iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

0
votes
0answers
2 views

Forwarding custom page rule for known ip adresses

I want to add some ip adresses to a blacklist, and i want to show a custom "you are in blacklist" page them. How can i do this? I have ubuntu server and apache. I tried to add rule to ip tables ...
0
votes
0answers
19 views

Forward all traffic when connected to a hub

I have a Ubuntu with two NICs. eth0 is connected to a hub and eth1 is connected to Internet. eth1 is used to do a point to point VPN using openVPN. So I have a tun0 interface. the VPN tunnel endpoints ...
0
votes
0answers
11 views

IPTables SNAT and DNAT - How to choose correct IP Address?

I have a physical host on which I run some virtual machines. IPTables is fully open and unconfigured but I add the following rule so the VMs can access the internet: iptables -t nat -A POSTROUTING -s ...
0
votes
0answers
13 views

IPTABLES + Ipset blacklist forward policy blocks all connectivity in OpenVPN (also non-blacklisted)

I'm blacklisting IPs using ipset + iptables. Made my own script, before I found this one by someone else: https://github.com/trick77/ipset-blacklist Both my own and his have the same issue: When ...
0
votes
0answers
8 views

conntrackd not syncing with external cache off

I have two firewall gateways that I want to work in active/active mode with conntrackd connection state syncing. Well, when I am using conntrackd with external cache on, connection created in one ...
-1
votes
0answers
4 views

redsocks and iptables in LAN

Is it possible for redsocks to capture traffic within the LAN/Same subnet/private network. I need to proxy ALL the outgoing tcp traffic from a Linux device. The device, proxy server and target server ...
1
vote
2answers
32 views

Route traffic in a public network

I have 3 stand alone CentOS servers on same hosting provider. The hosting company can't offer me a firewall for this devices, only iptables. So I want to buy another server and make this server a ...
0
votes
0answers
11 views

NAT for LXC Containers Debian 8 - no connection

I have a Debian 8 server running on a physical host machine. To seperate some services, I have created a lxc container (also debian 8). I am currently trying to set up a working NAT so my lxc ...
0
votes
0answers
24 views

iptables to do source nat for response packets

I am trying to do source NAT for all outgoing packets (packet initiating connection from my machine as well as responses to other connection). I put in following rule: iptables -t nat -A POSTROUTING ...
-1
votes
0answers
20 views

IPtables: block fragment type “DF” don't fragment [on hold]

I'm getting some DDoS attacks and I need to block the packets with UDP flags "DF" using iptables, or another packet filtering method. I think u32 can do it, but I don't know how to check the "Don't ...
-1
votes
0answers
15 views

Handling return status of multiple iptables command [closed]

I am adding 'n' number of blocking rules, 'm'number of NATting rules in a Linux PC. It will be awkward to see the return status of each and every rule using 'echo $?'. Is there any alternate approach ...
0
votes
0answers
6 views

Make redsocks redirect all tcp traffic for all users

Is it possible for redsocks (or any proxy in the same machine) to capture traffic within the private network (same LAN). I need to proxy ALL the outgoing tcp traffic from a client (which is a Linux ...
-1
votes
0answers
20 views

how to redirect domains to localhost iptables [on hold]

i wanted redirected all the traffic on my network to localhost. currently i am trying to use iptables to do so from below command.. iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j DNAT ...
2
votes
1answer
23 views

Should i use Firewalld or Iptables for Fail2ban in Centos 7?

I'm setting up Fail2ban to protect ssh, and I use firewalld, I saw a lot of people recommending to use anaction = iptables-multiport and other solutions using iptables instead of firewalld claiming ...
1
vote
0answers
16 views

iptables/nat/prerouting ignores UDP packets?

The same effect on many servers with various kernel versions. There are multiple Iptables DNAT rules: iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 12345 -j DNAT --to-destination ...
3
votes
3answers
37 views

How to use iptables or tc to limit packets per client.

