iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

1
vote
3answers
18 views

Ubuntu / iptables: Using a server as middle-man to talk to firewalled server [duplicate]

I have a situation where I need to communicate with an API that only allows connections from one particular IP. So api.example.com accepts connections on port 443 from whitelisted-ip I want to be ...
0
votes
0answers
24 views

Linux router for 2 public subnets with one getaway and one local subnet - not load balancing ;)

I have problem with routing on linux. My ISP give me 2 ranges of public addresses, lets say: 192.168.11.0/30 (4 addresses) - router 192.168.33.0/29 (8 addresses) - servers additionally I have on ...
0
votes
3answers
31 views

iptables actively refused everything despite exceptions

I was following the centos wiki page on iptables but no mater what I change only port 22 opens. Using various port scanning websites they all say the server is actively refusing connections on all ...
2
votes
1answer
28 views

How to count packets coming from outside using iptables? [duplicate]

If you don't give iptables a target, it simply counts how many bytes and packets match the rule. I'd like to count all packets that come from outside, i.e. don't match 10.0.0.0/8 and don't match ...
0
votes
0answers
28 views

IPtables string module

I am running 2 Apache servers behind a load balancer. I do not have access to the load balancer as it's run by our hosting provider. I am tasked with maintaining a blacklist of IP addresses that have ...
0
votes
0answers
31 views

Route postfix through different ISP/Gateway

Our network has 2 different gateways/ISPs, one with a dynamic IP used mostly for web traffic and SQUID and another with a dedicated connection and a static IP to handle VOIP and email. The network ...
0
votes
0answers
25 views

Cannot trace bug in iptables firewalls config

I seem to have a bug in my iptables configuration - when I comment out hte final line (drop) it works fine - when I uncomment it, I cannot ssh into my server - can anyone spot what I'm doing wrong? ...
0
votes
0answers
8 views

l7-filter does not set markers

I install l7-filter userspace on ubuntu 12.04 and run it by this command: sudo l7-filter -f /etc/l7.conf -q 1 but l7-filter does not set any markers. I set iptables to send forwarding packet to ...
0
votes
0answers
12 views

Iptables drop forwarded traffic destined for interface IP address

I have a small VPN setup where I use IP tables to nat traffic coming in the vpn0 interface to the IP address of the eth0 interface. These rules look like this: iptables -t nat -A POSTROUTING -o eth0 ...
0
votes
1answer
49 views

ntpd error: unable to bind to wildcard address 0.0.0.0 - another process may be running - EXITING

I have a problem. Time on server not synchronized. And it seems that this problem was appear after I set my rules for iptables, which I described here May be I'm wrong and these two events are not ...
0
votes
1answer
15 views

IP6Tables: How to enable external access to MySQL?

How to enable external access to MySQL with rules on ip6tables? I have tried to the rules below, where after inserted I get access, but when server restart the access remains blocked. :INPUT DROP ...
0
votes
1answer
61 views

Starting to learn about IPtables, why do I need this rule?

I have been reading all day about IP tables, how the rules work, sets of rules for basic webservers, etc. Now I`m trying to configure my webserver with IPtables using this thread as a starting point: ...
0
votes
2answers
52 views

Can iptables automatically drop established session after certain seconds?

Can iptables drop automatically an established output session after certain seconds e.g. 30 sec. since its launch? But I want to restrict it only for destination port 80 and 443. The purpose is to ...
0
votes
0answers
20 views

IPTables forwarding no more connection

I have a VPS for protect windows server from DDOS so I have forwarding connection. The forward works great but I can't access to the internet with the VPS. Ping doesn't works and I can't update or ...
0
votes
1answer
45 views

why my nat iptables rules dont work with marked packets?

