iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

2
votes
0answers
34 views

OpenVPN Access Server: Remote Subnet Cannot Access Client's Resources

I have OpenVPN Access Server running. Here's the configuration: 172.18.16.0/20 Client (172.18.16.101) ----- OpenVPN Server (172.16.0.0/20) | ...
0
votes
0answers
21 views

iptable with transparent proxy, how to pass the user IP

I have a local transparent proxy, but my problem is that the packages, when re-routed, have the router IP and not the user. those are the rules that I currently have in place: iptables -t nat -A ...
0
votes
0answers
20 views

Trying to access port 3306 (only using it locally)

I am trying to open port 3306 on my archlinux distro. I've tried multiple different iptables settings, but I can't seem to get it to work. (Locally) Here's my current iptables setting: Chain INPUT ...
0
votes
0answers
26 views

Port forwaring with iptables generate 404 error on apt-get

I have a server with Proxmox OS installed and some virtual machines inside. Following a guide found on the web i modified my /etc/network/interfaces like shown below to create a virutal interface ...
0
votes
1answer
18 views

Config differents external proxy to every VM with iptables

I have a virtualization server with one IP and 5 VM. To get internet access and ssh access in every VM I do this in -------------/etc/network/interfaces------- auto vmbr2 iface vmbr2 inet static ...
-3
votes
0answers
30 views

Redirect IP to another IP [on hold]

My domain redirects to my Teamspeak 3 Server on port 9987, and it works perfectly. But now I will add a second server to block DDoS so I must redirect my domain to server #1 and server #1 must ...
-1
votes
0answers
7 views

Port forwarding within network using iptables [on hold]

I'm trying to redirect external traffic internally within my network? This is my set up: External IP- Router - Ubuntu Server (Open to all traffic -192.168.1.2) - Raspberry Pi ...
-1
votes
0answers
9 views

Can't ping Subnet A from Subnet B with router between them [migrated]

I experimented with subnetting in my home network and Raspberry Pi. The ISP Cable Modem has 4 eth-interfaces and 1 wlan interface which all seem to be switched together. The routers IP is 192.168.0.1 ...
1
vote
0answers
35 views

Ping not reaching in OpenVpn clients to subnet and vice versa

I have a vpn server which is connected to vpn client having ip 10.30.0.x now. I want it to able to ping another private client connected to vpn server. Please note that other private client is private ...
0
votes
1answer
36 views

Can't connect to Nginx from remote browser (weird issue)

I've got a really weird issue with Nginx, I can't access it from my browser. I have installed a CentOS 7 virtual machine on my computer with Nginx, PHP-FPM and MariaDB installed and configured. The ...
0
votes
1answer
96 views
+50

Randomize destination port for *every* packet with iptables

There is a program at server side listens on port 3333, and a dedicated client box which sends and receives packet to the server, I'd like to setup a set of iptables rules, make every packet ...
0
votes
2answers
27 views

Puppet: converting a custom template into config file

I took over administrative duties for an Linux environment of around 20 boxes. Trying to consolidate configuration management with Puppet. Most is straightforward, however I stumbled on the firewall ...
0
votes
0answers
18 views

General matter of stateful iptables

I made a set of stateful iptables rules which only handle accepted traffic (More or less). The workflow can be seen in the image below. My questions are: Is it a good idea to drop INVALID state or ...
0
votes
1answer
23 views

iptables allow certain ports and disable the rest

I have the following scenario: I only want to allow access to 22, 80 and 443 ports and everything else permit. My iptables -L looks like this: Chain INPUT (policy ACCEPT) target prot opt source ...
0
votes
3answers
33 views

iptables “host/network not found”

If I add this line to my iptables: -A INPUT -s /32 -i tcp -p tcp -m tcp --dport 22 -j DROP I get the error: iptables-restore v1.4.14: host/network' not found` When running: sudo iptables-restore ...
0
votes
1answer
15 views

How to ban a ip with fail2ban using fail2ban-client and actionban

I am on fail2ban 0.8.3 and I would like to ban an ip address after reloading fail2ban. I tried: fail2ban-client get myjail actionban ip after that I get an empty line in bash and fail2ban status ...
0
votes
0answers
15 views

Is there any reasons not to disallow port scans on a public server?

