iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

0
votes
1answer
19 views

Allow port on firewall for internal network

I am trying to setup a Percona Galera Cluster but connection over port 4567 fails but port 3306 works. This is how it looks like on the servers Server percona1: netstat -lptu | grep mysql tcp ...
-3
votes
1answer
15 views

Route traffic from one interface to another [on hold]

i am trying to forward the traffic coming from wlan0(192.168.2.178) port 1337 to eth0(10.42.0.15) port 1337. I tried many routing table configurations but couldnt work it out. Thanks for help. BTW, i ...
0
votes
2answers
13 views

Load balancing IPTABLES POSTROUTING rules

I have an interface with 5 IP addresses assigned to it (as virtual adapters) let's call them x1,x2,x3,x4 and x5. Currently I have SNAT POSTROUTING forwarding rules from local source range to specific ...
0
votes
1answer
23 views

Access two web servers (VPS and Windows Server) through the same IP (PUBLIC AND VPN) using VPN

reference image: http://snag.gy/gSSM8.jpg I have two servers: a hosted VPS with a website on port 80 and a home server running windows 7. The home server is running WAMP on port 88, which works on ...
-2
votes
0answers
16 views

Linux - modify incoming packets before forwarding: [on hold]

I'm using a Linux (Debian based) system on which IP forwarding is enabled (/proc/sys/net/ipv4/ip_forward is set to 1). I can read the incoming packets using a raw sockets program, but I want to modify ...
-1
votes
0answers
16 views

iptables NATed traffic is not getting ack back

Ok, I'm trying to setup the classic iptables DNAT/SNAT scenario (RHEL 6.5, 2.6.32-431.17.1.el6.ppc64 kernel ): *Host A 172.16.0.0/24 nets Host B 172.16.0.0/24 + 192.168.0.0/24 nets Host C ...
1
vote
1answer
21 views

Redirect packet that matches a pattern?

How can I route an incoming udp packet with iptables that matches a pattern like: 53 41 4D 50 5B 79 95 DB 61 1E 69 from public interface (vmbr0) and port 7777 to 192.168.0.1:7777?
0
votes
1answer
16 views

Why port 22 redirection causes lxc containers to ssh to host?

I have a host A on which I have 2 lxc container (X and Y). I originally had port 22 on my host (A) forwarded to X. Using this configuration, I wasn't able to ssh out of the container X and when ...
1
vote
3answers
70 views

Forward Traffic in & out, NAT iptables

I have a box setup as DHCP Server with NAT ipv4 forwarding enabled. Currently the box uses eth0 to connect to a local network and has access to the internet, it has another 3 interfaces, eth1, eth2 ...
0
votes
2answers
39 views

Port forward with iptables

I got lo (127.0.0.1) and eth0 (172.17.0.8). I want to redirect packets that land on 127.0.0.1:80 to 172.17.42.1:80 (route from eth0). I tried iptables -t nat -A OUTPUT -p tcp --dport 80 -d 127.0.0.1 ...
0
votes
1answer
27 views

Ubuntu / node.js dropping incoming requests [on hold]

I am getting dropped requests on a node.js server. I have simplified the test case to the point that it must be a problem with system setup. I am a developer and have very little experience with ...
6
votes
1answer
235 views

IPTables: Allow outgoing MySQL connections but not incoming connections

I have a server which doesn't allow connections to mysql from external sources - all of my databases and connections take place on localhost. The default policy of iptables is to drop connections for ...
0
votes
0answers
4 views

linux: how to troubleshoot forwarded port? [migrated]

My home internet connection has a static IP address (eg: 123.123.123.123) I have configured my router to forward port 9000 to an internal host (192.168.1.101). That host is running Ubuntu 14-04. ...
0
votes
2answers
48 views

Add a VLAN tag to specific UDP port traffic

I'm running an application in Ubuntu12.04 that I've written that does some remote switch management. I have only a single NIC connected to the network of managed switches, eth0 which is set with IPv4 ...
-2
votes
1answer
43 views

How to open port with iptables [on hold]

I wanted to open port in centos and after executing openning port commands, the iptables caontents is like below: # Generated by iptables-save v1.3.5 on Thu Nov 20 17:09:28 2014 *filter :INPUT ...
-1
votes
1answer
35 views

IPTables Limit port speed

I want to limit a port's speed down to 5 kb/s per client connected (trying to share out the limited connection without smashing the network) I Have done research, mostly I find rules which drop ...
0
votes
1answer
33 views

iptables: service per physical interface

I have a vm on which I'm trying to configure (unsuccessfully) one service per physical device - i.e. ssh open only on eth0, http only on eth1 and ftp only on eth2. This has to happen regardless on the ...
-3
votes
0answers
31 views

