iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

0
votes
1answer
11 views

aws ec2 security group and centos ip tables

I try to change the SSH port from 22 to another port (218). In AWS EC2, I shall add the rules in security group or in IP Tables? Is there any guideline/references recommended for EC2 Security ...
0
votes
0answers
3 views

pptp gateway with ssh access

I am desperately trying to setup a gateway-server that forwards all local traffic to a ppp0 connection but is still reachable via ssh on the local network. The point-to-point connection establishes ...
-2
votes
1answer
29 views

Iptables block connection from specific IP - to another IP [on hold]

sudo iptables -A OUTPUT -p udp -d 8.8.8.8 --dport 53 -j DROP This rule will block all DNS output from my server to Google dns 8.8.8.8 Is it possible to add a line that not all the traffic will get ...
4
votes
3answers
64 views

Block traffic behind AWS ELB

My web servers are behind ELB, I want to block traffic from some specific user agent which is a DDOS attack. Apache always see ip address of ELB as an end user so I tried below attempts: Blocking IP ...
1
vote
1answer
39 views

Forward one IP to a docker container

As far as I understood, docker run containers with their own IPs, and fully open ports, on the bridge interface docker0. Let's say I launch a container, and it has its own IP: 172.17.0.11, and I have ...
1
vote
3answers
2k views

Howto use ipset and iptables on Ubuntu 12.04 to block lots of IPs

I would like to use this tutorial: http://www.jsimmons.co.uk/2010/06/08/using-ipset-with-iptables-in-ubuntu-lts-1004-to-block-large-ip-ranges/ In Ubuntu 12.04 the package ipset-source is removed from ...
3
votes
0answers
15 views

Filter mirrored port traffic using iptables

I receive traffic from a mirrored port and I would like to send it into an NFQUEUE for processing. Because of the mirrored port, the packets destination MAC addresses are not my host MAC address. ...
0
votes
1answer
40 views

Linux: iptables and marking confusion

Before I ask my question, let me first pose the situation: I have 2 network interfaces: eth0 and eth1 I bridge those 2 (using brctl) and form a new interface: br0 This bridge gets the ip address ...
1
vote
1answer
28 views

Influence of kernel code execution to Load average in top?

I'm trying to tests the amount of CPU that iptables use for NAT. Perhaps it will be more accurate to say "the amount of CPU that the netfilter kernel module" uses. The approach i took was to try and ...
0
votes
1answer
13 views

iptables dnat mapping to specific ip

I constructed a private net with two machine, both of them have two network interfaces this is the networking information: machine1: eth0 10.0.0.11 (private net) eth1 10.82.80.208 (Campus Network ...
0
votes
0answers
14 views

Can multiple firewalld zones be active at any given time?

I've been struggling through some weird (to me) firewalld errors but am now seeing the firewall behavior I'd like. But, baffling to me, what works seems to be a mix of both the drop zone and the ...
0
votes
1answer
724 views

grep, count and sort iptables log to get IPs qty and DPT?

How can I grep count and sort iptables log to get IPs quantity and DPT? Like I used this oneliner to get top IP quantity. egrep -w "Invalid Packet" ipfirewall.log | grep -o ...
1
vote
1answer
51 views

Why does my Firewalld configuration on CentOS 7 fail to start and show iptables errors?

I'd like to: Drop all incoming connections from the external Web except 80 and 443 Allow internal machines on 192.168.0.0/16 to connect to :9000 :8080 Here's what I did to setup my drop zone via ...
2
votes
1answer
21 views

iptables unknown option `--connlimit-upto'

I have been getting hit pretty hard every day from thousands of requests all from the same few class's of ip addresses. Recently it's taking up all of my MYSQL connections and not allowing any new ...
2
votes
1answer
147 views

How can i prevent TINC from relaying DHCP

I am running tinc in several NAT routers running Debian 7 Wheezy, the VPN works fine for months, except because i've set it up in switch mode it relays DHCP requests and answers over all the VPN. The ...
0
votes
1answer
822 views

Masquerade traffic from certain source IP to VPN connection

Network Setup: 10.0.0.1 Router: to internet 10.0.0.70 Server: Ubuntu based server,default gateway is 10.0.0.1 10.0.0.51 PC I created a PPTP connection(interface: ppp0) on Server to a machine ...
-1
votes
1answer
28 views

Debian iptables: Block all Incoming except special IPs or Ports

I play around with the rules for my web server, but it doesn´t work as i want. The ports seems to be reachable, but a connection won´t happen, here´s the script: #!/bin/bash # Drop all Incoming ...
2
votes
1answer
903 views

iptables rule(s) to send openvpn traffic from clients over an sshuttle tunnel?

