iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

5
votes
1answer
56 views

iptables command from RHEL documentation for cobbler, fails in RHEL 7

This seems like a very simple question. But I don't see anything much about it on the web. The command comes from the RHEL documentation itself, so I would expect that it works... and yet it fails. ...
3
votes
1answer
12 views

Fail2ban redirect

I've just finished setting up fail2ban on my Centos reverse proxy server. I was able to get it to block all requests if a certain criteria was met (pretty straight forward). However, I'd now like ...
0
votes
1answer
21 views

How to set up iptables on a gateway that also hosts Squid proxy?

I have a computer that serves as: a) a gateway between a wireless network (WLAN0) and a LAN (ETH0) connected to internet b) a Squid3 proxy server that does only web filtering (no caching) I have ...
2
votes
0answers
19 views

Test if iptables would pass a given ip/ip-range [duplicate]

I am currently trying to debug problems relating to our firewall configuration and found myself in the situation where I would like to test a config. Ideally I would like to take the iptables config ...
0
votes
1answer
27 views

How do I block all BlazingFast.io IP ranges?

In my logs I've been noticing several cases where frequent requests from an IP spam POST requests to a specific Wordpress script. What all of these spam source IPs have in common, is that they ...
0
votes
1answer
31 views

iptables slow down connections

When I enable iptables (v4/v6) for my server, every connection like ssh, imap, smtp, http, https and so on are slow down so if I try to connect to ssh, it tooks up to 30 (!) seconds. The imap service ...
0
votes
2answers
35 views

Clear TCP sessions

I am trying to use iptables to reject packets as well as reset the TCP connection. My rule is: iptables -I FORWARD -p tcp -s 10.0.0.10 -j REJECT --reject-with tcp-reset If 10.0.0.10 is SSH'ing into ...
1
vote
3answers
25 views

Ubuntu / iptables: Using a server as middle-man to talk to firewalled server [duplicate]

I have a situation where I need to communicate with an API that only allows connections from one particular IP. So api.example.com accepts connections on port 443 from whitelisted-ip I want to be ...
0
votes
0answers
31 views

Linux router for 2 public subnets with one getaway and one local subnet - not load balancing ;)

I have problem with routing on linux. My ISP give me 2 ranges of public addresses, lets say: 192.168.11.0/30 (4 addresses) - router 192.168.33.0/29 (8 addresses) - servers additionally I have on ...
0
votes
3answers
43 views

iptables actively refused everything despite exceptions

I was following the centos wiki page on iptables but no mater what I change only port 22 opens. Using various port scanning websites they all say the server is actively refusing connections on all ...
2
votes
1answer
29 views

How to count packets coming from outside using iptables? [duplicate]

If you don't give iptables a target, it simply counts how many bytes and packets match the rule. I'd like to count all packets that come from outside, i.e. don't match 10.0.0.0/8 and don't match ...
0
votes
0answers
32 views

IPtables string module

I am running 2 Apache servers behind a load balancer. I do not have access to the load balancer as it's run by our hosting provider. I am tasked with maintaining a blacklist of IP addresses that have ...
0
votes
0answers
34 views

Route postfix through different ISP/Gateway

Our network has 2 different gateways/ISPs, one with a dynamic IP used mostly for web traffic and SQUID and another with a dedicated connection and a static IP to handle VOIP and email. The network ...
0
votes
0answers
28 views

Cannot trace bug in iptables firewalls config

I seem to have a bug in my iptables configuration - when I comment out hte final line (drop) it works fine - when I uncomment it, I cannot ssh into my server - can anyone spot what I'm doing wrong? ...
0
votes
0answers
8 views

l7-filter does not set markers

I install l7-filter userspace on ubuntu 12.04 and run it by this command: sudo l7-filter -f /etc/l7.conf -q 1 but l7-filter does not set any markers. I set iptables to send forwarding packet to ...
0
votes
0answers
15 views

Iptables drop forwarded traffic destined for interface IP address

I have a small VPN setup where I use IP tables to nat traffic coming in the vpn0 interface to the IP address of the eth0 interface. These rules look like this: iptables -t nat -A POSTROUTING -o eth0 ...
0
votes
1answer
62 views

ntpd error: unable to bind to wildcard address 0.0.0.0 - another process may be running - EXITING

I have a problem. Time on server not synchronized. And it seems that this problem was appear after I set my rules for iptables, which I described here May be I'm wrong and these two events are not ...
0
votes
1answer
16 views

IP6Tables: How to enable external access to MySQL?