Map remote host to local ip (linux) [closed]

How can I map remote host to local ip? For example: If I map google.com to ip 192.168.1.15 so when i ping 192.168.1.15 i get forwarded response from google.com Maybe Iptables or something?
0
votes
0answers
5 views

xen routed setup, no internet connectivity in domU

My server has 4 public ips, but I have 5 vms running, the vm which doesn't have an own public ip should be able to reach the internet and all other vms over private interfaces. I configured a private ...
0
votes
2answers
34 views

How to redirect a packet with iptables that match a certain pattern? (eg a QUERY command with UDP)

I have a certain packet that I want at all times to be redirected to a specific ip on my virtual network interface. As for now my iptables is setup like this: (the commands, I use \ as for now to ...
-1
votes
0answers
10 views

How to use iptables and ebtables to limit qemu access to a set of IPs? [closed]

I want to limit the access of a VM (backed by QEMU) to a few IP address. The VM has a private IP received from dnsmasq. The guest is connected to outside through a bridge. To limit the access, I need ...
0
votes
0answers
13 views

Connections from virtual host to internet OK, but to rest of LAN, broken [migrated]

In a notebook running Ubuntu 14.04 I have installed VirtualBox and created a virtual server with Windows 7. The PC is connected to a 192.168.x.y LAN. The virtual server is in a host-only network with ...
0
votes
0answers
12 views

Fail2Ban Correctly Attempts to Ban IP but IP does not get banned - iptables chain exists but not working

Running on Ubuntu 14.04 Server. So I have fail2ban correctly configured to process /var/log/auth.log for SSH login attempts. Upon 3 failed attempts I see this in the fail2ban log: 2014-11-19 ...
1
vote
2answers
48 views

Make CentOS 7.x a port forwarding NAT device

I would like to make CentOS a port forwarding NAT machine using iptables. This is the first time I've tried this and I think i might need a little help. This is the configuration i'm trying to ...
2
votes
1answer
35 views

Traffic shaping outbound clients source ip with tc / iptables

My question is I am trying to limit a users bandwidth on a server and wondering the best way to do this. Before I dive to far into the tc/iptables I was wondering if I could get any advice on this ...
0
votes
0answers
17 views

iptables on AWS - how to get traffic mirroring to work?

Has anyone successfully deployed 'iptables -t mangle -j TEE...' for monitoring traffic on AWS instances? If so, how? My objective is for client<->server traffic between external customers and EC2 ...
0
votes
0answers
52 views

Forwarding traffic from one ethernet interface to another

Earlier, I was trying to get traffic from one ethernet interface to another without using a bridge. Here is a link to the solution : ...
0
votes
2answers
49 views

CentOS, How to allow SSH through only one server-ip [closed]

I currently have a dedicated server with two pv4 IP addresses assigned to it. I want to make one public, and the other private for SSH/FTP related material. IP 1 (The public ip): 192.23.6.11 IP 2 ...
-1
votes
1answer
39 views

How to drop first udp packet from a source with iptables?

As a defense against distributed udp flood, I need to drop first udp packet from a source and accept other than first packet. Does iptables has capability of doing this? If yes, how?
-1
votes
0answers
16 views

Linux router under VMware can't contact physical gateway server intermittently

We're a site with upwards of 800 concurrent users with most services hosted on the Internet and a BYO service to facilitate access to these. Situation is some days - not everyday - we're seeing our ...
1
vote
1answer
26 views

Are iptables prerouting (DNAT) packet changes visible to subsequent chains?

I was reading Rusty Russell's NAT Howto when I came across this section: 6.2. Destination NAT This is done in the PREROUTING chain, just as the packet comes in; this means that anything else on ...
0
votes
0answers
23 views

Error with IPTables command

I'm trying to run the following command iptables -A INPUT -i eth0 -j LOG --log-prefix "IPTables " And I get the following error: iptables: No chain/target/match by that name. I'm running Fedora 20 ...
1
vote
1answer
68 views

My iptable rules do not allow VPN connections

I have installed OpenVPN on my Archlinux server and modified my iptable rules to allow incoming traffic on port 1194 and forward it to the tun0 interface. When I disable/stop the iptables, the OpenVPN ...
0
votes
1answer
36 views

iptables setting output default to DROP

I have two servers: one web, one database. The db server is on a private network. I thought I needed to restrict the default OUTPUT on the web server to DROP and created OUTPUT rules to to ACCEPT ...
0
votes
0answers
24 views

