iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

-2
votes
1answer
25 views

Iptables block connection from specific IP - to another IP

sudo iptables -A OUTPUT -p udp -d 8.8.8.8 --dport 53 -j DROP This rule will block all DNS output from my server to Google dns 8.8.8.8 Is it possible to add a line that not all the traffic will get ...
1
vote
1answer
38 views

Forward one IP to a docker container

As far as I understood, docker run containers with their own IPs, and fully open ports, on the bridge interface docker0. Let's say I launch a container, and it has its own IP: 172.17.0.11, and I have ...
3
votes
0answers
13 views

Filter mirrored port traffic using iptables

I receive traffic from a mirrored port and I would like to send it into an NFQUEUE for processing. Because of the mirrored port, the packets destination MAC addresses are not my host MAC address. ...
0
votes
1answer
39 views

Linux: iptables and marking confusion

Before I ask my question, let me first pose the situation: I have 2 network interfaces: eth0 and eth1 I bridge those 2 (using brctl) and form a new interface: br0 This bridge gets the ip address ...
1
vote
1answer
28 views

Influence of kernel code execution to Load average in top?

I'm trying to tests the amount of CPU that iptables use for NAT. Perhaps it will be more accurate to say "the amount of CPU that the netfilter kernel module" uses. The approach i took was to try and ...
0
votes
0answers
14 views

Can multiple firewalld zones be active at any given time?

I've been struggling through some weird (to me) firewalld errors but am now seeing the firewall behavior I'd like. But, baffling to me, what works seems to be a mix of both the drop zone and the ...
0
votes
1answer
10 views

iptables dnat mapping to specific ip

I constructed a private net with two machine, both of them have two network interfaces this is the networking information: machine1: eth0 10.0.0.11 (private net) eth1 10.82.80.208 (Campus Network ...
1
vote
1answer
45 views

Why does my Firewalld configuration on CentOS 7 fail to start and show iptables errors?

I'd like to: Drop all incoming connections from the external Web except 80 and 443 Allow internal machines on 192.168.0.0/16 to connect to :9000 :8080 Here's what I did to setup my drop zone via ...
2
votes
1answer
21 views

iptables unknown option `--connlimit-upto'

I have been getting hit pretty hard every day from thousands of requests all from the same few class's of ip addresses. Recently it's taking up all of my MYSQL connections and not allowing any new ...
1
vote
2answers
42 views

Rotating outgoing IP's

I want to rotate IP addresses for web-scraping, and here is my setup: I have configured multiple IP addresses as below in my /etc/network/interfaces file: # The loopback network interface auto lo ...
-1
votes
1answer
26 views

Debian iptables: Block all Incoming except special IPs or Ports

I play around with the rules for my web server, but it doesn´t work as i want. The ports seems to be reachable, but a connection won´t happen, here´s the script: #!/bin/bash # Drop all Incoming ...
3
votes
1answer
138 views

How do I automatically ban udp short packet with fail2ban?

This logfile /var/log/kern.log contains some IP addresses, which I would like the system to automatically ban/block. Basicaly, a packet is from the UDP protocol, and is a short packet, then I would ...
2
votes
1answer
36 views

Block traffic to certain servers

In my organization, I'd like to make sure all servers are only accessible from the inside. The only exceptions are the mail and webservers. What's the best way to do this? My own suggestion was ...
2
votes
0answers
26 views

UDP Traffic from outside to docker container is dropped after container restart

following situation: i have a hardware box with Ubuntu 14.04LTS as host for docker 1.4 I'm running an ELK stack in several containers. Curenntly the logstash container is exposing only port 514 to ...
0
votes
0answers
16 views

Docker containers connecting to a host daemon

I would like to run a daemon on the host and get the containers connect to it. I was thinking I will bind the daemon on the host to 127.0.0.1 and then have something (delegate? or is iptables enough?) ...
0
votes
0answers
24 views

OpenVPN server cannot ping client (routing/iptables issue?)

