iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n
0
votes
0answers
12 views
iptables and virtual machines of KVM, no ping, no ssh from VMs
Hi everyone :) I have two virtual machines KVM. I did two alias to eth0 - eth0:0 and eth0:1 and put them on an external IPs (eth0:0 - 89.114.122.3, eth0:1 - 89.114.122.4). Now the problem is: ...
0
votes
2answers
39 views
Locating Source of Inbound DDOS
Our web server (Nginx, MySQL, PHP) is presently being attacked by DDOS.
Outgoing traffic is normal (avg 563 kb/sec) but incoming traffic is what is eating up our 1gbit port (avg 800Mb/sec).
In the ...
0
votes
1answer
23 views
iptables and virtual machines of KVM, external ip
Hi everyone :) In general, I'm still struggling with the virtual machine KVM. I did two alias to eth0 - eth0:0 and eth0:1 and put them on an external IPs (eth0:0 - 89.114.122.3, eth0:1 - ...
0
votes
0answers
3 views
What happens when there is no userspace service for NF_QUEUE?
What happens to a packet when its target is QUEUE on iptables/ip6tables and there is no application at userspace to handle that ?
Or what happens when I create a handle using ipq_create_handle() and ...
2
votes
0answers
28 views
Copy/Mirror traffic to different port - iptables
I have nginx running on port 80 and apache running on port 8080
I want to transfer all the traffic to both nginx and apache asynchronously i.e the performance of one server wont be dependent on the ...
1
vote
2answers
47 views
Linux Firewall authentication based on MySQL?
I have a linux server that many users connect to. I use Squid for http access but I need a software that can grant access control to different ports based on a MySQL database.
IPtables is great but I ...
0
votes
1answer
25 views
use iptables for transparent access to 2 proxies depending on domain
I have a setup where I have 2 proxy servers. One is a socks proxy which I wish to use for ALL connections by default. The second proxy is an http proxy which I wish to use for http connections to ...
0
votes
0answers
33 views
Redirect OpenVPN gateway traffic to Privoxy
I would like to redirect the traffic that goes through my OpenVPN gateway to Privoxy, like so:
OpenVPN client->Internet->OpenVPN gateway->Privoxy->Internet->Webserver (and vice versa)
So far I ...
2
votes
1answer
40 views
Firewall recommendation for Debian 6
What would you recommend to a firewall newbie for a firewall solution that can be handled remotely, maybe either by ssh or the browser?
3
votes
4answers
324 views
Blocked IP in iptables but still seeing it in apache logs
I'm running a Centos 6.0 server, with Apache 2/MySQL. I've got iptables running. I followed these steps tonight to block all traffic from an IP using iptables:
iptables -A INPUT -s xxx.xxx.xxx.xxx -j ...
0
votes
4answers
41 views
Understanding iptables chains in linux (in socket terms)
Is it true to say:
A) OUTPUT chain is for the packets that are "generated" by the machine itself i.e. OUTPUT chain affects connect() function.
B) INPUT chain is for packets that are "addressed to" ...
1
vote
0answers
28 views
Forwarding port though hamachi using iptables
I have a situation that can be described as bellow:
CentOS A: 11.22.33.44(eth0 - WAN network) --- 5.11.22.33 (ham0 - Hamachi)
Win32 B: 55.66.77.88 (WAN network) ---- 5.11.22.44 (hamachi)
I use ...
0
votes
2answers
32 views
Cannot ping outside network with these IP rules
Here is my firewall script for an internal development server. I want to be able to get out with http/https but I only want the server accessible via ssh/http from within the internal network.
...
1
vote
0answers
27 views
HTTP Logging Proxies
I want to implement a proxy that records and replays requests made to specific hosts. So that I can stub out external service requests when testing an application.
What is the best way to do this? ...
1
vote
1answer
61 views
Why does iptables output to /dev/console?
For some reason I see the output from this iptables rule
$IPT -A FORWARD --jump LOG
$IPT -A FORWARD --jump ACCEPT
on the console eventhough I have disabled kern in /etc/syslog.conf
#kern.* ...
4
votes
2answers
42 views
Iptables - Block https response only
I'm quite new to Linux and using iptables. Here is what I am trying to accomplish:
I have an ASP.net client that talks with a web service hosted through web-logic on linux. The communication is over ...
0
votes
1answer
37 views
iptables redirect range and exclude
i have this iptables and working.
