Tagged Questions

iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

0
votes
0answers
15 views

Only allow SSH from specific IP to evade VPN connection?

I want a Linux server to use the VPN connection for all traffic that is not SSH from a specific IP. If the VPN connection becomes unavailable, not other communication than SSH with the specific IP ...
0
votes
2answers
51 views

IPTables only solution to block any IP address who has made too many connections or reconnections

I’m looking for an IPTables only solution to block any IP address who has made too many (e.g. more than 5) connections or reconnections within a short period of time (e.g. 1 minutes) on a certain ...
0
votes
0answers
25 views

Debian port(s) not responding

I am fairly new to servers. I am trying to run a shoutcast server on debian. Shoutcast runs on a default port of 8000. My problem is it will not load when visiting xxx.xxx.xx.xxx:8000. When I log in ...
0
votes
1answer
3 views

Running snort behind iptables

I run a Centos 6.5 server with a highly restrictive iptables ruleset allowing incoming traffic only on a small handful of tcp ports (8 in total) and blocks all incoming unsolicited UDP traffic. I ...
-2
votes
0answers
5 views

whitelisting 127.0.0.1 localhost with dansguardian+privoxy+iptables

I'm trying to create the perfect development environment and to me that means one without distractions. So im running dansguardian to block web sites using a whitelist. so i configured iptables, ...
0
votes
1answer
30 views

How to ban Syn Flood Attacks using Fail2Ban?

In my log, I am frequently seeing dropped ips like this: > Oct 30 17:32:24 IPTables Dropped: IN=eth0 OUT= > MAC=04:01:2b:bd:b0:01:4c:96:14:ff:df:f0:08:00 SRC=62.210.94.116 > ...
3
votes
1answer
256 views

Does closed Port 25 cause mail to be marked as spam?

I have a web server where I have installed Postfix for sending emails only. All incoming mails will be handled by google apps and not my web server. Using iptables rules, I have blocked all incoming ...
-1
votes
0answers
28 views

i have blocked all incoming connections in iptables [on hold]

i have blocked my self on my server through all other ips after adding below (host-prohibited) line in /etc/sysconfig/iptables -A INPUT -p tcp -m tcp --dport 2095:2096 -j ACCEPT -A INPUT -p tcp -m ...
0
votes
0answers
13 views

SFTP Reverse-Proxy using iptables on custom port

I want to give SFTP access to anyone into to my Server (IP: ss.ss.ss.ss) passing through Proxy (reverse-Proxy? IP: pp.pp.pp.pp), so that IP ss.ss.ss.ss is never seen by whoever is connecting to the ...
0
votes
2answers
40 views

Can't block spammy IP

I'm being attacked by 37.59.4.76. It's sending me a great amount of data, which is destroying my dataplan. I've added the iptables Chain num pkts bytes target prot opt in out ...
1
vote
1answer
23 views

iptables destination NAT from one range to another

I am trying to make destination NAT from one range (192.168.2.0/24) to corresponding ip addresses in another range (192.168.1.0/24). I have managed to do this ip by ip iptables -t nat -A PREROUTING ...
1
vote
0answers
16 views

Forward single port between subnets on dd-wrt router

I have a DD-WRT router with two subnets, 192.168.0.0/24 and 192.168.8.0/24. The latter is used for a 'guest' WiFi network. Traffic between subnets is filtered using iptables. What I would like to ...
0
votes
0answers
23 views

Connection was reset - Apache

I have a server in which I can ssh using the live IP. The server is connected through a DMZ port. whenever I try to access the web server in the server I get Connection was reset. My SeLinux is ...
0
votes
1answer
21 views

Fail2ban MTA=Postfix Setting in Jail Config giving Error

In /etc/fail2ban/jail.local, when I have the MTA setting to Postfix, Fail2Ban is showing an error and is unable to start. [DEFAULT] ignoreip = 127.0.0.1/8 bantime = 1800 ...
-1
votes
0answers
11 views

Fail2Ban Nginx-Noscript filter for Wordpress and Joomla sites

Below is my No Script Nginx filter used in fail2ban settings. My questions is when having a site that runs on Joomla or Wordpress, is it really wise to block "php" from executing? Shouldnt that block ...
0
votes
0answers
11 views

What does Nginx Proxy Filter in Fail2ban really do?

