iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

3
votes
4answers
922 views

How can private IPV4 addresses get past iptables NAT (tcp RST,FIN)

I've got a router performing simple NAT translation using iptables iptables -t nat -o -j MASQUERADE This works fine almost all of the time except for one particular case where some TCP RST and FIN ...
1
vote
0answers
6 views

3 server point to point bridge loop

I have a setup with 3 servers (A, B and C) running debian jessie which are all directly connected to the other two servers, so it is a ring-like layout. I'd like them to only have ohne IP each like if ...
1
vote
1answer
32 views

Reloading IPTables Disable Access to Site

I have CentOS 7 VPS. IPtables contains 2000 IP block rules. When reloading it takes 80 seconds to complete reloading. During that 80 seconds, I notice that around 15 seconds, my site becomes ...
0
votes
1answer
1k views

Iptable Rule to redirect all traffic requesting a specific domain

I'm on a simple linux proxy. I'd like to add iptable rules to drop all requests for a specific domain. I figured I run a dig command to get the ip addresses for the domain and then add an iptable ...
1
vote
4answers
2k views

http request via iptables --to-destination ip redirect results in no response

I have two Ubuntu servers with each having their own ip addresses. Let's call them server1 and server2, having respectively ip 1.1.1.1 and 2.2.2.2 I have a nginx running on server2. The sole purpose ...
0
votes
0answers
26 views

blocking subnets in iptables

I currently have a router attached to the main network (192.168.0.x). On this router, I want the ethernet-ports to link to the main network, and the vlan's (wireless) to be set up via a separate DHCP ...
2
votes
0answers
37 views

IPTables DNAT Exemption

TL;DR - I'm looking for a way to send all my external traffic through a proxy server but not send all my internal traffic through a proxy server. How can I achieve this? My end goal is to forward ...
2
votes
1answer
21 views

How do I add a mangle rule to my saved iptables firewall rules file?

I've set up OpenVPN on my Debian server and would like to add a rule to iptables. I already have a file that lists default filter rules that iptables reads from (pre-up). I tried adding the rule to ...
-1
votes
0answers
14 views

ufw not working on openvz vps

I'm trying to make ufw work for an Ubuntu 14.04 vps using openvz. All questions about this problem (like this one) lead to the same site. This one: http://blog.bodhizazen.net/linux/how-to-use-ufw-in-...
-2
votes
0answers
23 views

Cannot get firewall to work

I have 2 machines A and B with 2 ethernet interfaces eth0 (internet) and eth1 (local) a) I want A to act as a FW and would like to install Shorewall on it and have in & outbound traffic go thru A ...
2
votes
1answer
1k views

Using LVS (Linux Virtual Server) for doing DNS HA

I have been trying to create an LVS DNS HA using CentOS 6.x: Piranha GUI to configure the DNS Pulse is the HA heart of CentOS LB IPTables to configure marks on the packets since DNS uses TCP and UDP ...
0
votes
1answer
2k views

Gre Tunnel Cisco Linux traffic forwarding

I setup a gre tunnel a cisco router and a Linux machine, the tunnel interface in the Linux box named pic. Well i have to forward traffic coming from cisco through the Linux box. the rules i've set in ...
0
votes
0answers
5 views

Windows 10 - NAT - Port forwarding & IP masquerade [migrated]

I'm looking for a way to get iptables functionality in windows 10. I enabled IP routing and I need to forward tcp data to another host (port 8080) and then forward his response while masquerading IP. ...
0
votes
2answers
3k views

lots of UDP_IN Blocked errors

Since I have reinstalled my OS, I'm getting lots of UDP_IN Blocked errors in my messages log. Can anyone kindly explain what the error say exactly and what I can do to get rid of this error. Aug 8 ...
14
votes
5answers
4k views

iptables management tools for large scale environment

The environment I'm operating in is a large-scale web hosting operation (several hundred servers under management, almost-all-public addressing, etc -- so anything that talks about managing ADSL links ...
-1
votes
1answer
26 views

Need to limit INPUT PSH+ACK packets

I have several HEAD queries a week that look like this (I assume that this is some kind hack attempt): 289 24133.787750 81.94.192.233 -> 95.85.35.251 HTTP 118 HEAD / HTTP/1.1 290 24133.987861 81.94....
-1
votes
0answers
30 views

Port 443 connection refused [duplicate]

A few days ago HTTPS was still working fine (I'm using nginx). But now even telnet localhost 443 gives connection refused. I've checked my iptables, but I think nothing is wrong with it? You can ...
-4
votes
0answers
32 views