System: debian squeeze, Linux server 2.6.32-5-amd64 #1 SMP Tue May 13 16:34:35 UTC 2014 x86_64 GNU/Linux, iptables v1.4.8 lsmod | grep iptable iptable_security 2176 0 iptable_mangle ...
0
votes
1answer
21 views

Static route to Single IP using SSL connection

I am trying to configure a static route to a single IP. My question is two fold: How do I specify a single IP using a subnet mask x.x.x.x/? (not a range of ip's) My pc is making an SSL connection to ...
0
votes
1answer
35 views

Cannot find error in iptables firewall configuration

I'm struggling with a firewall problem on my Centos server. I have the following configuration which when I use it with a service iptables restart and I try to ssh to the server with putty, I cannot ...
0
votes
0answers
10 views

embedded device vpn routing for iptables: Good place to find docs? [closed]

We will be making a vpn for our embedded linux devices. The embedded devices are outside the local network somewhere on the internet. We would like our company employees to be able to connect into a ...
1
vote
1answer
56 views

IPtables drops all, but postfix still send emails

My iptables rules: # delete all current rules and user chains iptables -F iptables -X # global policy (target by default) iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP # ...
0
votes
1answer
25 views

Configuring iptables for Haproxy

Ubuntu machine running haproxy with 2 network cards, 1 connected to WAN (called wan0) and another connected to LAN (called lan0). All chains set to DROP traffic. # Masquerade traffic from LAN to WAN ...
-1
votes
0answers
17 views

Routing traffic using IP tables for two NICs [closed]

I have two NICs (eth0 and eth1). I want to block all traffic (Incoming/outgoing) on eth0 except for port 25 and 993, and allow all other traffic (Incoming/outgoing) on eth1. What's the easiest IP ...
1
vote
1answer
44 views

Tcpdump/Iptables on bridge interface without assigned IP address

I have set up a bridge interface without an ip on it. $ brctl addbr br0 $ brctl addif tap0 $ brctl addif tap1 $ ifconfig br0 up As seen above, this bridge is connecting 2 TAP interfaces setup ...
3
votes
1answer
109 views

OpenVPN routing: multiple default entries. OpenVPN client: iptables. DNS issues

I'm running an OpenVPN-Server (Debian 8) for privacy purposes when using public wifi. Hence, all network traffic of the client is intended to be handled over the VPN connection. The server and client ...
2
votes
1answer
55 views

Block smtp service to a IP centos 7 Firewall

I would like to know how to block an IP to use smtp service on a server with centos 7 firewall . I try to use something like this : firewall-cmd --permanent --zone="public" --add-rich-rule='rule ...
-2
votes
1answer
43 views

ubuntu iptables DROP action has no effect [closed]

I installed zentyal web panel for ubuntu, And after a monument I removed it. After remove zentyal, iptables seems work not properly. DROP has no effect Run following code has no effect to block port ...
3
votes
1answer
49 views

PF vs -m of iptables

As you know, iptables has -m (match) such as : -m string -m state -m -iplimit and so on... My question: Does PF has similar features such as -m of iptables?
3
votes
2answers
65 views

Map IP to another IP

Assume the following scenario, if I have a local machine (A) the requests another machine (B) using B's internal IP without regard the ports. But A and B are not on the same network, however, B has a ...
0
votes
2answers
28 views

iptables blocking script using arp table lookup

I need to block certain hosts (multi-OS) on our LAN from gaining internet access. I decided to try and block certain hosts by mac address via iptables but I can't use the mac address of the ...
-2
votes
1answer
24 views

port forward in INPUT level

I want to change the destination port of the ipv6 packet in the INPUT level. So I tried to use ip6tables with nat in the INPUT level but seems this command does not work # ip6tables -t nat -I INPUT ...
0
votes
1answer
24 views

route output traffic from specific NAT'ed VM via ip alias

In a dedicated server with several containers behind NAT, I'm trying to route the output / outbound traffic from one of the containers through a specific virtual interface attached to the main ...
0
votes
1answer
68 views

Firewall rules not restricting access to Docker Web Apps

I have a problem where ports exposed to applications running on our system in docker containers remain open to the world despite the iptables configuration designed to restrict access. It seems to me ...
-5
votes
0answers
31 views

Block All Connections Not From CloudFlare [duplicate]

I have a simple request. I would like to only allow traffic to my server from cloudflare. My website is being pounded by attacks, and there is no legit reason someone should be making a connection to ...
1
vote
2answers
108 views

iptables not blocking IP addresses

I am experiencing DDOS attack on my server. I found out that someone was trying hard on one of Wordpress websites. I disabled that virtual host for temporarily. I am now trying to block their IP ...
0
votes
1answer
40 views

Iptables - Drop or Reject the whole connection

I have the following iptables log: May 13 17:29:20 Test: IN=eth0 LEN=60 TOS=0x00 PREC=0x00 TTL=56 ID=0 DF PROTO=TCP SPT=80 DPT=40660 WINDOW=14480 RES=0x00 ACK SYN URGP=0 May 13 17:29:20 Test: ...
0
votes
1answer
55 views

