iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n
0
votes
1answer
15 views
iptables rule to allow Nimsoft connection over internal interface
The company I host with (Softlayer) requires me to open up port ranges 48000 to 48020 for their monitoring service.
From ifconfig, these are my interfaces:
eth0 Link encap:Ethernet HWaddr ...
0
votes
1answer
25 views
Private ip iptables rule
I am using Windows Azure where they allocate a private IP for you like 10.3.2.1. If I have another machine at 10.3.2.2, how can I open up the first machine(say port 3306) to let the second machine to ...
0
votes
0answers
11 views
how to add socks5 to TCP traffic of a specific port on linux [duplicate]
We need to route all the traffic of the port 1070 through a socks5 (8.8.1.1:10880). So far I've tried something like
iptables -t nat -A PREROUTING -p tcp -m state --state ESTABLISHED,RELATED,NEW -d ...
0
votes
3answers
41 views
iptables drop or reject unless going through proxy
I've found hundreds of examples so far that describe how to set up iptables to transparently redirect traffic to a proxy server, a la:
sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT ...
0
votes
1answer
23 views
How to route the traffic from a specific port through a socks 5 server?
I'm running oracle sql on port 1521. However I can connect on it from a remote server only through a socks5 proxy(due firewall restriction). The client that I use to connect to the sql server doesn't ...
0
votes
1answer
64 views
Forwarded packets don't include their original IP address [closed]
I have a dedicated machine which has 2 VMs running.
Host A (Router):
eth0 192.0.2.8
eth1 10.0.0.1
and I have
Host B(Application Server)
eth0 10.0.0.2
My IPTables config is:
modprobe iptable_nat
...
1
vote
1answer
43 views
Can you configure SNAT with multiple source IP's and use static DNAT (port forwarding)?
We have a private LAN connected to a firewall with multiple public IP's to use for SNAT in order not to overload the ports on a single IP. However, we have a requirement to allow certain workstations ...
1
vote
0answers
45 views
Blocking torrents on PPTP/OpenVPN/IPSec [duplicate]
I run a VPN network and because of DMCA complaints in the USA I have to block torrent traffic.
I have tried the following:
iptables -t filter -A FORWARD -m string --string "BitTorrent protocol" ...
0
votes
1answer
27 views
Filtering input with iptables: -i <interface> versus -d <ip>
I'm changing my iptables setup to cope with the addition of a new uplink, which now receives its configuration through DHCP. I currently list my interface's IP addresses directly in my rules, which ...
-4
votes
1answer
27 views
Open Port 123 to change Server time [duplicate]
How can I actually open port 123 on my CentOS server, so I can synchronise my server with another server's time?
I couldn't be able to open 123 port using google guides.
0
votes
1answer
32 views
Why can't we contact a specific address range from inside our LAN?
We can't connect to a specific external server from inside our LAN.
However we can connect to the same server from outside our LAN, at home, or using a mobile phone. It was working just fine for ...
2
votes
2answers
61 views
Reduce firewall rules by half - one iptables rule for tcp and udp
I have a number of iptables rules on my firewall that look like this:
iptables -A zone_lan_forward -p tcp -d 1.2.3.0/24 -j ACCEPT
iptables -A zone_lan_forward -p udp -d 1.2.3.0/24 -j ACCEPT
Is ...
2
votes
4answers
174 views
Making iptables easier to maintain
My network is completely locked down except for a few sites which are whitelisted. This is all done through iptables, which looks something like this:
# Allow traffic to google.com
iptables -A ...
0
votes
3answers
37 views
Centos iptables open port 53
I am having problem opening port 53 on my centos machine, for DNS configuration.
Here is my iptables config
-A INPUT -p udp -m udp --sport 53 -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
...
0
votes
0answers
19 views
Setting up a local transparent proxy [closed]
I set up a local transparent proxy to see what my own linux box was generating over HTTP, although I needed to run the proxy as root, otherwise the proxy itself couldn't get out.
# allow proxy ...
0
votes
1answer
39 views
what is the --kerneltz in iptables command
I am using iptables for my project but facing some problem as follow.
1.in iptables 1.4.7
iptables -A INPUT -s 10.0.4.247 -m time --datestart 2013-5-16T12 --datestop 2013-5-16T16 -j DROP
or
...
0
votes
1answer
37 views
iptables with DNAT and multiple gateways: How to route replies to correct gateway?
I have a problem setting up iptables rules and routes on a Linux client for a scenario with DNAT and multiple gateways:
We have two gateways to the Internet. The first has a fixed IP, the second ...
