iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

0
votes
1answer
8 views

How iptables work when DNAT and REDIRECT are both set with the same rule?

$ iptables -t nat -L -n Chain KUBE-PORTALS-CONTAINER (1 references) target prot opt source destination … REDIRECT tcp -- 0.0.0.0/0 11.1.1.88 /* service-nginx */ ...
0
votes
0answers
2 views

KVM : Proper iptables rules to allow Guests network connection

I have a KVM running on Ubuntu 14.04 with a few guests (mostly centos7) behind NAT configuration. It seems the guests can't reach the internet connection if the following firewall rules are activated ...
0
votes
0answers
3 views

iptables open port to an LXC container with public IP

I've encountered a strange problem I have no idea how to fix. I'm trying to close all ports on my server, and open only the ports I need in the directions I need. Thus, I ended up with: IF=eth0 ...
0
votes
0answers
13 views

how to visit specifc web domain through one host with iptables?

I have 3 machines in the internet and all of them have their own public ip, the computer name of them, for example is "testA","testB","testC" I want to configure iptables in these machines that when ...
0
votes
0answers
13 views

Setting ToS/QoS for VoIP on Mikrotik

I have a Mikrotik router which looks like iptables. I need to setup QoS to ensure VoIP phones get top traffic priority. How do I know what ToS to use and how would I get it? I searched and can't seem ...
0
votes
0answers
13 views

How to make name resolving faster when querying a huge iptables log file

My daily iptables log files are 1-1.5 GB, which as you see is a huge size. And the amount of logs will get more and more each day. I often need to extract source and destination ip addresses, resolve ...
0
votes
1answer
13 views

Centos 6.6 Web Server iptables FTP issue

I have finished setting up my iptables, but the FTP login/connection does not work. the NAT/Firewall at the hardware/router level is forwarded correctly. I have added an entry for ftp but it appears ...
0
votes
1answer
20 views

adding extra ip address with different port number

I am connected to a NAS system that it is set to static IP address 192.168.2.41 and the ports 80 and 443 of its static ip are reserved for the NAS configuration webpage. So if I insert ...
1
vote
2answers
30 views

iptables setup forwarding between two ethernet interface

I want to create a gateway on linux which has 2 interfaces eth0 and eth1. Eth1 is created by a lte modem and once the lte modem attaches to the network and gets an ip address. Then a dhcp server is ...
0
votes
2answers
34 views

Forward Port on Guest Operating system With Libvirt

I am currently running a Xen Hypervisor underneath Ubuntu 14.04. On the host machine I am running a guest VM. From what I understand, In order to be able to receive incoming connections on the ...
1
vote
2answers
41 views

UDP packet comes to VPN interface and is not delivered to the process

I have a server X (45.55.245.182) which is connected to server Y by VPN. VPN interface on X is tap0 with ip 10.200.0.2; VPN interface on Y is tap0 with ip 10.200.0.1. I run netcat on server Y to ...
1
vote
0answers
20 views

forward vpn traffic from tun1 to tun0

I've been banging my head on this for a while and gave up trying to figure it out. My knowledge about routing and iptables is just too limited to understand this it seems. I have configured a split ...
0
votes
1answer
9 views

Opening a port to access a service in an isolated LAN

There is an isolated LAN (completely isolated, does not access outside and outside can't access it). But one of the server has 2 NICs, one of which is on our dev LAN and the other one in the isolated ...
0
votes
1answer
20 views

iptables TEE UDP traffic to a different subnet

I'm looking for a way to replicate UDP traffic received by one host to another host in a different subnet. The TEE target in iptables only works with gateways in the same subnet, i.e.: On the ...
0
votes
2answers
27 views

Simplest way to secure debian server on LAN

I currently have a basic debian server setup and connected to my LAN. Am I right in thinking that if I remove the gateway from the network configuration then the box will be unable to communicate ...
0
votes
1answer
23 views

