iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

2
votes
1answer
5 views

iptables command from RHEL documentation for cobbler, fails in RHEL 7

This seems like a very simple question. But I don't see anything much about it on the web. The command comes from the RHEL documentation itself, so I would expect that it works... and yet it fails. ...
0
votes
2answers
56 views

Can iptables automatically drop established session after certain seconds?

Can iptables drop automatically an established output session after certain seconds e.g. 30 sec. since its launch? But I want to restrict it only for destination port 80 and 443. The purpose is to ...
1
vote
0answers
5 views

Fail2ban redirect

I've just finished setting up fail2ban on my Centos reverse proxy server. I was able to get it to block all requests if a certain criteria was met (pretty straight forward). However, I'd now like ...
5
votes
4answers
3k views

Openvpn, forward packets very slowly

I rebooted my server, and an odd issue just came out. I am running on ArchLinux, the clients are Ubuntu, Android and Mac. The problem is that accessing the internet via the clients is slow, about ...
0
votes
1answer
16 views

How to set up iptables on a gateway that also hosts Squid proxy?

I have a computer that serves as: a) a gateway between a wireless network (WLAN0) and a LAN (ETH0) connected to internet b) a Squid3 proxy server that does only web filtering (no caching) I have ...
0
votes
2answers
1k views

How to delete all ufw rules for a certain port?

I am using ansible to configure ufw on my DB servers to only let accept connections from certain servers connection to a specific port (lets say 1234). When a server that used to have access is taken ...
2
votes
0answers
18 views

Test if iptables would pass a given ip/ip-range

I am currently trying to debug problems relating to our firewall configuration and found myself in the situation where I would like to test a config. Ideally I would like to take the iptables config ...
0
votes
1answer
25 views

How do I block all BlazingFast.io IP ranges?

In my logs I've been noticing several cases where frequent requests from an IP spam POST requests to a specific Wordpress script. What all of these spam source IPs have in common, is that they ...
0
votes
1answer
2k views

Iptable l7-filter installation guide and block p2p

I would install l7-filter to block P2P torrent, First of all , I have a linux debian. I installed by the below command apt-get install l7-filter-userspace And then run command iptables -I FORWARD ...
6
votes
3answers
2k views

Limiting interface bandwidth with tc under Linux

I have a linux router which has a 10GBe interface on the outside and bonded Gigabit ethernet interfaces on the inside. We have currently budget for 2GBit/s. If we exceed that rate by more than 5% ...
0
votes
2answers
35 views

Clear TCP sessions

I am trying to use iptables to reject packets as well as reset the TCP connection. My rule is: iptables -I FORWARD -p tcp -s 10.0.0.10 -j REJECT --reject-with tcp-reset If 10.0.0.10 is SSH'ing into ...
0
votes
1answer
1k views

Gre Tunnel Cisco Linux traffic forwarding

I setup a gre tunnel a cisco router and a Linux machine, the tunnel interface in the Linux box named pic. Well i have to forward traffic coming from cisco through the Linux box. the rules i've set in ...
0
votes
1answer
28 views

iptables slow down connections

When I enable iptables (v4/v6) for my server, every connection like ssh, imap, smtp, http, https and so on are slow down so if I try to connect to ssh, it tooks up to 30 (!) seconds. The imap service ...
0
votes
3answers
2k views

Forward traffic to local LAN IP while keeping the originator IP

I am trying to forward traffic from one server to another, while keeping the origin requestor IP. Therefor I cannot use SNAT or MASQUERADE. SERVER A: Public IP: 111.111.111.111 Private IP: 10.0.0.1 ...
0
votes
1answer
28 views

OpenVZ container(s) and NAT

I have been trying to days to solve my NAT issue with OpenVZ. I have used their guide on their website/wiki, however I just seem to be unable to get it to work. My Linux box is running on CentOS 6 ...
11
votes
2answers
24k views

How to enable iptables (instead of firewalld) services on RHEL 7 and Fedora 18?

