iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

-1
votes
2answers
14 views

OpenVPN Variables Passed via Script

Can someone explain and/or direct me to a summary of the variables that are available to be passed to OpenVPN upon a client connection? For example, what do the following $1, $2, $3, $4 values ...
6
votes
4answers
6k views

How to Enable IPtables TRACE Target on Debian Squeeze (6)

I am trying to use the TRACE target of IPtables but I can't seem to get any trace information logged. I want to use what is described here: Debugger for Iptables. From the iptables man for TRACE: ...
0
votes
0answers
14 views

Add Filters to Users

I am running OpenVPN on Ubuntu 14.04 (dev tun) and I can't seem to get my learn-address script to run below I would like to run the learn-address script each time a user connects to OpenVPN that ...
1
vote
0answers
9 views

iptable connetion to VPN Server (VPN + DNS)

i want to create iptable rules that allow no traffic to the outside world with the exception to my VPN - Server (xx.xx.xx.xx) and local Network 192.168.0.0/24 The rules i defined: iptables -F ...
0
votes
1answer
52 views
+50

Access Point Iptable/Route rule for allowing device discovery? Devices can connect manually, but not automatically. Multicast/Upnp issue?

I setup a wireless access point on my server and for some reason, everything works but automatic discovery features. I can't see any other devices, upnp devives aren't discovered, and I think it's a ...
0
votes
0answers
5 views

IPTABLES nat to LXD Containers

I created the following temporary rule that I enable occasionally but I would like to remove it without the need of restarting the machine. Can someone provide me the command? sudo iptables -t nat ...
0
votes
0answers
10 views

IPTABLES - Prerouting Issue - Port 443

I have a NAT server setup with 4 servers behind it. I have a PREROUTING entry to allow https/443 INTO my environment, specifically to to a web server running IIS on port 443. This works fine. ...
0
votes
2answers
19 views

Is it safe to open all UDP ports range?

I've setted some main ports - 20, 21, 22, 23, 53, 80, 443 for incoming and outgoing TCP connections. If i want to connect from inside my server to another ftp server, it uses random UDP port in range ...
6
votes
1answer
5k views

connect Open vSwitch switch to real network : iptables masquerade

I'm using Open vSwitch to create a switched network between virtualBox guest machines, and i want that the host OS (Ubuntu 12.04) join this network and to configure it as the gateway of this virtual ...
0
votes
0answers
10 views

what are the OpenVpn Iptables rules should i use? [on hold]

I'm going to install & configure Openvpn server in centos 7. I'm very much confident about how to confgure server but i'm getting little confusion about what rules should i use for security ...
0
votes
0answers
14 views

minimalistic way of redirecting http/s traffic

In my scenario, I dynamically provisioning compute nodes to preform a task - in this scenario, a client is given the IP of the node to access using a specific application that access the application ...
0
votes
2answers
135 views

iptables settings open ports

ipables configuration Trying to allowing connection to a server from the outside world. Port scanners are reporting the ports are not open. Just after confirmation my iptables are correctly set. ...
3
votes
1answer
362 views

How do iptables work with NFQ in terms of traffic shaping in snort?

I'm trying to understand how iptables and NFQ work together with snort. The reason that I ask this is because from what I understand snort can be set to IPS via NFQ but if you have iptables there ...
2
votes
2answers
4k views

How to block all incoming request through one network interface?

Saying I have a linux server as a router from LAN to WAN. I don't want any incoming WAN request for safety issue. So how should I block all the incoming request through the WAN interface, but ...
-3
votes
0answers
26 views

Forward packages to server ip between 2 network interfaces on Linux [on hold]

I have 2 network interfaces: eth0(192.168.7.2) and ppp0(10.222.12.81) on linux; and 2 server ip: 1.1.1.1 and 2.2.2.2. I want to forward all packages from eth0 to server 1.1.1.1 and forward all ...
33
votes
6answers
13k views

Debugger for Iptables

I'm looking for an easy way to follow a packet through the iptables rules. This is not so much about logging, because I don't want to log all traffic (and I only want to have LOG targets for very few ...
0
votes
1answer
26 views

IPTABLES blocking ports that should be open

I'm using centos7 and have the following rules set up: *filter :INPUT DROP [6:394] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [42:6917] -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j ...
57
votes
8answers
109k views