Port scanners like nmap or angry ip use TCP packets with flags Fin, psh, urg on. Are there any reasons not to block TCP packets with those flags on?
-3
votes
0answers
46 views

Default gateway is not reachable [migrated]

I have a vmware player on which i have installed CentOS 6.5. And on that CentOS 6.5 i have installed lxc and on that lxc i have installed centos 6.3. I am using NAT and bridger as a Network adaptor ...
0
votes
0answers
18 views

openvpn port UDP 53 connectivity issue

I need to run openvpn server on port 53. I have a bind server already running on this port. Here are my iptables rules to let my gateway decide to which service it should redirect traffic: # ...
0
votes
1answer
15 views

How can I add rule to iptables on ubuntu to enable redis on local ip but not external

I've followed the various scripts to set up 2 linode machines. Both have an external and local Ip. On one I have installed redis, and I want to connect to this machine via the local ip. Which rules ...
0
votes
0answers
17 views

Iptables config for BubbleUpnpServer

SUDDENLY my bubbleupnpserver is not able to connect on the port 58050 for http and 58051 for https. Yesterday was working, no changes on the server, puff, today no working anymore. Maybe it's ...
5
votes
2answers
120 views

CentOS 7 iptables not persistent after reboot

I installed a minimal CentOS 7 version on a development server to virtualize some linux guests with kvm/qemu. To use iptables instead of firewalld I install iptables-service and do: systemctl stop ...
0
votes
0answers
15 views

iptables hex string match rule migrate to Vyatta (BROCADE)

I have a string match, drop rule working in iptables firewall that I would like to migrate to a Vyatta firewall. Is string matching even possible in Vyatta? If so how can I replicate the following ...
2
votes
0answers
15 views

Samba server disappears from the browser list after a period of time

I have a Ubuntu server running as a router. On the server I use iptables and DHCP 3.1.3, Samba 3.4.7 and OpenVPN 2.1.0 server. I have problem with Samba server disappears from the VPN client browser ...
0
votes
0answers
17 views

iptables configuration for SSDP discovery

I'd like to configure iptables to allow SSDP discovery. SSDP works by sending a multicast UDP packet to 239.255.255.250 on port 1900, to which each UPnP supporting machine in the local network replies ...
0
votes
1answer
22 views

Block redirected port from external access using ufw

I have an application that uses ftp. I redirected the 21 port to 2221. But I see that 2221 is accessible from external even though it is not specified in ufw rules. So I want to block 2221 from ...
0
votes
2answers
27 views

How to list open but not used (by a process/program) port?

I have a VPS with debian wheezy installed on it. A firewall is active on the it with all ports not allowed by default. The firewall can be managed through the web interface of the provider of the VPS ...
0
votes
0answers
19 views

Expert iptables Nat - Virtual interface ip address issue

I've been looking information related to this problem several days, I had no luck finding a concrete explanation. Explanation about this issue: With this command I redirect one ip to another ip in ...
-3
votes
1answer
38 views

Port 22 Connection Refused After Ubuntu IPTables Tutorial [on hold]

I followed this tutorial from ubuntu on iptables. My commands are as follows: sudo iptables -A INPUT -p tcp --dport ssh -j ACCEPT sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT sudo iptables -A ...
0
votes
0answers
19 views

Loading iptables rules from /etc/init.d/

I decided to load my iptables rules from /etc/init.d/ on my Ubuntu 15 server. Is this good practice? Here is the script I have: #!/bin/sh iptables-restore < /etc/iptables.rules exit 0 By the ...
-1
votes
2answers
44 views

“Software caused connection abort” after removing rule in iptables

I use Putty to connect to a Linux Red Hat machine on an AWS instance. My local computer is Windows 8. On the iptables I had to make a change and accidentally forgot to put back this default rule: -A ...
-1
votes
1answer
46 views

Route torrent traffic through VPN interface [closed]

I'm trying to set up my own seedbox with rTorrent and I would like to redirect all torrent traffic through my VPN. I know there is a bunch of QA and HOWTOs on this subject. I've read a lot and came ...
0
votes
3answers
51 views

iptables ip address block ignored?

Running top on our server gives us load average: 68.67, 63.48, 60.30 We suspect this is from too many httpd connections. running: netstat -tun 2>/dev/null | awk '{print $5}' | cut -d: -f1 ...
0
votes
1answer
26 views

How to only allow access to a given IP and port on a nat forwarding rule?

