iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

1
vote
1answer
14 views

ipset not being applied to iptables

I'm trying to filter out a country that keeps probing my SMTP server (CentOS6) and I can't seem to get the ipset to work out right in iptables. I downloaded that countries IP addresses from ...
0
votes
0answers
5 views

CONFIG_NF_CONNTRACK is not set [migrated]

I am trying to setup iptables on udoo quad but I hit a brick wall and cannot find a fix anywhere: root@udoo:/# uname -a Linux udoo 3.0.35 #10 SMP PREEMPT Wed Jul 30 18:16:10 CEST 2014 armv7l ...
0
votes
1answer
23 views

IPtables on Linux for mysql server private interface

Looking to make a mysql database server for web-servers. The server has a public & private interface and I need some assistance writing the rules. I want to only allow SSH, mysql via private ...
10
votes
5answers
6k views

How to duplicate TCP traffic to one or multiple remote servers for benchmarking purposes?

Infrastructure: Servers in Datacenter, OS - Debian Squeeze, Webserver - Apache 2.2.16 Situation: The live server is in use by our cusotmers every day, which makes it impossible to test ...
0
votes
1answer
7 views

can't initialize iptables table `nat' in Proxmox Openvz vm

When I tried to run an iptables command in the Proxmox OpenVZ vm, I got the following error: # iptables -t nat -A POSTROUTING -o venet -j MASQUERADE && iptables-save iptables v1.4.21: can't ...
0
votes
1answer
33 views

iptables not starting upon reboot

I've enabled iptables in systemd with: systemctl enable iptables but after restart when I try service iptables status, it shows: # service iptables status Redirecting to /bin/systemctl status ...
5
votes
1answer
107 views
+100

Iptables rule-set so that a docker container can access a service on a host IP

I have troubles accessing a host private interface (ip) from a docker container. I'm fairly certain that it's related to my Iptables rules (or perhaps routing). When I add the --net=host flag to ...
12
votes
1answer
3k views

What is the point of the docker-proxy process? Why is a userspace tcp proxy needed?

I have noticed that there is docker-proxy process running for each published port. What is the purpose of this process? Why is a user space tcp proxy needed for this? $ ps -Af | grep proxy root ...
0
votes
1answer
1k views

iptables forwarding through virtual interfaces

I'm trying to configure my computer as a gateway between two networks, but I cannot make it working for some reasons Here is a representation of the network: 192.168.1.101 192.168.1.102 ...
0
votes
0answers
11 views

DNAT not forwarding to correct (local) IP address

I'm trying to port-forward a HTTPS service which uses different SSL certificates for each of the several IP addresses on the machine. Web server listens on each IP address on the internal port (444) ...
-1
votes
1answer
21 views

IPTABLES not working, fail2ban still notifying me of instrusions from those ips

I added 200 hundred iptable rules like these: iptables -A INPUT -s 108.62.150.0/24 -j DROP iptables -A INPUT -s 109.108.64.0/19 -j DROP iptables -A INPUT -s 109.110.32.0/19 -j DROP to block russian ...
2
votes
1answer
53 views

How to create a private network between a VPS and 4 IPs?

I own a VPS running Debian and i want to avoid security breaches from "outside" (via Internet). I want to guarantee these rules: Allow all outbound traffic; Allow HTTPS connections from IP 1, 2, 3; ...
2
votes
1answer
737 views

Disable kernel processing of TCP packets for raw socket

I'm working on a TCP/IP implementation, for an embedded device, that I want to test from a Linux user space process using raw sockets. raw(7) says that Raw sockets may tap all IP protocols in ...
0
votes
1answer
27 views

iptables, redirect all port 80 to an IP but let one IP forwards through

My router redirects all incoming traffic (interface eth0) to IP 1.2.3.4 : iptables -t NAT -A PREROUTING -i eth0 -p tcp --dport 80 --to-destination 1.2.3.4:80 When a client hits "100.80.77.8", I'd ...
0
votes
1answer
11 views

No internet connection via my OpenVPN server

I have OpenVPN up and running on my server. I want all traffic from my clients to be routed trough the VPN server. The client connects just fine but is unable to connect to the internet. Server ...
0
votes
0answers
20 views

Centos 7 IPTABLES - SSH Lockout

I'm currently ruunning an OVH dedicated box, which specifically, has the following operation system installed: CentOS 7.1-1503 By default on CentOS 7 and above, the firewalld service is used ...
0
votes
1answer
29 views

