iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

0
votes
2answers
14 views

VSFTPd 2.3.5 through iptables on Debian 7.6

Configured and running vsftpd 2.3.5 on Debian 7.6 behind IPtables and fail2ban with ssl_enabled I can't upload files properly because after a few I receive the following errors: Timeout or OOPS: ...
-1
votes
0answers
10 views

Fwsnort without string match support

How to use fwsnort on Ubuntu 12.04 ? http://www.cipherdyne.org/fwsnort/ Is that possible to use it somehow without string match support. Xtables possibly can help but I don't know how to use it. ...
1
vote
1answer
26 views

How to forward a port to multiple internal ips

I have a Centos 6 64 bit server with OpenVPN installed. I'm using this iptables rule to forward a port for an OpenVPN user: iptables -t nat -A PREROUTING -p tcp -m tcp --dport PORT -j DNAT ...
0
votes
0answers
30 views

IP TABLES port forwaring corrupts my packets?

Here's my scenario. I have a WORKING DAEMON receiving packets through a proprietary protocol (mounted on the port 5000) that has been working flawlessly for over a decade. I have a weird problem ...
2
votes
1answer
49 views

Iptables and conditional statements. Is it possible?

I tried a search but i was unsuccessful, in the case i'm sorry and i will appreciate the redirect. I had this problem in mind: a computer with mac address M is sending packets through an openwrt ...
3
votes
2answers
100 views

How to enable traceroute in linux machine

I'm working on something in the transport layer and after i ran our custom policies for securing the policies i'm not able to do traceroute from the linux machine. root@keystone-evm:~# iptables ...
0
votes
1answer
30 views

Sometimes this script fails to update the iptables

It does not happen often, but sometimes after running the below script, checking the iptables with service iptables status shows that they weren't updated and the script doesn't output any error. The ...
0
votes
0answers
18 views

Conflicting ip routes with local table on attaching a virtual network interface

I have an EC2 instance with these ip rules: $ sudo ip rule show 0: from all lookup local 32766: from all lookup main 32767: from all lookup default I can attach an elastic network interface to ...
0
votes
2answers
30 views

Open Specific Linux Port

Im trying to open a Port(2012) on my VPS so i can access it over the internet. This is the output of sudo iptables -L produces Chain INPUT (policy ACCEPT) target prot opt source ...
0
votes
0answers
17 views

iptables: Packet not being matched by neither INPUT nor FORWARD

How can it be, that a packet that gets matched by a mangle PREROUTING does not get matched by neither filter INPUT nor filter FORWARD? From this diagram ...
1
vote
1answer
27 views

Linux iptables - reject tcp SYN with RST

I am doing an implementation on a linux machine to reject incoming telnet requests from wan side telnet port 8023. The functionality is achieved by using the below iptables rules. The first rule in ...
0
votes
1answer
34 views

iptable CLUSTERIP doesn't work

We have some requirements which explained here. We tried to satisfy them without any success as described. Here is the brief information: Here are requirements: High Availability Load Balancing ...
-1
votes
0answers
11 views

Can I restart iptables w/o flushing user-defined chain rules?

I want to keep iptables rules under user-defined chains when I restart iptables using service iptables restart. Is it possible? For example, when I start openvpn, it calls a script that adds rules to ...
-4
votes
1answer
29 views

Because when I open ports with iptables appear closed

I opened the following ports with iptables on Debian 7: iptables -X iptables -F iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT ACCEPT iptables -A INPUT -m state --state ...
0
votes
1answer
18 views

Iptables and counters

I'm trying to use iptables counters with munin to monitor traffic of hosts on my local subnet. For each host I set up a rule like this: iptables -I OUTPUT -d $ip This should count the packets going ...
0
votes
0answers
25 views

is iptables-save rule dump deterministic?

is the order of the parameters of iptables rule line deterministic in the iptables-save output? -A CHAIN1 -m mod1 -m mod2 -j CHAIN2 will be always the same, or I can expect it to be -A CHAIN1 -m mod2 ...
2
votes
1answer
70 views

What is the correct iptables rule when NATing multiple private subnets?