Route HTTP(S) traffic to specific IP based on requested URL on Linux

I have an Ubuntu Server in the cloud. Let's call it ServerA. ServerA has an apache2 installed and is serving a default page on HTTP requests. mydomain.com is pointing to the ServerA's IP and thus the ...
1
vote
0answers
51 views

pf (Mac OS X) rule to redirect all traffic to a specific ip/port

I'm trying to recreate this iptables setup (from https://github.com/darkk/redsocks) with pf: iptables -t nat -A REDSOCKS -p tcp -d 10.0.0.0/8 -j REDIRECT --to-ports 12345 iptables -t nat -A OUTPUT -p ...
0
votes
1answer
14 views

iptables DNAT to external IP without masquerading does not work

On server 1.1.1.1: iptables -t nat -A PREROUTING -p tcp --dport 20000 -j DNAT --to-destination: 2.2.2.2:20000 iptables -t nat -A PREROUTING -p tcp --dport 20000 -j LOG --log-prefix pre20k iptables ...
0
votes
0answers
12 views

local port forwarding with failover

There is a number of similar though not identical processes (worker processes) running on the localhost and listening each on its own TCP port, let's say process1 is listening on port 10001 process2 ...
1
vote
1answer
27 views

Port forward linux iptables

My current network setup consists of a physical nic eth1 receiving my public ip from the modem. Next I have kvm/qemu virtual machines running on a virtual network using the ip range 192.168.122.0 - ...
1
vote
1answer
22 views

Forward connections from docker container on specific port to local interface on host

I am attempting to run services in containers within a cloud provider. I would like the containerised applications to authenticate with an on-premises LDAP server, which is (currently) available via ...
-2
votes
0answers
20 views

iptables shell command from php, does not apply fully?

I run a shell script from php. shell_exec("/abs_path_to/lorem.sh"); When I run the script in Terminal # sh "/abs_path_to/lorem.sh", it works. The script consists in iptables rules. I checked it is ...
0
votes
2answers
52 views

IPtables on Linux for mysql server private interface

Looking to make a mysql database server for web-servers. The server has a public & private interface and I need some assistance writing the rules. I want to only allow SSH, mysql via private ...
0
votes
0answers
5 views

CONFIG_NF_CONNTRACK is not set [migrated]

I am trying to setup iptables on udoo quad but I hit a brick wall and cannot find a fix anywhere: root@udoo:/# uname -a Linux udoo 3.0.35 #10 SMP PREEMPT Wed Jul 30 18:16:10 CEST 2014 armv7l ...
0
votes
1answer
46 views

iptables not starting upon reboot

I've enabled iptables in systemd with: systemctl enable iptables but after restart when I try service iptables status, it shows: # service iptables status Redirecting to /bin/systemctl status ...
0
votes
1answer
22 views

can't initialize iptables table `nat' in Proxmox Openvz vm

When I tried to run an iptables command in the Proxmox OpenVZ vm, I got the following error: # iptables -t nat -A POSTROUTING -o venet -j MASQUERADE && iptables-save iptables v1.4.21: can't ...
2
votes
1answer
39 views

ipset not being applied to iptables

I'm trying to filter out a country that keeps probing my SMTP server (CentOS6) and I can't seem to get the ipset to work out right in iptables. I downloaded that countries IP addresses from ...
0
votes
0answers
17 views

DNAT not forwarding to correct (local) IP address

I'm trying to port-forward a HTTPS service which uses different SSL certificates for each of the several IP addresses on the machine. Web server listens on each IP address on the internal port (444) ...
-1
votes
1answer
22 views

IPTABLES not working, fail2ban still notifying me of instrusions from those ips

I added 200 hundred iptable rules like these: iptables -A INPUT -s 108.62.150.0/24 -j DROP iptables -A INPUT -s 109.108.64.0/19 -j DROP iptables -A INPUT -s 109.110.32.0/19 -j DROP to block russian ...
2
votes
1answer
56 views

How to create a private network between a VPS and 4 IPs?

I own a VPS running Debian and i want to avoid security breaches from "outside" (via Internet). I want to guarantee these rules: Allow all outbound traffic; Allow HTTPS connections from IP 1, 2, 3; ...
0
votes
1answer
32 views

iptables, redirect all port 80 to an IP but let one IP forwards through

My router redirects all incoming traffic (interface eth0) to IP 1.2.3.4 : iptables -t NAT -A PREROUTING -i eth0 -p tcp --dport 80 --to-destination 1.2.3.4:80 When a client hits "100.80.77.8", I'd ...
0
votes
1answer
18 views

No internet connection via my OpenVPN server (solved)

I have OpenVPN up and running on my server. I want all traffic from my clients to be routed trough the VPN server. The client connects just fine but is unable to connect to the internet. Server ...
0
votes
0answers
26 views

Centos 7 IPTABLES - SSH Lockout

I'm currently ruunning an OVH dedicated box, which specifically, has the following operation system installed: CentOS 7.1-1503 By default on CentOS 7 and above, the firewalld service is used ...
0
votes
1answer
33 views

How to create advanced rules with firewall-cmd?