How to Unban an IP properly with Fail2Ban

I'm using Fail2Ban on a server and I'm wondering how to unban an IP properly. I know I can work with IPTables directly: iptables -D fail2ban-ssh <number> But is there not a way to do it with ...
1
vote
2answers
3k views

iptables block client ip internet access and keep LAN access

With the increase of appliances having network access and the potential for hacking, I want to block specific ip address from accessing the internet, but allow LAN access. For instance, I use a ...
1
vote
1answer
186 views

Huge performance penalty in gbit link with ip forwarding / masquerade through clear VPN tunnel

I have a problem with IP forwarding between my home computer and a remote server (from online.net). My home connection is a 1 Gbit/s FTTH and the remote server has a 2.5 Gbit/s bandwidth. The context ...
1
vote
2answers
28 views

iptables nat same port, multiple providers

my configuration: # ip route sh zzz.zzz.zzz.0/24 dev eth3 proto kernel scope link src zzz.zzz.zzz.1 yyy.yyy.yyy.0/24 dev eth1 proto kernel scope link src yyy.yyy.yyy.146 xxx.xxx.xx8.0/23 dev ...
0
votes
1answer
1k views

ZenOSS webinterface connecting

I'm having a problem with ZenOss. I installed the centos stack installer on Centos 5.5 x64. De installation succeeded and no errors where displayed. But when I tried to surft to the ip address it ...
0
votes
1answer
58 views

Multiple Gateways for Single Subnet

Right, this might be a long one, so bare with me... I have 2 machines, lets call them local1 and cloud1. local1 has 3 Nics: 2 connected directly to cable modems with public IPS (call them eth0 and ...
1
vote
3answers
99 views

Forward traffic between VLANs with iptables

We're having the following 4 VLANs on my network, connected to an Ubuntu Linux box with DHCP. This Linux should act as the L3 router as well. VLAN 10 on interface eth1.10 with subnet 10.10.10.0/24 ...
1
vote
1answer
2k views

Ubuntu iptables logs not going to any log file

I am trying to put logs in iptables but I can not find any log in any file. Although when I run dmesg command, I can see the iptables entries. But the same entry doesn't go to any log file. Here is ...
1
vote
1answer
20 views

pacemaker virtual ip loadbalancing with clone and clusterip

I am trying to make a loadbalanced gateway for a group of natted machines. I have 3 centos nodes. Initially only one node was supposed to have the internal gateway ip and that works well. Traffic ...
3
votes
2answers
1k views

iptables 1.4 and passive FTP on custom port

after the upgrade from debian squeeze to wheezy I've got a problem with passive FTP connection. I could narrow it to be iptables related, as I could connect via FTP w/o problems after adding my IP to ...
0
votes
0answers
22 views

Route/Forward specific traffic to Interface

I want to use a Rasperry Pi as (Wlan-)Router. The Access Point is working so far: I have an Accesspoint with wlan0 (ip 10.10.0.0/255.255.0.0) and wlan1 connected to the internet. Now I want to route ...
0
votes
1answer
19 views

NFS mount internal error

I have a server that I use for NFS share. 4 servers use it without a problem. I configured a new server and that can't mount. I get this error mount.nfs: internal error In the logfile of the ...
2
votes
1answer
1k views

Route outbound connections from local network through VPN

I have a server A running OpenVPN, an OpenVPN client B (a rooted Android phone as it happens) and a third party C (a laptop, tablet etc.) tethered to B. B can use the VPN to access the internet via ...
1
vote
1answer
2k views

Missing iptables rules for Strongswan routing for VPN for phone

I have a Centos 6.6 VPS out on the Internet that has a public IP. I have installed StrongSwan 5.1.3 to allow my BlackBerry10 phone to connect from hotspots and use the VPS' connection. The VPS' IP ...
2
votes
3answers
1k views

Reach LXC container from a virtualbox guest on the same host

Context I develop websites on my Ubuntu laptop (Ubuntu 13.04 64b). Each site runs within a dedicated LXC container¹ on network 10.0.3.x I sometimes need to reach those sites from a virtualbox guest ...
0
votes
1answer
21 views

Why is my ISP box talking to my DMZ host?

I have a setup where an internet connection is available via ISP box, which has a DMZ feature (one of the hosts can be exposed to Internet). The general setup is the following Internet - PublicIP - ...
0
votes
1answer
98 views

Iptables source mac match not always matching?