What does Nginx Proxy Filter in Fail2ban really do? I am currently setting up Fail2Ban for Nginx. Almost everywhere I've read, they all have included a setting for [nginx-proxy] proxy filter. From ...
0
votes
1answer
16 views

Fail2ban jail.local vs jail.conf

Does jail.local file act as an override to jail.conf or as a replacement to jail.conf? When I was learning about Fail2Ban from tutorials, most of them usually say either to copy jail.conf to ...
0
votes
0answers
48 views

Ubuntu 14.04 IPtables block all traffic from IPset group except specific port

I have ipset configured with some blocklists to block access to my server from specific countries, but I would like to allow access on one port, for torrents. My current iptables entry for this is ...
0
votes
1answer
16 views

Controlling the depth of iptables RETURN (or how to skip chains)

I have the following setup for iptables INPUT ParentChain ChildChain1 ChildChain2 ... More Rules on INPUT .... How can I return from ChildChain1 back to INPUT just after ...
-3
votes
0answers
16 views

multiple ip as source for one lan [on hold]

I'm in university and the speed is limited for each ip. I want to send packets with multiple source to speed up my connection. After too many search i found out we can not do this in windows. but ...
0
votes
1answer
20 views

fail2ban flushing my existing IPTABLES rules

I just implemented fail2ban on a server for testing purposes. I have a BLACKLIST chain which blocks a huge set of CIDR masks that I don't want to reach my server. When fail2ban is triggered by a ...
0
votes
1answer
13 views

Fail2ban not working on Ubuntu 12.04

I'm trying to implement fail2ban on a Ubuntu 12.04 x64 server. I've done the following: apt-get install fail2ban Made a copy of jail.conf in /etc/fail2ban/jail.conf.local here's an excerpt: ...
0
votes
2answers
75 views

When the OpenVPN client is on, remote ssh access don't works

I'm a new user forum and I'm doing my first VPN setup. I have purchased a VPN service with PrivateInternetAccess. I'm setting up a Linux VM (CentOS 6.5 server) on a VMware ESXi remote host. It's ...
-1
votes
1answer
24 views

Rewrite source with iptables

I'm going to route a static IP from a VPS to my OpenWRT router. They are connected with OpenVPN - the server is the 10.8.0.1 and the router the 10.8.0.6. My public IP is 1.1.1.1 for example, and all ...
0
votes
0answers
30 views

iptables - dropping specific established connections after X hours

Is there a way with iptables to drop specific established connections after X hours? We have an application with limited connection support, and occasionally we see some tcp sessions that shouldn't ...
2
votes
2answers
42 views

Running own DNS in intranet, how to reach outside DNS from clients

The Scenario: I am creating a Network for 8 Windows 7 Workstations running in a Student Laboratory. They are supposed to browse the internet, but not to be reached from outside their intranet. To ...
1
vote
1answer
31 views

MySQL on LAN not working when IPTables enabled

I have two Centos VM. The IP Addresses are as follows : VM_1 => 10.99.0.10 VM_2 => 10.99.0.12 Apache and PHP are in VM_1 and MySQL is in VM_2. Both are having iptables rules. VM_2 is working ...
1
vote
2answers
33 views

Is it safe to move “ACCEPT state RELATED,ESTABLISHED” to the top?

I've the following iptables configuration: Chain INPUT (policy DROP 11 packets, 604 bytes) num pkts bytes target prot opt in out source destination 1 127 11093 ...
-1
votes
0answers
27 views

Direct port 443 to 8443 on using ip6tables only? [duplicate]

I am running CentOS 5, running Kernel version 2.6.18 & ip6tables v1.3.5. IPv6 is enabled. I would like to use ip6tables to direct traffic from port 443 to the internal port 8443. We did this on ...
0
votes
1answer
29 views

Linux - Disable routing but allow bridging

I have a Linux server that is running the KVM hypervisor. I have multiple bridges on this server (that are on different VLANS). Is there an "easy" way to make sure that bridge hoping (i.e. routing ...
0
votes
0answers
16 views

Ubuntu can't connect as IPSec L2TP client

Goog afternoon, I have a corporate local network located behind NAT. There is another NAT in this local network for the corprorate server on Ubunit 12.04. So if clients connect to that server ...
0
votes
0answers
13 views

Setting up iptables for port forwarding of incoming requests over a OpenVPN Client on a Router

I have a Router that runs DD-WRT and a OpenVPN Client that connects and redirects every request over the VPN. My VPN provider supports port forwards, the problem is my router does not forward ...
0
votes
0answers
15 views