IpTables -j REJECT to instantly block the loading on user browser

I have been searching for a solution to notify the browser on user that the request is Rejected so stop loading it. Because I have blocked facebook and every page that have a facebook plugin is ...
0
votes
0answers
26 views

General protection fault by __d_drop following SMTP attack

The SMTP port (Postfix) of my box running 3.16.5 is being hammered. The log repeats this over and over: Nov 14 09:16:25 [postfix/smtpd] lost connection after UNKNOWN from unknown[177.43.41.74] Nov 14 ...
1
vote
1answer
82 views

AWS EC2 Ubuntu 14.04 Instance smtp port forwarding from 25 to 2025

I am trying to step up port forwarding from port 25 to port 2025 on the same AWS EC2 Ubuntu 14.04 instance using iptables. I am using port 2025 to receive income emails using Alfresco. The first step ...
0
votes
1answer
22 views

APF Limit to Deny IPs?

So, I've been actively banning IPs of malicious users. Previously, I only used IPtables to do this, but since giving APF a whirl, I've been having issues. It appears that there is a limit to the ...
0
votes
0answers
30 views

Iptables - double REDIRECTING - is it possible?

I have 2 kinds of proxies in my local machine : stunnel and TOR-VPN. stunnel is listening on port 6666 TOR-VPN is listening on port 9040 The IP of stunnel server is a.b.c.d. I want to get web ...
2
votes
0answers
34 views

How to route traffic through different interfaces based on the port number?

iptables -A PREROUTING -i usb0 -t mangle -p tcp --dport 8080 -j MARK --set-mark 1 iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination Chain ...
-2
votes
0answers
9 views

Cannot SSH on machine behind NAT. DD-WRT router [migrated]

I'm trying to remote access my home Debian from my other office. The home Debian is behind a DD-WRT router, connected from a ADSL modem (Yeh, it's dynamic IP but I have someone to tell me the WAN ...
0
votes
1answer
24 views

Local transparent proxy with squid and dansguardian

I am having trouble setting up a local web cache and filtering system using squid and dansguardian. It works perfectly when the browser is configured to use the proxy box's ip (192.168.1.2) but I ...
0
votes
0answers
23 views

Iptables - centos 5.8 - how to forward ports to internal lan

I'm trying to map port 8080 to another machine running a web server. ppp0 = ADSL internet connection eth0 = ethernet card of linux machine (ip address: 192.168.0.2) 192.168.0.105 = other machine ...
0
votes
0answers
31 views

Missing iptables rules for Strongswan routing for VPN for phone

I have a Centos 6.6 VPS out on the Internet that has a public IP. I have installed StrongSwan 5.1.3 to allow my BlackBerry10 phone to connect from hotspots and use the VPS' connection. The VPS' IP ...
2
votes
0answers
21 views

How to monitor the bandwidth per each iptables masqueraded device [closed]

Question: Which tool could I use to monitor and break-down in real-time which bandwidth is routed by iptables to which computers? Context: I have a linux box masquerading about 15 devices to ...
0
votes
1answer
33 views

Temporarily block communication with host if its connecting to port X

I have a Linux VPS, and it's constantly being scanned, bruteforced by some rogue IPs. This VPS is my private server, that serves only to me, and I'm the only user of it. Also I am the only user who ...
0
votes
0answers
49 views

OpenVPN Port forwarding on a OpenVZ VPS

I've been trying for the past 3 hours to forward the 443 port from my client to the 20443 port on my server (CentOS 7 on OpenVZ), so i can access it on myserverip:20443. I have OpenVPN Access ...
1
vote
1answer
32 views

Conntrack shows no result

I tried the command conntrack -L and it returns nothing when I have a ping www.google.com running. I also tried to load the module by modprobe nf_conntrack. But it still always returns conntrack ...
0
votes
0answers
19 views

ndpi iptables not working

I have a linux centOS 5 system. kernel 2.6.39 with iptables 1.4.12. xtable library is also availabe in my system. I have successfully compiled ndpi-netfilter-master with libndpi-1.5.1 modprobe xt_ndpi ...
0
votes
0answers
39 views

DD-WRT/OpenVPN Tunnel Between Two Routers - Block Non-VPN Traffic on vlan1

I have two DD-WRT routers with OpenVPN that I am trying to make a secured tunnel between them. I need them to drop everything that is not going to tap0 on the WAN ports(both of which are set to ...