iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

-2
votes
1answer
24 views

port forward in INPUT level

I want to change the destination port of the ipv6 packet in the INPUT level. So I tried to use ip6tables with nat in the INPUT level but seems this command does not work # ip6tables -t nat -I INPUT ...
1
vote
4answers
2k views

How to block ALL communications with an IP-address using iptables?

I have a FreeBSD system behind a Linux-based router (using DD-WRT firmware). The FreeBSD system is running sshd and is regularly probed by various script-kiddies. It currently runs a script, that, ...
0
votes
1answer
2k views

iptables forward rule not working in openwrt

I am trying to apply some iptables forwarding rules in openwrt. Here is my scenario - My server has two cards ath0 and br-lan. br-lan is connected to internet and ath0 to private network. The other ...
0
votes
1answer
24 views

route output traffic from specific NAT'ed VM via ip alias

In a dedicated server with several containers behind NAT, I'm trying to route the output / outbound traffic from one of the containers through a specific virtual interface attached to the main ...
0
votes
1answer
1k views

apt-get update can not connect

i run a dedicated ubuntu 10.04 server. i use kvm/libvirt/virsh to run a virtual machine that's also ubuntu 10.04. i bridged the network (1 of 2 IPs is routed via NAT to the LAN, where my VM ...
0
votes
2answers
29 views

iptables blocking script using arp table lookup

I need to block certain hosts (multi-OS) on our LAN from gaining internet access. I decided to try and block certain hosts by mac address via iptables but I can't use the mac address of the ...
2
votes
3answers
1k views

Block all outbound Email on Linux Server running sendmail while allowing incoming mail to still work

I have a server "CentOS 5" I would like to block all outgoing mail temporarily. Server is using sendmail. Preferably using iptables if applicable. I still need email to come into the machine tho if ...
0
votes
1answer
69 views

Firewall rules not restricting access to Docker Web Apps

I have a problem where ports exposed to applications running on our system in docker containers remain open to the world despite the iptables configuration designed to restrict access. It seems to me ...
0
votes
3answers
2k views

Only allowing traffic from Cloudflare

I am new to Linux System Administration and I am experimenting with iptables trying to learn how to really lock down a system with them. And one thing a friend of mine recommended was that there was a ...
-5
votes
0answers
31 views

Block All Connections Not From CloudFlare [duplicate]

I have a simple request. I would like to only allow traffic to my server from cloudflare. My website is being pounded by attacks, and there is no legit reason someone should be making a connection to ...
3
votes
1answer
605 views

Limiting bandwidth with hashlimit (e.g. kb/s — not connections!) doesn't work, though the man page says it should

According to the iptables-extensions man page hashlimit can do bandwidth limiting: "flows exceeding 512kbyte/s" => --hashlimit-mode srcip,dstip,srcport,dstport --hashlimit-above 512kb/s ...
1
vote
2answers
51 views

Block https by mac address. Squid or iptables

I want to block web access (http and https) to certain mac addresses. I was able to do this for http using squid but it still lets https sites through. acl denylist arp "/etc/squid/mac-deny-list.lst ...
0
votes
0answers
37 views

vpnc router on CentOS not forwarding the rensponse

I'm mounting a vpnc router on an openstack environment. I mounted a CentOS Server with ip_forward enabled and iptables, with local IP 192.168.2.2. The remote network is 10.0.0.0/8 and the local ...
0
votes
1answer
37 views

Route a port through a specific network interface

I'm using OpenVPN on Ubuntu Server to connect to my VPN. That network interface is tun0. All traffic currently goes through the VPN. I'd like to exclude traffic that goes over a specific port, and ...
49
votes
4answers
141k views

How can I port forward with iptables?

I want connections coming in on ppp0 on port 8001 to route to 192.168.1.200 on eth0 on port 8080 I've got these two rules -A PREROUTING -p tcp -m tcp --dport 8001 -j DNAT --to-destination ...
0
votes
0answers
19 views

Block Bad Referer

I am annoyed by a lot of bad referer spammers I am seeing in apache's logs. 208.118.126.250 - - [12/May/2015:17:45:06 +0200] "GET /js/parsley.js HTTP/1.1" 200 91434 "http://voiceit.be/logins/login" ...
1
vote
2answers
1k views

