iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

0
votes
2answers
22 views

Simplest way to secure debian server on LAN

I currently have a basic debian server setup and connected to my LAN. Am I right in thinking that if I remove the gateway from the network configuration then the box will be unable to communicate ...
0
votes
1answer
14 views

Route HTTP(S) traffic to specific IP based on requested URL on Linux

I have an Ubuntu Server in the cloud. Let's call it ServerA. ServerA has an apache2 installed and is serving a default page on HTTP requests. mydomain.com is pointing to the ServerA's IP and thus the ...
1
vote
0answers
16 views

pf (Mac OS X) rule to redirect all traffic to a specific ip/port

I'm trying to recreate this iptables setup (from https://github.com/darkk/redsocks) with pf: iptables -t nat -A REDSOCKS -p tcp -d 10.0.0.0/8 -j REDIRECT --to-ports 12345 iptables -t nat -A OUTPUT -p ...
0
votes
1answer
14 views

iptables DNAT to external IP without masquerading does not work

On server 1.1.1.1: iptables -t nat -A PREROUTING -p tcp --dport 20000 -j DNAT --to-destination: 2.2.2.2:20000 iptables -t nat -A PREROUTING -p tcp --dport 20000 -j LOG --log-prefix pre20k iptables ...
0
votes
0answers
8 views

local port forwarding with failover

There is a number of similar though not identical processes (worker processes) running on the localhost and listening each on its own TCP port, let's say process1 is listening on port 10001 process2 ...
1
vote
1answer
26 views

Port forward linux iptables

My current network setup consists of a physical nic eth1 receiving my public ip from the modem. Next I have kvm/qemu virtual machines running on a virtual network using the ip range 192.168.122.0 - ...
1
vote
1answer
16 views

Forward connections from docker container on specific port to local interface on host

I am attempting to run services in containers within a cloud provider. I would like the containerised applications to authenticate with an on-premises LDAP server, which is (currently) available via ...
-2
votes
0answers
19 views

iptables shell command from php, does not apply fully?

I run a shell script from php. shell_exec("/abs_path_to/lorem.sh"); When I run the script in Terminal # sh "/abs_path_to/lorem.sh", it works. The script consists in iptables rules. I checked it is ...
0
votes
1answer
32 views

IPtables on Linux for mysql server private interface

Looking to make a mysql database server for web-servers. The server has a public & private interface and I need some assistance writing the rules. I want to only allow SSH, mysql via private ...
0
votes
0answers
5 views

CONFIG_NF_CONNTRACK is not set [migrated]

I am trying to setup iptables on udoo quad but I hit a brick wall and cannot find a fix anywhere: root@udoo:/# uname -a Linux udoo 3.0.35 #10 SMP PREEMPT Wed Jul 30 18:16:10 CEST 2014 armv7l ...
0
votes
1answer
42 views

iptables not starting upon reboot

I've enabled iptables in systemd with: systemctl enable iptables but after restart when I try service iptables status, it shows: # service iptables status Redirecting to /bin/systemctl status ...
0
votes
1answer
14 views

can't initialize iptables table `nat' in Proxmox Openvz vm

When I tried to run an iptables command in the Proxmox OpenVZ vm, I got the following error: # iptables -t nat -A POSTROUTING -o venet -j MASQUERADE && iptables-save iptables v1.4.21: can't ...
2
votes
1answer
37 views

ipset not being applied to iptables

I'm trying to filter out a country that keeps probing my SMTP server (CentOS6) and I can't seem to get the ipset to work out right in iptables. I downloaded that countries IP addresses from ...
0
votes
0answers
14 views

DNAT not forwarding to correct (local) IP address

I'm trying to port-forward a HTTPS service which uses different SSL certificates for each of the several IP addresses on the machine. Web server listens on each IP address on the internal port (444) ...
-1
votes
1answer
22 views

IPTABLES not working, fail2ban still notifying me of instrusions from those ips

I added 200 hundred iptable rules like these: iptables -A INPUT -s 108.62.150.0/24 -j DROP iptables -A INPUT -s 109.108.64.0/19 -j DROP iptables -A INPUT -s 109.110.32.0/19 -j DROP to block russian ...
2
votes
1answer
55 views

How to create a private network between a VPS and 4 IPs?

