iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

0
votes
1answer
35 views

Multi-homed network?

I have a network with a layout like this: ******* ****** ******* ****** * SW1 * --------- * R1 * ---------- * SW2 * ---------- * R2 * ******* ****** ...
0
votes
1answer
22 views

Workaround for state ESTABLISHED,RELATED to allow downloads?

I'm trying work on a positive firewall and block the rest of the world with iptables. So, I've set INPUT chain default to DROP, allowing particular IPs which should have access. Basically, ...
1
vote
0answers
22 views

How to limit connections when redirecting ports using iptables

I am trying to accept incoming connections through port 80 and reject those from 8888, redirect from 80 to 8888, validate if in the last 30 seconds has connected less than 20 times and then accept. ...
0
votes
1answer
16 views

iptables configuration on Windows Azure (CentOS 6.5) for endpoint load-balanced set

I created 2 VMs (CentOS6.5) on Windows Azure for Postgresql database and HA cluster, everything works fine except when I set iptables service on, the endpoint load-balanced set is down. for security ...
1
vote
1answer
64 views

Hammered by botnet; iptables can't keep up

Fructis is a multi-site (and multi-software) VM (Xen) with 2 cores and like 6G of RAM. It hosts popular Drupal and Wordpress websites and is currently getting hammered. I will put all details below. ...
0
votes
0answers
22 views

iptables forward port range through OpenVPN

I have a VPN server (the "host" - 10.8.1.1) on a public VPS instance running OpenVPN. The second instance I am running (the "client" - 10.8.1.2) is a local ESXi instance connected to the host vpn ...
0
votes
0answers
16 views

iptables on router: why does nat prerouting not intercept packets?

There is a Debian Wheezy box with OpenVZ kernel (IP 1.1.1.1), working as router between Internet and VPS'es (IPs 1.1.1.100 and 1.1.1.200). Incoming packets addressed directly to VPS'es are normally ...
-1
votes
1answer
42 views

How should I properly block outgoing http traffic with iptables

I'm experimenting with iptables, and I'm trying to allow all outgoing requests for HTTPS, but to block HTTP. I have the code below; Chain INPUT (policy ACCEPT) target prot opt source ...
1
vote
1answer
47 views

Does “TARPIT” have any known vulnerabilities or downsides?

TARPIT can be used to waste an attacker's resources, thus slowing down his attacks and lowering his ability to attack other hosts... looks like a good idea. It is provided as a Netfilter addon and ...
0
votes
0answers
19 views

What should be the correct http response code for custom proxy login/register page

I configured a firewall rule on a dd-wrt router to redirect http connections to a shell script, and drop the remaining ports, for the unregistered range of IPs. I am trying to tell the clients they ...
0
votes
4answers
48 views

Create IP nullroute blacklist from text file

I've seen various guides out there for how to nullroute a single IP address, and I've done that before. However, I'm not sure how to nullroute a group of IP addresses. Going through each one ...
0
votes
0answers
26 views

drop smtp live connection

So the problem is that I think my server got DDoS attack with SMTP packet (my mail server). What I can see is that the attacker abuse the smtp_connection_cache. The attacker keep connections (smtp) ...
0
votes
0answers
26 views

OpenVPN in bridged mode, confusion about interfaces

I'm trying to understand some fundamental OpenVPN/networking basics. Let's assume the following scenario: there is an openVPN server which is already configured properly it runs in bridged mode the ...
1
vote
0answers
33 views

Iptables multiport and source ip

I have a rule which does not seem to allow traffic as expected -A INPUT -p tcp -m state --state NEW -m multiport -s x.x.x.x -d y.y.y.y --dports 38000:38100 -j ACCEPT If I remove the -s argument ...
0
votes
1answer
36 views

sip unreachable after changing routes using linux router

SIP server was unreachable after changing routes. I have 2 ISP ,ISP 1 is my default and ISP 2 is my back-up. I have a dialer behind linux router linux. Linux router has 3 ethernet cards. Router ...
2
votes
0answers
31 views

Understanding an OpenVPN bridge from iptable's point of view

In my scenario, there is a machine which acts as both an iptables-based firewall and an OpenVPN-server at the same time. It has two network interfaces - eth1 is connected to the internet whereas eth0 ...
1
vote
0answers
37 views

Change sender-IP for VM in libvirt behind NAT

I have a server with my own public /28 IPv4 Network. On this server I have some vServers, done with KVM/libvirt. These vServers are connected with a virtual network, NATed to the internet. Every ...
3
votes
4answers
145 views

