iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

0
votes
0answers
14 views

Connect two servers with RJ-45 cable and iptables (without switch!)

I have two servers and server_1 is connected to INTERNET port (of server farm) at eth0. No switch. They connected with cable from (server_1)eth1 -> (server_2)eth0 : ifconfig of (server_1): eth0 ...
-2
votes
1answer
41 views

How to close port 8080 from all except ip 127.0.0.1

I am on Centos 6 with Nginx on port 80 and Apache2 behind him on port 8080. I've written an anti DDOS script which works fine when ip access port 80, but if attacker directly spams port 8080 ...
1
vote
0answers
18 views

EC2 instance won't allow pinging

Ive got an EC2 instance with an iptables config as follows: *filter :INPUT ACCEPT [121:8012] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [64:6240] -A INPUT -p icmp --icmp-type echo-request -j ACCEPT -A ...
1
vote
0answers
19 views

Are DNS server responses categorized as “ESTABLISHED” by iptables? If so, why?

CentOS 5.x I'm trying to confirm which specific rule in my iptables config is allowing return UDP traffic from my DNS server. I THINK, it's this one: -A RH-Firewall-1-INPUT -m state --state ...
0
votes
0answers
28 views

Redirecting traffic through ssh tunnel

I'm trying to redirect the traffic coming from clients to external proxy server. I've the following architecture +----------------------------+ ...
-1
votes
0answers
21 views

iptables how to refuse connection if IP is not 1.1.1.1 [duplicate]

This line works just fine alone: -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -s 1.1.1.1 -j ACCEPT but answers i found on the internet suggest i need to use 2 lines like this: -A INPUT ...
-2
votes
1answer
180 views

iptables : reject connection to port if IP address IS NOT 1.1.1.1

Currently what i have is this: -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -s 1.1.1.1 -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j DROP but what i want is a single ...
0
votes
2answers
24 views

how to configure iptables to allow access to specific domain through squid proxy on port 3128?

What is wrong with my rules? I have installed squid on my server and i want just some specific domains to be reach able through squid but iptables completely blocked me I have found this : iptables ...
0
votes
0answers
17 views

Rule accepting input HTTP in ip6tables not enough to allow IPv6 requests

I am facing an IPv6 accessibility problem with my server. The server is IPv6-capable and is capable of contacting/being contacted by third-parties on IPv6 (ping6 and traceroute6 tested on my Debian ...
0
votes
0answers
12 views

openvpn connects and can ping outside internet but no tcp or udp connections

I have configured an openvpn setup with the server virtualized using openvz. The client connects correctly. I can ping the server from the client and vice versa. ssh to the client also works after the ...
0
votes
0answers
17 views

VPN routed traffic, response goes outside of VPN?

Here's a weird one. Whenever I'm on a hotel network I tend to like to route all my traffic through my home network. Mainly since I'm not entirely sure all my passwords go through SSL all the time. ...
0
votes
2answers
51 views

iptables treating ssh and http requests differently

Here are the facts: server (IP 192.168.1.140) that runs openssh on port 22 and nginx on port 80 server sits behind firewall/router (IP 192.168.1.1) that has identical iptables rules for openssh and ...
-2
votes
0answers
19 views

Why doesn't SpeedTest.net Upload work in Windows when using a Debian-router? [migrated]

There is a FTTx connection. I connect ISP cable to the WindowsXP pc, setup PPPoE. SpeedTest.net shows normal Upload / Download. Now I connect ISP cable to router with Debian 7.5 installed, set up ...
-1
votes
0answers
25 views

3 network interface and 2 subnets (same ip) routing

System description 1 GNU/Linux Box with Arch Linux OS 3 network interfaces 1 for WAN network 2 for every LAN LAN2 and LAN3 description On every LAN we have 3 devices main 192.168.2.2, second ...
0
votes
1answer
23 views

How to Add/Remove New Server behind Haproxy with Minimal Disruption

Haproxy is currently balancing the load between 2 servers, A an B. Clients are connecting to these servers via persistent TCP connections. Question: We want to upgrade from server A to a more ...
-1
votes
0answers
13 views

packets hitting rules in different tables in the same chain

I have the following rule in the mangle table and nat table respectively. iptables -t mangle -A PREROUTING -d 224.0.0.5 -p 89 -j TTL --ttl-inc 1 iptables -t nat -A PREROUTING -d 5.5.5.17 -p 89 -j ...
1
vote
0answers
21 views

iptables rule to set source IP depending on local userid

I have two users, alpha (uid 500) and beta (uid 501), and two IP addresses assigned as eth0 and eth0:1. I would like all outgoing packets originated by processes started by user alpha to be marked ...
0
votes
0answers
16 views