Control internet access in LAN

We have a lab setup with multiple user-systems, where user authentication is done centrally from a server through ldap and home directories exported from server through nfs. Within this lab setup we ...
0
votes
0answers
24 views

DMZ with 2 firewall - How to allow access to DMZ from LAN

i following tutorial to setup DMZ with 2 filewall. Diagram Network can be found here --[Modem]------eth0-[External FW]-eth1------eth1-[Internal FW]-eth2-------[Intranet] External FW: eth0: 192.168....
0
votes
1answer
1k views

How can I block all traffic to/from an bridged interface while allowing DHCP?

I have a PC (running Fedora 20) that is being used as a "software switch" to control the network connectivity of some external devices. There are eight such devices; the PC has two 4-port Ethernet ...
0
votes
0answers
4 views

Temporarily ignore/bypass proxy settings using iptables when WFH [migrated]

I have an HTTP and HTTPS proxy at my work. Though when I work from home I would like to disable the proxy settings (connect directly to the Internet). Then, when I come back to work, bring back the ...
1
vote
2answers
104 views

Linux change source ip adress of incoming traffic

I have a web service running on port X. It was never intended to run outside a local network, but I would like to access it over the internet. Therefore, I need to change the source IP address of all ...
0
votes
2answers
1k views

Blocking STP Traffic

I am using Xen virtualization with a bridged mode netwrk. I noticed that there is a lot of spanning tree (as understand) traffic coming from a network. Such as: STP 802.1d, Config, Flags [none], ...
0
votes
1answer
25 views

iptables port forwarding to server with different port

I am trying to port forward from one server to another. I have tried numerous iptables commands but they don't work. Am I doing something wrong? Here is my setup: VPS1: 1.1.1.1 SMTP Port : 25 UFW:...
0
votes
1answer
4k views

iptables forward rule not working in openwrt

I am trying to apply some iptables forwarding rules in openwrt. Here is my scenario - My server has two cards ath0 and br-lan. br-lan is connected to internet and ath0 to private network. The other ...
0
votes
0answers
12 views

L2TP and Openswan NAT

I have a connection between a local CentOS7 machine and a remote customer server connected via L2TP. I can communicate CentOS7 <--> Customer flawlessly, but the problem begins when I try to ...
0
votes
1answer
22 views

IPTables Policy INPUT DROP but accepts connection

I configured iptables with the following rules: iptables -I INPUT -p tcp --dport 22 -j ACCEPT iptables -P INPUT DROP iptables -A INPUT -p tcp --dport 80 -j ACCEPT iptables -A INPUT -p tcp --dport 443 ...
0
votes
1answer
19 views

allow ssh outgoing with iptables default policy as drop

Good day all My VPS allows incoming ssh connections as required (see rule), however attempting outgoing ssh connections fails to connect with $ ssh xyz.ddns.net ssh: connect to host xyz.ddns.net ...
0
votes
2answers
246 views

ERROR: could not open directory /lib/modules/4.2.0-25-generic: No such file or directory

I upgraded Ubuntu 15.10 to 16.04 and somewhere there must happened my trouble. I firstly realised my trouble when I wanted to do sudo iptables -A INPUT -m state --state NEW -p tcp --dport 80 -j ...
0
votes
1answer
41 views

Wifi router block internal traffic

I make a wifi router from raspberry with raspbian. My eth0 connect to a network that can access internet, and I make a local network for client connected to my wifi. My wifi works as a gateway for ...
1
vote
0answers
26 views

TC not classifying packets correctly based on iptables MARK

I have machineA that is connected to the internet via eth0. MachineB on the other hand is connected to machineA through a mesh and is connected to the internet via machineA. I am trying to give lower ...
0
votes
2answers
53 views

Is it safe to open all UDP ports range?

I've setted some main ports - 20, 21, 22, 23, 53, 80, 443 for incoming and outgoing TCP connections. If i want to connect from inside my server to another ftp server, it uses random UDP port in range ...
0
votes
1answer
35 views

IP Range - Subnet network configuration on CentOS 6.4

I have problems to configure an subnet /25 on an vps with CentOs 6.4 have tried different version. The original eth0 settings are: DEVICE=eth0 #HWADDR=de:8f:24:e9:7b:04 TYPE=Ethernet UUID=64e110dd-...
2
votes
3answers
4k views

How to redirect a website using IPtables?