I have an Ubuntu 12.04 box with OpenVPN. The VPN is working as expected -- clients can connect, browse the Web, etc. The OpenVPN server IP is 10.8.0.1 on tun0. On that same box, I can use sshuttle ...
1
vote
2answers
42 views

Rotating outgoing IP's

I want to rotate IP addresses for web-scraping, and here is my setup: I have configured multiple IP addresses as below in my /etc/network/interfaces file: # The loopback network interface auto lo ...
3
votes
1answer
138 views

How do I automatically ban udp short packet with fail2ban?

This logfile /var/log/kern.log contains some IP addresses, which I would like the system to automatically ban/block. Basicaly, a packet is from the UDP protocol, and is a short packet, then I would ...
1
vote
3answers
3k views

Routing between two subnets using a Linux box with two NICs

I have a Linux box with two NICs, each connected to a different LAN: Network A: 192.168.1.0 255.255.255.0 Network B: 192.168.2.0 255.255.255.0 The routers are: 192.168.1.1 192.168.2.1 Linux NICs are ...
2
votes
1answer
36 views

Block traffic to certain servers

In my organization, I'd like to make sure all servers are only accessible from the inside. The only exceptions are the mail and webservers. What's the best way to do this? My own suggestion was ...
2
votes
2answers
1k views

Iptables: Forwarding packets doesn't work

I have 3 Linux Systems A, B and C. A is a TCP Client and sends a message to TCP Server on C. A can see only the external IP of B which is at wlan0 interface, 192.168.0.3 ------------------ ...
1
vote
1answer
882 views

iptables block 1 ip, nat

I have a server with 2 interfaces. a small netework connects to eth0 and gets out to internet on eth1. To allow 1 ip to nat I use iptables -t nat -A POSTROUTING -o eth1 -s 192.168.0.23 -j SNAT ...
0
votes
1answer
1k views

Iptable l7-filter installation guide and block p2p

I would install l7-filter to block P2P torrent, First of all , I have a linux debian. I installed by the below command apt-get install l7-filter-userspace And then run command iptables -I FORWARD ...
1
vote
1answer
63 views

iptables starts dropping packets; temporarily fixed by doing restart; only from home

I am running a small apache2/iRedMail server but I am having an issue with iptables. After a while of working correctly (hours) my server is unreachable edit: from my home internet connection on some ...
6
votes
3answers
6k views

iftop - how to generate text file with its output?

iftop is great tool to view almost live bandwidth usage distinguished by source-ip source-port destination-ip destination port. I'm using it to see which client's ip is using most bandwidth. Now I ...
2
votes
0answers
27 views

UDP Traffic from outside to docker container is dropped after container restart

following situation: i have a hardware box with Ubuntu 14.04LTS as host for docker 1.4 I'm running an ELK stack in several containers. Curenntly the logstash container is exposing only port 514 to ...
0
votes
1answer
878 views

iptables: No chain/target/match by that name.

I am using this command to attempt to block this vulnerability scanner based on it's string, which is returning an error. # iptables -I INPUT -j DROP -d xxx.xxx.xxx.xxx -p tcp --dport 80 -m string ...
0
votes
0answers
16 views

Docker containers connecting to a host daemon

I would like to run a daemon on the host and get the containers connect to it. I was thinking I will bind the daemon on the host to 127.0.0.1 and then have something (delegate? or is iptables enough?) ...
0
votes
0answers
26 views

OpenVPN server cannot ping client (routing/iptables issue?)

I am not sure exactly where the issue is here. I'm fairly sure that this is some NAT or iptables issue on the OpenVPN server but am lacking the networking know-how to fix the issue. The crux of the ...
0
votes
1answer
23 views

Configuring IPTables without connection tracking module

Usually connection tracking is required for outbound connections to allow established connections back in, for instance: iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT I don't ...
0
votes
3answers
1k views

Forward traffic to local LAN IP while keeping the originator IP

I am trying to forward traffic from one server to another, while keeping the origin requestor IP. Therefor I cannot use SNAT or MASQUERADE. SERVER A: Public IP: 111.111.111.111 Private IP: 10.0.0.1 ...
1
vote
2answers
4k views

