iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

3
votes
0answers
566 views

Limiting bandwidth with hashlimit (e.g. kb/s — not connections!) doesn't work, though the man page says it should

According to the iptables-extensions man page hashlimit can do bandwidth limiting: "flows exceeding 512kbyte/s" => --hashlimit-mode srcip,dstip,srcport,dstport --hashlimit-above 512kb/s ...
3
votes
0answers
248 views

Monitoring Linux Kernel Space Processing

I'm running two "services" that are served in linux kernel-space: Linux Netfilter Firewall ("iptables") Linux Virtual Server Loadbalancer ("IPVS", "LVS") Now I want to (performance-)monitor my ...
3
votes
0answers
2k views

ufw deny all incoming and outgoing not working!

I'm sure I'm doing something wrong. I'm expecting my current rules of "denying all incoming/outgoing" to cripple anything network related, but it's not. First, I did: sudo ufw default deny incoming ...
2
votes
0answers
35 views

Iptables content blocking firewall

I have setup a firewall with iptables to ratelimit connections based on content. The following is an example of one of my rules that stops wordpress bruteforce attacks. `iptables -A INPUT -p tcp -m ...
2
votes
0answers
59 views

How do iptables work with NFQ in terms of traffic shaping in snort?

I'm trying to understand how iptables and NFQ work together with snort. The reason that I ask this is because from what I understand snort can be set to IPS via NFQ but if you have iptables there ...
2
votes
0answers
49 views

When is route lookup performed when a packet flows through iptables?

Iptables is often illustrated using diagram I fail to understand when route lookup (routing tables) is performed: inside the "Routing Decision" grey boxes? If so, does it mean a packet is routed ...
2
votes
0answers
137 views

How to route traffic through different interfaces based on the port number?

iptables -A PREROUTING -i usb0 -t mangle -p tcp --dport 8080 -j MARK --set-mark 1 iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination Chain ...
2
votes
0answers
74 views

Change sender-IP for VM in libvirt behind NAT

I have a server with my own public /28 IPv4 Network. On this server I have some vServers, done with KVM/libvirt. These vServers are connected with a virtual network, NATed to the internet. Every ...
2
votes
0answers
186 views

firehol simple config doesn't work on Debian 7

I'm trying to set up a very simple firehol setup under a brand new Debian7 server. I only installed ssh and sudo before this Installed firehol with sudo apt-get install firehol Changed the config ...
2
votes
0answers
337 views

Using ufw on OpenVZ-based VPSes

I'm facing with a problem to set up ufw on Ubuntu 12.04 running on an OpenVZ-based VPS. I know there is limitations for ufw. I googled a bunch of articles how to resolve the issue (like: ...
2
votes
0answers
84 views

Some packets are dropped in [wan-local], when DNAT rule exists

I am running EdgeOS (aka vyatta 6.3 aka debian) with 3.4.27. There are two DNAT port forwarding rules like this: rule 1 { destination { port 65432 } inbound-interface eth0 inside-address { ...
2
votes
0answers
2k views

ip6tables port redirect with TPROXY on IPv6 only

Our server is IPv6 only connected and an applications listen to port 8080 at private network, but we need port 80 at public Internet. On purpose of testing, when opening the firewall for port 8080, ...
2
votes
0answers
1k views

Forwarding udp ports iptables packets “lost”?

I have a Linux router (Debian 6.x) where i forward some ports to internal services. Some tcp ports (like 80, 22...) are OK. I have one Application listening on port 54277udp. No return is coming from ...
2
votes
0answers
474 views

A minmal iptables ruleset for a high volume Nginx reverse proxy (or: how to use NOTRACK for http and https)?

I'm looking for a minimal iptables ruleset for a rather high volume Nginx/Varnish reverse proxy. I'd like to close down the server, so that only ports 80 and 22 are open at all for connections from ...
2
votes
0answers
169 views

Virtual guest doesn't NAT when using the hosts IP

I am using lxc to host some services. I wish to expose one of these services to the outside world. I have setup three NAT rules on my host using iptables, one for the eth0, one for br0 (the bridge ...
2
votes
0answers
186 views

iptables ipt_recent recent module number of IP to remember

One of the parameters of ipt_recnet is ip_list_tot which dictates the number of IPs to remember. What happens if it reaches that limit? Is it going to stop recording new IPs?
2
votes
0answers
1k views

Routing only some local IPs through VPN on dd-wrt

Much similar to this entry: http://serverfault.com/questions/94283/using-dd-wrt-to-connect-to-vpn-and-forward-all-traffic-of-certain-devices-through , I have set up my router with dd-wrt + OpenVPN to ...
1
vote
0answers
13 views