0
votes
0answers
31 views
Apache server reached MaxClients setting
I'm using Apache/2.2.15 (Unix) in CentOS release 6.3 (Final) 2.6.32-279.1.1.el6.x86_64.
I have some HTTP requests from specific referer with diferrent ip adresses and i want to block these requests ...
-2
votes
0answers
31 views
How to solve 3 way handshake [closed]
18:19:21.543368 IP (tos 0x0, ttl 117, id 766, offset 0, flags [DF],
proto: TCP (6), length: 48) 103.84.236.14.27937 > 198.27.85.103.6010:
S, cksum 0xb8c2 (correct), 1102345511:1102345511(0) win ...
1
vote
1answer
19 views
How to block outgoing traffic of the mac address of one of the server's own NIC with ip tables?
i have a server with 5 nics connected to a switch, and running GNS3 (cisco router emulator).
I need to block, in the server, the packets originated by the nics at layer 2 level (the nics are not ...
-2
votes
0answers
41 views
I want to help turn IP iptables [closed]
hi I want to help turn IP
iptables -t nat -A PREROUTING -p tcp -d xx.xx.xx.xx --dport 80 -j DNAT --to 192.168.1.2:80
iptables -t nat -A POSTROUTING -d 192.168.1.2 -j MASQUERADE
xx.xx.xx.xx = Not ...
2
votes
2answers
46 views
iptables doesn't seem to be blocking IPs I ban
As a test, I started a TorBrowser, got its IP, and banned it via this command on my VPS:
sudo iptables -A INPUT -s <IP address> -j DROP
I'm still able to surf pages hosted by my server from ...
0
votes
2answers
40 views
iptables: filter before DNAT
iptables -t filter -A OUTPUT -d 1.2.3.4 -j DROP
iptables -t nat -A OUTPUT -p tcp -m owner --uid-owner abc -j DNAT --to 127.0.0.1:121
First rule does not work because nat it processed before filter. ...
0
votes
1answer
45 views
Unable to ping gateway from network
I got the following route table :
#!/bin/bash
IP=/sbin/ip
# SST
echo "SST: Setting up SST network ..."
$IP route flush table 10
$IP route add table 10 to 10.45.13.0/26 dev eth0
$IP route add table ...
0
votes
0answers
37 views
How to redirect a local port range to a guest VM using Linux?
I am trying to redirect connections made inside a linux host to a guest VM, say 192.168.122.158, for a certain port range, say 8000:8500, i.e.:
telnet localhost 8000
should actually result in a ...
0
votes
3answers
28 views
VPS security considerations when only accessing from one IP [duplicate]
I'm running an VPS where I have deployed some projects. As I am the only person who accesses the server and I furthermore have a fixed IP i decided to configure iptables so that server access is only ...
0
votes
3answers
44 views
IPTables add an IP to IPSet list
How to correctly add an IP address to ipset from an iptables rule?
Or isn't that possible at all?
This rule doesn't work for me: -A INPUT -m recent --name IP_LIST --set
Type of IP_LIST is hash:net
...
1
vote
2answers
27 views
iptables rule -d ! (not destination) is giving me errors
How do I use the [!] option for a destination IP?
I'm trying to redirect out-bound WAN DNS traffic to my sinkhole, but I can't get the --destination [!] option to work.
For example:
iptables -A ...
0
votes
1answer
34 views
preventing squid forwarding loop with IPtables
I have a web application, and I'd like to limit file upload size.
I thought I'd try using squid for this, via its directive request_body_size_max.
I have my webserver running on port 8080, and I've ...
2
votes
1answer
54 views
Iptables rules order
I have following script, which I found somewhere in the Internet, and I modified it a little bit to suit my needs.
My question is: If I understood output of iptables-save my iptables rules are ...
1
vote
3answers
26 views
Testing the limits of UFW with thousands of deny blocks
Here's the deal: I have a persistent Chinese botnet that spams my forum (running on an Ubuntu 12.04.2 server on nginx, etc). I've been using UFW (Ubuntu's "Uncomplicated FireWall") for managing the ...
0
votes
1answer
56 views
OpenVPN pass through to lan and out second internet connection
I asked on SuperUser, was told it might be best to ask on here, so here we go.
I want to run OpenVPN on a computer connected to a FiOS connection on one NIC, then pass that traffic onto the LAN, and ...
0
votes
1answer
46 views
How to add delay to incoming traffic?
For purpose of continuous testing, I would like have apache server to serve static files with at least 20ms delay.
I tried to find a apache configuration setting or a plugin with similar ability, but ...