The newest fedora has firewalld as new firewall aplication. I liked old iptables services. I want them back but have no idea how to do that. I have tried : systemctl disable firewalld.service ...
0
votes
0answers
31 views

Linux router for 2 public subnets with one getaway and one local subnet - not load balancing ;)

I have problem with routing on linux. My ISP give me 2 ranges of public addresses, lets say: 192.168.11.0/30 (4 addresses) - router 192.168.33.0/29 (8 addresses) - servers additionally I have on ...
0
votes
3answers
42 views

iptables actively refused everything despite exceptions

I was following the centos wiki page on iptables but no mater what I change only port 22 opens. Using various port scanning websites they all say the server is actively refusing connections on all ...
1
vote
3answers
25 views

Ubuntu / iptables: Using a server as middle-man to talk to firewalled server [duplicate]

I have a situation where I need to communicate with an API that only allows connections from one particular IP. So api.example.com accepts connections on port 443 from whitelisted-ip I want to be ...
0
votes
1answer
944 views

Masquerade traffic from certain source IP to VPN connection

Network Setup: 10.0.0.1 Router: to internet 10.0.0.70 Server: Ubuntu based server,default gateway is 10.0.0.1 10.0.0.51 PC I created a PPTP connection(interface: ppp0) on Server to a machine ...
0
votes
0answers
32 views

IPtables string module

I am running 2 Apache servers behind a load balancer. I do not have access to the load balancer as it's run by our hosting provider. I am tasked with maintaining a blacklist of IP addresses that have ...
2
votes
1answer
29 views

How to count packets coming from outside using iptables? [duplicate]

If you don't give iptables a target, it simply counts how many bytes and packets match the rule. I'd like to count all packets that come from outside, i.e. don't match 10.0.0.0/8 and don't match ...
1
vote
1answer
977 views

Ubuntu iptables logs not going to any log file

I am trying to put logs in iptables but I can not find any log in any file. Although when I run dmesg command, I can see the iptables entries. But the same entry doesn't go to any log file. Here is ...
0
votes
0answers
34 views

Route postfix through different ISP/Gateway

Our network has 2 different gateways/ISPs, one with a dynamic IP used mostly for web traffic and SQUID and another with a dedicated connection and a static IP to handle VOIP and email. The network ...
2
votes
2answers
1k views

Iptables: Forwarding packets doesn't work

I have 3 Linux Systems A, B and C. A is a TCP Client and sends a message to TCP Server on C. A can see only the external IP of B which is at wlan0 interface, 192.168.0.3 ------------------ ...
0
votes
0answers
27 views

Cannot trace bug in iptables firewalls config

I seem to have a bug in my iptables configuration - when I comment out hte final line (drop) it works fine - when I uncomment it, I cannot ssh into my server - can anyone spot what I'm doing wrong? ...
0
votes
1answer
60 views

ntpd error: unable to bind to wildcard address 0.0.0.0 - another process may be running - EXITING

I have a problem. Time on server not synchronized. And it seems that this problem was appear after I set my rules for iptables, which I described here May be I'm wrong and these two events are not ...
0
votes
0answers
8 views

l7-filter does not set markers

I install l7-filter userspace on ubuntu 12.04 and run it by this command: sudo l7-filter -f /etc/l7.conf -q 1 but l7-filter does not set any markers. I set iptables to send forwarding packet to ...
0
votes
1answer
42 views

Iptables forward traffic from A to B where A is not gateway for B

I want to forward ssh traffic from A port 2222 to B port 22. I do have ipv4 forwarding set to 1 on both interfaces. Still, this does not work. What is wrong? Machine A: eth0 192.168.0.150 eth1 ...
0
votes
0answers
14 views

Iptables drop forwarded traffic destined for interface IP address

I have a small VPN setup where I use IP tables to nat traffic coming in the vpn0 interface to the IP address of the eth0 interface. These rules look like this: iptables -t nat -A POSTROUTING -o eth0 ...
0
votes
1answer
16 views

IP6Tables: How to enable external access to MySQL?

How to enable external access to MySQL with rules on ip6tables? I have tried to the rules below, where after inserted I get access, but when server restart the access remains blocked. :INPUT DROP ...
0
votes
1answer
63 views

Starting to learn about IPtables, why do I need this rule?

I have been reading all day about IP tables, how the rules work, sets of rules for basic webservers, etc. Now I`m trying to configure my webserver with IPtables using this thread as a starting point: ...
0
votes
1answer
1k views

iptables forwarding through virtual interfaces

I'm trying to configure my computer as a gateway between two networks, but I cannot make it working for some reasons Here is a representation of the network: 192.168.1.101 192.168.1.102 ...
4
votes
2answers
552 views

ntpd running as non-root, but outgoing packets match as uid 0

I set my default iptables OUTPUT chain to DROP packets. I then created a firewall rule to only allow the ntp user to send ntp packets out: iptables -A OUTPUT -m owner --uid-owner ntp -p udp --dport ...
0
votes
0answers
23 views

IPTables forwarding no more connection

I have a VPS for protect windows server from DDOS so I have forwarding connection. The forward works great but I can't access to the internet with the VPS. Ping doesn't works and I can't update or ...
0
votes
1answer
45 views

why my nat iptables rules dont work with marked packets?

