iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

-2
votes
1answer
21 views

Opinions about firewall rules for vps [on hold]

I just switched to a new vps, which I installed Linux and I wish to harden it a bit by applying firewall rules using iptables. I use Firewall Builder to create my rules and I would like some ...
2
votes
2answers
46 views

How to have ntpd serve only my local subnet

I have a few servers with public Internet IP addresses like A.B.C.x. One of my hosts (A.B.C.10) runs ntpd and I have it syncing it's time from europe.pool.ntp.org. Now I only want to allow hosts ...
-3
votes
0answers
19 views

Linux: Iptables: Block most ports for accessing from outside [on hold]

I want to block most ports on my Linux-Server for accessing from outside. For internal(127.0.0.1 etc.) all ports should be open. I want to make some rules to block all ports(exception: port 80) when ...
1
vote
0answers
21 views

why port forwarding is not working in this setup?

I'm trying to setup a docker virtualization environment. This is a follow up of this question. I have a virtual eth0:0 interface, and I would like to forward it using iptables. I've a server where ...
3
votes
2answers
23 views

source address with iptables port forwarding

I set up port forwarding for port 80 with iptables: iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 10080 Additionally, I have ip forwarding enabled to route connections ...
0
votes
1answer
21 views

Fail2ban detects attempts from permanently banned IPs

I have a VM with a custom firewall script and Fail2ban. I've identified some IP ranges that make permanent intrusion attempts so I blocked them directly in my firewall script. Here is a simplified ...
1
vote
1answer
15 views

Add custom NAT rule to Plesk managed firewall

I am running a vServer with Ubuntu 10.04 LTS and Plesk 12. I am using the Plesk firewall module which was ok for me so far. However, now I set up a OpenVPN server on the server. In order to be able to ...
1
vote
0answers
6 views

How to set up a hotspot with socks5 proxy [migrated]

I have a laptop with linux installed on it. The laptop has two network interfaces: eth0 and wlan0. Normally I surf the Internet through eth0, and I've successfully set up a hotspot in linux for my ...
2
votes
1answer
85 views

ACCEPT statements in policy DROP

I'm trying to set up some rules using IPtables under Debian (Wheezy) and have been running in to some problems i think. The policy of INPUT is set to DROP. Does this drop everything based on the ...
0
votes
3answers
21 views

aws ec2 security group and centos ip tables

I try to change the SSH port from 22 to another port (218). In AWS EC2, I shall add the rules in security group or in IP Tables? Is there any guideline/references recommended for EC2 Security ...
0
votes
0answers
3 views

pptp gateway with ssh access

I am desperately trying to setup a gateway-server that forwards all local traffic to a ppp0 connection but is still reachable via ssh on the local network. The point-to-point connection establishes ...
-2
votes
1answer
36 views

Iptables block connection from specific IP - to another IP [on hold]

My server with dnsmasq will send Facebook.com (for example) to DNS 8.8.8.8. All other websites go trough another dns server. When i use:sudo iptables -A INPUT -p udp -s 8.8.8.8 --sport 53 -j DROP With ...
1
vote
2answers
70 views

Forward one IP to a docker container

As far as I understood, docker run containers with their own IPs, and fully open ports, on the bridge interface docker0. Let's say I launch a container, and it has its own IP: 172.17.0.11, and I have ...
3
votes
0answers
18 views

Filter mirrored port traffic using iptables

I receive traffic from a mirrored port and I would like to send it into an NFQUEUE for processing. Because of the mirrored port, the packets destination MAC addresses are not my host MAC address. ...
0
votes
1answer
42 views

Linux: iptables and marking confusion

Before I ask my question, let me first pose the situation: I have 2 network interfaces: eth0 and eth1 I bridge those 2 (using brctl) and form a new interface: br0 This bridge gets the ip address ...
1
vote
1answer
29 views

Influence of kernel code execution to Load average in top?

I'm trying to tests the amount of CPU that iptables use for NAT. Perhaps it will be more accurate to say "the amount of CPU that the netfilter kernel module" uses. The approach i took was to try and ...
0
votes
0answers
14 views

Can multiple firewalld zones be active at any given time?

