/24 (Gateway 192.168.254.1) eth2: 192.168.253.131/24 (Gateway 192.168.253.1) where both gateways ...
-2
votes
0answers
12 views

iptables - NAT dport after OUTPUT connlimit

I have these rules in iptables: restricting calls -A OUTPUT -o eth0 -p tcp --dport 7874 -d IP-DESTINATION -m connlimit --connlimit-above 3 --connlimit-mask 32 -j REJECT --reject-with tcp-reset ...
0
votes
1answer
52 views

iptables on Linux router does not forward DHCP between two LANs

I have an internal network as follows: A Linux system that serves as router, using iptables, with two network cards A client machine A DHCP Server The Router's eth1 is on the same LAN as the ...
0
votes
0answers
51 views

Proxy website Centos

everybody would like some help from you I wonder what I can do about it, I would like to redirect an ip from my dedicated server for a website as well? actually would like to do something similar ...
0
votes
1answer
56 views

What is the point of the docker-proxy process? Why is a userspace tcp proxy needed?

I have noticed that there is docker-proxy process running for each published port. What is the purpose of this process? Why is a user space tcp proxy needed for this? $ ps -Af | grep proxy root ...