iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

4
votes
0answers
2k views

ip6tables port redirect with TPROXY on IPv6 only

Our server is IPv6 only connected and an applications listen to port 8080 at private network, but we need port 80 at public Internet. On purpose of testing, when opening the firewall for port 8080, ...
3
votes
0answers
57 views

How to split traffic through two different network adapters based on TCP port in OS X

I have a scenario where we will be using a Mac to stream video content to an RTMP server. This RMTP service provides 2 ingest URLs so that you can upload the same video content twice and have ...
3
votes
0answers
167 views

How do iptables work with NFQ in terms of traffic shaping in snort?

I'm trying to understand how iptables and NFQ work together with snort. The reason that I ask this is because from what I understand snort can be set to IPS via NFQ but if you have iptables there ...
2
votes
0answers
17 views

Samba server disappears from the browser list after a period of time

I have a Ubuntu server running as a router. On the server I use iptables and DHCP 3.1.3, Samba 3.4.7 and OpenVPN 2.1.0 server. I have problem with Samba server disappears from the VPN client browser ...
2
votes
0answers
39 views

Understanding packets dropped by iptables from puppetmaster

I am seeing packets getting dropped during my puppet client runs on a semi regular basis. And I do not understand what is causing this. I should mention that Puppet is managing the firewall rules ...
2
votes
0answers
114 views

pf (Mac OS X) rule to redirect all traffic to a specific ip/port

I'm trying to recreate this iptables setup (from https://github.com/darkk/redsocks) with pf: iptables -t nat -A REDSOCKS -p tcp -d 10.0.0.0/8 -j REDIRECT --to-ports 12345 iptables -t nat -A OUTPUT -p ...
2
votes
0answers
79 views

Change sender-IP for VM in libvirt behind NAT

I have a server with my own public /28 IPv4 Network. On this server I have some vServers, done with KVM/libvirt. These vServers are connected with a virtual network, NATed to the internet. Every ...
2
votes
0answers
235 views

firehol simple config doesn't work on Debian 7

I'm trying to set up a very simple firehol setup under a brand new Debian7 server. I only installed ssh and sudo before this Installed firehol with sudo apt-get install firehol Changed the config ...
2
votes
0answers
85 views

OpenVPN running on Internet Gateway, so all private clients can access VPN with no config

Our LAN connects to our office gateway machine (192.168.1.1), which is connected to the Internet. I have setup NAT/Masquerading for this purpose with no issue. We also use OpenVPN to connect to our ...
2
votes
0answers
383 views

Using ufw on OpenVZ-based VPSes

I'm facing with a problem to set up ufw on Ubuntu 12.04 running on an OpenVZ-based VPS. I know there is limitations for ufw. I googled a bunch of articles how to resolve the issue (like: ...
2
votes
0answers
93 views

Some packets are dropped in [wan-local], when DNAT rule exists

I am running EdgeOS (aka vyatta 6.3 aka debian) with 3.4.27. There are two DNAT port forwarding rules like this: rule 1 { destination { port 65432 } inbound-interface eth0 inside-address { ...
2
votes
0answers
1k views

Forwarding udp ports iptables packets “lost”?

I have a Linux router (Debian 6.x) where i forward some ports to internal services. Some tcp ports (like 80, 22...) are OK. I have one Application listening on port 54277udp. No return is coming from ...
2
votes
0answers
533 views

A minmal iptables ruleset for a high volume Nginx reverse proxy (or: how to use NOTRACK for http and https)?

I'm looking for a minimal iptables ruleset for a rather high volume Nginx/Varnish reverse proxy. I'd like to close down the server, so that only ports 80 and 22 are open at all for connections from ...
2
votes
0answers
171 views

Virtual guest doesn't NAT when using the hosts IP

I am using lxc to host some services. I wish to expose one of these services to the outside world. I have setup three NAT rules on my host using iptables, one for the eth0, one for br0 (the bridge ...
2
votes
0answers
197 views

iptables ipt_recent recent module number of IP to remember

One of the parameters of ipt_recnet is ip_list_tot which dictates the number of IPs to remember. What happens if it reaches that limit? Is it going to stop recording new IPs?
2
votes
0answers
2k views

Routing only some local IPs through VPN on dd-wrt

Much similar to this entry: http://serverfault.com/questions/94283/using-dd-wrt-to-connect-to-vpn-and-forward-all-traffic-of-certain-devices-through , I have set up my router with dd-wrt + OpenVPN to ...
1
vote
0answers
21 views