How to enable external access to MySQL with rules on ip6tables? I have tried to the rules below, where after inserted I get access, but when server restart the access remains blocked. :INPUT DROP ...
0
votes
1answer
63 views

Starting to learn about IPtables, why do I need this rule?

I have been reading all day about IP tables, how the rules work, sets of rules for basic webservers, etc. Now I`m trying to configure my webserver with IPtables using this thread as a starting point: ...
0
votes
2answers
58 views

Can iptables automatically drop established session after certain seconds?

Can iptables drop automatically an established output session after certain seconds e.g. 30 sec. since its launch? But I want to restrict it only for destination port 80 and 443. The purpose is to ...
0
votes
0answers
23 views

IPTables forwarding no more connection

I have a VPS for protect windows server from DDOS so I have forwarding connection. The forward works great but I can't access to the internet with the VPS. Ping doesn't works and I can't update or ...
0
votes
1answer
46 views

why my nat iptables rules dont work with marked packets?

System: debian squeeze, Linux server 2.6.32-5-amd64 #1 SMP Tue May 13 16:34:35 UTC 2014 x86_64 GNU/Linux, iptables v1.4.8 lsmod | grep iptable iptable_security 2176 0 iptable_mangle ...
0
votes
1answer
22 views

Static route to Single IP using SSL connection

I am trying to configure a static route to a single IP. My question is two fold: How do I specify a single IP using a subnet mask x.x.x.x/? (not a range of ip's) My pc is making an SSL connection to ...
0
votes
1answer
36 views

Cannot find error in iptables firewall configuration

I'm struggling with a firewall problem on my Centos server. I have the following configuration which when I use it with a service iptables restart and I try to ssh to the server with putty, I cannot ...
1
vote
1answer
59 views

IPtables drops all, but postfix still send emails

My iptables rules: # delete all current rules and user chains iptables -F iptables -X # global policy (target by default) iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP # ...
0
votes
1answer
28 views

Configuring iptables for Haproxy

Ubuntu machine running haproxy with 2 network cards, 1 connected to WAN (called wan0) and another connected to LAN (called lan0). All chains set to DROP traffic. # Masquerade traffic from LAN to WAN ...
1
vote
1answer
45 views

Tcpdump/Iptables on bridge interface without assigned IP address

I have set up a bridge interface without an ip on it. $ brctl addbr br0 $ brctl addif tap0 $ brctl addif tap1 $ ifconfig br0 up As seen above, this bridge is connecting 2 TAP interfaces setup ...
3
votes
1answer
118 views

OpenVPN routing: multiple default entries. OpenVPN client: iptables. DNS issues

I'm running an OpenVPN-Server (Debian 8) for privacy purposes when using public wifi. Hence, all network traffic of the client is intended to be handled over the VPN connection. The server and client ...
2
votes
1answer
61 views

Block smtp service to a IP centos 7 Firewall

I would like to know how to block an IP to use smtp service on a server with centos 7 firewall . I try to use something like this : firewall-cmd --permanent --zone="public" --add-rich-rule='rule ...
-2
votes
1answer
43 views

ubuntu iptables DROP action has no effect [closed]

I installed zentyal web panel for ubuntu, And after a monument I removed it. After remove zentyal, iptables seems work not properly. DROP has no effect Run following code has no effect to block port ...
3
votes
1answer
49 views

PF vs -m of iptables

As you know, iptables has -m (match) such as : -m string -m state -m -iplimit and so on... My question: Does PF has similar features such as -m of iptables?
3
votes
2answers
75 views

Map IP to another IP

Assume the following scenario, if I have a local machine (A) the requests another machine (B) using B's internal IP without regard the ports. But A and B are not on the same network, however, B has a ...
0
votes
2answers
31 views

iptables blocking script using arp table lookup

I need to block certain hosts (multi-OS) on our LAN from gaining internet access. I decided to try and block certain hosts by mac address via iptables but I can't use the mac address of the ...
-2
votes
1answer
24 views

port forward in INPUT level

I want to change the destination port of the ipv6 packet in the INPUT level. So I tried to use ip6tables with nat in the INPUT level but seems this command does not work # ip6tables -t nat -I INPUT ...
0
votes
1answer
26 views

route output traffic from specific NAT'ed VM via ip alias

In a dedicated server with several containers behind NAT, I'm trying to route the output / outbound traffic from one of the containers through a specific virtual interface attached to the main ...
0
votes
2answers
80 views

