iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n
0
votes
0answers
6 views
Can you configure SNAT with multiple source IP's and use static DNAT (port forwarding)?
We have a private LAN connected to a firewall with multiple public IP's to use for SNAT in order not to overload the ports on a single IP. However, we have a requirement to allow certain workstations ...
1
vote
0answers
39 views
Blocking torrents on PPTP/OpenVPN/IPSec
I run a VPN network and because of DMCA complaints in the USA I have to block torrent traffic.
I have tried the following:
iptables -t filter -A FORWARD -m string --string "BitTorrent protocol" ...
0
votes
1answer
23 views
Filtering input with iptables: -i <interface> versus -d <ip>
I'm changing my iptables setup to cope with the addition of a new uplink, which now receives its configuration through DHCP. I currently list my interface's IP addresses directly in my rules, which ...
-4
votes
1answer
26 views
Open Port 123 to change Server time [duplicate]
How can I actually open port 123 on my CentOS server, so I can synchronise my server with another server's time?
I couldn't be able to open 123 port using google guides.
1
vote
2answers
53 views
Reduce firewall rules by half - one iptables rule for tcp and udp
I have a number of iptables rules on my firewall that look like this:
iptables -A zone_lan_forward -p tcp -d 1.2.3.0/24 -j ACCEPT
iptables -A zone_lan_forward -p udp -d 1.2.3.0/24 -j ACCEPT
Is ...
2
votes
4answers
151 views
Making iptables easier to maintain
My network is completely locked down except for a few sites which are whitelisted. This is all done through iptables, which looks something like this:
# Allow traffic to google.com
iptables -A ...
0
votes
3answers
34 views
Centos iptables open port 53
I am having problem opening port 53 on my centos machine, for DNS configuration.
Here is my iptables config
-A INPUT -p udp -m udp --sport 53 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
...
0
votes
0answers
19 views
Setting up a local transparent proxy [closed]
I set up a local transparent proxy to see what my own linux box was generating over HTTP, although I needed to run the proxy as root, otherwise the proxy itself couldn't get out.
# allow proxy ...
0
votes
1answer
39 views
what is the --kerneltz in iptables command
I am using iptables for my project but facing some problem as follow.
1.in iptables 1.4.7
iptables -A INPUT -s 10.0.4.247 -m time --datestart 2013-5-16T12 --datestop 2013-5-16T16 -j DROP
or
...
0
votes
1answer
34 views
iptables with DNAT and multiple gateways: How to route replies to correct gateway?
I have a problem setting up iptables rules and routes on a Linux client for a scenario with DNAT and multiple gateways:
We have two gateways to the Internet. The first has a fixed IP, the second ...
0
votes
0answers
31 views
Apache server reached MaxClients setting
I'm using Apache/2.2.15 (Unix) in CentOS release 6.3 (Final) 2.6.32-279.1.1.el6.x86_64.
I have some HTTP requests from specific referer with diferrent ip adresses and i want to block these requests ...
-2
votes
0answers
31 views
How to solve 3 way handshake [closed]
18:19:21.543368 IP (tos 0x0, ttl 117, id 766, offset 0, flags [DF],
proto: TCP (6), length: 48) 103.84.236.14.27937 > 198.27.85.103.6010:
S, cksum 0xb8c2 (correct), 1102345511:1102345511(0) win ...
1
vote
1answer
19 views
How to block outgoing traffic of the mac address of one of the server's own NIC with ip tables?
i have a server with 5 nics connected to a switch, and running GNS3 (cisco router emulator).
I need to block, in the server, the packets originated by the nics at layer 2 level (the nics are not ...
-2
votes
0answers
41 views
I want to help turn IP iptables [closed]
hi I want to help turn IP
iptables -t nat -A PREROUTING -p tcp -d xx.xx.xx.xx --dport 80 -j DNAT --to 192.168.1.2:80
iptables -t nat -A POSTROUTING -d 192.168.1.2 -j MASQUERADE
xx.xx.xx.xx = Not ...
2
votes
2answers
46 views
iptables doesn't seem to be blocking IPs I ban
As a test, I started a TorBrowser, got its IP, and banned it via this command on my VPS:
sudo iptables -A INPUT -s <IP address> -j DROP
I'm still able to surf pages hosted by my server from ...
0
votes
2answers
39 views
iptables: filter before DNAT
iptables -t filter -A OUTPUT -d 1.2.3.4 -j DROP
iptables -t nat -A OUTPUT -p tcp -m owner --uid-owner abc -j DNAT --to 127.0.0.1:121
First rule does not work because nat it processed before filter. ...