I am not sure exactly where the issue is here. I'm fairly sure that this is some NAT or iptables issue on the OpenVPN server but am lacking the networking know-how to fix the issue. The crux of the ...
0
votes
1answer
21 views

Configuring IPTables without connection tracking module

Usually connection tracking is required for outbound connections to allow established connections back in, for instance: iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT I don't ...
1
vote
0answers
22 views

Strange entries in Squid3 access.log

My WiFi network for guests is transparently proxied by Squid3. There's now a girl from Indonesia with her Samsung GT-B5330 running Android 4.0.4, who gets blocked by "The requested URL could not be ...
1
vote
1answer
63 views

iptables starts dropping packets; temporarily fixed by doing restart; only from home

I am running a small apache2/iRedMail server but I am having an issue with iptables. After a while of working correctly (hours) my server is unreachable edit: from my home internet connection on some ...
1
vote
0answers
45 views

linux not replying to an arp request

I am running linux 3.14 on a system with 2 interfaces. on the first interface, i can access our local network. on the second interface, arp packets come in but linux doesn't send out reply. is it ...
3
votes
1answer
42 views

iptables-restore is creating dangerous rule

I'm having this definition file: *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [0:0] :Firewall-INPUT - [0:0] -A INPUT -j Firewall-INPUT -A FORWARD -j Firewall-INPUT -A Firewall-INPUT ...
-1
votes
0answers
34 views

Access to alternative DirectAdmin port is removed from iptables after a while

First i installed csf. Then these auto block rules: http://help.directadmin.com/item.php?id=380 Next i opened a different port in csf for directadmin to listen to. Also added the exception to ...
-1
votes
0answers
12 views

iptables fails between two NICs and 2.6.32.64 kernel

Until recently we used to split our WAN traffic and send it to two NICs (eth0 and eth1) apllying iptables: $IPTABLES -A OUTPUT -s $PRI -p tcp -m tcp -j MARK --set-mark 0x02 -t mangle $IPTABLES -A ...
1
vote
2answers
27 views

Iptables: Filtering string encrypted by ssl

I need to filter (send to BANRULES set) incoming http/https packets with a certain string (matchword). I do it easy when ssl is not in use (port 80): iptables -A INPUT -p tcp -m tcp --dport 80 -m ...
1
vote
1answer
49 views

When iptables is started, there is no ftp access because of timeout

When I start the iptables service, there is no ftp access because of a connection timeout. When I stop the iptables service, ftp works fine. This is the current iptables data: Update: replaced ...
-2
votes
2answers
42 views

How to improve IP tables for web server [closed]

this is my curreny /etc/sysconfig/iptables file for a webserver that must allow http, ftp and ssh access. *filter :INPUT ACCEPT [31395:4050333] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [30540:7083959] -A ...
0
votes
1answer
51 views

Routing between two interfaces

I have a network 10.0.0.0/24, a gateway with ip 10.0.0.1. On the gateway there are two interfaces. eth0 Link encap:Ethernet HWaddr 08:00:27:a1:24:2d inet addr:10.0.0.1 ...
0
votes
2answers
47 views

nmap port 3128 shows open but no squid running

Im trying to lock down an Ubuntu server and ran nmap -T4 against my server. Everything looks right except that it shows port 3128 open but I dont run a squid server or anything else I know of on that ...
1
vote
0answers
27 views

Configuring IPTables to exclude webhost from VPN tunnel [migrated]

I have a Raspberry Pi running as a server for my webhost. Raspberry pi is connected to a VPN service 24/7. Due to this, I am unable to connect to my webhost using my public IP address issued by my ...
4
votes
3answers
62 views

Block traffic behind AWS ELB

My web servers are behind ELB, I want to block traffic from some specific user agent which is a DDOS attack. Apache always see ip address of ELB as an end user so I tried below attempts: Blocking IP ...
0
votes
2answers
65 views

RHEL 6 Having issues forwarding port 80 to port 8080

I am trying to set up a JBoss app server on an RHEL build. Jboss is bound to 127.0.0.1:8080, and I am trying to setup iptables to redirect all traffic from port 80 to port 8080. This is my config ...
3
votes
1answer
27 views

How can I run a shell script on a snort alert?

I have snort listening to the SPAN port of a cisco switch. I'd like to be able to add an iptables DROP rule on my webserver for specific snort alerts but having a hard time finding out exactly how to ...
1
vote
1answer
58 views

Redirect all traffic from multiple interfaces to single IP

I would like to redirect all traffic (specifically TCP & UDP) from multiple WAN interfaces (ppp0, ppp1, ppp2) to a single IP from eth0. When it comes to interface to IP, I can use the PREROUTING ...
-1
votes
0answers
22 views

Slackware internet gateway with iptables / poor browsing performance [migrated]

