iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

1
vote
0answers
30 views

Ban IP doesn't work with forwarding

I use à VPS like a bridge for an other server. I use apf-firewall and this file /etc/apf-firewall/preroute.rules for forward somme port one the other server. This is the end of the file: iptables ...
0
votes
2answers
2k views

Remove Iptables log from kern.log syslog messages

I'm having trouble with Iptables logs, i'm not able to get them out from kern.log, syslog and message files. I added two rules in rsyslog.conf which redirect my messages to an "iptables.log" file but ...
0
votes
0answers
11 views

Filter Traffic Between Virtual Machines

I have a machine with Fedora 21 which acts as a host system for two virtual machines. The VMs are made up using QEMU/KVM/libvirt/virt-manager. One VM is running a webserver, the other VM acts as a ...
2
votes
0answers
25 views

Whitelisted MAC address not getting access to NAT'd network

I'm in the process of setting up a whitelist-based router and am encountering issues when trying to grant access to clients. Follows is my current iptables configuration # Generated by iptables-save ...
6
votes
3answers
2k views

Limiting interface bandwidth with tc under Linux

I have a linux router which has a 10GBe interface on the outside and bonded Gigabit ethernet interfaces on the inside. We have currently budget for 2GBit/s. If we exceed that rate by more than 5% ...
1
vote
1answer
89 views

Docker containers connecting to a host daemon

I would like to run a daemon on the host and get the containers connect to it. I was thinking I will bind the daemon on the host to 127.0.0.1 and then have something (delegate? or is iptables enough?) ...
0
votes
1answer
2k views

Iptable l7-filter installation guide and block p2p

I would install l7-filter to block P2P torrent, First of all , I have a linux debian. I installed by the below command apt-get install l7-filter-userspace And then run command iptables -I FORWARD ...
1
vote
1answer
29 views

iptables block net range

I'm trying to REJECT network via iptables(8) and for whatever reason it is not doing so: # cat /etc/redhat-release Red Hat Enterprise Linux Server release 6.6 (Santiago) # uname -a Linux X ...
2
votes
2answers
49 views

Exposing private network ip

I have the following setup: Box A eth0 - 192.168.1.101 eth1 - 10.10.2.1 Box B eth0 - 10.10.2.2 Box A has internet access through eth0. I want Box B to be visible on the 192.168.1.0/24 network, so ...
0
votes
3answers
2k views

Forward traffic to local LAN IP while keeping the originator IP

I am trying to forward traffic from one server to another, while keeping the origin requestor IP. Therefor I cannot use SNAT or MASQUERADE. SERVER A: Public IP: 111.111.111.111 Private IP: 10.0.0.1 ...
8
votes
5answers
4k views

How to duplicate TCP traffic to one or multiple remote servers for benchmarking purposes?

Infrastructure: Servers in Datacenter, OS - Debian Squeeze, Webserver - Apache 2.2.16 Situation: The live server is in use by our cusotmers every day, which makes it impossible to test ...
1
vote
1answer
21 views

iptables 'rewrite' requests on a certain port?

Alright, my situation is basically this... I have a box that's acting as a router, with 2 interfaces, eth0 and eth1. eth1 is my uplink, that is it is the interface through which the box is obtaining ...
0
votes
2answers
2k views

iptables returns me “no chain/target/match by that name”

Been trying to run iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o venet0:0 -j MASQUERADE and I keep getting the above error message. Trying to set up openvpn on my server. Does anyone have any ...
0
votes
1answer
1k views

Gre Tunnel Cisco Linux traffic forwarding

I setup a gre tunnel a cisco router and a Linux machine, the tunnel interface in the Linux box named pic. Well i have to forward traffic coming from cisco through the Linux box. the rules i've set in ...
6
votes
5answers
4k views

Copying packets from an interface to another

I have a Linux system (let it be A) with 2 ethernet cards, namely eth0 and eth1 which are attached to two totally unrelated LANs. Basically eth0 is used for normal application traffic and eth1 is ...
0
votes
2answers
33 views

Iptables rule to match on mac address fails

Why is the following simple IPtable rule not working? iptables -A INPUT -s 192.168.1.88 -m mac --mac-source 00-27-0E-33-4B-B2 -j DROP Actually I want to inverse the match. Something like this: ...
-3
votes
1answer
35 views

How to set up port forwarding from Windows host to Vagrant Linux VM to Docker containers?

