iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

-2
votes
0answers
6 views

Route outbound traffic with iptables [on hold]

I am not able to route outbound traffic with iptables on a server to a specific IP while keeping access to ssh and some others services to this server from anywhere. Can anyone provide any advice ...
-1
votes
0answers
13 views

iptables: No chain/target/match by that name while setting IP Rotation [duplicate]

I want to set IP Rotation using iptables so I am using below code. Don't know what is the wrong, It is showing error iptables: No chain/target/match by that name. iptables -t nat -I POSTROUTING -m ...
0
votes
1answer
12 views

Loading fail2ban rules to iptables using iptables-persistent

I am using iptables-persistent package to reload my iptables on boot. And I have been thinking should I add the fail2ban rules to the loaded config file? Now I am seeing they are duplicated. This is ...
1
vote
1answer
31 views

Amazon EC2: OpenVPN server won't route bridged packets from client to VPC subnet

I have a bridged OpenVPN setup on a Linux server in an Amazon EC2 VPC. (Spent hours on docs, reading similar problems, here, openVPN forums, no luck yet.) The bridged interface is up and contains ...
0
votes
0answers
23 views

Forwarding ports and traffic to VPN tunnel

I've installed OpenVPN on my VPS. I have one question: how to forward traffic going to that VPS to go to VPN tunnel created with my local PC. I will use TCP connection. The whole traffic will be like ...
0
votes
1answer
16 views

Ping from OpenVZ host to container

I have a host with multiple containers. I would to ping from the host to container, and vice versa. Currently ping works only from inside a container to the host, e.g.: root@c1313s02:~# vzctl enter ...
-2
votes
2answers
35 views

how to change the special port output source address?

I want to change the my datapackage from port 25 to another internal address(192.168.2.253). iptables -A OUTPUT -o em1 -p tcp --dport 25 -j SNAT --to 192.168.2.253 But I get the output is: ...
0
votes
1answer
21 views

Squid running in intercept mode on same machine as browser keeps giving access denied

It's been a while since I last touched squid and I've been sitting here figuring out this problem since the last few hours why my squid setup on this standalone server machine (behind router nat) ...
1
vote
1answer
36 views

Using host's iptables to prevent access to docker-container's exposed ports

I have a host which runs a few docker's containers. This host has a few network interfaces, my goal is make some exposed ports from containers accessible only by certain interfaces, and prevent ...
0
votes
0answers
30 views

Access port forwarded http service inside host only network vbox (docker)

I used vagrant to create a host only network for my ubuntuserver machine with this option: config.vm.network "private_network", type: "dhcp" Inside this box I have a docker container which is port ...
0
votes
0answers
20 views

Make local subnet clients get redirected like public clients, when requesting a redirected outside port on the firewall

I have a server that also functions as a firewall for the 192.168.1.0/24 subnet via iptables. It also double as a VM Server. Both the VM's and the local machines share the subnet. The servers ...
-1
votes
0answers
21 views

nftables - call for documentation [on hold]

I'm currently using some pretty advanced iptables setup in deployment for traffic-shaping and NATting routers for ISP customers (talking about gigabits traffic, so a bit of efficiency is needed...). ...
0
votes
0answers
13 views

iptables improvement: log DROPped connections to unknown ports/destinations for banning with fail2ban

I'm testing the following iptables rules (ipv4) with support for logging of dropped packets. I log the drops to /var/log/iptables.log and then ban retrying/hammering IPs with fail2ban. I'm no expert ...
-2
votes
1answer
28 views

Routing FQDN to Web Server on Specific Port [on hold]

I am running multiple web servers on a single machine. localhost:9000 localhost:8080 I want external requests (from the open net) to mysite.com to route to port 9000 and myevenbettersite.com to ...
-1
votes
1answer
28 views

Block everything except some ports and specific IP Addresses, server can't do HTTP GET

I can't get this firewall.sh script to work. It currently doesn't allow me to get a file at 'https://index.docker.io/v1/repositories/library/ubuntu/images' so either my DNS is flawed or I am blocking ...
1
vote
1answer
13 views

limit multicast to wanted outout interfaces using iptables (or other lartc commands)

I have the unifi server running for all my access points on a network. The controller host sits on a few networks, but only one of them should be used by unifi. Of course, the server has no options ...
1
vote
0answers
36 views

Trouble setting up a transparent proxy

I have been trying without success to setup a transparent proxy on a router like computer. Most examples that I have found don't have the gateway and proxy on the same computer, so I may be looking at ...
4
votes
1answer
100 views

Alternative to Firewalld on memory critical servers?

