Tagged Questions

iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

0
votes
1answer
6 views

IPTables: Allow outgoing MySQL connections but not incoming connections

I have a server which doesn't allow connections to mysql from external sources - all of my databases and connections take place on localhost. The default policy of iptables is to drop connections for ...
0
votes
0answers
4 views

linux: how to troubleshoot forwarded port? [migrated]

My home internet connection has a static IP address (eg: 123.123.123.123) I have configured my router to forward port 9000 to an internal host (192.168.1.101). That host is running Ubuntu 14-04. ...
0
votes
2answers
38 views

Add a VLAN tag to specific UDP port traffic

I'm running an application in Ubuntu12.04 that I've written that does some remote switch management. I have only a single NIC connected to the network of managed switches, eth0 which is set with IPv4 ...
-2
votes
1answer
34 views

How to open port with iptables

I wanted to open port in centos and after executing openning port commands, the iptables caontents is like below: # Generated by iptables-save v1.3.5 on Thu Nov 20 17:09:28 2014 *filter :INPUT ...
-1
votes
1answer
27 views

IPTables Limit port speed

I want to limit a port's speed down to 5 kb/s per client connected (trying to share out the limited connection without smashing the network) I Have done research, mostly I find rules which drop ...
0
votes
1answer
33 views

iptables: service per physical interface

I have a vm on which I'm trying to configure (unsuccessfully) one service per physical device - i.e. ssh open only on eth0, http only on eth1 and ftp only on eth2. This has to happen regardless on the ...
-3
votes
0answers
22 views

Map remote host to local ip (linux) [on hold]

How can I map remote host to local ip? For example: If I map google.com to ip 192.168.1.15 so when i ping 192.168.1.15 i get forwarded response from google.com Maybe Iptables or something?
0
votes
0answers
5 views

xen routed setup, no internet connectivity in domU

My server has 4 public ips, but I have 5 vms running, the vm which doesn't have an own public ip should be able to reach the internet and all other vms over private interfaces. I configured a private ...
0
votes
2answers
30 views

How to redirect a packet with iptables that match a certain pattern? (eg a QUERY command with UDP)

I have a certain packet that I want at all times to be redirected to a specific ip on my virtual network interface. As for now my iptables is setup like this: (the commands, I use \ as for now to ...
-1
votes
0answers
9 views

How to use iptables and ebtables to limit qemu access to a set of IPs? [on hold]

I want to limit the access of a VM (backed by QEMU) to a few IP address. The VM has a private IP received from dnsmasq. The guest is connected to outside through a bridge. To limit the access, I need ...
0
votes
0answers
13 views

Connections from virtual host to internet OK, but to rest of LAN, broken [migrated]

In a notebook running Ubuntu 14.04 I have installed VirtualBox and created a virtual server with Windows 7. The PC is connected to a 192.168.x.y LAN. The virtual server is in a host-only network with ...
0
votes
0answers
11 views

Fail2Ban Correctly Attempts to Ban IP but IP does not get banned - iptables chain exists but not working

Running on Ubuntu 14.04 Server. So I have fail2ban correctly configured to process /var/log/auth.log for SSH login attempts. Upon 3 failed attempts I see this in the fail2ban log: 2014-11-19 ...
1
vote
2answers
36 views

Make CentOS 7.x a port forwarding NAT device

I would like to make CentOS a port forwarding NAT machine using iptables. This is the first time I've tried this and I think i might need a little help. This is the configuration i'm trying to ...
2
votes
1answer
23 views

Traffic shaping outbound clients source ip with tc / iptables

My question is I am trying to limit a users bandwidth on a server and wondering the best way to do this. Before I dive to far into the tc/iptables I was wondering if I could get any advice on this ...
0
votes
0answers
17 views

iptables on AWS - how to get traffic mirroring to work?

Has anyone successfully deployed 'iptables -t mangle -j TEE...' for monitoring traffic on AWS instances? If so, how? My objective is for client<->server traffic between external customers and EC2 ...
0
votes
0answers
46 views

Forwarding traffic from one ethernet interface to another

Earlier, I was trying to get traffic from one ethernet interface to another without using a bridge. Here is a link to the solution : ...
0
votes
2answers
40 views

CentOS, How to allow SSH through only one server-ip [closed]

I currently have a dedicated server with two pv4 IP addresses assigned to it. I want to make one public, and the other private for SSH/FTP related material. IP 1 (The public ip): 192.23.6.11 IP 2 ...
-1
votes
1answer
39 views

How to drop first udp packet from a source with iptables?