Block an IP for UDP

I am under UDP flood attack. I used following protections to solve it: iptable IP ban: iptables -I INPUT -s 37.187.231.xxx -j DROP Tried another iptable syntax /sbin/iptables -I INPUT -i eth0 -s ...
4
votes
1answer
86 views

Iptables LOG rule inside a network namespace

I'm trying to setup iptables rules for a docker container. I'm using nsenter to execute the iptables command inside of the container's network namespace: # log access to port 8080 PID=$(docker ...
0
votes
1answer
36 views

Route a port through a specific network interface

I'm using OpenVPN on Ubuntu Server to connect to my VPN. That network interface is tun0. All traffic currently goes through the VPN. I'd like to exclude traffic that goes over a specific port, and ...
1
vote
2answers
51 views

Block https by mac address. Squid or iptables

I want to block web access (http and https) to certain mac addresses. I was able to do this for http using squid but it still lets https sites through. acl denylist arp "/etc/squid/mac-deny-list.lst ...
0
votes
0answers
18 views

Block Bad Referer

I am annoyed by a lot of bad referer spammers I am seeing in apache's logs. 208.118.126.250 - - [12/May/2015:17:45:06 +0200] "GET /js/parsley.js HTTP/1.1" 200 91434 "http://voiceit.be/logins/login" ...
0
votes
0answers
18 views

Reject a http response with iptables and log it

I just started working with iptables and I am trying to do something that I even know for sure if is really possible. I need to test some of my services in a particular server. To debug my ...
0
votes
0answers
34 views

How to block ip/ports using iptables with specific date and time?

Normally to block in command-line I used iptables. iptables -I INTPUT -s xxx.xxx.xxx.xxx -m time --utc --datestart 2013-09-09T15:00 --datestop 2013-09-09T15:30 -j DROP But the problem is, this ...
0
votes
0answers
23 views

How to forward traffic from ipsec host to local network?

Could anybody explain how to implement forward traffic from host in IPsec to local network. On my server I have 3 network cards: red0 - extern orange0 - dmz green0 - local IPsec builds through ...
1
vote
1answer
38 views

Can't get iptables working in VPS - state and conntrack not possible

I've been browsing and reading documentations all night and I can't figure out any solution... I'm trying to get iptables working on my VPS (Debian 7). But I can't get established connections ...
0
votes
0answers
24 views

Static IP Forwarding on OpenWRT

I have a /28 block of static IP's that my ISP provides. Lets say x.x.x.x/28. The new building we are in has a OpenWRT router that I want to configure to forward those IP's to specific servers on the ...
3
votes
1answer
82 views

How do I combine firewall --enabled and --nobase in a CentOS kickstart?

As part of system hardening, I'm trying to configure my firewall during a CentOS 6.6 kickstart with the following line. It does work under one circumstance, and otherwise it doesn't. Kickstart ...
0
votes
1answer
69 views

Make Asterisk to serve another subnet

I have server with Linux Ubuntu 12.04. It has two subnets - 192.168.0.1(eth0) and 192.168.1.1 (eth1). There is an Asterisk server (IP PBX) connected to first subnet, lets say it has IP address ...
1
vote
0answers
43 views

Linux ipv6 forwarding

Situation I know how to do ipv4 forwarding, and expected ipv6 forwarding to work pretty much the same way. So I configured a VirtualBox host with the network address configured from my ISP. Right ...
1
vote
0answers
24 views

How to reroute outgoing vpn server traffic to Tor with iptables? [closed]

After three days of following HowTos, guides, some debugging and help from guys at users@lists.strongswan.org I was able to setup a VPN server on my spare PC (Ubuntu Server 14.04) using StrongSwan. ...
2
votes
0answers
62 views

Stop senseless mass-queries on DNS-server [duplicate]

I have a disturbing problem for a few weeks now ... One of my three DNS-servers (running bind9 as slave of a Plesk DNS master) is getting spammed with senseless DNS requests. The origin IPs of those ...
-1
votes
2answers
52 views

Port forwarding ssh with iptables

Moved from stackoverflow... My new Internet firewall, based on Linux iptables, is working in most regards very well, but the port forwarding does not work: $ ssh -p 7022 [ppp0-ip-address] ssh: ...