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 0:20 -j REDIRECT --to-port 8080 #bypass SSH
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 23:442 -j ...
2
votes
1answer
48 views
Ban Specific IP's on VPS
I have a case where I want to ban specific IP address on my VPS.
To ban the IP's I use SSH Access with this code:
iptables -I INPUT -s my-ip-here -j DROP
The case wich I want to ban is as ...
0
votes
1answer
68 views
Limit bandwidth using tc, iptables, and htb
I'm running a Debian server and was wondering if there are good resources out there, to which you can point me, where I can read about traffic limitations.
I have couple users sharing one server. ...
0
votes
2answers
83 views
Iptables not persisting after reboot on CentOS 6.2
I've tried adding a few rules to my iptables but they don't seem to be saving. In order to save them, I've tried running iptables-save and service iptables save. Each time I have run either of those ...
7
votes
5answers
91 views
Managing parallel rules for ipv4 and ipv6 iptables?
We've recently started experimenting with IPv6, and one of the first issues we're having to contend with is dealing with a completely separate set of firewall (Linux iptables/ip6ables) rules for the ...
0
votes
1answer
56 views
Lots of bots making fake calls
I have a small VPS with Apache + php on which i host just a small blog.
I've been looking through its logs and seen tons of calls that (i guess) have the hostname faked. Here's a sample. Obviously ...
2
votes
2answers
52 views
IPTables + SSH dynamic port forwarding = BLOCKED
IPTables is running on my web server. I really need SSH dynamic port forwarding, but my IPTables DROP any INPUT/OUPUT connection, only allow some ports.
For FORWARD chain, I wrote these rules:
Chain ...
2
votes
3answers
58 views
iptables exception
If my iptables is set to drop packets from certain hosts, is it possible to add a host that can be excepted from this if it is affected?
The hostname I'm wanting to except from these rules is ...
1
vote
2answers
38 views
IPTables - Change Port of outgoing and incoming packets
Is it possible to configure IPTables in a way that all outgoing packets to a certain IP and Port are altered with a different port and do the same for incoming packets?
I have to work with a server ...
0
votes
3answers
48 views
iptables configuration not working
I have a VPS for Apples push notification service I am trying to open a port 2195. I am currently doing this
vi /etc/sysconfig/iptables
then I go to insert mode of vi and enter these two lines
-A ...
1
vote
2answers
69 views
iptables and multiple ports
This doesn't work fir me:
# iptables -A INPUT -p tcp --dports 110,143,993,995 -j ACCEPT
iptables v1.4.7: unknown option `--dports'
Try `iptables -h' or 'iptables --help' for more information.
...
1
vote
2answers
30 views
View requests that iptables has blocked
Is it possible to view or enable a log that shows what requests iptables is blocking? I am trying to track down a request that iptables is blocking, but shouldn't be (because of an exception rule that ...
0
votes
1answer
15 views
iptables issue: libipt_DPORT.so not found
I'm trying to set up a proxy server on an Ubuntu Box, but my linux-fu is pretty weak and I'm stymied with an iptables issue.
I'm trying to execute this command:
iptables -A INPUT -d xxx.xxx.xxx.xxx ...
0
votes
0answers
30 views
portsentry on centos keeps restarting over and over
I have been doing some hardening on a new server [ centos 5.7 final ]
i also have logwatch and seem to be getting these strange logs
Commands Run:
User root:
/sbin/service portsentry restart ...
3
votes
1answer
127 views
Iptables: Selective PPTP VPN routing
I've been able to set up TomatoUSB firmware with Ipredator via PPTP, the configuration is as follows:
However, I don't want to use Ipredator PPTP VPN for every machine on my network, how to only ...
2
votes
1answer
124 views
Iptables list doesn't persist across restarts
I am trying to white list CloudFlare's IP addresses on my server by issuing these:
iptables -N whitelist
iptables -A whitelist -s 204.93.177.0/24 -j ACCEPT
iptables -A whitelist -s 199.27.128.0/21 -j ...
0
votes
1answer
39 views
Gateway between wireless network and wired network not routing packets
I have the following interfaces/routes :
# ip route show
192.168.101.0/24 dev eth0 proto kernel scope link src 192.168.101.10
192.168.8.0/24 dev tun0 proto kernel scope link src 192.168.8.1
...