I am running a dual core headless computer as internet gateway via pppoe with two NICs. eth1 (internet interface) no ip, no dhcp eth0 (LAN interface) - 192.168.0.100 static ppp0 - dynamic ip ...
0
votes
0answers
20 views

Asterisk Firewall access Rules

I have a questions regarding the firewall rules for Asterisk VoIP server. I have a restricted access to UDP/TCP port 5060, which seems to be blocking calls. I want to make sure that my VoIP Server ...
1
vote
2answers
14 views

Use iptables to log connections except for two addresses

We would like to use iptables to log all network connections except if the connecting address is A.B.C.D or the connecting address is E.F.G.H. These two addresses cannot be combined into a single CIDR ...
0
votes
1answer
34 views

Load balancing iptables

I am trying to use iptable for load balancing. I'm working with virtualbox. All vm (debian)are in internal networking and IPs are static. I want to route requests coming to my web server(apache2) with ...
2
votes
2answers
243 views

No SNMP query responses from Ubuntu 14.04 LTS server client machine

Alright, I've got two VMs both running under ESXi. One VM is hosting Observium, which uses SNMP to grab its info. I pointed Observium at my ESXi host directly, and it worked fine, so there's no issue ...
0
votes
0answers
19 views

amazon ec2 instance going to a remote ip using openswan tunnel is up but no traffic being established on the remote ip

I having establishing a vpn tunnel to a remote peer/public ip using amazon ec2 openswan. The tunnel is up but no traffic has been seen on our side or the remote side? Is there I been missing? Please ...
1
vote
1answer
76 views

Limit Number of TCP connections in Linux Server, to avoid attack

I want to limit the number of TCP connections in Linux server, I have used the following command. iptables -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 25 --connlimit-mask 32 ...
-3
votes
0answers
36 views

Large number of requests, high outgoing traffic [duplicate]

I have a VPS on Linode with Ubuntu 12.04 LTS on which I run my staging server (protected with basic HTTP authentication). I the recent days, I received a high number of requests from a handful of IPs ...
3
votes
1answer
48 views

IPTABLES for multiple Public IP Addresses

Currently i have two servers Running Debian 7 with HA Active/Passive setup using Pacemaker and Corosync as follows: node1->IP->xx.xx.xx.1 node2->IP->xx.xx.xx.2 VIP(Floating IP) ...
-1
votes
2answers
38 views

Restricting internet access of some client systems of LAN to a few websites using gateway

How to limit internet access of most systems in my LAN to a few websites and block all the other websites? Also want to bypass that restrictions for some systems. All systems have static IP address ...
0
votes
1answer
37 views

Port 53 in Amazon Security Group

Everything works as expected. This question is for learning purposes only. Using Amazon Security Groups in a VPC. Outbound rules are: 0.0.0.0/0 Port 80 0.0.0.0/0 Port 443 Iptables allows OUTPUT ...
-1
votes
2answers
40 views

iptables -D POSTROUTING -t nat -o tun0 -j MASQUERADE

I was wondering if somone could explain what the purpose of MASQUERADE is. This rule is added and deleted as my openvpn connection goes up/down. iptables -A POSTROUTING -t nat -o tun0 -j MASQUERADE ...
1
vote
1answer
31 views

Two openvpn servers on the same machine, route traffic between the two subnets

I have two openvpn servers ( one on tcp, one on udp) running on the same machine - an OPENVZ vps. The first network A uses 10.10.0.0/24 and it is designed as an intranet. The second network B uses ...
0
votes
1answer
41 views

UFW deny all incoming except SSH

I am about to configure firewall with UFW. I am logged in over SSH so I don't know if the terminal will be locked out as soon as I do: sudo ufw default deny incoming If so, how can I deny all ...
0
votes
1answer
40 views

How to block HTTP floods using IP tables and perm block the attacking IP?

I want to find out how to block HTTP floods fully. I was using this code right here: iptables -A INPUT -i eth0 -p tcp --dport 80 -m state --state NEW -m recent --set --name HTTP iptables -A INPUT -i ...
5
votes
1answer
97 views

Load balancing network traffic using iptables

I am trying to load balance traffic from internal LAN on a linux router having two gateways. Initially I went for the iproute implementation which didnt balance the load as expected, reason being that ...
1
vote
0answers
42 views

iptables IP address (source and destination IP address) mangling [migrated]

I tried to understand the concept of iptables mangling part, but somehow failed to understand the IP header manipulative section. For example: Below is the system scenario which I'm trying to ...