I have referred to the following links before asking this question. I am making an example for my students on NAT - pre-routing. Here, I am trying to replace the destination ip with the one I want. ...
1
vote
1answer
32 views

Port forwarding prevents container from updating

I use the following route on my host machine in order to pass all my traffic to a NGINX server running at port 8080. -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080 Unfortunately when I ...
4
votes
3answers
7k views

How to enable traceroute in linux machine

I'm working on something in the transport layer and after i ran our custom policies for securing the policies i'm not able to do traceroute from the linux machine. root@keystone-evm:~# iptables -L ...
1
vote
1answer
2k views

SSH Socks Proxy wiith iptables REDIRECT

I have googled and haven`t found the answer on my question. Help me please. There are two servers: serverA with public IP 12.0.0.10 and an private IP 10.0.0.5 serverB with public IP 20.0.0.11 I ...
-2
votes
1answer
39 views

How can I force applications to use specific interface (tun0) or eth0? [on hold]

I have two active networks: eth0, tun0. By default all outgoing traffic uses tun0 (when active). How can I force certain applications (like Plex) to use eth0 for incoming/outgoing calls?
0
votes
1answer
1k views

fsockopen(): unable to connect to 127.0.0.1:6379

Im running centOs 6.3, I installed redis-server via remi repository on my local machine. I can run the redis cli. But when I try to connect via php script I get fsockopen(): unable to connect to ...
5
votes
2answers
4k views

Iptables - Redirect outbound traffic on a port to inbound traffic on 127.0.0.1

Is there a way to redirect traffic set to go out of the server to another IP, back to the server on localhost (preferably as if it was coming from the original destination)? I'd basically like to be ...
-2
votes
2answers
36 views

Route only Web Traffic of my Ubuntu machine through OpenVPN proxy [closed]

My question is simple, but I couldn't find a clean, step_by_step guide/example on the Internet. I have an OpenVPN proxy server and I want to just route the web traffic of my local Ubuntu machine ...
0
votes
0answers
16 views

How can I forward blocked http/https traffic by IP Tables to another host?

I have a huge list of IP Addresses blocked by iptables with rules set to DROP all of their traffic. The main traffic that comes is either http (port 80) or https (port 443). Is there a way (without ...
-1
votes
1answer
21 views

Iptables in ubuntu 14.04 doesn't have statistics extension

I have an Ubuntu box and need to manage iptables rules with the help of statistics extension but everytime I try to run iptables -m statistics --help I'll get such error iptables v1.4.21: ...
1
vote
1answer
47 views

How to mangle IP addresses based on time using iptables

I want to change my IP addresses based on time not urls. Following is my iptable rule to mangle IPs I have : sudo iptables -t nat -A POSTROUTING -o em1 -p tcp --dport 80 -j SNAT \ --to ...
2
votes
1answer
507 views

“nf_conntrack: table full, dropping packet” even though nf_conntrack_count is much less than nf_conntrack_max

I have a node in our cluster which gets lots of "nf_conntrack: table full, dropping packet" messages in the syslog. I checked the nf_conntrack_count and it was running right up against the ...
0
votes
1answer
21 views

Simultaneous outgoing connections limit with iptables not working

I run a website that technically acts as a proxy to another website (I make HTTP requests to it), and I needed to make sure not too many simultaneous connections were made, I thus limited it to 29 ...
0
votes
1answer
2k views

apt-get update can not connect

i run a dedicated ubuntu 10.04 server. i use kvm/libvirt/virsh to run a virtual machine that's also ubuntu 10.04. i bridged the network (1 of 2 IPs is routed via NAT to the LAN, where my VM (192....
6
votes
4answers
6k views

How to Enable IPtables TRACE Target on Debian Squeeze (6)

I am trying to use the TRACE target of IPtables but I can't seem to get any trace information logged. I want to use what is described here: Debugger for Iptables. From the iptables man for TRACE: ...
-1
votes
1answer
2k views

How to set up port forwarding for postgresql listening on localhost?

I have a postgresql instance running on SLES. I want to set it up to listen on localhost, and enable iptables to perform port forwarding. My current configuration postgresql.conf: ...
-1
votes
2answers
52 views

Ports aren't really getting blocked with iptables [closed]

I'm on Ubuntu 14.04.4 LTS, I'm under attack from some ports, I blocked all of ports except SSH in my own server, I'm doing that by this way: iptables -F iptables -P INPUT DROP iptables -P OUTPUT DROP ...