Centos 7 save iptables settings

Problem: iptables resets to default settings after server reboot. I'm trying to set rule like this: iptables -I INPUT -p tcp --dport 3000 -j ACCEPT after that I do: service iptables save and it ...
1
vote
0answers
22 views

Strange entries in Squid3 access.log

My WiFi network for guests is transparently proxied by Squid3. There's now a girl from Indonesia with her Samsung GT-B5330 running Android 4.0.4, who gets blocked by "The requested URL could not be ...
1
vote
0answers
45 views

linux not replying to an arp request

I am running linux 3.14 on a system with 2 interfaces. on the first interface, i can access our local network. on the second interface, arp packets come in but linux doesn't send out reply. is it ...
10
votes
6answers
19k views

Delete a iptables chain with its all rules

I have a chain appended with many rules like: > :i_XXXXX_i - [0:0] > -A INPUT -s 282.202.203.83/32 -j i_XXXXX_i > -A INPUT -s 222.202.62.253/32 -j i_XXXXX_i > -A INPUT -s ...
5
votes
1answer
98 views

Load balancing network traffic using iptables

I am trying to load balance traffic from internal LAN on a linux router having two gateways. Initially I went for the iproute implementation which didnt balance the load as expected, reason being that ...
1
vote
2answers
845 views

How to redirect a website using IPtables?

I have referred to the following links before asking this question. I am making an example for my students on NAT - pre-routing. Here, I am trying to replace the destination ip with the one I want. ...
5
votes
4answers
2k views

Openvpn, forward packets very slowly

I rebooted my server, and an odd issue just came out. I am running on ArchLinux, the clients are Ubuntu, Android and Mac. The problem is that accessing the internet via the clients is slow, about ...
0
votes
1answer
2k views

SSH Socks Proxy wiith iptables REDIRECT

I have googled and haven`t found the answer on my question. Help me please. There are two servers: serverA with public IP 12.0.0.10 and an private IP 10.0.0.5 serverB with public IP 20.0.0.11 I ...
9
votes
2answers
15k views

How to enable iptables (instead of firewalld) services on RHEL 7 and Fedora 18?

The newest fedora has firewalld as new firewall aplication. I liked old iptables services. I want them back but have no idea how to do that. I have tried : systemctl disable firewalld.service ...
-1
votes
0answers
35 views

Access to alternative DirectAdmin port is removed from iptables after a while

First i installed csf. Then these auto block rules: http://help.directadmin.com/item.php?id=380 Next i opened a different port in csf for directadmin to listen to. Also added the exception to ...
3
votes
1answer
42 views

iptables-restore is creating dangerous rule

I'm having this definition file: *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [0:0] :Firewall-INPUT - [0:0] -A INPUT -j Firewall-INPUT -A FORWARD -j Firewall-INPUT -A Firewall-INPUT ...
1
vote
1answer
81 views

Why is conntrackd not replicating state?

I have a problem with an active/active firewall cluster where the connection tracking state in the firewall does not seem be be being replicated. It's active/active because I have two routers ...
-1
votes
0answers
12 views

iptables fails between two NICs and 2.6.32.64 kernel

Until recently we used to split our WAN traffic and send it to two NICs (eth0 and eth1) apllying iptables: $IPTABLES -A OUTPUT -s $PRI -p tcp -m tcp -j MARK --set-mark 0x02 -t mangle $IPTABLES -A ...
1
vote
2answers
27 views

Iptables: Filtering string encrypted by ssl

I need to filter (send to BANRULES set) incoming http/https packets with a certain string (matchword). I do it easy when ssl is not in use (port 80): iptables -A INPUT -p tcp -m tcp --dport 80 -m ...
1
vote
1answer
49 views

When iptables is started, there is no ftp access because of timeout

When I start the iptables service, there is no ftp access because of a connection timeout. When I stop the iptables service, ftp works fine. This is the current iptables data: Update: replaced ...
-2
votes
2answers
42 views

How to improve IP tables for web server [closed]

this is my curreny /etc/sysconfig/iptables file for a webserver that must allow http, ftp and ssh access. *filter :INPUT ACCEPT [31395:4050333] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [30540:7083959] -A ...
0
votes
1answer
51 views

Routing between two interfaces

I have a network 10.0.0.0/24, a gateway with ip 10.0.0.1. On the gateway there are two interfaces. eth0 Link encap:Ethernet HWaddr 08:00:27:a1:24:2d inet addr:10.0.0.1 ...