I've bought a 512MB VPS @ DigitalOcean. Currently, I use Firewalld to allow/deny access to certain ports (probably 22, 80, 443 are open). It uses around 25-30MB of memory. EDIT: Not to forget that ...
-1
votes
2answers
32 views

Is there a way to block ALL inbound/outbound traffic going outside of a LAN with iptables?

As the title says, I'm just looking for a way to disallow any traffic on ANY port unless it's going to a local IP address (192.168.1.*).
-1
votes
0answers
29 views

Using iptables to forward traffic to different servers - all connections end at one of them [closed]

I have 2 servers which I would like to connect to over the internet. Unfortunately, my connection suffers from carrier-grade nat. To circumvent that problem, I have created a VPN connection from each ...
2
votes
1answer
65 views

What is the state of subsequent http requests in iptables terms?

When a user requests a web page, e.g. www.example.com/about-us/history.html. The server will send them an HTML file, the HTML file will contain elements that subsequently generate many more HTTP ...
0
votes
1answer
50 views

Iptables block layer 7 DDoS attacks

Recently I've been experiencing lots of layer 7 ddos attacks to my website. Specifically an HTTP GET request flood on the index page. (~20k r/s), my server is at OVH, so it's not overloading the pipe, ...
0
votes
2answers
28 views

In iptables, does state ESTABLISHED require a later state NEW to make an ESTABLISHED connection?

When using the following rule: iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT ...do you need to add specific rules including the NEW states to allow for an ESTABLISHED ...
-1
votes
1answer
41 views

How to allow google-analytics via iptables when internet is blocked for other traffic

I am running the following script on a wifi gateway. The WAN side of the gateway has ppp0 interface while LAN side is on wlan0. No LAN user should be allowed to browser internet Some services on ...
1
vote
1answer
39 views

iptables forward ip to another ip

I've configured multiple IP Addresses on my Ubuntu ssh server. Now the server can be accessed by using any IP Address, from 192.168.0.51 to 192.168.0.99. Depending on which IP Address someone uses to ...
-2
votes
0answers
13 views

Iptables block all trafic in my home network [closed]

Hi i ahve a router DDWRT with OpenVPN and works ok. I use this rules to block traffic wen the connection VPN fails, and works ok. iptables -I FORWARD -i br0 -o tun1 -j ACCEPT iptables -I FORWARD -i ...
0
votes
0answers
26 views

How to do the port forwarding from one ip to another ip only for right incoming ip?

I'm have 2 vpn clients and 1 vpn server. One vpn client(work) has access to the server on amazon, but it seems for this server in the firewall block incoming requests from all ips except work ...
0
votes
1answer
23 views

Cannot understand this example fail2ban rule

I'm trying to secure my admin and user login page from brute force attacks. I have setup iptables and the closest thing I can find which looks useful is this: jail file: [nginx-login] enabled = true ...
0
votes
1answer
23 views

Iptables drop all connection except my domain(s)

I tried use this command to block a domain iptables -I INPUT -p tcp -m string --string "Host: domain.com" --algo bm -j REJECT and it worked but, i want to Reject all but accept from specified ...
0
votes
1answer
22 views

ip6tables snat don't work properly [closed]

I got three computers with these names: laptop, vds and home; vds is openvpn server; home is openvpn client. and, I got an ipv6 network 2a01:dead:beef::/64 vds has address 2a01:dead:beef::311 on ...
0
votes
0answers
30 views

iptables DNAT packets into an openswan IPSEC tunnel

I have the following network setup: +-----------------------------------+ | | ...
-2
votes
0answers
21 views

How to unblock IP range in iptables

I made a simple script for apache2 web server to block webscrapers. It's working fine but sometimes MSN Crawlers are getting banned. iptables -L (...) DROP all -- ...
0
votes
0answers
27 views

Trying to create a NAT with virtual Ethernet using IPTables

I have a separate namespace running on my server and I want to create a NAT that will enable Internet connectivity in this namespace. I specifically want to do this so that certain inbound ports are ...
0
votes
1answer
21 views

iptables using, goto + jump: what is the RETURN behaviour?