ISC DHCP Server - Client Uplink Is Not Working

Running a DHCP server, client(s) does not have up-link (0Mbps) and has a downlink (50Mbps.) I am setting up a gateway/router on a PC running Debian Wheezy with ISC-DHCP. I have 1 WAN (eth0) and 2 LAN ...
0
votes
0answers
10 views

CSF not blocking ports [closed]

Yesterday I've installed CSF on my VPS. I blocked many ports on my machine (allowing only these included in /etc/csf/csf.conf However, my services like teamspeak or mumble server are still able to be ...
-1
votes
1answer
73 views

My server does not listen to port 25, even though iptables allows smtp traffic [closed]

My public server accepts traffic and relays them to other machines on the network with iptables PREROUTING rules. I recently added a mail server at 192.168.1.10 and made its iptables rules to accept ...
0
votes
0answers
19 views

ip6tables: how to handle periodically changing prefix?

My ISP provides me with native IPv6 (unfortunately DS-Lite for v4) and I'm using SLAAC for the clients in my local network behind a broadband router. As I don't trust the router (which is configured ...
0
votes
0answers
28 views

Linux Server as Router using IPtables Don't Forward IP traffic [closed]

Currently, I'm trying to setup based on Ubuntu 14.04 LTS router like solution. I don't have much alternatives available, so I will use linux box as a router. Current Config (machine is virtual ...
-1
votes
2answers
58 views

Can't configure httpd.conf

I have some problems with httpd and can't configure it(can't open in browser). I have done it a lot of times, but now I missing something. I have installed CentOS 6.5 on virtualbox with ubuntu 14. ...
1
vote
1answer
32 views

Bypass Transparent Squid With IPTables

Similar questions have been asked before but the answers received were not satisfying or didn't apply to my situation. I have a transparent squid proxy that filters all the http and , for some ...
0
votes
1answer
34 views

Iptables redirecting DNS lookup IP and Port [closed]

I have discovered that my ISP (verizon) is intercepting all DNS traffic on port 53. Using iptables, I want to redirect all DNS traffic to a specific IP and Port (5353). To verify the DNS server and ...
-1
votes
2answers
28 views

Forward Clients to New Server using iptables

Clients are connected to a server A by connecting to the domain name address www.example.com:4444, where www.example.com resolves to the IP address of server A. Question: In order to provide a ...
0
votes
2answers
41 views

Assign IPs to programs/processes

I need to assign different IP addresses to different processes (mostly PHP & Ruby programs) running on my Linux server. They will be making queries to various servers, including the situation ...
-2
votes
1answer
23 views

iptables prerouting with match-set

I'm trying to create a iptables entry to redirect a list of ip's to another port. Using ipset I can setup and add lists of ip's and reject them with this command iptables -t nat -A INPUT -p tcp -m ...
3
votes
1answer
23 views

iptables tables — fixing a typo in lo handling

I spent some time today auditing my iptables script. I'm a software engineer, not an Ops guru, but I've tried to pick up the basics of iptables. I noticed something that must have been broken for a ...
0
votes
1answer
57 views

Multi-homed network?

I have a network with a layout like this: ******* ****** ******* ****** * SW1 * --------- * R1 * ---------- * SW2 * ---------- * R2 * ******* ****** ...
0
votes
1answer
33 views

Workaround for state ESTABLISHED,RELATED to allow downloads?

I'm trying work on a positive firewall and block the rest of the world with iptables. So, I've set INPUT chain default to DROP, allowing particular IPs which should have access. Basically, ...
0
votes
1answer
28 views

iptables configuration on Windows Azure (CentOS 6.5) for endpoint load-balanced set

I created 2 VMs (CentOS6.5) on Windows Azure for Postgresql database and HA cluster, everything works fine except when I set iptables service on, the endpoint load-balanced set is down. for security ...
1
vote
1answer
73 views

Hammered by botnet; iptables can't keep up [duplicate]

Fructis is a multi-site (and multi-software) VM (Xen) with 2 cores and like 6G of RAM. It hosts popular Drupal and Wordpress websites and is currently getting hammered. I will put all details below. ...
0
votes
0answers
57 views

iptables forward port range through OpenVPN

I have a VPN server (the "host" - 10.8.1.1) on a public VPS instance running OpenVPN. The second instance I am running (the "client" - 10.8.1.2) is a local ESXi instance connected to the host vpn ...
0
votes
0answers
28 views

iptables on router: why does nat prerouting not intercept packets?