I have added some rules to my PREROUTING chain in NAT. Usually at the beginning of a new machine joining the network, these matches don't always match correctly? Im using iptables v1.4.21 on OpenWRT ...
2
votes
2answers
1k views

Correct usage of whitelisting cloudflare IPs in iptables

I'm relatively new to using the command line so I'm understandably nervous about fiddling around with IP tables and accidentally doing something wrong which consequently opens up vulnerabilities in ...
1
vote
4answers
20k views

Error applying iptables rules using iptables-restore

Hi I'm using Ubuntu 9.04 on a VPS. I'm getting an error if I apply a iptables rule. Here is what I have done. 1.Saved the existing rules iptables-save > /etc/iptables.up.rules Created ...
-2
votes
0answers
16 views

How to block ssh when not logged into openvpnas

How can I configure my server so that someone who tries to SSH into the server without being logged into the openvpnas is dropped and only people who are "inside" the network (connected to openvpnas) ...
0
votes
0answers
12 views

Docker is only listening locally on a container connected to a VPN

I've just nuked my CoreOS box and am rebuilding the setup as a Ubuntu Xenial (16.04) based docker platform. I'm happy with it so far but I'm now having to re-resolve a problem I already fixed on ...
2
votes
1answer
2k views

OpenVPN connected but no Internet or LAN

Good evening, I'm facing an issue with my OpenVPN installation. Been at it for 3 days now but still cant figure out what is wrong for the life of me... Basically the issue is that i'm able to ...
2
votes
1answer
3k views

strongswan VPN on OpenWrt

Hi I'm running Barrier Breaker version of OpenWRT and I have setup a VPN according to: http://wiki.openwrt.org/inbox/strongswan.howto I can connect to the VPN with my iPhone or Mac (to 10.10.1.0/24 ...
0
votes
1answer
26 views

Forward outgoing traffic for port to another server using iptables

I'm trying to forward outgoing traffic 194.97.114.3:2010 to another server but with no luck. netstat -anup gives me udp 0 0 94.23.28.183:44174 194.97.114.3:2010 ESTABLISHED ...
0
votes
2answers
1k views

grep, count and sort iptables log to get IPs qty and DPT?

How can I grep count and sort iptables log to get IPs quantity and DPT? Like I used this oneliner to get top IP quantity. egrep -w "Invalid Packet" ipfirewall.log | grep -o ...
0
votes
0answers
19 views

Ports aren't really getting blocked with iptables

I'm on Ubuntu 14.04.4 LTS, I'm under attack from some ports, I blocked all of ports except SSH in my own server, I'm doing that by this way: iptables -F iptables -P INPUT DROP iptables -P OUTPUT DROP ...
6
votes
4answers
4k views

Openvpn, forward packets very slowly

I rebooted my server, and an odd issue just came out. I am running on ArchLinux, the clients are Ubuntu, Android and Mac. The problem is that accessing the internet via the clients is slow, about ...
13
votes
3answers
1k views

Debugging iptables and common firewall pitfalls?

This is a proposed Canonical Question about understanding and debugging the software firewall on Linux systems. In response to EEAA's answer and @Shog's comment that we need a suitable ...
3
votes
1answer
2k views

What does nf_conntrack.acct really do?

I've found the kernel parameter nf_conntrack.acct interesting, in that the kernel documentation merely says "Enable connection tracking flow accounting". I've appended this to grub and rebooted and I ...
1
vote
0answers
13 views

How do I remove ufw blocked protocol 59 log noise?

The logfile on one of my private servers running Ubuntu 14.04 is being filled with messages of the following form: [UFW BLOCK] IN=eth0 OUT= MAC=[macaddr] SRC=[srcipv6addr] DST=[destipv6addr] LEN=40 ...
-1
votes
2answers
58 views

Iptables on a Debian machine, the delete command needs a networking restart to work?

I have a big problem with iptables, this the thing I try to make : PC windows (192.168.1.1) -> (192.168.1.2) PC Linux (192.168.2.1) -> (192.168.2.2) card I want to forward the messages from Windows ...
0
votes
1answer
26 views

What is the FIREWALLD equivalent to IPTABLES -NOTRACK

I recently converted to centos 7 and so far I am beginning to like the simplicity of zones in my firewall structure, however I can't seem to find a configuration parameter for firewalld like the ...
-1
votes
2answers
28 views

iptables for internet connection sharing

Objective: I am working on an embedded Linux device with the following network configuration. Interface-1: 'wlan0' acts as an access point. Interface-2: 'eth1' connected to Internet. Interface-3: ...