iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

0
votes
1answer
1k views

IPTables port forward Remote mysql to localhost

i have a MySQL server1.1.1.1 and I need port 3306 in 1.1.1.1:3306 port forward to my secondary server 2.2.2.2:3306 I don't have access to MySQL server. i have tried iptables -t nat -A PREROUTING -p ...
-1
votes
2answers
33 views

Is there a way to block ALL inbound/outbound traffic going outside of a LAN with iptables?

As the title says, I'm just looking for a way to disallow any traffic on ANY port unless it's going to a local IP address (192.168.1.*).
4
votes
3answers
2k views

Fail2Ban: already banned?

I have Fail2Ban running on my Centos Server. (Config below) In my var/log/messages I noticed something really weird: Jun 19 12:09:32 localhost fail2ban.actions: INFO [postfix] 114.43.245.205 ...
0
votes
1answer
32 views

iptables ipset misconfiguration?

I'm looking for a solid method to block unwanted TCP/IP traffic. On my linux machine iptables and ipset seem to offer a nice way to do so. Until now I've done this: ipset create ipsok hash:net ...
0
votes
1answer
2k views

SSH Socks Proxy wiith iptables REDIRECT

I have googled and haven`t found the answer on my question. Help me please. There are two servers: serverA with public IP 12.0.0.10 and an private IP 10.0.0.5 serverB with public IP 20.0.0.11 I ...
2
votes
1answer
66 views

What is the state of subsequent http requests in iptables terms?

When a user requests a web page, e.g. www.example.com/about-us/history.html. The server will send them an HTML file, the HTML file will contain elements that subsequently generate many more HTTP ...
0
votes
2answers
186 views

Load balancing IPTABLES POSTROUTING rules

I have an interface with 5 IP addresses assigned to it (as virtual adapters) let's call them x1,x2,x3,x4 and x5. Currently I have SNAT POSTROUTING forwarding rules from local source range to specific ...
16
votes
13answers
51k views

Using Linux IPTables, How to block torrents or any P2P protocols? [closed]

At our institution we had connected 300+ computers to different LAN's with Internet. Included here are Officies LAN, and Internet Laboratory for students. And we want to Control Torrents or any P2P ...
0
votes
1answer
60 views

Iptables block layer 7 DDoS attacks

Recently I've been experiencing lots of layer 7 ddos attacks to my website. Specifically an HTTP GET request flood on the index page. (~20k r/s), my server is at OVH, so it's not overloading the pipe, ...
40
votes
15answers
16k views

iptables Tips & Tricks

I'm sure Linux sysadmins are quite familiar with iptables, the userland interface to the netfilter packet-filtering framework. Now, this "Question" is meant to be a Community Wiki for collecting ...
-1
votes
1answer
49 views

How to allow google-analytics via iptables when internet is blocked for other traffic [duplicate]

I am running the following script on a wifi gateway. The WAN side of the gateway has ppp0 interface while LAN side is on wlan0. No LAN user should be allowed to browser internet Some services on ...
0
votes
0answers
41 views

failing to tunnel F5VPN through OpenVPN [migrated]

summary I need to tunnel an F5VPN through an OpenVPN in order to ssh from a client device (Debian laptop) through a firewall. The OpenVPN works, but I lose all networking on the laptop once I start ...
1
vote
1answer
44 views

iptables forward ip to another ip

I've configured multiple IP Addresses on my Ubuntu ssh server. Now the server can be accessed by using any IP Address, from 192.168.0.51 to 192.168.0.99. Depending on which IP Address someone uses to ...
0
votes
2answers
28 views

In iptables, does state ESTABLISHED require a later state NEW to make an ESTABLISHED connection?

When using the following rule: iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT ...do you need to add specific rules including the NEW states to allow for an ESTABLISHED ...
3
votes
1answer
263 views

route traffic from a cgroup via a specific network interface

Is there a possiblity, to restrict a cgroup to a specific network interface? All packets from the cgroup should only be routed via a VPN connection, while other packets use the default route. With ...
5
votes
3answers
3k views

Persisting nf_conntrack_max Across Reboots

In /proc I have two entries for nf_conntrack_max: /proc/sys/net/netfilter/nf_conntrack_max /proc/sys/net/nf_conntrack_max The seem to point to the same value as changing one also changes the ...
0
votes
1answer
25 views

Cannot understand this example fail2ban rule

I'm trying to secure my admin and user login page from brute force attacks. I have setup iptables and the closest thing I can find which looks useful is this: jail file: [nginx-login] enabled = true ...
0
votes
0answers
28 views

How to do the port forwarding from one ip to another ip only for right incoming ip?