0
votes
1answer
45 views
Unable to ping gateway from network
I got the following route table :
#!/bin/bash
IP=/sbin/ip
# SST
echo "SST: Setting up SST network ..."
$IP route flush table 10
$IP route add table 10 to 10.45.13.0/26 dev eth0
$IP route add table ...
0
votes
0answers
36 views
How to redirect a local port range to a guest VM using Linux?
I am trying to redirect connections made inside a linux host to a guest VM, say 192.168.122.158, for a certain port range, say 8000:8500, i.e.:
telnet localhost 8000
should actually result in a ...
0
votes
3answers
28 views
VPS security considerations when only accessing from one IP [duplicate]
I'm running an VPS where I have deployed some projects. As I am the only person who accesses the server and I furthermore have a fixed IP i decided to configure iptables so that server access is only ...
0
votes
3answers
43 views
IPTables add an IP to IPSet list
How to correctly add an IP address to ipset from an iptables rule?
Or isn't that possible at all?
This rule doesn't work for me: -A INPUT -m recent --name IP_LIST --set
Type of IP_LIST is hash:net
...
1
vote
2answers
26 views
iptables rule -d ! (not destination) is giving me errors
How do I use the [!] option for a destination IP?
I'm trying to redirect out-bound WAN DNS traffic to my sinkhole, but I can't get the --destination [!] option to work.
For example:
iptables -A ...
0
votes
1answer
34 views
preventing squid forwarding loop with IPtables
I have a web application, and I'd like to limit file upload size.
I thought I'd try using squid for this, via its directive request_body_size_max.
I have my webserver running on port 8080, and I've ...
2
votes
1answer
52 views
Iptables rules order
I have following script, which I found somewhere in the Internet, and I modified it a little bit to suit my needs.
My question is: If I understood output of iptables-save my iptables rules are ...
1
vote
3answers
26 views
Testing the limits of UFW with thousands of deny blocks
Here's the deal: I have a persistent Chinese botnet that spams my forum (running on an Ubuntu 12.04.2 server on nginx, etc). I've been using UFW (Ubuntu's "Uncomplicated FireWall") for managing the ...
0
votes
1answer
55 views
OpenVPN pass through to lan and out second internet connection
I asked on SuperUser, was told it might be best to ask on here, so here we go.
I want to run OpenVPN on a computer connected to a FiOS connection on one NIC, then pass that traffic onto the LAN, and ...
0
votes
1answer
44 views
How to add delay to incoming traffic?
For purpose of continuous testing, I would like have apache server to serve static files with at least 20ms delay.
I tried to find a apache configuration setting or a plugin with similar ability, but ...
0
votes
0answers
23 views
how to open forwarded port (on remote server)
I have tunel from local router(dd-wrt) to external server:
ssh -i /root/.ssh/id_rsa -f -N -R 221:${LOCALIP}:221 root@VPS-MACHINE
Port 221 - ftp server. Now i can login to local ftp through ...
-3
votes
2answers
75 views
how to intercept(not only capture) outgoing packets from TCP programs(or specifically TCP stack)? [closed]
I have a web server running on a host and I want to intercept all packets(including IP/TCP header) sent by the webserver, so the packets are not sent out to the Internet by the web server directly.
...
0
votes
0answers
20 views
OpenVPN server cannot ping client
First of all apologies if this has been answered anywhere else, but I Have been googling around for a few days and it is driving me crazy now.
I have installed OpenVPN server on a CentOS VPS hosted ...
0
votes
3answers
41 views
iptables for a /16 subnet with a /24 exception
simply put, i want to use these rules:
iptables -I FORWARD -i br0.105 -d 192.168.0.0/16 -j DROP
iptables -I FORWARD -s 192.168.0.0/16 -i br0.105 -j DROP
but with the exception of the ...
0
votes
2answers
107 views
My iptables does not allow apt-get update to work properly, what rule has broken it?
I thought my iptables' rules were working great, until I did an apt-get update, for which I get Temporary failure resolving error messages for all sites in sources.list. However, when I disable ...
0
votes
1answer
43 views
Parse Apache logfile and ban IPs
My server is under attack, it is flooded with request with the following pattern:
Thousands of IPs
Each IP request the same page "GET / HTTP/1.1" with the same referrer 3-5 times per second (same ...
0
votes
1answer
43 views
Forwarding all HTTP/HTTPS traffic to a port with iptables
I'm trying to setup a wireless network that routes all traffic to a local webserver (basically a hotel wifi login page).
Here's my dhcpd config:
$ cat /etc/dhcpd.conf
ddns-update-style none;
...