Redirect OpenVPN gateway traffic to Privoxy

I would like to redirect the traffic that goes through my OpenVPN gateway to Privoxy, like so: OpenVPN client->Internet->OpenVPN gateway->Privoxy->Internet->Webserver (and vice versa) So far I ...
0
votes
0answers
206 views

Why is the first of two post-up commands for routing in interfaces configuration not automatically processed

We managed to connect our servers to two distinct networks and everything works fine. We use routing rules that ensure that server responds to the right network. I followed the instructions under ...
0
votes
1answer
70 views

Make Asterisk to serve another subnet

I have server with Linux Ubuntu 12.04. It has two subnets - 192.168.0.1(eth0) and 192.168.1.1 (eth1). There is an Asterisk server (IP PBX) connected to first subnet, lets say it has IP address ...
0
votes
0answers
18 views

Reject a http response with iptables and log it

I just started working with iptables and I am trying to do something that I even know for sure if is really possible. I need to test some of my services in a particular server. To debug my ...
2
votes
2answers
1k views

500 internal server error php long running process

I am trying to run a long php process and it ends with the 500 internal server error. It executes fine for about 8 mins. I have rebooted the machine after changing the php settings. PHP Config: ...
0
votes
0answers
34 views

How to block ip/ports using iptables with specific date and time?

Normally to block in command-line I used iptables. iptables -I INTPUT -s xxx.xxx.xxx.xxx -m time --utc --datestart 2013-09-09T15:00 --datestop 2013-09-09T15:30 -j DROP But the problem is, this ...
0
votes
0answers
23 views

How to forward traffic from ipsec host to local network?

Could anybody explain how to implement forward traffic from host in IPsec to local network. On my server I have 3 network cards: red0 - extern orange0 - dmz green0 - local IPsec builds through ...
1
vote
1answer
38 views

Can't get iptables working in VPS - state and conntrack not possible

I've been browsing and reading documentations all night and I can't figure out any solution... I'm trying to get iptables working on my VPS (Debian 7). But I can't get established connections ...
-1
votes
2answers
53 views

Port forwarding ssh with iptables

Moved from stackoverflow... My new Internet firewall, based on Linux iptables, is working in most regards very well, but the port forwarding does not work: $ ssh -p 7022 [ppp0-ip-address] ssh: ...
1
vote
2answers
1k views

iptables 1.4 and passive FTP on custom port

after the upgrade from debian squeeze to wheezy I've got a problem with passive FTP connection. I could narrow it to be iptables related, as I could connect via FTP w/o problems after adding my IP to ...
0
votes
2answers
110 views

Managed hosting firewall vs managing own firewall

I posted on stackoverflow as to the overall benefits of managed hosting vs non-managed hosting. The more I think about it, it seems to boil down to one question: should I use a managed host because ...
0
votes
0answers
24 views

Static IP Forwarding on OpenWRT

I have a /28 block of static IP's that my ISP provides. Lets say x.x.x.x/28. The new building we are in has a OpenWRT router that I want to configure to forward those IP's to specific servers on the ...
1
vote
0answers
25 views

How to reroute outgoing vpn server traffic to Tor with iptables? [closed]

After three days of following HowTos, guides, some debugging and help from guys at users@lists.strongswan.org I was able to setup a VPN server on my spare PC (Ubuntu Server 14.04) using StrongSwan. ...
3
votes
1answer
82 views

How do I combine firewall --enabled and --nobase in a CentOS kickstart?

As part of system hardening, I'm trying to configure my firewall during a CentOS 6.6 kickstart with the following line. It does work under one circumstance, and otherwise it doesn't. Kickstart ...
2
votes
1answer
154 views

Stateless NAT with CentOS 6

I'm looking to set up the following: ---[IVR 1] | (internet)----[CentOS box]---+---[IVR 2] | ...
0
votes
2answers
1k views

How can I reject all incoming UDP packets except for DNS lookups?