I'm using Rancher to manage a set of Docker containers. I'm trying to secure these containers with iptables, and have got as far as completely blocking all access to it and now have been unable to ...
0
votes
0answers
20 views

amazon server using RedHat EL 7 on port 3306 so that i can access mysql database remotely

I want to remotely access mysqld on port 3306 but when hen i telnet from public ip address i get a connection time out error. Whats happening here. But within the server telnet is working just fine ...
0
votes
2answers
43 views

server1 & server2.. because w/same firm.. ssh connection shows private ip.. how to enforce public ip being using during ssh's?

server1 has a private and public ip. server2 has a private and public ip. generally.. if server1 to ssh to server2 .. server2 would recognize server1 by it's public ip. but because both servers are ...
1
vote
1answer
36 views

forwarding from internal to external network does not work

I have a Ubuntu 14.04 LTS server with two NICs. One is connected to the internal network (eth0, 192.168.4.0/24) and the other one is connected to a router with internet access (eth1, network ...
0
votes
1answer
24 views

iptables drop hex-string tcp synack

I'm not sure can drop packet syn ack flood with hex string match, can someone help me and give me clue how to do this? 17:03:10.274551 IP (tos 0x0, ttl 89, id 6656, offset 0, flags [DF], proto TCP ...
0
votes
1answer
44 views

Blocking ddos string with iptables [duplicate]

I want to ask how do block spefic packet payload? 14:46:35.837759 IP 145.92.16.14.27017 > x.27030: UDP, length 25 0x0000: 4500 0035 44a4 0000 ee11 53ae 915c 100e E..5D.....S..\.. ...
0
votes
0answers
12 views

Cisco Anyconnect + iptables - force all traffic over VPN (and drop all traffic when no VPN connection)

I'm trying to force all traffic over a VPN, and drop every other traffic, just like it was asked and done in this question: iptables - force all traffic over VPN (and drop all traffic when no VPN ...
1
vote
3answers
65 views

10,000 entries in iptables on CentOS 4GB Ran, dual core 2.3ghz?

I am running a linux box with FreePBX/Astrisk installed. I have blocked China and Hong Kong using lists from ip2location. com/blockvisitorsbycountry.aspx website. My fail2ban was going off like ...
0
votes
1answer
27 views

iptables-save syntax

My goal is to automate my iptables config, so while analyzing my current iptables rules setup on my local box for reference I get the following when using iptables-save > ./iptables.save; cat ...
0
votes
1answer
23 views

Limit User Linux Login using IPTABLES

Is posible to limit user login using iptables? It's like if one user is logged in, no one else can log in using that user. I try this command: iptables -A INPUT -p tcp --syn --dport 22 -m ...
0
votes
1answer
16 views

iptables jump targets - which terminate and which return?

Where can I find documentation on which iptables jump targets terminate processing and which implicitly return. For example "-j MARK" returns, but "-j DNAT" does not. I can not find this documented ...
1
vote
1answer
31 views

iptables optimization - state NEW?

I have a set of rules that implement VIP behavior - all in the nat table. Obviously I want to do as little processing as possible to packets. It's not clear to me whether "-m state --state NEW" is ...
0
votes
0answers
22 views

iptables -j MARK in the nat tables

I accidentally (didn't read docs enough) set a '-j MARK' rule in the nat table and it seems to work. All the docs say it only works in the mangle table. Is this something that is supposed to work or ...
2
votes
0answers
38 views

Understanding packets dropped by iptables from puppetmaster

I am seeing packets getting dropped during my puppet client runs on a semi regular basis. And I do not understand what is causing this. I should mention that Puppet is managing the firewall rules ...
1
vote
2answers
31 views

Forwarding a ssh connection from one port to another

I have a box B (say on 1.2.3.4) which I can only ssh to from another box A. But a certain development tool on 192.168.0.1 only allows me to specify the host and port of a ssh server and not anything ...
1
vote
0answers
14 views

iptables rule limiting the number of connection in a broken pipe case

I am limiting the number of SSH connections using iptables but in case of, for example, a broken pipe (computer goes sleep mode, network problem, etc.) I am no longer able to reconnect. The rule I ...
0
votes
1answer
16 views

Using a VPS as an OpenVPN client

I am trying to tunnel the traffic coming from a VPS through a VPN but it doesn't seem to be working. The current .ovpn file that I am using seems to work just fine on my local machine, but when I ...