I've been struggling through some weird (to me) firewalld errors but am now seeing the firewall behavior I'd like. But, baffling to me, what works seems to be a mix of both the drop zone and the ...
0
votes
1answer
13 views

iptables dnat mapping to specific ip

I constructed a private net with two machine, both of them have two network interfaces this is the networking information: machine1: eth0 10.0.0.11 (private net) eth1 10.82.80.208 (Campus Network ...
1
vote
1answer
60 views

Why does my Firewalld configuration on CentOS 7 fail to start and show iptables errors?

I'd like to: Drop all incoming connections from the external Web except 80 and 443 Allow internal machines on 192.168.0.0/16 to connect to :9000 :8080 Here's what I did to setup my drop zone via ...
2
votes
1answer
21 views

iptables unknown option `--connlimit-upto'

I have been getting hit pretty hard every day from thousands of requests all from the same few class's of ip addresses. Recently it's taking up all of my MYSQL connections and not allowing any new ...
1
vote
2answers
44 views

Rotating outgoing IP's

I want to rotate IP addresses for web-scraping, and here is my setup: I have configured multiple IP addresses as below in my /etc/network/interfaces file: # The loopback network interface auto lo ...
-1
votes
1answer
31 views

Debian iptables: Block all Incoming except special IPs or Ports

I play around with the rules for my web server, but it doesn´t work as i want. The ports seems to be reachable, but a connection won´t happen, here´s the script: #!/bin/bash # Drop all Incoming ...
3
votes
1answer
147 views

How do I automatically ban udp short packet with fail2ban?

This logfile /var/log/kern.log contains some IP addresses, which I would like the system to automatically ban/block. Basicaly, a packet is from the UDP protocol, and is a short packet, then I would ...
2
votes
1answer
36 views

Block traffic to certain servers

In my organization, I'd like to make sure all servers are only accessible from the inside. The only exceptions are the mail and webservers. What's the best way to do this? My own suggestion was ...
2
votes
0answers
29 views

UDP Traffic from outside to docker container is dropped after container restart

following situation: i have a hardware box with Ubuntu 14.04LTS as host for docker 1.4 I'm running an ELK stack in several containers. Curenntly the logstash container is exposing only port 514 to ...
0
votes
0answers
19 views

Docker containers connecting to a host daemon

I would like to run a daemon on the host and get the containers connect to it. I was thinking I will bind the daemon on the host to 127.0.0.1 and then have something (delegate? or is iptables enough?) ...
0
votes
0answers
31 views

OpenVPN server cannot ping client (routing/iptables issue?)

I am not sure exactly where the issue is here. I'm fairly sure that this is some NAT or iptables issue on the OpenVPN server but am lacking the networking know-how to fix the issue. The crux of the ...
0
votes
1answer
27 views

Configuring IPTables without connection tracking module

Usually connection tracking is required for outbound connections to allow established connections back in, for instance: iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT I don't ...
1
vote
0answers
24 views

Strange entries in Squid3 access.log

My WiFi network for guests is transparently proxied by Squid3. There's now a girl from Indonesia with her Samsung GT-B5330 running Android 4.0.4, who gets blocked by "The requested URL could not be ...
1
vote
1answer
63 views

iptables starts dropping packets; temporarily fixed by doing restart; only from home

I am running a small apache2/iRedMail server but I am having an issue with iptables. After a while of working correctly (hours) my server is unreachable edit: from my home internet connection on some ...
1
vote
0answers
46 views

linux not replying to an arp request

I am running linux 3.14 on a system with 2 interfaces. on the first interface, i can access our local network. on the second interface, arp packets come in but linux doesn't send out reply. is it ...
3
votes
1answer
44 views

iptables-restore is creating dangerous rule

I'm having this definition file: *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [0:0] :Firewall-INPUT - [0:0] -A INPUT -j Firewall-INPUT -A FORWARD -j Firewall-INPUT -A Firewall-INPUT ...
-1
votes
0answers
35 views

Access to alternative DirectAdmin port is removed from iptables after a while

First i installed csf. Then these auto block rules: http://help.directadmin.com/item.php?id=380 Next i opened a different port in csf for directadmin to listen to. Also added the exception to ...
-1
votes
0answers
12 views

iptables fails between two NICs and 2.6.32.64 kernel

Until recently we used to split our WAN traffic and send it to two NICs (eth0 and eth1) apllying iptables: $IPTABLES -A OUTPUT -s $PRI -p tcp -m tcp -j MARK --set-mark 0x02 -t mangle $IPTABLES -A ...
1
vote
2answers
28 views