I have some problem network clients which send data too fast. I want to slow them down, using iptables, or possibly tc. I've seen iptables solutions like: sudo iptables -A INPUT -m state --state ...
-1
votes
0answers
23 views

docker on aws ec2, not reachable from outside

Trying to get the sharelatex community docker image up and running on aws. Followedd their guide and got to the point where I can see the login page when using lunx on the aws instance via ssh. So it ...
-1
votes
1answer
31 views

Make Apache work on a custom port using iptables only

My Apache/2.2.14 (Ubuntu) is running on port 80. I'm trying to make it listen on port 999 as well, but without making any changes to the apache config, only using iptables. I've added this to the ...
-2
votes
0answers
13 views

Forward port with iptables

router ip wan:170.110.181.xx eth0 192.168.1.2 gw 192.168.1.1 eth1 10.10.0.1 1- TCP,UDP port 9955 from ip 10.10.0.18 2- TCP port 8080 from ip 10.10.0.18 How to do this with iptables?
0
votes
0answers
14 views

VPN Internet Access on a Zyxel SBG3300

I have Zyxel SBG3300 VDSL router that connects to ISP using VDSL and L2TP. The configuration was provided by my ISP - when I checked it seems like the VDSL modem first establishes a connection and the ...
0
votes
1answer
42 views

Linux server as router emulating commercial modem [closed]

When you buy some commercial routers like TP-LINK or Buffalo or many others, you have the chance of connect to a wan network. So if in a commercial router I set the IP Address 192.168.0.2 and ...
0
votes
0answers
21 views

convert iptables u32 module to mikrotik

We experience some kind of DDos attack. here is attack log: http://paste.ubuntu.com/14476372/ in all of lines the expression "win 512, length 0" is the same, with this iptables rule we can drop ...
0
votes
1answer
20 views

DNS requests from a local server to another local server

I have two servers running in one network. External IP of main server: 1.2.3.4 (domain.com) External IP of secondary server: should not be available directly from outside Main server (dns, mx, ...
0
votes
2answers
26 views

How safe is IPtables whitelisting?

I am deploying some VPS and of course, security is a big concern. I read that IPtables whitelisting is the best way to safeguard your machine. So I set up the follwing : echo "Flushing rules" ...
0
votes
1answer
17 views

source nat for return traffic (Hair pinning )

Is there any way to source nat traffic received ? iptables -t nat -A POSTROUTING -o eth18 --src 123.123.123.123/32 --jump SNAT --to-source 66.66.66.66 Return traffic still uses 123.123.123.123 as ...
0
votes
1answer
28 views

port forwarding by iptables failed

I hope to forward from 192.168.1.230:9090 to 192.168.1.231:8080. I execute the following command: iptables -t nat -A PREROUTING -d 192.168.1.230 -p tcp --dport 9090 -j DNAT --to 192.168.1.231:8080 ...
0
votes
3answers
40 views

iptables rules for port 53 not taking effect

My ubuntu 14.04 LTS server is receiving lots of incoming traffic on port 53 from different ip addresses. I am not hosting any DNS service. So I decided to block port 53: iptables -A INPUT -p tcp ...
0
votes
0answers
12 views

iptable script to block Post request to a specific file [duplicate]

I get these attacks daily across multiple servers (Apache): 135.120.5.180 - - [31/Jan/2016:14:21:08 +0000] "POST /xmlrpc.php HTTP/1.0" 200 598 "-" "Mozilla/4.0 (compatible: MSIE 7.0; Windows NT 6.0)" ...
1
vote
1answer
11 views

:: gem list -remote :: iptables configuration

Once I locked down my VPS server with iptables meaning I only have a few selected ports opened for input access, my Gem command stopped working and I'm not sure what I'm doing wrong. This is a two ...
0
votes
0answers
10 views

Setup router iptables like VPN for single pc

I'm currently far away from my office for a family visit. One of the applications got frozen and needs a restart. The config files are set up to only accept logins from local ips. Only device I ...
0
votes
2answers
22 views

IPTables: How to log and set a specific log file

Is it possible log all dropped connections by IPTables and set a iptables.log file for logging in /var/log/?
0
votes
2answers
27 views

IPTables: apt-get and wget not working

When resetting IPTables, the apt-get and wget command functions correctly and also downloads what I want. But once I activate this firewall, it isn't functional. Pings still work. I want to allow all ...
0
votes
0answers
26 views

iptables using ipset with SNAT

I have a bunch of iptables SNAT rules that map networks to ougoing public ips, like this: iptables -t nat -A POSTROUTING -o eth0 --src 10.1.1.0/26 --jump SNAT --to-source 123.123.123.12 iptables -t ...
-1
votes
1answer
22 views

Unable to connect to a port from a remote machine in Centos?