I'm using a Windows host, running CoreOS in Vagrant with VirtualBox provider, and in that CoreOS, I have Kubernetes 0.14.2 single-node cluster running (I couldn't get latest version, 0.15, to work ...
0
votes
1answer
18 views

IPTables not working as expected for ssh control

I have the following rules, which for testing is all that I have: iptables -F iptables -A INPUT -p tcp --dport 22 -j DROP iptables -A OUTPUT -p tcp --sport 22 -j DROP iptables -A INPUT -i em1 ...
0
votes
4answers
15k views

Allow traffic to/from specific IP with iptables

i want to allow all traffic to specific ip, using iptables. tryed by adding lines: /sbin/iptables -A INPUT -p tcp -s XXX.XXX.XXX.XXX -j ACCEPT /sbin/iptables -A OUTPUT -p tcp -s XXX.XXX.XXX.XXX -j ...
3
votes
1answer
12 views

Routing SMTP Connections to Different IP Sets with IPTables

I'm trying to set up two different IPs for SMTP that each get routed to two different sets of IPs, with no IPs shared between the two sets. I'm trying this, but it mixes the two sets of IPs so that ...
3
votes
1answer
42 views

How to test iptables settings by port scanning?

I want to test my iptables and prove that it only allows traffic for given Protocol / Port - combinations. How I can use as a target for a port scan?
1
vote
3answers
266 views

What is the best way to get PRECISE domain name from ip address logged in iptables log

In iptables I am logging certain public IP addresses... say of websites visited from different workstations, depending on destination port number... All this is not really relevant to the question but ...
1
vote
1answer
24 views

IPTABLES -L OPTION NOT SHOWING SNAT RULE

I am able to get NAT to work using the following snat rule: iptables -t nat -A POSTROUTING -o em2 -j SNAT --to 192.168.2.2 My question is: Why is this rule not displayed when I issue the ...
1
vote
1answer
85 views

iptables failed to forward packages to NFQ

I have set the following rules in iptables: sudo iptables -I INPUT -i eth0 -p tcp -s 192.168.37.184 -j NFQUEUE sudo iptables -I OUTPUT -p tcp --dport 3306 -j NFQUEUE What I want to do is forward ...
4
votes
3answers
5k views

Using FTPS (FTP over explicit TLS/SSL) with active ftp?

I am using vsftpd with active ftp. I have module "ip_conntrack_ftp" (in /etc/sysconfig/iptables-config) on and port 21 is open. Connecting with FTP works, but FTPS doesn't. I can login but get no ...
0
votes
1answer
917 views

Masquerade traffic from certain source IP to VPN connection

Network Setup: 10.0.0.1 Router: to internet 10.0.0.70 Server: Ubuntu based server,default gateway is 10.0.0.1 10.0.0.51 PC I created a PPTP connection(interface: ppp0) on Server to a machine ...
1
vote
1answer
75 views

Chinese Firewall DDoS and IPtables not working

Recently my server has been hit with DDoS's coming from the Great Chinese Firewall. As per the advice in one of the replies in mod_security block requests by http-host header, and the advice in ...
0
votes
1answer
36 views

Route traffic through private IP for only certain hosts - CentOS 6.6

I am having a weird problem which I cant figure out - so I was hoping someone here could give me a hand. First off the end goal is that a specific server in my network runs an IPSEC connection to ...
5
votes
4answers
3k views

Openvpn, forward packets very slowly

I rebooted my server, and an odd issue just came out. I am running on ArchLinux, the clients are Ubuntu, Android and Mac. The problem is that accessing the internet via the clients is slow, about ...
2
votes
1answer
42 views

Port 8080 remains closed even when opened with iptable and nodejs is listening on it [duplicate]

I am trying to install a nodejs server listening to port 8080 that I opened with iptable but when I run nmap or a web tools I always get the message that the port is closed. I'm on a Ubuntu vps. ...
0
votes
0answers
23 views

How to set up Iptables SNAT with dynamically assigned public IP address

I am trying to set up a system to do NAT and other iptables-stuff (like logging, firewall, monitoring, etc.). The ISP provides a dynamic IP address and the DSL modem does NAT. I have the following ...
0
votes
3answers
58 views

Assign IPs to programs/processes

I need to assign different IP addresses to different processes (mostly PHP & Ruby programs) running on my Linux server. They will be making queries to various servers, including the situation ...
1
vote
1answer
890 views

