iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

0
votes
1answer
37 views

Iptables drop forwarded traffic destined for interface IP address

I have a small VPN setup where I use IP tables to nat traffic coming in the vpn0 interface to the IP address of the eth0 interface. These rules look like this: iptables -t nat -A POSTROUTING -o eth0 ...
-1
votes
2answers
49 views

How to set up iptables for local router machine

I have set up a local linux (14.0.4 Ubuntu) machine as a router and can do the following ping server/router from the clients ping clients from server/router ping one client from the other ping the ...
0
votes
0answers
12 views

Isolate access point clients with iptables

Is there an effective and easy way to isolate access point clients so that they do not see each other over LAN ? I created an open access point with Kali Linux + Hostapd + dnsmask I want to make ...
2
votes
3answers
2k views

500 internal server error php long running process

I am trying to run a long php process and it ends with the 500 internal server error. It executes fine for about 8 mins. I have rebooted the machine after changing the php settings. PHP Config: ...
0
votes
0answers
24 views

Simple IPtables Script for Whitelisting (Amazon Endpoints)

I'm attempting to lockdown an Amazon EC2 instance which has a single open port for Amazon SNS. I can't use security groups to restrict the port as the IP is forever changing, so it must be open to all ...
2
votes
1answer
42 views

Simulate 2 clusters in the same network

I have 4 pc´s and another pc, which will act as a proxy, all being in the same network: 172.16.96.0/20 . I can ping between each other. But, I want to separate them into two groups. That is: pc1 is ...
0
votes
1answer
43 views

How to route traffic between 2 VLANs on different subnet

I have the following problem: I have one interface eth0 with IP 172.20.51.61/24 I have configured 2 VLANS on the same machine: eth0.120 : 172.20.52.61/24 eth0.200 : 172.20.54.61/24 I also have a ...
1
vote
0answers
20 views

IPTables, route specific port through VPN

I'm running my own mail server at home on a dynamic IP. Dynamic IPs are often blacklisted, so I currently send out mails through my provider's relay. I want to change that to sending mail directly, ...
0
votes
1answer
34 views

Prevent squid forwarding twice with transparent and non-transparent setup

I'm running squid in a small network. I've setup a couple of squid listening ports for different scenarios: http_port 3128 - This is will be pushed to Windows clients via domain policy, with the ...
0
votes
1answer
42 views

Delaying packets with libnetfilter_queue

From my Raspberry Pi configured as an access point, I set the following rules: sudo iptables -I FORWARD -p tcp --sport 25 -j NFQUEUE --queue-num 0 sudo iptables -I FORWARD -p tcp --sport 80 -j ...
0
votes
1answer
28 views

How can I do site-to-site OpenVPN routing without NAT

I have two OpenVPN servers at different location. Each machine in one location can ping and connect to every machine in the other location. My problem is when I use SSH to connect from machine A in ...
0
votes
1answer
26 views

How to configure an nginx VHost to hang up on the client in the rudest possible way?

I have a, let's call it, "legacy" VHost configured on an nginx server. It used to be a full site, but it has since been decommissioned and all the content removed. The server block now looks something ...
0
votes
0answers
15 views

Forwarding Traffic from an PPTP Server to Another Server

I'm facing a problem here. I have 2 servers. Server 1 is a pptp server and server 2 is another without pptp service. I want to forward some of the traffic from server 1 to server 2 through a tunnel ...
1
vote
1answer
642 views

csf Integrated User Interface not working

I've installed CSF on ubuntu 14.04 using their official install guide. After disabling UFW with the following command: sudo ufw disable then I have modified csf.conf with the following values: ...
0
votes
0answers
24 views

Filter packets with layer 7 (raw) data with iptables

Let's suppose I've got the following iptables rule: iptables -A INPUT -p tcp -s $IP --sport $PORT -j DROP filtering (and dropping, in this case) packets coming from $IP:$PORT. This filter drop ...
0
votes
0answers
17 views

How to find which program invoke iptables command [duplicate]

My SUSE Linux server always add an iptables rule that deny itself automatic, but I do not know which program added it. So how to find which program invoke iptables command or how to find which program ...
0
votes
0answers
16 views

IPTABLES Forward a Input with specif dport to VPN and masquerade

Inside our company we have a XMPP server that works with source 10.0.0.0/8. But, What I want to do is redirect a package coming from WAN to the VPN (which is where our XMPP is located) but doing a ...
5
votes
2answers
13k views

What's the mangle table in iptables?