How to use conntrack to allow SIP traffic

I have the following problem: Device (eth0)----> SWITCH(trunk)+VLAN120 ---> (PC1) +VLAN200 ---> (PC2) I am able to ping from PC1 to PC2 which are in ...
2
votes
1answer
2k views

CentOS error with iptables recent module

This is the rule in iptables for stop sync_flood attacks: iptables -A INPUT -m state --state NEW -p tcp -m tcp --syn \ -m recent --name synflood --set iptables -A INPUT -m state --state NEW -p tcp ...
0
votes
1answer
24 views

Seemingly acceptable iptables rule blocking NIS (ypbind) from operating

I am not an iptables expert. I have a use case to block all outgoing traffic that does not destined for either 10.0.0.0/8 or 167.114.0.0/16. I have two NIS servers (10.57.132.11, 10.57.132.40). I ...
0
votes
1answer
30 views

How to create advanced rules with firewall-cmd?

I want to create a rule using firewalld that uses criteria username or userID and maybe one other module criteria. In iptables, I think you can do things like iptables -A OUTPUT -m owner --uid-owner ...
0
votes
2answers
24 views

Iptables on Centos 7 doesn't work after reboot

I am on Centos 7, removed the new firewall and installed a classic iptables service. I have a guest machine in it with Debian 8.1 and static external ip. I do: echo 1 > ...
1
vote
0answers
27 views

Multicast destination NAT on same network interface, with netem

For testing purpose, in a big network where IT will shoot me if multicast data are not streamed in the right VLAN, I am trying to degrade multicast packets with a server running netem configuration. ...
3
votes
2answers
919 views

LXC networking with public IP

I have installed LXC in ubuntu server 12.04 using this link. It was installed successfully and i am able login using ubutu/ubuntu as username and password. Then I tried to setup network for LXC ...
0
votes
1answer
14 views

How do you sync ipset sets across two machines?

I would like to replicate IPSet sets from one machine (server01) to another machine (server02) using rsync or btsync or something similar. Is that possible? If so how do I do it? This is a redundancy ...
0
votes
1answer
2k views

SSH Socks Proxy wiith iptables REDIRECT

I have googled and haven`t found the answer on my question. Help me please. There are two servers: serverA with public IP 12.0.0.10 and an private IP 10.0.0.5 serverB with public IP 20.0.0.11 I ...
0
votes
1answer
15 views

Cant route traffic through OpenVPN on Debian 8

I have been trying to setup OpenVPN and have run into a bit of a hiccup, i have can't seem to route all my traffic through the server. I can connect to the server just fine but i can't seem to ping ...
3
votes
2answers
1k views

Shorewall: logging to custom file

I am running an Ubuntu Server 14.04 system with a shorewall firewall. Shorewall is essentially a front end to iptables, and it is iptables that does the logging via Netfilter (my understanding so ...
1
vote
0answers
28 views

Ubuntu 12.04 Router Firewall TTFB Delay

I use Ubuntu Server as my router/firewall for my network for a number of reasons. Until recently, I was using 10.04 with great success for this purpose. The OS provides DNS lookup and DHCP using ...
0
votes
1answer
20 views

Iptables time-based rules having no effect - Gateway with 2 NICs

I have a network with the following topology: - WAN Modem with NIC facing the gateway: 192.168.0.1 - Ubuntu 14.04 gateway with two NICs: 1) Eth0 (facing the modem): 192.168.0.201 2) Eth1 (facing ...
0
votes
4answers
1k views

Server not reachable on all TCP ports from all locations [on hold]

I have a very strange situation on a Linux (CentOS) server. Firstly, from my Ubuntu desktop PC, I can successfully connect to all services that are running on it, on ports 22, 80, 8080 and others. ...
0
votes
1answer
27 views

Gateway can't ping client

I try setup a new gateway in my virtual network. But sure I' have a problem. The Gateway cannot ping client but client can ping other client and gateway. So I have check my iptables rule (I does'nt ...
-1
votes
0answers
23 views

Android 4.2.2 Tethering : IP Routing instad of NAT/Masquerade [closed]