I'm trying to work out what is the iptables behaviour when you have multiple custom chains and you sue a mix between -goto and -jump Example: INPUT iptables -A INPUT -i eth1 -j CUSTOM-A CUSTOM-A ...
0
votes
1answer
44 views

How to block every port except specific ones to a user with iptables? [closed]

I'd like to block every port except 80, 443, 1005 to a specific user (owner) with iptables. What command should I use?
-1
votes
0answers
18 views

IPTables Quota Limiting and Redirect

I am currently working on a quota limitation for a wireless captive portal based on iptables. With the following ruleset all new connections get redirected to the login page after the quota is ...
0
votes
0answers
40 views

CentOS 6.6 ignores iptables nat rules

I try to use iptables nat to forward incoming TCP traffic to another computer. I use following rules within nat table: -A PREROUTING -i eth3 -p tcp -m tcp --dport 8888 -j DNAT --to-destination ...
0
votes
1answer
18 views

How to disable network access for a user on Linux?

Trying to disable the network access for the user: [root@notebook ~]# iptables -I OUTPUT -m owner --uid-owner tempuser -j DROP [root@notebook ~]# ip6tables -I OUTPUT -m owner --uid-owner tempuser -j ...
0
votes
3answers
33 views

“Bad argument 'NEW'” when configuring iptables

I am getting the following error when configuring iptables on a Debian 7.6 server to log new TCP connections: Bad argument `NEW' Error occurred at line: ## The line throwing the error is formatted ...
-1
votes
0answers
84 views

Customising IPtables for a more secure webserver

Based on my reading online and a few tutorials I have produced a set of iptables rules: i=/sbin/iptables # Flush all rules $i -F $i -X # Setup default filter policy $i -P INPUT DROP $i -P OUTPUT ...
0
votes
1answer
18 views

Is there a way to run just save with firewalld in RHEL7?

I'm starting to use RHEL7 and learning a little about the changes that come with systemd. Is there a way to perform /sbin/service iptables save in firewalld? $ /sbin/service iptables save The ...
1
vote
0answers
20 views

How to block hping3 SYN ACK efficiently with iptables?

Actually I'm trying to execute a SYN TCP flood on my Debian web server with nginx and, by executing tcpdump "tcp[tcpflags] & (tcp-syn) != 0" while flooding, I see all packets coming. I already ...
1
vote
0answers
47 views

Squid intercept proxy stuck with forwarding loop

I'm trying to set up a debugging proxy using Squid, mainly to test our own client communications library for various proxy types (one possibility with our client, is to connect to an external ...
0
votes
0answers
25 views

Port forwarding to VPN

| |WAN /-------\ ...
0
votes
0answers
41 views

failing to tunnel F5VPN through OpenVPN [migrated]

summary I need to tunnel an F5VPN through an OpenVPN in order to ssh from a client device (Debian laptop) through a firewall. The OpenVPN works, but I lose all networking on the laptop once I start ...
0
votes
1answer
44 views

iptables-save return with errno 1 - operation not permited

When I run the command iptables-save it returns with errno 1 - opearation not permitted If I do: iptables -L and then: iptables-save then iptables-save succeeds This error happens only ...
1
vote
0answers
15 views

Troubles with subnets and redirections

What I want to create is 2 subnets that communicate each other through a gateway. Here is my gateway: wlan0 Link encap:Ethernet IndirizzoHW c4:46:19:69:b7:a5 indirizzo ...
0
votes
1answer
23 views

ssh port is different from what is connected

Ok, so here's the deal. I setup an Iptables rule as follows: IPTABLES -A INPUT -p tcp --dport 51722 -j ACCEPT and if I do systemctl status sshd.service, I get the following: Server listening on ...
0
votes
1answer
39 views

drop ip blacklist with firewalld centos 7 [closed]

Question 1 I have I very long list 1500+ ips in a file lets say /etc/blocklist.ips each ip in a line of the file. How can I DROP for every ip in the file with firewalld from centos 7 ? also I been ...
0
votes
2answers
42 views

IPTables port redirect with Docker

I have a web service running on port 8080, which is made available on port 80 through IPTables like so: iptables -t nat -A OUTPUT -p tcp -d 127.0.0.0/8 --dport 80 -j REDIRECT --to-port 8080 This ...