1
vote
0answers
56 views
DNAT to 127.0.0.1 with iptables / Destination access control for transparent SOCKS proxy
I have a server running on my local network that acts as a router for the computers in my network. I want to achieve now that outgoing TCP requests to certain IP addresses are tunnelled through an SSH ...
2
votes
3answers
114 views
On CentOS 4.5, How to Masquerade a connection using MAC address?
Currently we give Internet access using ip address in our firewall script as follows
iptables -t nat -A POSTROUNTING -s 192.168.1.40 -j MASQUERADE
But we have noticed that some guys steal these ...
0
votes
1answer
21 views
iptables forwarding not working, possibly change firewall on target machine
I can't get iptables port forwarding to work. I think I have it set up correctly on the gateway, but I'm now doubting if the target machine might be the problem.
If I set up forwarding from machine A ...
-1
votes
0answers
34 views
Secondary NIC: what all can I do? [migrated]
I was loaned a NIC which I promptly installed in my F16 workstation just to 'play' with it (using iptables and stuff).
Other than forwarding packets from the new NIC to the old NIC using various ...
0
votes
1answer
40 views
Need some explanations on iptables appended rules
Here are some rules that I append to filter table, and I list the added output related to each one:
$iptables -A INPUT -i eth0 -j ACCEPT
and the output is:
target prot opt source ...
4
votes
4answers
141 views
iptables: Allow connections on a port to only “safe” hosts
I have a centos machine and wish to only allow outbound connections to port 587 to certain remote machines, and drop packets trying to connect to all other hosts.
I only want to allow access on port ...
1
vote
3answers
127 views
iptables / bridge / NAT setup
Between our gateway and our LAN, we have a bridging firewall running iptables. I want to add an additional NIC into the firewall and set up a private subnet on it. Traffic from this subnet which is ...
0
votes
1answer
89 views
how to make curl uploads faster with firewall
We recently moved a new server and are facing the slow upload issues . We suspect this because of firewall . how do I make sure applications like ftp,curl become faster with firewall.
Any inputs ...
0
votes
1answer
73 views
(D)DOS Deflate Bug/Alternative
Hi guys I run a busy CentOS webserver (nginx/php-fpm) an to protect it to certain attacks I used http://deflate.medialayer.com/ for a while. I had setup a white-list with 127.0.0.1, my external ...
1
vote
2answers
111 views
CentOS 6 - How to modify iptables during kickstart install?
I'm having trouble modifying iptables configuration during a customized kickstart installation of CentOS 6. The kickstart process is installing several custom RPMs on top of a minimal ISO image. ...
0
votes
3answers
82 views
How can I find out what is congesting my network connection?
I am asking because there has been a couple of times when our server's network connection was saturated. I want to get an idea as to what is causing the network load.
My first idea was to make an ...
0
votes
1answer
43 views
Logging websites with iptables
I currently have a Sokeris net4501 running Voyage Linux acting as a firewall using iptables. Is it possible to use iptables to log all websites that are visited? If not, is there any other software ...
0
votes
2answers
63 views
NFS support in iptables (or other firewall)
How do I enable NFS mounts/shares with iptables with DROP policy?
NFS uses dynamically assigned ports, thus it is difficult to use with firewalls.
I have an NFS server and a few clients.
I would ...
2
votes
5answers
615 views
DD-WRT, forwarding TCP port 80 for http doesn't work from WAN?
I'm running DD-WRT firmware on my router, version DD-WRT v24-sp2 (12/12/11) std.
I'm trying to port forward http traffic on port 80 to my PC's local IP, 192.168.2.97, and although I can browse my ...
0
votes
4answers
85 views
Network traffic accounting of Xen VMs
How do I monitor network traffic usage on Xen virtual machines running on Debian GNU/Linux Squeeze?
I have a number of Xen virtual machines (domUs) running on a few physical machines (dom0s). Each ...
0
votes
3answers
88 views
CentOS 5, port 8080 won't allow traffic
I'm trying to open up port 8080 on my CentOS 5, Apache 2.2.3 server. When I go to ip:8080/mydirectory - it times out. I have ran these commands thus far:
$ iptables -A INPUT -p tcp --dport 8080 -j ...
0
votes
1answer
45 views
How to get Passive FTP Working Through an Iptables Firewall?
I have an iptables firewall running on a Fedora Linux server that is basically being used as a firewall router and OpenVPN server. That's it. We have been using the same iptables firewall code for ...