-1
votes
1answer
59 views
Any way to Improve performance of iptables DDOS whitelist? [closed]
I'm having a problem stopping a DDOS attack on a dedicated server. I have tried a lot of things (mod_evasive, apf, ddos deflate, bfd...). The attack is very big and from a lot of differents IPs, and ...
0
votes
1answer
51 views
syn flood attack — packet hits on shared ip
How can I dump the TCP packets to get a better idea to know which website is being attacked?
Here is what I have in my logs:
May 4 23:10:26 host kernel: [2130002.635000] Firewall: *SYNFLOOD ...
1
vote
3answers
83 views
iptables: match only untagged traffic on an interface with VLANs
As far as i know, there is no way of distinguishing VLAN traffic in iptables on the master interface (that is the interface to which virtual VLAN interfaces are added with vconfig or ip link add link; ...
0
votes
1answer
15 views
Iptables Proxy like setup
So the situation is we're having issues forwarding packets from a particular IP on a server. This is what is happening so far.
Main server IP - 1.1.1.1
Secondary IP (what we want the client ot ...
0
votes
0answers
67 views
strongswan VPN on OpenWrt
Hi I'm running Barrier Breaker version of OpenWRT and I have setup a VPN according to:
http://wiki.openwrt.org/inbox/strongswan.howto
I can connect to the VPN with my iPhone or Mac (to 10.10.1.0/24 ...
1
vote
1answer
33 views
IPTABLES with AND conditions
I need to apply an iptables rules using --string option. I need to match on --hex or ascii 2 strings that are never localized on the same area.
Each samples I tried DROP only one of my two strings, ...
1
vote
1answer
25 views
Rewrite domain.com:3000 to port 80 with Apache
I'm hosting two applications on my web server, one is a Drupal site, and the other is an Errbit installation, which is a Ruby on Rails application. The URLs looks something like this:
...
0
votes
2answers
58 views
How to properly drop ICMP type 3 packets on possible DDoS attack?
Even after running
iptables -A INPUT -p icmp -m icmp --icmp-type 3 -j DROP
I keep getting ICMP type 3 code 13 packets on tcpdump. when I run tcpdump icmp, I get messages like:
19:41:31.923630 IP ...
-1
votes
2answers
68 views
Dnsmasq not distributing address as dhcp server [closed]
I have a Debian Linux server connected with ethernet cable to a Netgear Access Point (Wnr2000).
I want all users wirelessly connected to the access point to have the Debian Linux server as gateway.
...
0
votes
1answer
18 views
How to configure port-forwarding to enable internal service accessed by another machine?
I have an existing service which is listening on 127.0.0.1:2009, and I want to access that service from another machine, so I tried to configure port-forwarding to do it:
sudo /sbin/iptables -t nat ...
0
votes
1answer
72 views
install iptables_nat module on centos 6.4 [duplicate]
I am trying to add the following rule:
iptables -t nat -A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080
but what I am getting is:
FATAL: Module ip_tables not found.
iptables ...
0
votes
0answers
29 views
DD-WRT/iptables - Setting up multiple external IP addresses to route to the same IP
I'm trying to route multiple external IP addresses using my DD-WRT and iptables. Hopefully this is a relevant post as it will basically all be iptables.
I have 5 IP addresses, 24.123.1.26-30 and am ...
0
votes
1answer
69 views
DDWRT/iptables - block outgoing connections on ALL ports except 80 and 443
A bit lost with ddwrt here... It's actually straight-up iptables but I can't figure it out. All I need to do is:
Block ALL outgoing connections on ALL ports, except 80 and 443.
Block ALL incoming ...
0
votes
1answer
30 views
redirect traffic from 2 Ubuntu external NICs to specific internal hosts
I am having problems redirecting incoming traffic to 2 external facing interfaces on my Ubuntu 12.10 server to 2 separate internal hosts. I am able to redirect incoming traffic on my eth0 just fine to ...
0
votes
0answers
29 views
How to filter out/disable DHCP NAK responses?
We have some crappy situation where we don't have control over the existing DHCP server on the network and where we need to add another BOOTP/DHCP server with the authoritative directive.
Our ...
1
vote
0answers
26 views
Iptables configuration to allow Steam Client [migrated]
I recently got and setup a small linux (Debian) router box. I'm adding it to an existing network to create a small subnet with specific properties, namely internet content filtering. I'm highjacking ...
1
vote
1answer
38 views
Redirect traffic on port 80 into apache for unknown macs, and into squid for some macs
I have a linux box behaving like a router that handles two network interfaces: eth0 for internet and eth1 for LAN.
I set up iptables in order to redirect all the web traffic coming by the LAN into a ...