Unable to connect to web server hosted in private subnet of VPC via NAT hosted in public subnet

I have hosted my android/web application on a EC2 instance in the private subnet (10.0.1.0) of my VPC. This instance has apache-tomcat installed on it, but does not have a public IP. I also have a ...
1
vote
0answers
14 views

Docker's iptables=false option seems to have not the desired behavior

Good morning at all. I am running Ubuntu 14.04 server and Docker 1.8.1 and UFW is my front-end to manage iptables. I need to run an application into a container. I do need the following behavior: ...
1
vote
0answers
36 views

Ping not reaching in OpenVpn clients to subnet and vice versa

I have a vpn server which is connected to vpn client having ip 10.30.0.x now. I want it to able to ping another private client connected to vpn server. Please note that other private client is private ...
1
vote
0answers
14 views

iptables rule limiting the number of connection in a broken pipe case

I am limiting the number of SSH connections using iptables but in case of, for example, a broken pipe (computer goes sleep mode, network problem, etc.) I am no longer able to reconnect. The rule I ...
1
vote
0answers
34 views

forward vpn traffic from tun1 to tun0

I've been banging my head on this for a while and gave up trying to figure it out. My knowledge about routing and iptables is just too limited to understand this it seems. I have configured a split ...
1
vote
0answers
43 views

Multicast destination NAT on same network interface, with netem

For testing purpose, in a big network where IT will shoot me if multicast data are not streamed in the right VLAN, I am trying to degrade multicast packets with a server running netem configuration. ...
1
vote
0answers
42 views

Ubuntu 12.04 Router Firewall TTFB Delay

I use Ubuntu Server as my router/firewall for my network for a number of reasons. Until recently, I was using 10.04 with great success for this purpose. The OS provides DNS lookup and DHCP using ...
1
vote
0answers
44 views

IPTables, route specific port through VPN

I'm running my own mail server at home on a dynamic IP. Dynamic IPs are often blacklisted, so I currently send out mails through my provider's relay. I want to change that to sending mail directly, ...
1
vote
0answers
37 views

Investigating connectivity issue

I'm trying to set a up a new service on a server that is running apache, however it seems like incoming traffic on that specific port is blocked, although I do not understand why. On the first server, ...
1
vote
0answers
36 views

Get Original Destination Port From iptables

I would like to create a local server that acts as a proxy for all trafic, but how would I determan the original ports when using iptables to rederect the network traffic. I need this for when the ...
1
vote
0answers
39 views

Fail to redirect requests to specific url to localhost

I have a server that listens on http://localhost:3000 and I want to forward all requests to http://api.lingualeo.com/addword from Chrome extension (some JSON data) to http://localhost:3000. What I ...
1
vote
0answers
78 views

Linux ipv6 forwarding

Situation I know how to do ipv4 forwarding, and expected ipv6 forwarding to work pretty much the same way. So I configured a VirtualBox host with the network address configured from my ISP. Right ...
1
vote
0answers
513 views

How to configure iptables when running Docker

I have a difficult situation here, i have setup many containers on my docker host, running different applications like mailserver, databases, redis, and certain html applications using other ...
1
vote
0answers
59 views

iptables foward to multiple interfaces with NAT

I want to use iptables for provide NAT translation and forward the packets out a different interface. The network set-up is as follows: Alias: eth0:220 with IP address 10.1.1.220 / 255.255.252.0 ...
1
vote
0answers
263 views

Virtual IP Pool for NAT with StrongSwan VPN

I'm trying to wrap my head around a site-to-site VPN configuration using StrongSwan that will allow remote sites to connect to our AWS VPC. The catch is, the remote gateways will potentially be using ...
1
vote
0answers
195 views

openvpn TLS handshake fails on client because firewall drops packets (but why?)

I seem to have problem with my openvpn server - client connection. now, the important information is in the log (verb3) of my client: Mon Mar 30 17:09:59 2015 OpenVPN 2.2.2 ...
1
vote
0answers
118 views

How to block hping3 SYN ACK efficiently with iptables?