Iptables: Filtering string encrypted by ssl

I need to filter (send to BANRULES set) incoming http/https packets with a certain string (matchword). I do it easy when ssl is not in use (port 80): iptables -A INPUT -p tcp -m tcp --dport 80 -m ...
1
vote
1answer
50 views

When iptables is started, there is no ftp access because of timeout

When I start the iptables service, there is no ftp access because of a connection timeout. When I stop the iptables service, ftp works fine. This is the current iptables data: Update: replaced ...
-2
votes
2answers
42 views

How to improve IP tables for web server [closed]

this is my curreny /etc/sysconfig/iptables file for a webserver that must allow http, ftp and ssh access. *filter :INPUT ACCEPT [31395:4050333] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [30540:7083959] -A ...
0
votes
1answer
54 views

Routing between two interfaces

I have a network 10.0.0.0/24, a gateway with ip 10.0.0.1. On the gateway there are two interfaces. eth0 Link encap:Ethernet HWaddr 08:00:27:a1:24:2d inet addr:10.0.0.1 ...
0
votes
2answers
49 views

nmap port 3128 shows open but no squid running

Im trying to lock down an Ubuntu server and ran nmap -T4 against my server. Everything looks right except that it shows port 3128 open but I dont run a squid server or anything else I know of on that ...
1
vote
0answers
27 views

Configuring IPTables to exclude webhost from VPN tunnel [migrated]

I have a Raspberry Pi running as a server for my webhost. Raspberry pi is connected to a VPN service 24/7. Due to this, I am unable to connect to my webhost using my public IP address issued by my ...
4
votes
3answers
65 views

Block traffic behind AWS ELB

My web servers are behind ELB, I want to block traffic from some specific user agent which is a DDOS attack. Apache always see ip address of ELB as an end user so I tried below attempts: Blocking IP ...
0
votes
2answers
70 views

RHEL 6 Having issues forwarding port 80 to port 8080

I am trying to set up a JBoss app server on an RHEL build. Jboss is bound to 127.0.0.1:8080, and I am trying to setup iptables to redirect all traffic from port 80 to port 8080. This is my config ...
3
votes
1answer
28 views

How can I run a shell script on a snort alert?

I have snort listening to the SPAN port of a cisco switch. I'd like to be able to add an iptables DROP rule on my webserver for specific snort alerts but having a hard time finding out exactly how to ...
1
vote
1answer
65 views

Redirect all traffic from multiple interfaces to single IP

I would like to redirect all traffic (specifically TCP & UDP) from multiple WAN interfaces (ppp0, ppp1, ppp2) to a single IP from eth0. When it comes to interface to IP, I can use the PREROUTING ...
-1
votes
0answers
22 views

Slackware internet gateway with iptables / poor browsing performance [migrated]

I am running a dual core headless computer as internet gateway via pppoe with two NICs. eth1 (internet interface) no ip, no dhcp eth0 (LAN interface) - 192.168.0.100 static ppp0 - dynamic ip ...
0
votes
0answers
21 views

Asterisk Firewall access Rules

I have a questions regarding the firewall rules for Asterisk VoIP server. I have a restricted access to UDP/TCP port 5060, which seems to be blocking calls. I want to make sure that my VoIP Server ...
1
vote
2answers
14 views

Use iptables to log connections except for two addresses

We would like to use iptables to log all network connections except if the connecting address is A.B.C.D or the connecting address is E.F.G.H. These two addresses cannot be combined into a single CIDR ...
0
votes
1answer
34 views

Load balancing iptables

I am trying to use iptable for load balancing. I'm working with virtualbox. All vm (debian)are in internal networking and IPs are static. I want to route requests coming to my web server(apache2) with ...
2
votes
2answers
254 views

No SNMP query responses from Ubuntu 14.04 LTS server client machine

Alright, I've got two VMs both running under ESXi. One VM is hosting Observium, which uses SNMP to grab its info. I pointed Observium at my ESXi host directly, and it worked fine, so there's no issue ...
0
votes
0answers
20 views

amazon ec2 instance going to a remote ip using openswan tunnel is up but no traffic being established on the remote ip

I having establishing a vpn tunnel to a remote peer/public ip using amazon ec2 openswan. The tunnel is up but no traffic has been seen on our side or the remote side? Is there I been missing? Please ...