I have a Centos minimal 6.5 acting as a router. eth0 is connected to a Cisco switch trunk port, allowing VLANs 200-213. I have several VLAN interfaces just as this link suggests: ...
0
votes
0answers
10 views

BROUTING's target “redirect” in ebtables behaving in a strange way

Situation (host A)-------(bridge B)------(host C) where: A has MAC A on it's interface C has MAC C on it's interface B has MAC BA and MAC BC on it's two interfaces (depending on who it's facing) ...
0
votes
1answer
19 views

iptables and TPROXY support

I'm running iptables v1.4.21 on Ubuntu 14.04 and is trying to setup iptables to use TPROXY. How can I check whether my current build of iptables supports TPROXY? I can check TPROXY support for ...
0
votes
0answers
57 views

TPROXY Not working with HAProxy, Ubuntu 14.04

I'm trying to use HAProxy as a fully transparent proxy using TPROXY in Ubuntu 14.04. HAProxy will be setup on the first server with eth0 111.111.250.250 and eth1 10.111.128.134. The single balanced ...
0
votes
1answer
21 views

fail2ban block ports rules iptable

I just installed Ubuntu Server 14.04 and don't have much experience with IPtables. I am trying to get a basic setup going where I only accept SSH connections on port 22 and 2222. I actually have that ...
0
votes
1answer
25 views

Using 2 Transparent HAProxy for load balancing

We can configure HAProxy to be a transparent proxy by using the guide here, where one of the steps says ...to put the backend servers in a different subnet to the front end clients and make sure that ...
1
vote
0answers
17 views

Policy routing local user's traffic down a tunnel

I've got a Linux based Firewall/Router running iptables and SNAT for traffic passing through it to the Internet via a single uplink - This is working fine. There is also a small number of applications ...
1
vote
1answer
23 views

Need help translating rate limiting iptables rules to Puppet format

I use Puppet Iptables module to manage Iptables rules on my machine. I'd like to implement to rate limit failed SSH connections as described here: iptables -A INPUT -p tcp --dport 22 -m recent ...
0
votes
1answer
24 views

How can I reload IPTables without interrupting existing connections?

I will be adding and removing entries to the script below automatically (adding ports 80/443 with different IP addresses). If I run this script, I am "assuming" that connections will be uninterrupted, ...
0
votes
1answer
26 views

Ubuntu 14.04 UWF for iptables

Can I still use the init.d iptables stop? It seems that init.d is replaced by systemd. Is that correct? The iptables is part of the kernel right and not a service. On redhat based systems it is a ...
-1
votes
2answers
30 views

Allow connection only from 2 ips [closed]

I need to block all connection on port 30000. I alredy did that , with command like that iptables -I INPUT ! -s IP_HERE -p tcp --dport 30001 -j DROP but now i need 2 ips , how i could do that? ...
0
votes
0answers
15 views

rkhunter reports suspicious activity /bin/usr/wget and killall permissions changed

Sorry about the long post but please bear with me. I'm wondering if my system has been compromised. I've had issues in the past on this VM server with a Linux.BackDoor.Gates.5 Trojan that was DDoSing ...
1
vote
2answers
56 views

How to setup IPTables on KVM host - iptables-persistent is being ignored

I'm trying to setup some specific IPTables rules on an ubuntu 14.04.1 host that runs some KVM guests. The box has multiple NICs with multiple IP addresses and the guests use different addresses based ...
0
votes
0answers
20 views

Iptables and PREROUTING-Chain. Checking only the first (SYN-) packet of a connection?

Assume for simplicity that there is only this one rule described below. Is it possible that the PREROUTING Chain of ip-tables checks only the first packet of connection A and then allows all ...
2
votes
2answers
65 views

Iptables management with ansible in huge environment

What is the best way to manage iptables from one point and have the ability to edit something on local server. We need to add some rules centralized on all servers, but we have specific servers with ...
0
votes
1answer
34 views

iptables DROP statement causing issues

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -p tcp --dport ssh -j ACCEPT iptables -A INPUT -p tcp --dport 80 -j ACCEPT iptables -A INPUT -j DROP I have the ...
1
vote
1answer
25 views

Unknown arg `--hashlimit-upto'

I'm trying to prevent loic attackes by using this command iptables -A INPUT -p tcp --dport 80 -m hashlimit --hashlimit-upto 50/min \ --hashlimit-burst 500 --hashlimit-mode srcip --hashlimit-name http ...
-2
votes
1answer
29 views