System: debian squeeze, Linux server 2.6.32-5-amd64 #1 SMP Tue May 13 16:34:35 UTC 2014 x86_64 GNU/Linux, iptables v1.4.8 lsmod | grep iptable iptable_security 2176 0 iptable_mangle ...
4
votes
1answer
88 views

Iptables LOG rule inside a network namespace

I'm trying to setup iptables rules for a docker container. I'm using nsenter to execute the iptables command inside of the container's network namespace: # log access to port 8080 PID=$(docker ...
0
votes
1answer
22 views

Static route to Single IP using SSL connection

I am trying to configure a static route to a single IP. My question is two fold: How do I specify a single IP using a subnet mask x.x.x.x/? (not a range of ip's) My pc is making an SSL connection to ...
0
votes
4answers
1k views

How to refuse IP's with no reverse DNS with Apache2 or iptables?

With Apache2, or iptables, is there a way to refuse visitors if their IP has no reverse DNS, or does not resolve at all? I have a website targeted to a specific population who has valid reverse DNS. ...
-3
votes
3answers
10k views

Blocking WhatsApp and other IM traffic

In my office, I have set up a linux machine as router and provide internet connectivity to all clients. Behind this linux router I have set up a cisco wireless router, with which I have made internet ...
0
votes
1answer
36 views

Cannot find error in iptables firewall configuration

I'm struggling with a firewall problem on my Centos server. I have the following configuration which when I use it with a service iptables restart and I try to ssh to the server with putty, I cannot ...
0
votes
1answer
27 views

Configuring iptables for Haproxy

Ubuntu machine running haproxy with 2 network cards, 1 connected to WAN (called wan0) and another connected to LAN (called lan0). All chains set to DROP traffic. # Masquerade traffic from LAN to WAN ...
1
vote
1answer
57 views

IPtables drops all, but postfix still send emails

My iptables rules: # delete all current rules and user chains iptables -F iptables -X # global policy (target by default) iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP # ...
4
votes
2answers
9k views

Stop DoS attacks with an IP tables rule?

I was wondering if I could prevent small (D)DoS attacks with a simple IP tables rule? By small I mean that they are flooding my web server with about 400+ requests from one or two IP addresses. I ...
1
vote
5answers
4k views

OpenVPN client connects but can't access internet

I setup an Openvpn server on a centos box and I can get the client to connect (osx) but can't access the internet or even the local network. I thought maybe DNS but couldn't access any sites via IP. ...
0
votes
1answer
2k views

SSH Socks Proxy wiith iptables REDIRECT

I have googled and haven`t found the answer on my question. Help me please. There are two servers: serverA with public IP 12.0.0.10 and an private IP 10.0.0.5 serverB with public IP 20.0.0.11 I ...
1
vote
1answer
909 views

How to reset a tcp connection immediately on both ends on a certain condition using linux netfilter/iptables?

Dear Serverfault community, I have the following problem: I need to reset (disconnect) tcp connections on both network sides immediately if a certain string is encountered in the packet data. I don't ...
7
votes
2answers
12k views

Bridging LXC containers to host eth0 so they can have a public IP

UPDATE: I found the solution there: http://www.linuxfoundation.org/collaborate/workgroups/networking/bridge#No_traffic_gets_trough_.28except_ARP_and_STP.29 # cd /proc/sys/net/bridge # ls ...
1
vote
1answer
44 views

Tcpdump/Iptables on bridge interface without assigned IP address

I have set up a bridge interface without an ip on it. $ brctl addbr br0 $ brctl addif tap0 $ brctl addif tap1 $ ifconfig br0 up As seen above, this bridge is connecting 2 TAP interfaces setup ...
0
votes
4answers
1k views

Server not reachable on all TCP ports from all locations

I have a very strange situation on a Linux (CentOS) server. Firstly, from my Ubuntu desktop PC, I can successfully connect to all services that are running on it, on ports 22, 80, 8080 and others. ...