I own a VPS running Debian and i want to avoid security breaches from "outside" (via Internet). I want to guarantee these rules: Allow all outbound traffic; Allow HTTPS connections from IP 1, 2, 3; ...
0
votes
1answer
28 views

iptables, redirect all port 80 to an IP but let one IP forwards through

My router redirects all incoming traffic (interface eth0) to IP 1.2.3.4 : iptables -t NAT -A PREROUTING -i eth0 -p tcp --dport 80 --to-destination 1.2.3.4:80 When a client hits "100.80.77.8", I'd ...
0
votes
1answer
18 views

No internet connection via my OpenVPN server (solved)

I have OpenVPN up and running on my server. I want all traffic from my clients to be routed trough the VPN server. The client connects just fine but is unable to connect to the internet. Server ...
0
votes
0answers
23 views

Centos 7 IPTABLES - SSH Lockout

I'm currently ruunning an OVH dedicated box, which specifically, has the following operation system installed: CentOS 7.1-1503 By default on CentOS 7 and above, the firewalld service is used ...
0
votes
1answer
32 views

How to create advanced rules with firewall-cmd?

I want to create a rule using firewalld that uses criteria username or userID and maybe one other module criteria. In iptables, I think you can do things like iptables -A OUTPUT -m owner --uid-owner ...
0
votes
1answer
24 views

Seemingly acceptable iptables rule blocking NIS (ypbind) from operating

I am not an iptables expert. I have a use case to block all outgoing traffic that does not destined for either 10.0.0.0/8 or 167.114.0.0/16. I have two NIS servers (10.57.132.11, 10.57.132.40). I ...
0
votes
2answers
26 views

Iptables on Centos 7 doesn't work after reboot

I am on Centos 7, removed the new firewall and installed a classic iptables service. I have a guest machine in it with Debian 8.1 and static external ip. I do: echo 1 > ...
0
votes
1answer
14 views

How do you sync ipset sets across two machines?

I would like to replicate IPSet sets from one machine (server01) to another machine (server02) using rsync or btsync or something similar. Is that possible? If so how do I do it? This is a redundancy ...
1
vote
0answers
29 views

Multicast destination NAT on same network interface, with netem

For testing purpose, in a big network where IT will shoot me if multicast data are not streamed in the right VLAN, I am trying to degrade multicast packets with a server running netem configuration. ...
1
vote
0answers
30 views

Ubuntu 12.04 Router Firewall TTFB Delay

I use Ubuntu Server as my router/firewall for my network for a number of reasons. Until recently, I was using 10.04 with great success for this purpose. The OS provides DNS lookup and DHCP using ...
0
votes
1answer
20 views

Iptables time-based rules having no effect - Gateway with 2 NICs

I have a network with the following topology: - WAN Modem with NIC facing the gateway: 192.168.0.1 - Ubuntu 14.04 gateway with two NICs: 1) Eth0 (facing the modem): 192.168.0.201 2) Eth1 (facing ...
0
votes
1answer
18 views

Cant route traffic through OpenVPN on Debian 8

I have been trying to setup OpenVPN and have run into a bit of a hiccup, i have can't seem to route all my traffic through the server. I can connect to the server just fine but i can't seem to ping ...
0
votes
1answer
34 views

How to use conntrack to allow SIP traffic

I have the following problem: Device (eth0)----> SWITCH(trunk)+VLAN120 ---> (PC1) +VLAN200 ---> (PC2) I am able to ping from PC1 to PC2 which are in ...
0
votes
1answer
29 views

Gateway can't ping client

I try setup a new gateway in my virtual network. But sure I' have a problem. The Gateway cannot ping client but client can ping other client and gateway. So I have check my iptables rule (I does'nt ...
0
votes
1answer
18 views

Why does iptables not doing DNAT for the same subnet? [duplicate]

I have the following NAT setup: +--------------+ +-----------------------+ +-------------------+ | | | | | | | | ...
0
votes
0answers
12 views

Isolate access point clients with iptables

Is there an effective and easy way to isolate access point clients so that they do not see each other over LAN ? I created an open access point with Kali Linux + Hostapd + dnsmask I want to make ...
0
votes
1answer
20 views

What rules do I need to remote desktop to a virtual machine where the host has iptables running?