Multiport negation in iptables

Consider I want to make a rule that if destination port of the incomming packet is any of the ports 80,120,130 for established or related states the system should drop it but other ports should be ...
-1
votes
1answer
13 views

How to redirect ip to address iptables

I would like to know if is there a way to redirect the internal ip to another ip, but the second ip is Dynamically so i need to put an address, is there a way? Example: iptables -t nat -I OUTPUT ...
-1
votes
1answer
17 views

command not foundbles-config error on service firewall restart

This is a follow-up question after I fixed my initial problems: I have a CENTOS Linux VPS. I have the following in my IPTABLES script to run when my VPN restarts, but I get errors when I do a service ...
1
vote
1answer
32 views

IPTABLES command that end with ACCEPT or DROP fail on service firewall restart

I have a CENTOS Linux VPS. I have the following in my IPTABLES script to run when my VPN restarts, but I get errors when I do a service firewall restart I've ran each of the commands below manually ...
1
vote
0answers
16 views

xtable geoip filter unable to load into memroy

Ok, I have a odd problem. I just got done doing the bas configuring of my server. Adding in fail2ban, postfix, apache, mysql, ect ect. I then went in and started to add the xtable addons. I ...
0
votes
0answers
17 views

puppetlabs/firewall nat policy issue

I'm using puppetlabs/firewall. I need to create following iptable rules: iptables -A PREROUTING -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 8443 My manifests is firewall { '001 default ...
0
votes
1answer
42 views

OpenVPN with no internet access

I am using OpenVPN and am able to connect, but with no internet access anymore. Here is my ip table: sshadmin@mdpi1:/etc/openvpn/easy-rsa/keys$ netstat -nr Kernel IP routing table Destination ...
3
votes
2answers
558 views

iptables -F locks me out of the server until reboot, why?

I'm trying to apply some iptables rules and iptables -F is supposed to remove the current rules (from my understanding), but instead it appears to freeze my SSH connection and not let me re-establish ...
-2
votes
1answer
32 views

Iptables “if not” condition?

I am trying to create a rule for iptables which logically does the following: IF [destination != 192.168.0.1] forward port 80 requests to port 3128 else carry on like this never ...
0
votes
1answer
26 views

will renaming iptables mean I have no firewall after a reboot?

I'm having some issues accessing my VPS due to a combination of things. Serial console via my VPS control panel isn't accepting input either so my VPS host has offered to mount my file system on the ...
0
votes
1answer
23 views

Drop packets after NAT in iptables

I'm trying to rate limit traffic to a certain client behind the NAT (using hashlimit combined with DROP target) using iptables rule but due to my rudimentary knowledge of this area, I'm not sure which ...
-1
votes
1answer
38 views

Why does this IPTables command create 4 entries?

When I executed this IPTables command: iptables -A INPUT -p tcp -m tcp --dport 9080 -s localhost -d localhost -j ACCEPT iptables -L shows: ACCEPT tcp -- localhost localhost ...
-1
votes
0answers
36 views

iptables service won't start error line 1 fail - centOS 6.5

I can't seem to get my iptables to setup quite right. It seems to keep erroring out at line 1 on the service start. service iptables start iptables: Applying firewall rules: iptables-restore: line 1 ...
0
votes
0answers
49 views

nginx images, css not loading from outside LAN

On my LAN, all the websites hosted on the nginx machine load fine. When outside of the LAN, they usually don't load at all, and if they do it takes several clicks of the refresh button and several ...
0
votes
0answers
23 views

Site to Site VPN - Openswan and CISCO A2A

Below is the diagram that the VPN connection between Openswan server and CISCO A2A. http://i.stack.imgur.com/yQBSw.jpg client A and B are remote hosts with static ips. client X and Y are behind the ...
0
votes
1answer
71 views

lots of UDP_IN Blocked errors

Since I have reinstalled my OS, I'm getting lots of UDP_IN Blocked errors in my messages log. Can anyone kindly explain what the error say exactly and what I can do to get rid of this error. Aug 8 ...
0
votes
2answers
46 views

How to block a VM from accessing other machines on network - XenServer

This might be a little far fetched and might not be possible. I have a virtual machine that will have files on that I don't want people to be able to transfer off - they are allowed access, I just ...