Actually I'm trying to execute a SYN TCP flood on my Debian web server with nginx and, by executing tcpdump "tcp[tcpflags] & (tcp-syn) != 0" while flooding, I see all packets coming. I already ...
1
vote
0answers
350 views

Squid intercept proxy stuck with forwarding loop

I'm trying to set up a debugging proxy using Squid, mainly to test our own client communications library for various proxy types (one possibility with our client, is to connect to an external ...
1
vote
0answers
17 views

Troubles with subnets and redirections

What I want to create is 2 subnets that communicate each other through a gateway. Here is my gateway: wlan0 Link encap:Ethernet IndirizzoHW c4:46:19:69:b7:a5 indirizzo ...
1
vote
0answers
2k views

squid transparent proxy for https / ssl trafic

I am trying to configure squid as transparent proxy , I followed below steps to configure Downloaded squid3.5 from the website, As squid3.1 will not support for ssl bump ./configure ...
1
vote
0answers
71 views

iptables keeps using old nat rules

I use iptables snat on my gateway to change local source ip addresses to external. The trouble is that after I change the rules (or even if I flush iptables nat table) gateway keeps using the old rule ...
1
vote
0answers
100 views

Connect AWS and Azure via OpenVPN

I am trying to connect two networks (AWS and Azure) together via OpenVPN. I am aware of other implementations (OpenSwan+Azure GW etc.) but I need maximal portability as I will be expanding this to ...
1
vote
0answers
150 views

How to use iptables or IFB to mark incoming traffic by device?

I'm trying to use iptables to mark incoming packets based on the device where those packets arrived (rather than their originating IP address or port etc), but haven't found a way of getting this to ...
1
vote
0answers
99 views

OpenVZ : live migration fails

I can't launch live migration of OpenVZ container between two proxmox nodes... Feb 05 03:30:27 starting migration of CT 102 to node 'madrid' (xx.xx.xx.xx) Feb 05 03:30:27 container is running - using ...
1
vote
0answers
49 views

Clone and then route SNMP traps to new destination

We have 2 SNMP trap servers 10.0.0.1 and 10.0.0.2 which are the SNMP trap servers for close to 500 devices that we monitor.In all these 500 devices,10.0.0.1 and 10.0.0.2 are configured as the trap ...
1
vote
0answers
80 views

Redirect incoming WAN connection to other WAN host with iptables

I have router with Linux. I want to redirect incoming WAN connections with specified port to some other WAN host:port. I've tryed do this standard way: iptables -t nat -A PREROUTING -p tcp --dport ...
1
vote
0answers
86 views

iptables traffic after forwarding

I have 2 servers Server A and Server B ServerA = 1.1.1.1 ServerB = 2.2.2.2 I am using ip-tables to send all traffic on port 80 to Server B on Server (A) 1.1.1.1 i have done iptables -t nat -A ...
1
vote
0answers
29 views

How can I proxy requests to a specific IP to a different IP on OS X?

On OS X how can I setup a route so that when I make a request to 10.0.0.1 it is redirected to localhost? Right now I can do curl localhost:3000 and get back a blob of HTML from my running node web ...
1
vote
0answers
62 views

Strange entries in Squid3 access.log

My WiFi network for guests is transparently proxied by Squid3. There's now a girl from Indonesia with her Samsung GT-B5330 running Android 4.0.4, who gets blocked by "The requested URL could not be ...
1
vote
0answers
131 views

linux not replying to an arp request

I am running linux 3.14 on a system with 2 interfaces. on the first interface, i can access our local network. on the second interface, arp packets come in but linux doesn't send out reply. is it ...
1
vote
0answers
181 views

amazon ec2 instance going to a remote ip using openswan tunnel is up but no traffic being established on the remote ip

I having establishing a vpn tunnel to a remote peer/public ip using amazon ec2 openswan. The tunnel is up but no traffic has been seen on our side or the remote side? Is there I been missing? Please ...
1
vote
0answers
610 views

Fail2Ban Correctly Attempts to Ban IP but IP does not get banned - iptables chain exists but not working

Running on Ubuntu 14.04 Server. So I have fail2ban correctly configured to process /var/log/auth.log for SSH login attempts. Upon 3 failed attempts I see this in the fail2ban log: 2014-11-19 ...
1
vote
0answers
102 views

Dovecot/Postfix mail server replies to [SYN] with [RST, ACK] when user attempts to connect (POP3). Likely iptables?

Currently I am trying to trouble shoot an e-mail server that will allow users to send e-mail, but not log in to the server (POP3) or receive e-mail using their Outlook clients. Previously this was ...
1
vote
0answers
210 views

Forward single port between subnets on dd-wrt router

I have a DD-WRT router with two subnets, 192.168.0.0/24 and 192.168.8.0/24. The latter is used for a 'guest' WiFi network. Traffic between subnets is filtered using iptables. What I would like to ...