Firewall rules not restricting access to Docker Web Apps

I have a problem where ports exposed to applications running on our system in docker containers remain open to the world despite the iptables configuration designed to restrict access. It seems to me ...
-5
votes
0answers
32 views

Block All Connections Not From CloudFlare [duplicate]

I have a simple request. I would like to only allow traffic to my server from cloudflare. My website is being pounded by attacks, and there is no legit reason someone should be making a connection to ...
1
vote
2answers
113 views

iptables not blocking IP addresses

I am experiencing DDOS attack on my server. I found out that someone was trying hard on one of Wordpress websites. I disabled that virtual host for temporarily. I am now trying to block their IP ...
0
votes
1answer
43 views

Iptables - Drop or Reject the whole connection

I have the following iptables log: May 13 17:29:20 Test: IN=eth0 LEN=60 TOS=0x00 PREC=0x00 TTL=56 ID=0 DF PROTO=TCP SPT=80 DPT=40660 WINDOW=14480 RES=0x00 ACK SYN URGP=0 May 13 17:29:20 Test: ...
0
votes
1answer
59 views

Block an IP for UDP

I am under UDP flood attack. I used following protections to solve it: iptable IP ban: iptables -I INPUT -s 37.187.231.xxx -j DROP Tried another iptable syntax /sbin/iptables -I INPUT -i eth0 -s ...
4
votes
1answer
89 views

Iptables LOG rule inside a network namespace

I'm trying to setup iptables rules for a docker container. I'm using nsenter to execute the iptables command inside of the container's network namespace: # log access to port 8080 PID=$(docker ...
0
votes
1answer
42 views

Route a port through a specific network interface

I'm using OpenVPN on Ubuntu Server to connect to my VPN. That network interface is tun0. All traffic currently goes through the VPN. I'd like to exclude traffic that goes over a specific port, and ...
1
vote
2answers
54 views

Block https by mac address. Squid or iptables

I want to block web access (http and https) to certain mac addresses. I was able to do this for http using squid but it still lets https sites through. acl denylist arp "/etc/squid/mac-deny-list.lst ...
0
votes
0answers
19 views

Block Bad Referer

I am annoyed by a lot of bad referer spammers I am seeing in apache's logs. 208.118.126.250 - - [12/May/2015:17:45:06 +0200] "GET /js/parsley.js HTTP/1.1" 200 91434 "http://voiceit.be/logins/login" ...
0
votes
0answers
19 views

Reject a http response with iptables and log it

I just started working with iptables and I am trying to do something that I even know for sure if is really possible. I need to test some of my services in a particular server. To debug my ...
0
votes
0answers
35 views

How to block ip/ports using iptables with specific date and time?

Normally to block in command-line I used iptables. iptables -I INTPUT -s xxx.xxx.xxx.xxx -m time --utc --datestart 2013-09-09T15:00 --datestop 2013-09-09T15:30 -j DROP But the problem is, this ...
0
votes
0answers
25 views

How to forward traffic from ipsec host to local network?

Could anybody explain how to implement forward traffic from host in IPsec to local network. On my server I have 3 network cards: red0 - extern orange0 - dmz green0 - local IPsec builds through ...
1
vote
1answer
41 views

Can't get iptables working in VPS - state and conntrack not possible

I've been browsing and reading documentations all night and I can't figure out any solution... I'm trying to get iptables working on my VPS (Debian 7). But I can't get established connections ...
0
votes
0answers
29 views

Static IP Forwarding on OpenWRT

I have a /28 block of static IP's that my ISP provides. Lets say x.x.x.x/28. The new building we are in has a OpenWRT router that I want to configure to forward those IP's to specific servers on the ...
3
votes
1answer
84 views

How do I combine firewall --enabled and --nobase in a CentOS kickstart?

As part of system hardening, I'm trying to configure my firewall during a CentOS 6.6 kickstart with the following line. It does work under one circumstance, and otherwise it doesn't. Kickstart ...