0
votes
0answers
23 views
how to open forwarded port (on remote server)
I have tunel from local router(dd-wrt) to external server:
ssh -i /root/.ssh/id_rsa -f -N -R 221:${LOCALIP}:221 root@VPS-MACHINE
Port 221 - ftp server. Now i can login to local ftp through ...
-3
votes
2answers
76 views
how to intercept(not only capture) outgoing packets from TCP programs(or specifically TCP stack)? [closed]
I have a web server running on a host and I want to intercept all packets(including IP/TCP header) sent by the webserver, so the packets are not sent out to the Internet by the web server directly.
...
0
votes
0answers
20 views
OpenVPN server cannot ping client
First of all apologies if this has been answered anywhere else, but I Have been googling around for a few days and it is driving me crazy now.
I have installed OpenVPN server on a CentOS VPS hosted ...
0
votes
3answers
41 views
iptables for a /16 subnet with a /24 exception
simply put, i want to use these rules:
iptables -I FORWARD -i br0.105 -d 192.168.0.0/16 -j DROP
iptables -I FORWARD -s 192.168.0.0/16 -i br0.105 -j DROP
but with the exception of the ...
0
votes
2answers
107 views
My iptables does not allow apt-get update to work properly, what rule has broken it?
I thought my iptables' rules were working great, until I did an apt-get update, for which I get Temporary failure resolving error messages for all sites in sources.list. However, when I disable ...
0
votes
1answer
43 views
Parse Apache logfile and ban IPs
My server is under attack, it is flooded with request with the following pattern:
Thousands of IPs
Each IP request the same page "GET / HTTP/1.1" with the same referrer 3-5 times per second (same ...
0
votes
1answer
43 views
Forwarding all HTTP/HTTPS traffic to a port with iptables
I'm trying to setup a wireless network that routes all traffic to a local webserver (basically a hotel wifi login page).
Here's my dhcpd config:
$ cat /etc/dhcpd.conf
ddns-update-style none;
...
-1
votes
1answer
64 views
Any way to Improve performance of iptables DDOS whitelist? [closed]
I'm having a problem stopping a DDOS attack on a dedicated server. I have tried a lot of things (mod_evasive, apf, ddos deflate, bfd...). The attack is very big and from a lot of differents IPs, and ...
0
votes
1answer
51 views
syn flood attack — packet hits on shared ip
How can I dump the TCP packets to get a better idea to know which website is being attacked?
Here is what I have in my logs:
May 4 23:10:26 host kernel: [2130002.635000] Firewall: *SYNFLOOD ...
1
vote
3answers
88 views
iptables: match only untagged traffic on an interface with VLANs
As far as i know, there is no way of distinguishing VLAN traffic in iptables on the master interface (that is the interface to which virtual VLAN interfaces are added with vconfig or ip link add link; ...
0
votes
1answer
15 views
Iptables Proxy like setup
So the situation is we're having issues forwarding packets from a particular IP on a server. This is what is happening so far.
Main server IP - 1.1.1.1
Secondary IP (what we want the client ot ...
0
votes
0answers
69 views
strongswan VPN on OpenWrt
Hi I'm running Barrier Breaker version of OpenWRT and I have setup a VPN according to:
http://wiki.openwrt.org/inbox/strongswan.howto
I can connect to the VPN with my iPhone or Mac (to 10.10.1.0/24 ...
1
vote
1answer
34 views
IPTABLES with AND conditions
I need to apply an iptables rules using --string option. I need to match on --hex or ascii 2 strings that are never localized on the same area.
Each samples I tried DROP only one of my two strings, ...
1
vote
1answer
25 views
Rewrite domain.com:3000 to port 80 with Apache
I'm hosting two applications on my web server, one is a Drupal site, and the other is an Errbit installation, which is a Ruby on Rails application. The URLs looks something like this:
...
0
votes
2answers
58 views
How to properly drop ICMP type 3 packets on possible DDoS attack?
Even after running
iptables -A INPUT -p icmp -m icmp --icmp-type 3 -j DROP
I keep getting ICMP type 3 code 13 packets on tcpdump. when I run tcpdump icmp, I get messages like:
19:41:31.923630 IP ...
-1
votes
2answers
69 views
Dnsmasq not distributing address as dhcp server [closed]
I have a Debian Linux server connected with ethernet cable to a Netgear Access Point (Wnr2000).
I want all users wirelessly connected to the access point to have the Debian Linux server as gateway.
...
0
votes
1answer
18 views
How to configure port-forwarding to enable internal service accessed by another machine?
I have an existing service which is listening on 127.0.0.1:2009, and I want to access that service from another machine, so I tried to configure port-forwarding to do it:
sudo /sbin/iptables -t nat ...