As a defense against distributed udp flood, I need to drop first udp packet from a source and accept other than first packet. Does iptables has capability of doing this? If yes, how?
-1
votes
0answers
16 views

Linux router under VMware can't contact physical gateway server intermittently

We're a site with upwards of 800 concurrent users with most services hosted on the Internet and a BYO service to facilitate access to these. Situation is some days - not everyday - we're seeing our ...
1
vote
1answer
21 views

Are iptables prerouting (DNAT) packet changes visible to subsequent chains?

I was reading Rusty Russell's NAT Howto when I came across this section: 6.2. Destination NAT This is done in the PREROUTING chain, just as the packet comes in; this means that anything else on ...
0
votes
0answers
23 views

Error with IPTables command

I'm trying to run the following command iptables -A INPUT -i eth0 -j LOG --log-prefix "IPTables " And I get the following error: iptables: No chain/target/match by that name. I'm running Fedora 20 ...
1
vote
1answer
61 views

My iptable rules do not allow VPN connections

I have installed OpenVPN on my Archlinux server and modified my iptable rules to allow incoming traffic on port 1194 and forward it to the tun0 interface. When I disable/stop the iptables, the OpenVPN ...
0
votes
1answer
34 views

iptables setting output default to DROP

I have two servers: one web, one database. The db server is on a private network. I thought I needed to restrict the default OUTPUT on the web server to DROP and created OUTPUT rules to to ACCEPT ...
0
votes
0answers
24 views

IpTables -j REJECT to instantly block the loading on user browser

I have been searching for a solution to notify the browser on user that the request is Rejected so stop loading it. Because I have blocked facebook and every page that have a facebook plugin is ...
0
votes
0answers
25 views

General protection fault by __d_drop following SMTP attack

The SMTP port (Postfix) of my box running 3.16.5 is being hammered. The log repeats this over and over: Nov 14 09:16:25 [postfix/smtpd] lost connection after UNKNOWN from unknown[177.43.41.74] Nov 14 ...
1
vote
1answer
68 views

AWS EC2 Ubuntu 14.04 Instance smtp port forwarding from 25 to 2025

I am trying to step up port forwarding from port 25 to port 2025 on the same AWS EC2 Ubuntu 14.04 instance using iptables. I am using port 2025 to receive income emails using Alfresco. The first step ...
0
votes
1answer
22 views

APF Limit to Deny IPs?

So, I've been actively banning IPs of malicious users. Previously, I only used IPtables to do this, but since giving APF a whirl, I've been having issues. It appears that there is a limit to the ...
0
votes
0answers
30 views

Iptables - double REDIRECTING - is it possible?

I have 2 kinds of proxies in my local machine : stunnel and TOR-VPN. stunnel is listening on port 6666 TOR-VPN is listening on port 9040 The IP of stunnel server is a.b.c.d. I want to get web ...
2
votes
0answers
29 views

How to route traffic through different interfaces based on the port number?

iptables -A PREROUTING -i usb0 -t mangle -p tcp --dport 8080 -j MARK --set-mark 1 iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination Chain ...
-2
votes
0answers
9 views

Cannot SSH on machine behind NAT. DD-WRT router [migrated]

I'm trying to remote access my home Debian from my other office. The home Debian is behind a DD-WRT router, connected from a ADSL modem (Yeh, it's dynamic IP but I have someone to tell me the WAN ...
0
votes
1answer
20 views

Local transparent proxy with squid and dansguardian

I am having trouble setting up a local web cache and filtering system using squid and dansguardian. It works perfectly when the browser is configured to use the proxy box's ip (192.168.1.2) but I ...
-1
votes
0answers
51 views

Iptables - REDIRECTING - transparent proxy - TOR VPN [closed]

these below rules are used to use TOR as VPN: iptables -t nat -A OUTPUT -p tcp -m owner --uid-owner bob -m tcp -j REDIRECT --to-ports 9040 iptables -t nat -A OUTPUT -p udp -m owner --uid-owner bob -m ...
0
votes
0answers
23 views

Iptables - centos 5.8 - how to forward ports to internal lan

I'm trying to map port 8080 to another machine running a web server. ppp0 = ADSL internet connection eth0 = ethernet card of linux machine (ip address: 192.168.0.2) 192.168.0.105 = other machine ...
0
votes
0answers
29 views