I want to create a rule using firewalld that uses criteria username or userID and maybe one other module criteria. In iptables, I think you can do things like iptables -A OUTPUT -m owner --uid-owner ...
0
votes
1answer
25 views

Seemingly acceptable iptables rule blocking NIS (ypbind) from operating

I am not an iptables expert. I have a use case to block all outgoing traffic that does not destined for either 10.0.0.0/8 or 167.114.0.0/16. I have two NIS servers (10.57.132.11, 10.57.132.40). I ...
0
votes
2answers
27 views

Iptables on Centos 7 doesn't work after reboot

I am on Centos 7, removed the new firewall and installed a classic iptables service. I have a guest machine in it with Debian 8.1 and static external ip. I do: echo 1 > ...
0
votes
1answer
15 views

How do you sync ipset sets across two machines?

I would like to replicate IPSet sets from one machine (server01) to another machine (server02) using rsync or btsync or something similar. Is that possible? If so how do I do it? This is a redundancy ...
1
vote
0answers
31 views

Multicast destination NAT on same network interface, with netem

For testing purpose, in a big network where IT will shoot me if multicast data are not streamed in the right VLAN, I am trying to degrade multicast packets with a server running netem configuration. ...
1
vote
0answers
32 views

Ubuntu 12.04 Router Firewall TTFB Delay

I use Ubuntu Server as my router/firewall for my network for a number of reasons. Until recently, I was using 10.04 with great success for this purpose. The OS provides DNS lookup and DHCP using ...
0
votes
1answer
20 views

Iptables time-based rules having no effect - Gateway with 2 NICs

I have a network with the following topology: - WAN Modem with NIC facing the gateway: 192.168.0.1 - Ubuntu 14.04 gateway with two NICs: 1) Eth0 (facing the modem): 192.168.0.201 2) Eth1 (facing ...
0
votes
1answer
20 views

Cant route traffic through OpenVPN on Debian 8

I have been trying to setup OpenVPN and have run into a bit of a hiccup, i have can't seem to route all my traffic through the server. I can connect to the server just fine but i can't seem to ping ...
0
votes
1answer
41 views

How to use conntrack to allow SIP traffic

I have the following problem: Device (eth0)----> SWITCH(trunk)+VLAN120 ---> (PC1) +VLAN200 ---> (PC2) I am able to ping from PC1 to PC2 which are in ...
0
votes
1answer
32 views

Gateway can't ping client

I try setup a new gateway in my virtual network. But sure I' have a problem. The Gateway cannot ping client but client can ping other client and gateway. So I have check my iptables rule (I does'nt ...
0
votes
1answer
19 views

Why does iptables not doing DNAT for the same subnet? [duplicate]

I have the following NAT setup: +--------------+ +-----------------------+ +-------------------+ | | | | | | | | ...
0
votes
0answers
13 views

Isolate access point clients with iptables

Is there an effective and easy way to isolate access point clients so that they do not see each other over LAN ? I created an open access point with Kali Linux + Hostapd + dnsmask I want to make ...
0
votes
1answer
20 views

What rules do I need to remote desktop to a virtual machine where the host has iptables running?

I am attempting to remote desktop to a virtual Ubuntu install (headless on VirtualBox) that resides on a Linux host (Centos 6.6). I can reach it with no issue if I turn iptables off. I feel like I ...
-1
votes
2answers
51 views

How to set up iptables for local router machine

I have set up a local linux (14.0.4 Ubuntu) machine as a router and can do the following ping server/router from the clients ping clients from server/router ping one client from the other ping the ...
0
votes
0answers
26 views

Simple IPtables Script for Whitelisting (Amazon Endpoints)

I'm attempting to lockdown an Amazon EC2 instance which has a single open port for Amazon SNS. I can't use security groups to restrict the port as the IP is forever changing, so it must be open to all ...
0
votes
1answer
49 views

How to route traffic between 2 VLANs on different subnet

I have the following problem: I have one interface eth0 with IP 172.20.51.61/24 I have configured 2 VLANS on the same machine: eth0.120 : 172.20.52.61/24 eth0.200 : 172.20.54.61/24 I also have a ...
1
vote
0answers
23 views

IPTables, route specific port through VPN

I'm running my own mail server at home on a dynamic IP. Dynamic IPs are often blacklisted, so I currently send out mails through my provider's relay. I want to change that to sending mail directly, ...