Ubuntu iptables logs not going to any log file

I am trying to put logs in iptables but I can not find any log in any file. Although when I run dmesg command, I can see the iptables entries. But the same entry doesn't go to any log file. Here is ...
2
votes
2answers
1k views

Iptables: Forwarding packets doesn't work

I have 3 Linux Systems A, B and C. A is a TCP Client and sends a message to TCP Server on C. A can see only the external IP of B which is at wlan0 interface, 192.168.0.3 ------------------ ...
0
votes
0answers
35 views

IPTABLES and GEOIP: Show Custom Webpage to Blocked Visitors

Because of legal protection, as a first stage of launching my project I will focus on couple of countries only. The number of supported countries will grow. I know, it is possible to block or allow ...
0
votes
0answers
29 views

How to configure iptables when running Docker

I have a difficult situation here, i have setup many containers on my docker host, running different applications like mailserver, databases, redis, and certain html applications using other ...
0
votes
1answer
998 views

iptables denies internal access to port 17500

In the kernel log there are hundreds of these lines. The source is the external IP of the VPS (not localhost nor 127.0.0.1), other times an IP of the network of the VPS provider. The source port and ...
5
votes
3answers
4k views

How do you test iptables rules to prevent remote lockout and check matches?

As I'm learning about iptables I've made a couple of mistakes and locked myself out. What method(s) do you use to test rules without locking yourself out? I'm using ubuntu server 12.04 LTS All ...
1
vote
2answers
26 views

iptables performance - iprange vs subnets

I want to allow a range of ip addresses - two /24 subnets, which don't fall under /23. I have two options: Use two rules with /24 masks and -s option Use single rule with -m iprange and specify ...
0
votes
1answer
15 views

Do I need to set rules for source and destination ports for outgoing rules on iptables?

I'm using puppetlabs firewall module and I'm having troubles setting up iptables for a simple web host. I'm following this guide and want to set up additional rules. ...
0
votes
0answers
24 views

How to allow applications in network namespace access to global filesystem?

I have several applications that are potentially high-risk and high-throughput (like bind, ntpd, etc.). I plan on having a "management domain" for OS tasks, updates, SNMP, automation, etc. and a ...
-1
votes
1answer
42 views

Forwarding ports and traffic to VPN tunnel

I've installed OpenVPN on my VPS. I have one question: how to forward traffic going to that VPS to go to VPN tunnel created with my local PC. I will use TCP connection. The whole traffic will be like ...
0
votes
1answer
28 views

Return OpenVPN Internet clients' traffic to non-default gateway

At home I have an OpenVPN server which is at the same time an OpenVPN client. The purpose is to share one foreign IP address between several devices. In the local network everything works fine since ...
0
votes
1answer
24 views

Allowing all ports from an IP

I have successfully entered the following command to iptables sudo iptables -I INPUT -p tcp --dport 5000:5020 -j ACCEPT -m comment --comment "Allow Ports 5000s" However, AFAIK this allows access to ...
52
votes
5answers
7k views

I accidentaly forbid SSH connection to a remote server… What's next?

Let's say it again, we all make mistakes, and I have just made one. A brief history: I was doing some stuff on a VPS (Debian) I'm renting, when I noticed some strange behaviour. Using the netstat ...
1
vote
0answers
23 views

iptables foward to multiple interfaces with NAT

I want to use iptables for provide NAT translation and forward the packets out a different interface. The network set-up is as follows: Alias: eth0:220 with IP address 10.1.1.220 / 255.255.252.0 ...
1
vote
0answers
37 views

Effect of firewall on virtual machine [closed]

We have a ubuntu-12.04 host machine that has another ubuntu-12.04 guest machine running in it. The network interface between the two is bridged. I would like to put the host machine behind a firewall, ...
-5
votes
3answers
55 views

How I can Block all China to entry to my server [closed]

How I can Block China to entry to my server ? All China country ? By ipset and iptables I want by this to avoid DDOS attacks OS: CentOS 6.6 Thanks.
0
votes
1answer
21 views

Iptables - How can i limit the access of a service on a server with two ips?

On my personal server ( Centos 6.6 ), i acquired a secondary ip in order to keep all backend access splitted from the frontend applications. But i'm not sure how can i specify wich port can be ...
0
votes
0answers
26 views

KVM port-forwarding from ppp0 to VM's bridged NIC not working, but to VM's NAT NIC works?

I've spent a lot of time on this freaky problem, I've created a simple host and VM configuration to try isolate the problem. Terminology in this question Host: The bare metal server VM: The KVM ...