IPTables: allow outgoing SSH

I tried to write my rules for securing a web server with just http/https, apt-get updates, sending mails SSH access. So far I've done that: IPT=/sbin/iptables $IPT -F $IPT -X $IPT -t nat -F $IPT -t ...
0
votes
1answer
73 views

SecAst blocking IP's that fail2ban is not

I'm using SecAst on my Asterisk server as well as fail2ban. (Setup as an option as per the SecAst installation guide). I did this to test if SecAst is working right. I planned to remove fail2ban if ...
0
votes
0answers
26 views

Why can't some user accounts access certain remote ports?

I am trying to troubleshoot a couple issues on RHEL 6.5 that seem related. In both cases, a user on a machine (seperate machines) cannot access a service (seperate services) on a remote machine. In ...
0
votes
2answers
44 views

iptables for ipv6 address port forwarding to localhost port

Say I want to redirect 2a00:1450:400c:c01::71 on Port 443 to localhost Port 12345. How to do that with Iptables? Update Okey, it's Weechat which running an SSL relay on a port >=1000. It can make ...
0
votes
0answers
21 views

Packets are not routed by iptables, how to debug

I'm using OpenStack and OVS. This is my case: From a remote host, I ping VM with IP A. Local gateway received the echo request, then send a packet with IP A and MAC address A' (based on a fixed ...
0
votes
1answer
32 views

Cannot browse web server

I have a server running Apache on Centos 6.4 and I cannot get to browse the box - SSH works fine and as does FTP but nothing http will work. httpd is started, SELinux is not running and I have opened ...
1
vote
1answer
19 views

Linux iptables DNAT 53306 to 127.0.0.1 3306

mysql real port is 3306。 I want public network using 53306 to visit mysql,and 3306 not allowed access from public network. How to write the iptables rules DNAT 53306 to 127.0.0.1 3306 ? help me
0
votes
1answer
36 views

iptables slows down outgoing web request

Before I enabled iptables, requests via curl to this url were instant. But after configuring iptables it takes almost 30-40 seconds to get response. How do I make particular url white listed so it can ...
2
votes
1answer
65 views

Error: iptables: No chain/target/match by that name [duplicate]

I am trying to configure proxy server on RHEL Server 6.5 using Squid and iptables. Below is the command I executed and the error message it displayed: vzlptest01 root [root] > iptables -A INPUT -i ...
0
votes
1answer
42 views

Port forward remote desktop without a gateway over 3G modem router [closed]

I'm trying to connect from a laptop, through a VPN, and a 3G modem/router, to a remote PC / computer. PC (192.168.1.33) | 3G Modem (192.168.1.22) | [3G internet, connecting to VPN] | ...
0
votes
1answer
28 views

Using OpenVPN and iptables in combination

Let's imagine there are three networks, WAN, LAN-A and LAN-B. In between, there is a firewall server connecting the networks to each other. iptables ensures the following things: There is no way for ...
0
votes
0answers
21 views

Simple MASQUERADE NAT between 2 VM

I'm on a cloud service and I'm trying to set up NAT between two VM. I've never experienced issues in this simple step, but this time is different and I'm near to give up. The first VM had two ...
-1
votes
4answers
214 views

Is there anyway to tell what user will receive data from inbound packet?

In linux, considering this use case: 1. User initiates http request for webpage to remote server 2. Remote server answers request and sends packets Is there any reference to the user who started ...
0
votes
2answers
44 views

Forward SSH request to an External Server to an Internal Server

I have a VM config currently where I have 1 external IP pointing to a VM with an Nginx HTTP Reverse proxy serving HTTP Web Pages from several internal VMs without external IPs. I need a similar setup ...
0
votes
4answers
109 views

iptables not installed on centos

If a machine does not have iptables installed, is there still a firewall running? If yes, how to I disable / change rules? if I enter the command iptables I receive the response: iptables v1.4.7: ...
0
votes
1answer
40 views

No route to host centos

I am trying to allow a port through a firewall on centos 6. The error I am receiving is telnet: connect to address 80.xx.xx.xx: No route to host The port I am trying to allow is 5666. If I disable ...
0
votes
1answer
83 views