When clients connect to Android Tethering they get IPs of the private Tethering networl. There is plenty of info available on how to NAT/Masquerade the tethering clients (for example into a VPN), but ...
0
votes
1answer
1k views

lots of UDP_IN Blocked errors

Since I have reinstalled my OS, I'm getting lots of UDP_IN Blocked errors in my messages log. Can anyone kindly explain what the error say exactly and what I can do to get rid of this error. Aug 8 ...
1
vote
1answer
3k views

strongswan VPN on OpenWrt

Hi I'm running Barrier Breaker version of OpenWRT and I have setup a VPN according to: http://wiki.openwrt.org/inbox/strongswan.howto I can connect to the VPN with my iPhone or Mac (to 10.10.1.0/24 ...
0
votes
1answer
1k views

apt-get update can not connect

i run a dedicated ubuntu 10.04 server. i use kvm/libvirt/virsh to run a virtual machine that's also ubuntu 10.04. i bridged the network (1 of 2 IPs is routed via NAT to the LAN, where my VM ...
0
votes
1answer
20 views

What rules do I need to remote desktop to a virtual machine where the host has iptables running?

I am attempting to remote desktop to a virtual Ubuntu install (headless on VirtualBox) that resides on a Linux host (Centos 6.6). I can reach it with no issue if I turn iptables off. I feel like I ...
0
votes
1answer
18 views

Why does iptables not doing DNAT for the same subnet? [duplicate]

I have the following NAT setup: +--------------+ +-----------------------+ +-------------------+ | | | | | | | | ...
0
votes
1answer
3k views

iptables forward rule not working in openwrt

I am trying to apply some iptables forwarding rules in openwrt. Here is my scenario - My server has two cards ath0 and br-lan. br-lan is connected to internet and ath0 to private network. The other ...
0
votes
1answer
36 views

Iptables drop forwarded traffic destined for interface IP address

I have a small VPN setup where I use IP tables to nat traffic coming in the vpn0 interface to the IP address of the eth0 interface. These rules look like this: iptables -t nat -A POSTROUTING -o eth0 ...
-1
votes
2answers
49 views

How to set up iptables for local router machine

I have set up a local linux (14.0.4 Ubuntu) machine as a router and can do the following ping server/router from the clients ping clients from server/router ping one client from the other ping the ...
0
votes
0answers
12 views

Isolate access point clients with iptables

Is there an effective and easy way to isolate access point clients so that they do not see each other over LAN ? I created an open access point with Kali Linux + Hostapd + dnsmask I want to make ...
2
votes
3answers
1k views

500 internal server error php long running process

I am trying to run a long php process and it ends with the 500 internal server error. It executes fine for about 8 mins. I have rebooted the machine after changing the php settings. PHP Config: ...
0
votes
0answers
21 views

Simple IPtables Script for Whitelisting (Amazon Endpoints)

I'm attempting to lockdown an Amazon EC2 instance which has a single open port for Amazon SNS. I can't use security groups to restrict the port as the IP is forever changing, so it must be open to all ...
2
votes
1answer
42 views

Simulate 2 clusters in the same network

I have 4 pc´s and another pc, which will act as a proxy, all being in the same network: 172.16.96.0/20 . I can ping between each other. But, I want to separate them into two groups. That is: pc1 is ...
0
votes
1answer
42 views

How to route traffic between 2 VLANs on different subnet

I have the following problem: I have one interface eth0 with IP 172.20.51.61/24 I have configured 2 VLANS on the same machine: eth0.120 : 172.20.52.61/24 eth0.200 : 172.20.54.61/24 I also have a ...
1
vote
0answers
19 views

IPTables, route specific port through VPN

I'm running my own mail server at home on a dynamic IP. Dynamic IPs are often blacklisted, so I currently send out mails through my provider's relay. I want to change that to sending mail directly, ...
0
votes
1answer
31 views

Prevent squid forwarding twice with transparent and non-transparent setup

I'm running squid in a small network. I've setup a couple of squid listening ports for different scenarios: http_port 3128 - This is will be pushed to Windows clients via domain policy, with the ...
0
votes
1answer
39 views

Delaying packets with libnetfilter_queue

From my Raspberry Pi configured as an access point, I set the following rules: sudo iptables -I FORWARD -p tcp --sport 25 -j NFQUEUE --queue-num 0 sudo iptables -I FORWARD -p tcp --sport 80 -j ...
1
vote
0answers
26 views

TLS Error: Handshake failed. Openvpn Server is behind NAT on dynamic ip

this is a common problem that appears easily in searches and seems to be related to the firewall , yet I can't seem to figure out how to fix it. I have actually asked before, but this time I come back ...
0
votes
1answer
28 views

How can I do site-to-site OpenVPN routing without NAT

I have two OpenVPN servers at different location. Each machine in one location can ping and connect to every machine in the other location. My problem is when I use SSH to connect from machine A in ...