I am using iptable rules to filter & manipulate packets in my Ubuntu server. but I cannot understand the mangle table. Quoting from this iptables tutorial: This table should as we've already ...
0
votes
3answers
29 views

OpenVZ container - Can't set nf_conntrack_max

My question is does the Host Node and a container both have the same "nf_conntrack_max" ? When i check on the host vs the container these are the results: Host Node [root@echo ~]# cat ...
-1
votes
2answers
21 views

Can't access server through web access despite allowing ports 80 & 443?

Here is the server's iptables file *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [13:2648] -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A ...
1
vote
2answers
1k views

iptables 1.4 and passive FTP on custom port

after the upgrade from debian squeeze to wheezy I've got a problem with passive FTP connection. I could narrow it to be iptables related, as I could connect via FTP w/o problems after adding my IP to ...
0
votes
1answer
1k views

ZenOSS webinterface connecting

I'm having a problem with ZenOss. I installed the centos stack installer on Centos 5.5 x64. De installation succeeded and no errors where displayed. But when I tried to surft to the ip address it ...
2
votes
1answer
979 views

Route outbound connections from local network through VPN

I have a server A running OpenVPN, an OpenVPN client B (a rooted Android phone as it happens) and a third party C (a laptop, tablet etc.) tethered to B. B can use the VPN to access the internet via ...
0
votes
3answers
1k views

How to configure linux routing/filtering to send packets out one interface, over a bridge and into another interface on the same box

I'm trying to test a ethernet bridging device. I have multiple ethernet ports on a linux box. I would like to send packets out one interface, say eth0 with IP 192.168.1.1, to another interface, say ...
0
votes
0answers
22 views

Limiting bandwidth to a specific IP

My question is very similar to http://serverfault.com/a/191605/253872 however I wish not to limit someone on my network, but traffic from my server to a specific IP. In reference to the script in the ...
5
votes
1answer
3k views

connect Open vSwitch switch to real network : iptables masquerade

I'm using Open vSwitch to create a switched network between virtualBox guest machines, and i want that the host OS (Ubuntu 12.04) join this network and to configure it as the gateway of this virtual ...
0
votes
1answer
41 views

Steps for limiting outside connections to docker container with iptables?

My goal is to limit access to docker containers to just a few public IP addresses. Is there a simple, repeatable process to accomplish my goal? Understanding only the basics of iptables while using ...
2
votes
3answers
3k views

How can I achieve OpenVPN client routing without NAT on Linode

I've set up an OpenVPN network, and it is working properly in the sense that I can access the inner/LAN machines from the remote client. However, my problem is that all traffic from the remote ...
0
votes
0answers
18 views

Cannot create a valid BPF program: bpf: check failed: parse error

I am trying to use xt_bpf iptables module to match for UDP DNS packets that have Recursion Desired bit set. I am slowly building my BPF program in assembly and compiling it through bpfc from ...
5
votes
4answers
147 views

Route IP Traffic Based on Process to Different Default Routes / Interfaces

I'm trying to determine if it is possible to selectively route IP packets from a process or process group through a specific interface while all other packets are routed through another interface. ...
-1
votes
2answers
41 views

I cant open a port iptables - The command runs, but port keeps closed [closed]

I want to make a simple redirect of my notebook port to a VM port (in my notebook also).. iptables -I INPUT -p tcp --dport 2424 -j ACCEPT iptables -t nat -A PREROUTING -p tcp --dport 2424 -j DNAT ...
0
votes
1answer
29 views

Ubuntu Iptables FTP passive mode

I have a problem when trying to define iptables rules in my ubuntu server. I reject all connections and allow some like FTP. The problem is that in passive mode I can connect but I cannot list ...
0
votes
1answer
38 views

Original IP lost with IPTables NAT to another server

I'm trying to forward all HTTP traffic from one EC2 linux server (external IP 11.11.11.11) to another one (external IP 22.22.22.22), these rules set: sudo iptables -t nat -A PREROUTING -p tcp --dport ...
0
votes
1answer
1k views

iptables: No chain/target/match by that name.