HowTo: Let ufw block single IPs when default policy is ALLOW

I want to be able to block certain IPs from accessing my server. As I don't really know what services are running on what port on the machine, I decided to quick&dirty let ufw's default policy be ...
0
votes
1answer
19 views

how to run pptp over redsocks proxy

I have one (virtual) Linux box in Ubuntu, that has redsocks set up done. Inside the machine, I could confirm that the the redsocks did work (use wget to check the external IP). Now, I want other ...
0
votes
1answer
43 views

iptables not allowing ssh

This is my iptable configuration. But I cannot connect with ssh with these rules. What am I doing wrong? I want to block all traffic except ssh coming from x.x.x.x ip address. iptables -F iptables -X ...
0
votes
1answer
16 views

DNAT packet after decryption of ipsec

how to DNAT packet decrypted by ipsec. encrypted packet is: sourceIP: 192.168.4.6 destIP 10.10.0.100: If i simply : iptables -t nat -A PREROUTING d 10.10.0.100 -j DNAT --to-destination 10.0.0.5 ...
0
votes
0answers
8 views

centos 6, vsftpd,user access

Is there a way to block users access to particular server interface? I have a server with three interfaces, eth0, eth1, eth2, and would like to block access to eth0 for particular user. For example ...
-1
votes
1answer
53 views

How to determine what traffic is being dropped / blocked base on iptables log

I have followed the example for iptable logging from https://help.ubuntu.com/community/IptablesHowTo#More_detailed_Logging sudo iptables -I INPUT 5 -m limit --limit 5/min -j LOG --log-prefix ...
0
votes
0answers
27 views

Why is the first of two post-up commands for routing in interfaces configuration not automatically processed

We managed to connect our servers to two distinct networks and everything works fine. We use routing rules that ensure that server responds to the right network. I followed the instructions under ...
0
votes
0answers
41 views

iptables, nat for only one interface?

On my dom0 I have got 4 domUs running, but only 3 of them have different public ips. On the domU without a public I would like to forward all trafic, but if I add nat rules the whole traffic from ...
1
vote
0answers
36 views

NAT for IPSEC access?

Please help to understand if the following configuration can be created. I have IPSEC connection with my customer. It is site2site vpn between customer network and my network 10.102.103.0/28. This ...
0
votes
0answers
39 views

How can I log and maybe even block IPs that send lots of incoming UDP traffic?

we run a voice / teamspeak server which receives legitmate traffic on port 9987 from many ips. Sometimes we get DDoSed. So people use single Servers and send 1-3 Gbits of UDP Floods to that port. This ...
-2
votes
0answers
30 views

Many output tcp connections in SYN_SENT status showed up [duplicate]

I manage some Linux servers, I find a strange phenomenon since last month. When I'm running netstat command, it shows me too many tcp connections point to specific ports like 22 or 80 of different ...
0
votes
1answer
24 views

open all traffic on the pptp interface iptables [closed]

I set up a PPTP client in Ubuntu. Filter iptables denies network access to everything except TOR and PPTP client. *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT DROP [0:0] -A OUTPUT -d ...
0
votes
1answer
28 views

iptables with sticky forwarding/routing

My iptables is sticking. I have a DNS server behind IPTables and down a NAT'ed OpenVPN pipe. Using tcpdump I see DNS packets hit the outside router but it takes 4 or 5 DNS query attempts before the ...
3
votes
1answer
79 views

Change source IP address based on the system user

I would like to make a certain user have a specific source IP address. For this purpose, I added a secondary IP address to the network interface and tried to enforce the source IP using ip6tables and ...
-1
votes
1answer
30 views

restrict access to ssh by hostname with iptables

I want to allow connecting via ssh only for a certain domain sub.example.com. How can I do this via iptables?
0
votes
2answers
70 views

IP rules misconfigured, lost access to server

I have to give my IP rule like, DROP if source is not from 127.0.0.1 AND destination is 9200 But unfortunately, I gave it like, DROP if source is not from 127.0.0.1 (missed the port) So I lost ...
0
votes
1answer
36 views

Keep source port for outgoing packets

I have 2 interfaces eth0(192.168.0.1) and eth1(10.1.1.15). And I do nat for all packets in this way. iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j MASQUERADE Now I want to keep source port ...
0
votes
4answers
60 views

Using iptables without root privileges [closed]

When running the following script as user ec2-user, I get the error message iptables v1.4.18: can't initialize iptables table filter: Permission denied (you must be root) Script: #!/bin/sh # ...