I set my server to reject ALL incoming UDP packets, to prevent UDP floods. However, I was told that because I use my own domain and server for my nameservers, this can cause some problems. How can I ...
2
votes
0answers
63 views

Stop senseless mass-queries on DNS-server [duplicate]

I have a disturbing problem for a few weeks now ... One of my three DNS-servers (running bind9 as slave of a Plesk DNS master) is getting spammed with senseless DNS requests. The origin IPs of those ...
1
vote
0answers
44 views

Linux ipv6 forwarding

Situation I know how to do ipv4 forwarding, and expected ipv6 forwarding to work pretty much the same way. So I configured a VirtualBox host with the network address configured from my ISP. Right ...
1
vote
1answer
56 views

OpenVZ - SMTP - telnet - Connection timed out

I have problem with SMTP in my OpenVZ container. I've created OpenVZ container by Proxmox on dedicated server in OVH. This container will be as mail server. So I create on "mother-server" rules to ...
1
vote
1answer
62 views

IPTABLES block User-Agent

I get DDoS by the Wordpress Pingback BOTNET, now I want to block all client who contain Wordpress in there Useragents. For example: WordPress/4.0; http://vk.lokos.net; verifying pingback from ...
0
votes
1answer
975 views

ZenOSS webinterface connecting

I'm having a problem with ZenOss. I installed the centos stack installer on Centos 5.5 x64. De installation succeeded and no errors where displayed. But when I tried to surft to the ip address it ...
5
votes
1answer
2k views

connect Open vSwitch switch to real network : iptables masquerade

I'm using Open vSwitch to create a switched network between virtualBox guest machines, and i want that the host OS (Ubuntu 12.04) join this network and to configure it as the gateway of this virtual ...
-1
votes
1answer
23 views

rewrite destination IP of TEEed traffic

Server 1 and Server 2 (Centos 7) both host the same application, which listens on UDP port 1514. Server 1 receives traffic on this port. The goal is for the application on Server 2 to receive a copy ...
2
votes
3answers
3k views

How can I achieve OpenVPN client routing without NAT on Linode

I've set up an OpenVPN network, and it is working properly in the sense that I can access the inner/LAN machines from the remote client. However, my problem is that all traffic from the remote ...
1
vote
1answer
49 views

Iptables udp port forwarding [duplicate]

I'm using latest debian relese and i need to do some port forwarding, but i dont know how.I have 2 stream sources coming to my server on the same udp port from 2 diferent ip-s 192.168.1.2:1003 via ...
0
votes
1answer
1k views

/etc/init.d/iptables-persistent start returns fail but seems to work

I am trying to activate iptables-persistent on an Ubunutu server. Config files are located in /etc/iptables/rules.v4 /etc/iptables/rules.v6 I have installed the iptables-persistent package. ...
0
votes
2answers
2k views

Configuring port in iptables for websockets

I'm implementing Ratchet's push example in my server (websockets) on port 9090. These are current iptables policies: [root@myserver ~]# iptables -L -n -v Chain INPUT (policy ACCEPT 309 packets, 22420 ...
-1
votes
2answers
32 views

iptables unable to open 80 && 8000 port on my ubuntu server

I am unable to open 8080 port on my server though iptables settings seem correct Here is the result of iptables-save iptables-save # Generated by iptables-save v1.4.21 on Thu May 7 21:31:19 2015 ...
0
votes
2answers
2k views

Iptables port forwarding on AWS EC2

I have AWS VPC with 1 public subnet and 1 private subnet. I have my web-server running on port 80 in private subnet. I want this webserver be accessible form public internet Yes, The VPC security ...
0
votes
2answers
36 views

Redirect a port to a blocked port but with the filter to unlock it

I have all ports with iptables dropped for security reasons, now i want to open a port which redirects the traffic to a blocked port, but it will open if the traffic comes to this port. Let's see, i ...
0
votes
0answers
32 views

SNAT traffic through tun interface

Here is the diagram of the network : Internet -----eth0(WAN), tun0 (GATEWAYPC) eth1(LAN)----- UserPCs Network interface : eth0 : WAN, DHCP tun0 : OpenVPN Client tunnel IP:10.0.0.9, ...
0
votes
1answer
972 views

iptables: No chain/target/match by that name.

I am using this command to attempt to block this vulnerability scanner based on it's string, which is returning an error. # iptables -I INPUT -j DROP -d xxx.xxx.xxx.xxx -p tcp --dport 80 -m string ...
0
votes
1answer
94 views

Aggregate switch ports to go through different iptables servers acting as firewalls?

Scenario: One internet connection with the need to firewall a very high number of pps, without having to invest in expensive hardware firewalls. I do not have a specific number of pps to aim after, ...
0
votes
0answers
13 views

IPTables slow FTP listing

Every time I open a new connection (which uses a different port then), it is very slow until the communication starts. For example Downloading multiple files via FTP, listing new dirs and so on takes ...