There is a Debian Wheezy box with OpenVZ kernel (IP 1.1.1.1), working as router between Internet and VPS'es (IPs 1.1.1.100 and 1.1.1.200). Incoming packets addressed directly to VPS'es are normally ...
-1
votes
1answer
49 views

How should I properly block outgoing http traffic with iptables

I'm experimenting with iptables, and I'm trying to allow all outgoing requests for HTTPS, but to block HTTP. I have the code below; Chain INPUT (policy ACCEPT) target prot opt source ...
1
vote
1answer
49 views

Does “TARPIT” have any known vulnerabilities or downsides?

TARPIT can be used to waste an attacker's resources, thus slowing down his attacks and lowering his ability to attack other hosts... looks like a good idea. It is provided as a Netfilter addon and ...
0
votes
0answers
22 views

What should be the correct http response code for custom proxy login/register page

I configured a firewall rule on a dd-wrt router to redirect http connections to a shell script, and drop the remaining ports, for the unregistered range of IPs. I am trying to tell the clients they ...
0
votes
4answers
61 views

Create IP nullroute blacklist from text file

I've seen various guides out there for how to nullroute a single IP address, and I've done that before. However, I'm not sure how to nullroute a group of IP addresses. Going through each one ...
0
votes
0answers
29 views

drop smtp live connection

So the problem is that I think my server got DDoS attack with SMTP packet (my mail server). What I can see is that the attacker abuse the smtp_connection_cache. The attacker keep connections (smtp) ...
0
votes
0answers
32 views

OpenVPN in bridged mode, confusion about interfaces

I'm trying to understand some fundamental OpenVPN/networking basics. Let's assume the following scenario: there is an openVPN server which is already configured properly it runs in bridged mode the ...
1
vote
0answers
35 views

Iptables multiport and source ip

I have a rule which does not seem to allow traffic as expected -A INPUT -p tcp -m state --state NEW -m multiport -s x.x.x.x -d y.y.y.y --dports 38000:38100 -j ACCEPT If I remove the -s argument ...
0
votes
1answer
40 views

sip unreachable after changing routes using linux router

SIP server was unreachable after changing routes. I have 2 ISP ,ISP 1 is my default and ISP 2 is my back-up. I have a dialer behind linux router linux. Linux router has 3 ethernet cards. Router ...
2
votes
0answers
37 views

Understanding an OpenVPN bridge from iptable's point of view

In my scenario, there is a machine which acts as both an iptables-based firewall and an OpenVPN-server at the same time. It has two network interfaces - eth1 is connected to the internet whereas eth0 ...
1
vote
0answers
38 views

Change sender-IP for VM in libvirt behind NAT

I have a server with my own public /28 IPv4 Network. On this server I have some vServers, done with KVM/libvirt. These vServers are connected with a virtual network, NATed to the internet. Every ...
3
votes
4answers
151 views

IPTables: allow outgoing SSH

I tried to write my rules for securing a web server with just http/https, apt-get updates, sending mails SSH access. So far I've done that: IPT=/sbin/iptables $IPT -F $IPT -X $IPT -t nat -F $IPT -t ...
0
votes
1answer
75 views

SecAst blocking IP's that fail2ban is not

I'm using SecAst on my Asterisk server as well as fail2ban. (Setup as an option as per the SecAst installation guide). I did this to test if SecAst is working right. I planned to remove fail2ban if ...
0
votes
0answers
28 views

Why can't some user accounts access certain remote ports?

I am trying to troubleshoot a couple issues on RHEL 6.5 that seem related. In both cases, a user on a machine (seperate machines) cannot access a service (seperate services) on a remote machine. In ...
0
votes
2answers
52 views

iptables for ipv6 address port forwarding to localhost port

Say I want to redirect 2a00:1450:400c:c01::71 on Port 443 to localhost Port 12345. How to do that with Iptables? Update Okey, it's Weechat which running an SSL relay on a port >=1000. It can make ...
0
votes
0answers
27 views

Packets are not routed by iptables, how to debug

I'm using OpenStack and OVS. This is my case: From a remote host, I ping VM with IP A. Local gateway received the echo request, then send a packet with IP A and MAC address A' (based on a fixed ...