I'm have 2 vpn clients and 1 vpn server. One vpn client(work) has access to the server on amazon, but it seems for this server in the firewall block incoming requests from all ips except work ...
0
votes
1answer
25 views

Iptables drop all connection except my domain(s)

I tried use this command to block a domain iptables -I INPUT -p tcp -m string --string "Host: domain.com" --algo bm -j REJECT and it worked but, i want to Reject all but accept from specified ...
0
votes
1answer
23 views

ip6tables snat don't work properly [closed]

I got three computers with these names: laptop, vds and home; vds is openvpn server; home is openvpn client. and, I got an ipv6 network 2a01:dead:beef::/64 vds has address 2a01:dead:beef::311 on ...
0
votes
1answer
2k views

strongswan VPN on OpenWrt

Hi I'm running Barrier Breaker version of OpenWRT and I have setup a VPN according to: http://wiki.openwrt.org/inbox/strongswan.howto I can connect to the VPN with my iPhone or Mac (to 10.10.1.0/24 ...
0
votes
0answers
34 views

iptables DNAT packets into an openswan IPSEC tunnel

I have the following network setup: +-----------------------------------+ | | ...
0
votes
3answers
3k views

By passing squid for few hosts using iptables

We have a squid proxy setup which listens on default port(3128): on eht0 (192.x.x.x). It has another interface eth1 (10.x.x.x) used to connect to external world. It is doing good quality content ...
-2
votes
0answers
21 views

How to unblock IP range in iptables

I made a simple script for apache2 web server to block webscrapers. It's working fine but sometimes MSN Crawlers are getting banned. iptables -L (...) DROP all -- ...
0
votes
1answer
1k views

iptables forwarding through virtual interfaces

I'm trying to configure my computer as a gateway between two networks, but I cannot make it working for some reasons Here is a representation of the network: 192.168.1.101 192.168.1.102 ...
0
votes
0answers
27 views

Trying to create a NAT with virtual Ethernet using IPTables

I have a separate namespace running on my server and I want to create a NAT that will enable Internet connectivity in this namespace. I specifically want to do this so that certain inbound ports are ...
8
votes
3answers
11k views

How to configure a custom NAT for use in Amazon VPC

I have an Ubuntu box I wish to use as NAT instance (among other things). I would prefer to avoid using the NAT AMIs provided by Amazon, and instead configuring NAT myself. Currently, my host has a ...
0
votes
1answer
924 views

lots of UDP_IN Blocked errors

Since I have reinstalled my OS, I'm getting lots of UDP_IN Blocked errors in my messages log. Can anyone kindly explain what the error say exactly and what I can do to get rid of this error. Aug 8 ...
4
votes
2answers
1k views

What is this in my syslog and should I be concerned?

I'm seeing a lot of the following line in /var/log/syslog: Jun 21 14:36:15 my-server kernel: [416219.080061] iptables denied: IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:the-mac-address:08:00 SRC=0.0.0.0 ...
1
vote
4answers
1k views

How to block ALL communications with an IP-address using iptables?

I have a FreeBSD system behind a Linux-based router (using DD-WRT firmware). The FreeBSD system is running sshd and is regularly probed by various script-kiddies. It currently runs a script, that, ...
7
votes
4answers
10k views

Block range of IP Addresses

I am getting bombarded with attempted hacks from China all with similar IPs. How would I block the IP range with something like 116.10.191.* etc. I am running Ubuntu Server 13.10. The current line ...
0
votes
1answer
44 views

How to block every port except specific ones to a user with iptables? [closed]

I'd like to block every port except 80, 443, 1005 to a specific user (owner) with iptables. What command should I use?
0
votes
1answer
23 views

iptables using, goto + jump: what is the RETURN behaviour?

