iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

1
vote
2answers
182 views

Reach LXC container from a virtualbox guest on the same host

Context I develop websites on my Ubuntu laptop (Ubuntu 13.04 64b). Each site runs within a dedicated LXC container¹ on network 10.0.3.x I sometimes need to reach those sites from a virtualbox guest ...
0
votes
1answer
38 views

No route to host centos

I am trying to allow a port through a firewall on centos 6. The error I am receiving is telnet: connect to address 80.xx.xx.xx: No route to host The port I am trying to allow is 5666. If I disable ...
0
votes
1answer
16 views

squid3 with tcp_outgoing_address could not connect to anywhere

I have one server with 3 interfaces (3 physical lan card), which are connected to 3 different routers. Each router has a different subnet, i.e. the 3 interfaces of server belong to 3 different ...
0
votes
1answer
37 views

Iptables: Matching packets for bridged interface

I'm building a firewall configuration tool based on iptables, and trying to get a "bump in the wire" scenario working. Given a setup with eth0 and eth1 in a bridge br0 and a third interface eth2: ...
-1
votes
0answers
27 views

DHCPREQUEST Operation not permitted

I am configuring iptables on a Ubuntu 14.10 VPS. However, I am having a few issues with the following: Jun 25 08:28:23 www dhclient: DHCPREQUEST of 1.2.3.4 on eth0 to 2.3.4.5 port 67 ...
0
votes
2answers
51 views

resetting iptables seems to make connections clear faster

I have iptables setup on 2 servers. Server#1 is public and Server#2 only allows the ip address of Server#1 to have ACCESS. Server#2 has a mySQL database that Server#1 queries. I ran a query and it ...
1
vote
2answers
781 views

500 internal server error php long running process

I am trying to run a long php process and it ends with the 500 internal server error. It executes fine for about 8 mins. I have rebooted the machine after changing the php settings. PHP Config: ...
1
vote
0answers
12 views

How to test if packet has been tagged with classid

I'm trying to troubleshoot an issue I'm having related to IFB Mirroring which I'm attempting to deploy based on this question: Tc: ingress policing and ifb mirroring My theory is that since the ...
0
votes
0answers
11 views

forwarding an incoming ip multicast packet over another interface

Is it possible to forward an incoming IP multicast packet out of a specific interface using iptables rules if the incoming packet already has a TTL > 1? (The incoming interface is a GRE tunnel ...
-2
votes
0answers
28 views

iptables: Block all connections on port 8080, allow whitelisted IPs [duplicate]

Lets say I have a whitelist text file containing IPs. Ex: whitelist.txt 67.31.137.187 107.130.111.123 How do I use iptables to block all IPs on port 8080 and allow only whitelisted IPs? I was ...
1
vote
0answers
26 views

Firewall rejecting UDP “connections”?

I have a server that is aggregating logs from various other servers. It mostly works great, however from time-to-time (right after a reboot, but not all reboots) it will decide that various UDP ...
0
votes
0answers
28 views

iptables not forwarding traffic from 80 to 8000

iptables is proving to be a very complicated tool for me to use. I'm trying to do the following: Accept all packets on 80, 443, 22 Forward packets received from 80 to 8000 Accept packets from only ...
-2
votes
1answer
36 views

IPTables Block Many IPs Using Domain

DROP all -- 114-43-XXX-XXX.dynamic.hinet.net anywhere DROP all -- 118-161-XXX-XXX.dynamic.hinet.net anywhere These are just two of the several restrictions I have in IPTables right ...
0
votes
1answer
1k views

strongswan VPN on OpenWrt

Hi I'm running Barrier Breaker version of OpenWRT and I have setup a VPN according to: http://wiki.openwrt.org/inbox/strongswan.howto I can connect to the VPN with my iPhone or Mac (to 10.10.1.0/24 ...
9
votes
5answers
14k views

How to Unban an IP properly with Fail2Ban

I'm using Fail2Ban on a server and I'm wondering how to unban an IP properly. I know I can work with IPTables directly: iptables -D fail2ban-ssh <number> But is there not a way to do it with ...
1
vote
1answer
694 views

SNMP closed state in CentOS

I'm having a problem here, I've added to my IPtables rules this: -A INPUT -p tcp -m state --state NEW -m tcp --dport 161 -j ACCEPT -A INPUT -p udp -m state --state NEW -m udp --dport 161 -j ACCEPT ...
1
vote
2answers
307 views

netfilter: How to mark packet by reqid?