Is it possible to make the server accessible from two internet connections

how to make this: have: Centos 6.5 WAN1 eth0 44.44.44.44 (DEFROUTE=yes) WAN2 ppp0 95.95.95.95 (DEFROUTE=no) HTTP server work and available only in eth0 DNS server work but port 53 blocked in ...
0
votes
3answers
44 views

Packages drop when using iptables NAT

We are using NAT made with iptables. However when there are lots of connections (or sessions) through NAT server packages start to drop. There is no log in syslog etc. I think this is caused by sysctl ...
0
votes
1answer
17 views

squid3 with tcp_outgoing_address could not connect to anywhere

I have one server with 3 interfaces (3 physical lan card), which are connected to 3 different routers. Each router has a different subnet, i.e. the 3 interfaces of server belong to 3 different ...
-1
votes
0answers
27 views

DHCPREQUEST Operation not permitted

I am configuring iptables on a Ubuntu 14.10 VPS. However, I am having a few issues with the following: Jun 25 08:28:23 www dhclient: DHCPREQUEST of 1.2.3.4 on eth0 to 2.3.4.5 port 67 ...
0
votes
2answers
51 views

resetting iptables seems to make connections clear faster

I have iptables setup on 2 servers. Server#1 is public and Server#2 only allows the ip address of Server#1 to have ACCESS. Server#2 has a mySQL database that Server#1 queries. I ran a query and it ...
1
vote
0answers
12 views

How to test if packet has been tagged with classid

I'm trying to troubleshoot an issue I'm having related to IFB Mirroring which I'm attempting to deploy based on this question: Tc: ingress policing and ifb mirroring My theory is that since the ...
0
votes
0answers
11 views

forwarding an incoming ip multicast packet over another interface

Is it possible to forward an incoming IP multicast packet out of a specific interface using iptables rules if the incoming packet already has a TTL > 1? (The incoming interface is a GRE tunnel ...
-2
votes
0answers
28 views

iptables: Block all connections on port 8080, allow whitelisted IPs [duplicate]

Lets say I have a whitelist text file containing IPs. Ex: whitelist.txt 67.31.137.187 107.130.111.123 How do I use iptables to block all IPs on port 8080 and allow only whitelisted IPs? I was ...
1
vote
0answers
27 views

Firewall rejecting UDP “connections”?

I have a server that is aggregating logs from various other servers. It mostly works great, however from time-to-time (right after a reboot, but not all reboots) it will decide that various UDP ...
0
votes
0answers
28 views

iptables not forwarding traffic from 80 to 8000

iptables is proving to be a very complicated tool for me to use. I'm trying to do the following: Accept all packets on 80, 443, 22 Forward packets received from 80 to 8000 Accept packets from only ...
-2
votes
1answer
36 views

IPTables Block Many IPs Using Domain

DROP all -- 114-43-XXX-XXX.dynamic.hinet.net anywhere DROP all -- 118-161-XXX-XXX.dynamic.hinet.net anywhere These are just two of the several restrictions I have in IPTables right ...
0
votes
1answer
39 views

Iptables: Matching packets for bridged interface

I'm building a firewall configuration tool based on iptables, and trying to get a "bump in the wire" scenario working. Given a setup with eth0 and eth1 in a bridge br0 and a third interface eth2: ...
0
votes
0answers
44 views

Iptables - Port forwarding has no effect

I have a dedicated server with a single public IP (Say 1.2.3.4) running CentOS. Via virt-manager, I added a virtual machine, running CentOS as well. They are connected through a virtual network: ...
0
votes
1answer
40 views

Limit incoming connections using iptables per IP

I need to limit access to some port per IP. Let's say 5 connections per minute - not more. I've seen iptables recent, connlimit and limit, but all of them are not fitting exactly what I need. ...
-3
votes
0answers
11 views

Redirecting locally generated IP multicast over a GRE interface [duplicate]

On a linux box, I want to redirect locally-originating IP multicast traffic (OSPF hello) over a gre tunnel interface. How can I do this using iptables rules?
0
votes
0answers
32 views

Iptables INVALID packet from akamai and google to linux

I set up the firewall rules below (I also blacklisted the IPV6 Module): iptables -A INPUT -m conntrack --ctstate INVALID -j LOG --log-level debug --log-prefix '[FW INVALID]: ' iptables -A INPUT -m ...
-2
votes
3answers
30 views

How do I get iptables to allow a new port (for a webserver sockets handler)

In the local development server, I don't have any iptables rules (running on a Mac). The production server however, runs CentOS 6 with certain rules. I need to add a rule that allows the client to ...