Missing iptables rules for Strongswan routing for VPN for phone

I have a Centos 6.6 VPS out on the Internet that has a public IP. I have installed StrongSwan 5.1.3 to allow my BlackBerry10 phone to connect from hotspots and use the VPS' connection. The VPS' IP ...
2
votes
0answers
21 views

How to monitor the bandwidth per each iptables masqueraded device [closed]

Question: Which tool could I use to monitor and break-down in real-time which bandwidth is routed by iptables to which computers? Context: I have a linux box masquerading about 15 devices to ...
0
votes
1answer
33 views

Temporarily block communication with host if its connecting to port X

I have a Linux VPS, and it's constantly being scanned, bruteforced by some rogue IPs. This VPS is my private server, that serves only to me, and I'm the only user of it. Also I am the only user who ...
0
votes
0answers
48 views

OpenVPN Port forwarding on a OpenVZ VPS

I've been trying for the past 3 hours to forward the 443 port from my client to the 20443 port on my server (CentOS 7 on OpenVZ), so i can access it on myserverip:20443. I have OpenVPN Access ...
1
vote
1answer
29 views

Conntrack shows no result

I tried the command conntrack -L and it returns nothing when I have a ping www.google.com running. I also tried to load the module by modprobe nf_conntrack. But it still always returns conntrack ...
0
votes
0answers
15 views

ndpi iptables not working

I have a linux centOS 5 system. kernel 2.6.39 with iptables 1.4.12. xtable library is also availabe in my system. I have successfully compiled ndpi-netfilter-master with libndpi-1.5.1 modprobe xt_ndpi ...
0
votes
0answers
29 views

DD-WRT/OpenVPN Tunnel Between Two Routers - Block Non-VPN Traffic on vlan1

I have two DD-WRT routers with OpenVPN that I am trying to make a secured tunnel between them. I need them to drop everything that is not going to tap0 on the WAN ports(both of which are set to ...
0
votes
0answers
9 views

iptables NAT can't initialise on Debian openvz [duplicate]

So i want to create a nat rule for an openVPN server. After getting trouble with the TAP/TUN Devices, it's finally working i think It's working greate but not routed so useless. Now i have to make a ...
0
votes
1answer
25 views

How do I use iptables to do port forwarding from one to another port on the same host? [closed]

How do I use iptables to forward all requests to a port (say 1443) to another port on the same host (say 443)? This should also be done for requests from another computer.
0
votes
0answers
20 views

Networking issue (CentOS) - 2x Bridged networks

I've got an issue with a bridged network on CentOS machines. Basically, the setup at present: 2x Firewalls 2x internal networks (10.0.1.0/24 - Private, 10.0.10.0/24 - DMZ) 4x Virtual Hosts host1 ...
0
votes
0answers
15 views

iptables - matching on CLASSIFY class or LOG a specific class

I have a series of CLASSIFY rules in the mangle table where a packet CLASSFYed may be reCLASSIFYed further down the POSTROUTING chain (i.e. match more than one rule). At the end of the chain I would ...
0
votes
1answer
12 views

Ubuntu UFW setup on database server for connections to a varying array of clustered applications

I'm a little confused and could use some clarification. Let's say I want to deny all connections to a mongodb server, except for to SSH from my IP and from my IP to port 27017. The way I understand ...
0
votes
2answers
36 views

How to forward traffic to different nics based on source?

I'm a newbie to IPtables, but am looking to do send traffic to a specific card based on the source. Here's what I would like: eth0 - all traffic comes in on this NIC Depending on the source IP, I ...
-1
votes
1answer
43 views

Very weird port forward on Ubuntu

I have a droplet running Ubuntu 13 on Digital Ocean. On it I have a node server running on port 5000. From the outside I can access that server on port 80, but I don't know what's forwarding the ...
-1
votes
0answers
10 views

Direct each user's traffic out of a particular IP address - Ubuntu [duplicate]

I am setting up a multi-user Linux workstation to act as a terminal server. Users connect via Xming (x11 forwarding). Is it possible to map each user's traffic to a unique IP address. I could do it ...
1
vote
1answer
18 views

Forward traffic to port 80 on WHM via iptables

I'm working on a VPS (DV) that's hosted on Media Temple. I need to forward traffic from port 8774 to 80. I logged in as root, ran iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 8774 -j ...
0
votes
2answers
39 views

Iptables with dynamic ip list

We have 5 servers in EU datacenter and 5 servers in US datacenter. All servers have some Redis instances installed and Redis port is opened for IP adresses from list (via iptables). All Redis's ...