How to blacklist or whitelist lots or few ip ranges with ipset and iptables + fail2ban

In a nutshell: My problem is to find the right set of rules to make: - my own rules - fail2ban - additional dns blacklist work together, whereas "my rules" also implies either whitelisting my country ...
1
vote
0answers
23 views

iptables foward to multiple interfaces with NAT

I want to use iptables for provide NAT translation and forward the packets out a different interface. The network set-up is as follows: Alias: eth0:220 with IP address 10.1.1.220 / 255.255.252.0 ...
1
vote
0answers
53 views

Virtual IP Pool for NAT with StrongSwan VPN

I'm trying to wrap my head around a site-to-site VPN configuration using StrongSwan that will allow remote sites to connect to our AWS VPC. The catch is, the remote gateways will potentially be using ...
1
vote
0answers
59 views

openvpn TLS handshake fails on client because firewall drops packets (but why?)

I seem to have problem with my openvpn server - client connection. now, the important information is in the log (verb3) of my client: Mon Mar 30 17:09:59 2015 OpenVPN 2.2.2 ...
1
vote
0answers
48 views

How to block hping3 SYN ACK efficiently with iptables?

Actually I'm trying to execute a SYN TCP flood on my Debian web server with nginx and, by executing tcpdump "tcp[tcpflags] & (tcp-syn) != 0" while flooding, I see all packets coming. I already ...
1
vote
0answers
130 views

Squid intercept proxy stuck with forwarding loop

I'm trying to set up a debugging proxy using Squid, mainly to test our own client communications library for various proxy types (one possibility with our client, is to connect to an external ...
1
vote
0answers
16 views

Troubles with subnets and redirections

What I want to create is 2 subnets that communicate each other through a gateway. Here is my gateway: wlan0 Link encap:Ethernet IndirizzoHW c4:46:19:69:b7:a5 indirizzo ...
1
vote
0answers
46 views

iptables keeps using old nat rules

I use iptables snat on my gateway to change local source ip addresses to external. The trouble is that after I change the rules (or even if I flush iptables nat table) gateway keeps using the old rule ...
1
vote
0answers
75 views

Connect AWS and Azure via OpenVPN

I am trying to connect two networks (AWS and Azure) together via OpenVPN. I am aware of other implementations (OpenSwan+Azure GW etc.) but I need maximal portability as I will be expanding this to ...
1
vote
0answers
61 views

How to use iptables or IFB to mark incoming traffic by device?

I'm trying to use iptables to mark incoming packets based on the device where those packets arrived (rather than their originating IP address or port etc), but haven't found a way of getting this to ...
1
vote
0answers
56 views

OpenVZ : live migration fails

I can't launch live migration of OpenVZ container between two proxmox nodes... Feb 05 03:30:27 starting migration of CT 102 to node 'madrid' (xx.xx.xx.xx) Feb 05 03:30:27 container is running - using ...
1
vote
0answers
30 views

Clone and then route SNMP traps to new destination

We have 2 SNMP trap servers 10.0.0.1 and 10.0.0.2 which are the SNMP trap servers for close to 500 devices that we monitor.In all these 500 devices,10.0.0.1 and 10.0.0.2 are configured as the trap ...
1
vote
0answers
48 views

Redirect incoming WAN connection to other WAN host with iptables

I have router with Linux. I want to redirect incoming WAN connections with specified port to some other WAN host:port. I've tryed do this standard way: iptables -t nat -A PREROUTING -p tcp --dport ...
1
vote
0answers
42 views

iptables traffic after forwarding

I have 2 servers Server A and Server B ServerA = 1.1.1.1 ServerB = 2.2.2.2 I am using ip-tables to send all traffic on port 80 to Server B on Server (A) 1.1.1.1 i have done iptables -t nat -A ...
1
vote
0answers
47 views

Strange entries in Squid3 access.log

My WiFi network for guests is transparently proxied by Squid3. There's now a girl from Indonesia with her Samsung GT-B5330 running Android 4.0.4, who gets blocked by "The requested URL could not be ...
1
vote
0answers
88 views

linux not replying to an arp request

I am running linux 3.14 on a system with 2 interfaces. on the first interface, i can access our local network. on the second interface, arp packets come in but linux doesn't send out reply. is it ...
1
vote
0answers
237 views

Fail2Ban Correctly Attempts to Ban IP but IP does not get banned - iptables chain exists but not working

Running on Ubuntu 14.04 Server. So I have fail2ban correctly configured to process /var/log/auth.log for SSH login attempts. Upon 3 failed attempts I see this in the fail2ban log: 2014-11-19 ...
1
vote
0answers
77 views

Dovecot/Postfix mail server replies to [SYN] with [RST, ACK] when user attempts to connect (POP3). Likely iptables?