I am attempting to remote desktop to a virtual Ubuntu install (headless on VirtualBox) that resides on a Linux host (Centos 6.6). I can reach it with no issue if I turn iptables off. I feel like I ...
-1
votes
2answers
49 views

How to set up iptables for local router machine

I have set up a local linux (14.0.4 Ubuntu) machine as a router and can do the following ping server/router from the clients ping clients from server/router ping one client from the other ping the ...
0
votes
0answers
24 views

Simple IPtables Script for Whitelisting (Amazon Endpoints)

I'm attempting to lockdown an Amazon EC2 instance which has a single open port for Amazon SNS. I can't use security groups to restrict the port as the IP is forever changing, so it must be open to all ...
0
votes
1answer
44 views

How to route traffic between 2 VLANs on different subnet

I have the following problem: I have one interface eth0 with IP 172.20.51.61/24 I have configured 2 VLANS on the same machine: eth0.120 : 172.20.52.61/24 eth0.200 : 172.20.54.61/24 I also have a ...
1
vote
0answers
20 views

IPTables, route specific port through VPN

I'm running my own mail server at home on a dynamic IP. Dynamic IPs are often blacklisted, so I currently send out mails through my provider's relay. I want to change that to sending mail directly, ...
2
votes
1answer
42 views

Simulate 2 clusters in the same network

I have 4 pc´s and another pc, which will act as a proxy, all being in the same network: 172.16.96.0/20 . I can ping between each other. But, I want to separate them into two groups. That is: pc1 is ...
0
votes
1answer
34 views

Prevent squid forwarding twice with transparent and non-transparent setup

I'm running squid in a small network. I've setup a couple of squid listening ports for different scenarios: http_port 3128 - This is will be pushed to Windows clients via domain policy, with the ...
1
vote
1answer
38 views

TLS Error: Handshake failed. Openvpn Server is behind NAT on dynamic ip

this is a common problem that appears easily in searches and seems to be related to the firewall , yet I can't seem to figure out how to fix it. I have actually asked before, but this time I come back ...
0
votes
1answer
27 views

How to configure an nginx VHost to hang up on the client in the rudest possible way?

I have a, let's call it, "legacy" VHost configured on an nginx server. It used to be a full site, but it has since been decommissioned and all the content removed. The server block now looks something ...
0
votes
1answer
28 views

How can I do site-to-site OpenVPN routing without NAT

I have two OpenVPN servers at different location. Each machine in one location can ping and connect to every machine in the other location. My problem is when I use SSH to connect from machine A in ...
0
votes
0answers
15 views

Forwarding Traffic from an PPTP Server to Another Server

I'm facing a problem here. I have 2 servers. Server 1 is a pptp server and server 2 is another without pptp service. I want to forward some of the traffic from server 1 to server 2 through a tunnel ...
0
votes
0answers
24 views

Filter packets with layer 7 (raw) data with iptables

Let's suppose I've got the following iptables rule: iptables -A INPUT -p tcp -s $IP --sport $PORT -j DROP filtering (and dropping, in this case) packets coming from $IP:$PORT. This filter drop ...
0
votes
0answers
17 views

How to find which program invoke iptables command [duplicate]

My SUSE Linux server always add an iptables rule that deny itself automatic, but I do not know which program added it. So how to find which program invoke iptables command or how to find which program ...
0
votes
0answers
16 views

IPTABLES Forward a Input with specif dport to VPN and masquerade

Inside our company we have a XMPP server that works with source 10.0.0.0/8. But, What I want to do is redirect a package coming from WAN to the VPN (which is where our XMPP is located) but doing a ...
5
votes
1answer
122 views

Iptables rule-set so that a docker container can access a service on a host IP

I have troubles accessing a host private interface (ip) from a docker container. I'm fairly certain that it's related to my Iptables rules (or perhaps routing). When I add the --net=host flag to ...
-1
votes
2answers
21 views

Can't access server through web access despite allowing ports 80 & 443?

Here is the server's iptables file *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [13:2648] -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A ...
0
votes
3answers
30 views

OpenVZ container - Can't set nf_conntrack_max

My question is does the Host Node and a container both have the same "nf_conntrack_max" ? When i check on the host vs the container these are the results: Host Node [root@echo ~]# cat ...
0
votes
1answer
41 views

Steps for limiting outside connections to docker container with iptables?

My goal is to limit access to docker containers to just a few public IP addresses. Is there a simple, repeatable process to accomplish my goal? Understanding only the basics of iptables while using ...
0
votes
0answers
18 views

Cannot create a valid BPF program: bpf: check failed: parse error

I am trying to use xt_bpf iptables module to match for UDP DNS packets that have Recursion Desired bit set. I am slowly building my BPF program in assembly and compiling it through bpfc from ...