I am using this command to attempt to block this vulnerability scanner based on it's string, which is returning an error. # iptables -I INPUT -j DROP -d xxx.xxx.xxx.xxx -p tcp --dport 80 -m string ...
1
vote
1answer
26 views

Restrict only 1 file to use sendmail

I want to restrict access to sendmail process, to only 1 php file /var/www/mysite/contact.php How can I do this? Maybe there is a trick with Iptables or sendmail configuration? I want to secure ...
1
vote
1answer
36 views

Can't access to a port (which is running Spring boot jar) via it's public ip

I have deployed my spring boot app jar to centos server with this command: nohup java -jar black-0.0.1-SNAPSHOT.jar > log_black.out & In my application.properties I set the server port ...
1
vote
1answer
1k views

/etc/init.d/iptables-persistent start returns fail but seems to work

I am trying to activate iptables-persistent on an Ubunutu server. Config files are located in /etc/iptables/rules.v4 /etc/iptables/rules.v6 I have installed the iptables-persistent package. ...
2
votes
0answers
39 views

How to split traffic through two different network adapters based on TCP port in OS X

I have a scenario where we will be using a Mac to stream video content to an RTMP server. This RMTP service provides 2 ingest URLs so that you can upload the same video content twice and have ...
0
votes
1answer
13k views

I can connect, but cannot ping/route to remote VPN computers

Setup: L2TP VPN Server on a Windows Server 2008 machine which is behind a router, which is behind a modem/router. Modem/Router (IP: 192.168.2.1, Subnet: 255.255.255.0, DHCP serves 192.168.2.2 to ...
1
vote
1answer
975 views

Is there any way to filter packets (eg. by iptables) after routing is complete?

I want to drop certain packet destined to an ip_address AFTER it has reached the POSTROUTING chain. However, for iptables, the "nat" table cannot be used for filtering so the following doesn't work: ...
0
votes
2answers
66 views

iptables: trying to block port 53 but not working

I'm messing around with IP tables and I'm trying to do the following: I have several hosts on the same network: 192.168.1.0/24. The DNS server is 192.168.1.1. I'm trying to prevent all the hosts ...
0
votes
0answers
55 views

Trouble figuring out a fail2ban log error message: “iptables -n -L INPUT | grep -q 'fail2ban-SSH[ \t]' returned 100”

Here is my jail.local rule for ssh: [ssh-iptables] enabled = true filter = sshd action = iptables[name=SSH, port=ssh, protocol=tcp] logpath = /var/log/messages maxretry = 5 Here is what my ...
0
votes
2answers
60 views

SSH works but tunneling or SFTP doesn't. Why?

since 2014 I've got a server from SoYouStart, with Centos 7. It worked perfectly, but now I had to install again the OS. Now I'm configuring all the services to work again. I need to connect to the ...
1
vote
1answer
927 views

Transparent proxy which preserves client mac address

I have a customer that wants to intercept SSL traffic as it leaves their network. My proposed solution is to setup a proxy that is transparent and both layer 2 and layer 3 so it can simply be dropped ...
2
votes
4answers
18k views

Need to open port 10000 for webmin and 21 for FTP in Centos?

How can I open these two ports in CentOS? I have used Ubuntu before, but I never had to manually open any port. When I enter iptables -L, I get output like this: Chain INPUT (policy ACCEPT) target ...
0
votes
1answer
29 views

Iptables redirect HTTP traffic to proxy

I have a local HTTP proxy running, if I configure my browser to go through it works perfectly but I would need to leave the browser configuration blank and only redirect the traffic to the proxy with ...
1
vote
2answers
40 views

ftp server in passive mode at private subnetwork

I have following configuration: FTP client (public_IP1) => internet => Firewall(Public_IP2) => FTP server (10.10.12.171) I have following iptables rules at Firewall: DNAT tcp -- 0.0.0.0/0 ...
3
votes
1answer
63 views

Firewall: allow all traffic from sources authenticated via. an open ssh connection

I'm looking for a way to avoid the editing of the firewall rules all the time on test and dev servers. I don't want to open up all ports. So I thought maybe there is a way to allow all traffic from ...
0
votes
1answer
2k views

Iptable l7-filter installation guide and block p2p

I would install l7-filter to block P2P torrent, First of all , I have a linux debian. I installed by the below command apt-get install l7-filter-userspace And then run command iptables -I FORWARD ...
2
votes
2answers
2k views

mod_evasive DOSSystemCommand not working

I'm trying to get mod_evasive to fire off a script to add an iptables rule to deny the offending host. I've tried the suggestions from both answers here but I still can't get it working. Apart from ...