I'm trying to work out what is the iptables behaviour when you have multiple custom chains and you sue a mix between -goto and -jump Example: INPUT iptables -A INPUT -i eth1 -j CUSTOM-A CUSTOM-A ...
-1
votes
0answers
20 views

IPTables Quota Limiting and Redirect

I am currently working on a quota limitation for a wireless captive portal based on iptables. With the following ruleset all new connections get redirected to the login page after the quota is ...
0
votes
2answers
4k views

Can not open port 3306 on Ubuntu using iptables

I am trying to open port 3306 (for remote mysql connections) on my ubuntu 12.04 server machine but for the life of me can't get the damned thing to work! Here is what I did: 1) list current firewall ...
0
votes
0answers
45 views

CentOS 6.6 ignores iptables nat rules

I try to use iptables nat to forward incoming TCP traffic to another computer. I use following rules within nat table: -A PREROUTING -i eth3 -p tcp -m tcp --dport 8888 -j DNAT --to-destination ...
1
vote
1answer
47 views

ipt_CLUSTERIP: unknown protocol 1

I am trying to create a web cluster with two load balancers and a single public ip address The command I use is the following: iptables -I INPUT -d $CLUSTERIP -i $WAN_IF -j CLUSTERIP --new ...
0
votes
1answer
20 views

How to disable network access for a user on Linux?

Trying to disable the network access for the user: [root@notebook ~]# iptables -I OUTPUT -m owner --uid-owner tempuser -j DROP [root@notebook ~]# ip6tables -I OUTPUT -m owner --uid-owner tempuser -j ...
-1
votes
0answers
86 views

Customising IPtables for a more secure webserver

Based on my reading online and a few tutorials I have produced a set of iptables rules: i=/sbin/iptables # Flush all rules $i -F $i -X # Setup default filter policy $i -P INPUT DROP $i -P OUTPUT ...
0
votes
4answers
1k views

Server not reachable on all TCP ports from all locations

I have a very strange situation on a Linux (CentOS) server. Firstly, from my Ubuntu desktop PC, I can successfully connect to all services that are running on it, on ports 22, 80, 8080 and others. ...
0
votes
1answer
2k views

iptables forward rule not working in openwrt

I am trying to apply some iptables forwarding rules in openwrt. Here is my scenario - My server has two cards ath0 and br-lan. br-lan is connected to internet and ath0 to private network. The other ...
0
votes
3answers
36 views

“Bad argument 'NEW'” when configuring iptables

I am getting the following error when configuring iptables on a Debian 7.6 server to log new TCP connections: Bad argument `NEW' Error occurred at line: ## The line throwing the error is formatted ...
0
votes
1answer
19 views

Is there a way to run just save with firewalld in RHEL7?

I'm starting to use RHEL7 and learning a little about the changes that come with systemd. Is there a way to perform /sbin/service iptables save in firewalld? $ /sbin/service iptables save The ...
3
votes
2answers
2k views

How to enable traceroute in linux machine

I'm working on something in the transport layer and after i ran our custom policies for securing the policies i'm not able to do traceroute from the linux machine. root@keystone-evm:~# iptables -L ...
1
vote
2answers
1k views

iptables 1.4 and passive FTP on custom port

after the upgrade from debian squeeze to wheezy I've got a problem with passive FTP connection. I could narrow it to be iptables related, as I could connect via FTP w/o problems after adding my IP to ...
1
vote
0answers
23 views

How to block hping3 SYN ACK efficiently with iptables?

Actually I'm trying to execute a SYN TCP flood on my Debian web server with nginx and, by executing tcpdump "tcp[tcpflags] & (tcp-syn) != 0" while flooding, I see all packets coming. I already ...
0
votes
1answer
44 views

iptables-save return with errno 1 - operation not permited

When I run the command iptables-save it returns with errno 1 - opearation not permitted If I do: iptables -L and then: iptables-save then iptables-save succeeds This error happens only ...
1
vote
0answers
62 views

Squid intercept proxy stuck with forwarding loop

I'm trying to set up a debugging proxy using Squid, mainly to test our own client communications library for various proxy types (one possibility with our client, is to connect to an external ...
0
votes
0answers
25 views
0
votes
1answer
1k views

apt-get update can not connect

i run a dedicated ubuntu 10.04 server. i use kvm/libvirt/virsh to run a virtual machine that's also ubuntu 10.04. i bridged the network (1 of 2 IPs is routed via NAT to the LAN, where my VM ...