I have the following problem. I have SAs that use firewall marks. So only packets that have that mark get encoded and decoded. I managed to set the mark for packets that shall be encoded but I cannot ...
0
votes
0answers
43 views

Iptables - Port forwarding has no effect

I have a dedicated server with a single public IP (Say 1.2.3.4) running CentOS. Via virt-manager, I added a virtual machine, running CentOS as well. They are connected through a virtual network: ...
0
votes
1answer
37 views

Limit incoming connections using iptables per IP

I need to limit access to some port per IP. Let's say 5 connections per minute - not more. I've seen iptables recent, connlimit and limit, but all of them are not fitting exactly what I need. ...
-3
votes
0answers
11 views

Redirecting locally generated IP multicast over a GRE interface [duplicate]

On a linux box, I want to redirect locally-originating IP multicast traffic (OSPF hello) over a gre tunnel interface. How can I do this using iptables rules?
4
votes
1answer
63 views

Iptables counters restore, when using quotas, not working as expected

I've set a quota for a certain computer: iptables -A FORWARD -d 192.168.1.10 -m quota --quota 500000000 -j ACCEPT iptables -A FORWARD -d 192.168.1.10 -j DROP This works as expected. When the limit ...
3
votes
1answer
6k views

How to enable iptables (instead of firewalld) services on RHEL 7 and Fedora 18?

The newest fedora has firewalld as new firewall aplication. I liked old iptables services. I want them back but have no idea how to do that. I have tried : systemctl disable firewalld.service ...
0
votes
0answers
32 views

Iptables INVALID packet from akamai and google to linux

I set up the firewall rules below (I also blacklisted the IPV6 Module): iptables -A INPUT -m conntrack --ctstate INVALID -j LOG --log-level debug --log-prefix '[FW INVALID]: ' iptables -A INPUT -m ...
1
vote
2answers
298 views

iptables rule -d ! (not destination) is giving me errors

How do I use the [!] option for a destination IP? I'm trying to redirect out-bound WAN DNS traffic to my sinkhole, but I can't get the --destination [!] option to work. For example: iptables -A ...
1
vote
1answer
774 views

iptables rule(s) to send openvpn traffic from clients over an sshuttle tunnel?

I have an Ubuntu 12.04 box with OpenVPN. The VPN is working as expected -- clients can connect, browse the Web, etc. The OpenVPN server IP is 10.8.0.1 on tun0. On that same box, I can use sshuttle ...
-2
votes
3answers
30 views

How do I get iptables to allow a new port (for a webserver sockets handler)

In the local development server, I don't have any iptables rules (running on a Mac). The production server however, runs CentOS 6 with certain rules. I need to add a rule that allows the client to ...
1
vote
1answer
66 views

All connections to a bridged domU originate from the dom0 public IP instead of real IP

I have a Dom0 with a mixed configuration: bridged networking and NAT is set up. There is one NIC connected to the internet (& 3 more that are unused). This is my interfaces file: # The primary ...
0
votes
1answer
26 views

Reverse Proxy Linux Containers

I am trying to set up a reverse proxy on my ubuntu 14.04 host so that I can run multiple websites, each in their own LXC container (one day docker but one step at a time). In this example the ...
-1
votes
1answer
19 views

iptables: REJECT not working, but DROP does

I have recently setup a server with fail2ban, and it is mostly working except I am getting errors whenever this command tries to execute: sudo iptables -D fail2ban-ssh -s xxx.xxx.xxx.xxx -j REJECT ...
1
vote
1answer
47 views

Fail2Ban: already banned?

I have Fail2Ban running on my Centos Server. (Config below) In my var/log/messages I noticed something really weird: Jun 19 12:09:32 localhost fail2ban.actions: INFO [postfix] 114.43.245.205 ...
0
votes
1answer
654 views

block access to wrt from vlan using iptables dd-wrt

I set up multiple isolated vlans in dd-wrt. Now I need to forward a port to vlan2. I isolated the vlans using: iptables -I FORWARD -i br0 -o vlan2 -j DROP iptables -I FORWARD -i br0 -o vlan3 -j DROP ...
1
vote
2answers
3k views

Iptables not persisting after reboot on CentOS 6.2

I've tried adding a few rules to my iptables but they don't seem to be saving. In order to save them, I've tried running iptables-save and service iptables save. Each time I have run either of those ...
0
votes
4answers
1k views

OpenVPN client connects but can't access internet

I setup an Openvpn server on a centos box and I can get the client to connect (osx) but can't access the internet or even the local network. I thought maybe DNS but couldn't access any sites via IP. ...
2
votes
2answers
1k views