I am not able to connect to 9423 port of a machine from another machine though the local telnet localhost 9423 works. Here is my netstat -putna. Is there anything suspicious? 10000 works just fine ...
0
votes
0answers
18 views

Iptables and rate limit http URL

I need limit requests to xmlrpc.php in Centos 6.x. I have this rules added, but nothing do it. Thanks for help. iptables -I INPUT 1 -p tcp -m state --state NEW -m recent --rcheck --seconds 600 ...
-1
votes
1answer
35 views

IPTables: Does blocking spoofing, affect any services? [closed]

Do these rules affect any services/applications? Will apt-get and others still work? - iptables -A INPUT -s 10.0.0.0/8 -j DROP - iptables -A INPUT -s 169.254.0.0/16 -j DROP - iptables -A INPUT -s ...
2
votes
0answers
17 views

iptables configuations for stunnel+squid

I'm building a highly anonymous proxy server with squid and stunnel, and I'm facing a configurations problem on iptables. The server should act like this: browser <-> client stunnel <=> ...
0
votes
0answers
6 views

Http request blocked on port 80 [duplicate]

I currently have Centos 7 installed on EC2 with the following: Apache Php Mysql Iptables Firewalld Apache running Redirecting to /bin/systemctl status httpd.service ● httpd.service - The ...
0
votes
0answers
10 views

Proftpd: no way to get port 21 as user?

I run a proftpd server. Is on chroot and running as user(ftp),ftp user cannot bind port 21 because is privileged and need root. So i redirect all connect to 21 on 2121. The problem is,if I start a ...
0
votes
0answers
21 views

Sending duplicate packets to the wan ip address

I'm in need to send duplicated packets to the remote host (wan ip address). I'm aware that -j TEE would do just that on the LAN, but what about WAN? iptables -I POSTROUTING -t mangle -d x.x.x.x -j ...
0
votes
0answers
9 views

Another get pfctl equivalent of iptables, use ipfw or pfctl?

I'm trying to get the OS X equivalent of this iptables usage: sudo iptables -t nat -A OUTPUT -p tcp -m owner ! --uid-owner mitm_account --dport 80 -j REDIRECT --to-port 9001 But having a really ...
0
votes
1answer
18 views

Port forwarding work on virtual machines but not on host

I use this iptables config It simply redirect to port 21 the connection of 2121(used to run ftp as user instead of root) *nat :PREROUTING ACCEPT [200:39210] :INPUT ACCEPT [6:360] ...
0
votes
1answer
26 views

can access virtualhost locally on the same server but cannot access on remote machine

A pretty wired problem occured when configure a virtualhost at port 81. When I use command curl 123.123.123.123:81 or curl localhost:81 in the same server, it got response. While when I access it ...
1
vote
2answers
50 views

IPTABLES: Route outgoing http requests to eth1

I am trying to route all outgoing HTTP requests LEAVING my server to go through a proxy (tinyproxy) on another server. I want the transmission to the proxy to use our LAN which is on eth1. No matter ...
0
votes
2answers
24 views

Ubuntu server - packets from different networks not coming through (flushed iptables)

I have set up a brand new Ubuntu server, and I'm encountering a very strange network related issue - the processes running on the server cannot 'see' packets originating from external networks, but ...
-1
votes
1answer
176 views

port 80 is open by iptables but Connection timed out

I have nginx on my server, I run the script below to add rules to iptables: #!/bin/bash ip=/sbin/iptables services='22 25 53 80 443 5432 8000 8080' $ip -F; $ip -t nat -F; echo -e "Opening port 22 ...
0
votes
0answers
13 views

dnsmasq different replies based on source [migrated]

I want to override the DNS configuration for some domains by using dnsmasq so that queries are forwarded elsewhere to be resolved. I can do this with this configuration snippet: ...
0
votes
1answer
65 views

Telnet: Unable to connect to remote host

Related Threads: SMTP server works, but telnet to port 25 does not Can't connect to SMTP server The problem I have a server running Debian 3.2.65-1 and i am having some problems to connect other ...
0
votes
1answer
57 views

Add latency and random packet drops excluding SSH packets

I want to add some random delay/drop to all packets excluding SSH packets. I can do that to all packets this way: tc qdisc change dev $NIC root netem delay 100ms 10ms 25% tc qdisc change dev $NIC ...
-1
votes
1answer
18 views

OpenVPN cannot route traffic

Scenario OpenVPN server running on Gentoo eno1: (server public ip) has static ip... NO dhcp eno2: vlan (down for now) tun0: openvpn tunnel interface server.conf local <external ip> port ...