Currently I am trying to trouble shoot an e-mail server that will allow users to send e-mail, but not log in to the server (POP3) or receive e-mail using their Outlook clients. Previously this was ...
1
vote
0answers
187 views

Forward single port between subnets on dd-wrt router

I have a DD-WRT router with two subnets, 192.168.0.0/24 and 192.168.8.0/24. The latter is used for a 'guest' WiFi network. Traffic between subnets is filtered using iptables. What I would like to ...
1
vote
0answers
49 views

NAT for IPSEC access?

Please help to understand if the following configuration can be created. I have IPSEC connection with my customer. It is site2site vpn between customer network and my network 10.102.103.0/28. This ...
1
vote
0answers
167 views

shorewall can'T start: UNTRACKED state requires Raw Table in your kernel and iptables

I'm trying setting up my firewall and installed and configured shorewall. Unfortunately I tried to directly configure iptables first, but this didn't work. When I start shorewall, I get this messages ...
1
vote
0answers
257 views

Shorewall: DNAT to IPSEC tunnel zone not routing correctly

I have a ipsec tunnel working that gives access to a 192.168.4.0/24 lan. It is working fine and I can access hosts on the other side without problem: # from fw and lan hosts: # ping 192.168.4.44 PING ...
1
vote
0answers
40 views

Why do some outgoing IP traffic not contain UID information?

I am doing egress logging on my server using IPTABLES with the following line which is supposed to provide UID information on all traffic that is logged: -A OUTPUT -j LOG --log-prefix "IPTABLES(O): " ...
1
vote
0answers
53 views

Automatically add rules to iptables when an user logs in or logs out with ssh?

I'm looking for a solution to automatically add couple of rules to iptables when an user logs in and remove those rules when it logs out. I'd like to get somehow get the ip address of the user from ...
1
vote
0answers
541 views

Client successfully connects to OpenVPN server but with no internet access over the VPN

I'm trying to setup OpenVPN with static key authentication(instead of TLS) on TCP port 443; but the client cannot access the internet over the VPN after connecting to the server. Here's my current ...
1
vote
0answers
991 views

TPROXY Not working with HAProxy, Ubuntu 14.04

I'm trying to use HAProxy as a fully transparent proxy using TPROXY in Ubuntu 14.04. HAProxy will be setup on the first server with eth0 111.111.250.250 and eth1 10.111.128.134. The single balanced ...
1
vote
0answers
76 views

Policy routing local user's traffic down a tunnel

I've got a Linux based Firewall/Router running iptables and SNAT for traffic passing through it to the Internet via a single uplink - This is working fine. There is also a small number of applications ...
1
vote
0answers
190 views

Command to set dscp / ToS value on outgoing packets for OS X Mavericks?

I want to set a certain DSCP (or ToS) value on all packets sent over port 22. I have an iptables command to do so, but Mavericks only has the equivalent of pfctl and I can't figure out how to ...
1
vote
0answers
91 views

`ufw insert 1 deny to any` not working

ufw insert 1 deny to any ufw enable ufw status Status output: Status: active Logging: on (high) Default: deny (incoming), allow (outgoing), disabled (routed) New profiles: skip To ...
1
vote
0answers
43 views

EC2 instance won't allow pinging

Ive got an EC2 instance with an iptables config as follows: *filter :INPUT ACCEPT [121:8012] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [64:6240] -A INPUT -p icmp --icmp-type echo-request -j ACCEPT -A ...
1
vote
0answers
148 views

Iptables multiport and source ip

I have a rule which does not seem to allow traffic as expected -A INPUT -p tcp -m state --state NEW -m multiport -s x.x.x.x -d y.y.y.y --dports 38000:38100 -j ACCEPT If I remove the -s argument ...
1
vote
0answers
40 views

How to test if packet has been tagged with classid

I'm trying to troubleshoot an issue I'm having related to IFB Mirroring which I'm attempting to deploy based on this question: Tc: ingress policing and ifb mirroring My theory is that since the ...
1
vote
0answers
181 views

Firewall rejecting UDP “connections”?

I have a server that is aggregating logs from various other servers. It mostly works great, however from time-to-time (right after a reboot, but not all reboots) it will decide that various UDP ...