Limiting interface bandwidth with tc under Linux

I have a linux router which has a 10GBe interface on the outside and bonded Gigabit ethernet interfaces on the inside. We have currently budget for 2GBit/s. If we exceed that rate by more than 5% ...
0
votes
1answer
64 views

Connection tracking not working in a Debian 7 OpenVZ VPS

I have a small VPS instance (used for web hosting) that runs Debian 7, and for a few weeks I have issues with my firewall and connection tracking. I had no issue for months, but without any system ...
0
votes
3answers
119 views

My webserver is getting flooded with invalid requests

My webserver (nginx) keeps getting requests like this: 23.244.104.206 - - [15/Jun/2014:21:21:47 -0400] "GET ...
6
votes
4answers
17k views

Whitelist allowed IPs (in/out) using iptables

I have a few ip ranges to which I want my server to able to connect and users to connect from. Everything else should be blocked. How should I do that with iptables? My OS is Debian based linux ...
-5
votes
1answer
35 views

How to route to next server? [closed]

I must route all traffic from first server to second server and next to third server. Like this: server1 -> server2 -> server3 I use Debian Wheezy. Can anyone tell how to do this with iproute?
0
votes
1answer
759 views

ZenOSS webinterface connecting problem

I'm having a problem with ZenOss. I installed the centos stack installer on Centos 5.5 x64. De installation succeeded and no errors where displayed. But when I tried to surft to the ip address it ...
1
vote
1answer
156 views

How to see the list of ip addresses in 'recent' module?

How to see the full list of ip addresses in 'recent' module? I want to see current hitcounts to adjust my values accordingly so no valid users gets accidentally blocked
0
votes
2answers
32 views

Openning a port in my CentOS server [closed]

I'm trying to open a port in my CentOS server... I tried using iptables, adding the "-A INPUT -p udp -m udp --dport portnum -j ACCEPT" and didn't work. I tried installing CSF, adding the ports and ...
0
votes
1answer
33 views

Simultaneous iptables POSTROUTING for SNAT and MASQUERADE block outgoing ssh

I am using iptables on a virtualized host to distribute services using one IP to different virtual machines(VMs). This works well with DNAT in PREROUTING and SNAT in POSTROUTING. Furthermore I am ...
0
votes
1answer
31 views

Unable to get out of rescue mode after a spontaneous reboot

I am experiencing a weird problem where the CentOS 6.5 system I was using spontaneously underwent a restart that was not authorized by me, and then enters Rescue Mode, where I am unable to diagnose ...
2
votes
1answer
148 views

How do I set up an IPv6 DMZ with iptables without a static allocation?

I have several networks which are on Comcast's residential network. I need to access those networks from a variety of environments, via an SSH proxy on one of the hosts. (As it happens I'm using ...
0
votes
3answers
1k views

Configuring Iptables On CentOS 6 Locks Me Out

I'm running the following bash script as root to configure iptables (I'm logged in via SSH): #!/bin/bash # Delete all existing rules iptables --flush # Set default chain policies iptables -P INPUT ...
2
votes
2answers
870 views

Iptables: Forwarding packets doesn't work

I have 3 Linux Systems A, B and C. A is a TCP Client and sends a message to TCP Server on C. A can see only the external IP of B which is at wlan0 interface, 192.168.0.3 ------------------ ...
0
votes
0answers
10 views

Is it necessary to open all used ports when using one Node.JS application to route from port 80 to apps on different ones?

I'm working with an Ubuntu 12.04 LTS, 64 Bit server there I have used the following commands to send all http request on port 80 to port 8080 Commands: cat /proc/sys/net/ipv4/ip_forward #returns 1 ...
0
votes
2answers
39 views

How to I forward requests on a IPv6 port to a IPv4 host behind NAT?

I run a Xen Dom0 with 2 VMs NATted (other VMs are bridged, and are ok). This Dom0 has an IPv6 and IPv4 address. Requests to, for example port 25 are forwarded to a LAN address that one of the VMs ...
4
votes
3answers
746 views

iptables for local connections

On "Server A", I have a service running on port 1445. "Server B" can connect to "Server A" on port 445 via the following rule: iptables -t nat -A PREROUTING -d www.kunde.de -p tcp -m tcp --dport 445 ...
-1
votes
0answers
12 views

Specifying routes among 3 subnets using iptables at firewall server

I have 3 subnets each connected to the same router (cisco router with 3 interfaces). One of these subnets (LAN3) has got an Ubuntu server (named atlas) running iptables to filter traffic and to make ...