iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

7
votes
2answers
19k views

Bridging LXC containers to host eth0 so they can have a public IP

UPDATE: I found the solution there: http://www.linuxfoundation.org/collaborate/workgroups/networking/bridge#No_traffic_gets_trough_.28except_ARP_and_STP.29 # cd /proc/sys/net/bridge # ls bridge-...
8
votes
2answers
3k views

iptables | Types of ICMP: which ones are (potentially) harmful?

I read that certain types¹ of ICMP packets can be harmful. Questions: Which ones and why? How should I layout an iptables ruleset to handle each type of ICMP packet? Should I rate-limit any of these ...
4
votes
1answer
5k views

How to create UDP proxy using iptables

I have a server running UDP server on port 50000. This server receives updates from clients, and pings back the clients every 5 seconds to the socket they were connected from. Now I want to redirect ...
3
votes
1answer
7k views

iptables allow all outgoing - still can't resolve dns or make a http request

I have setup iptables this way: Table: mangle Chain PREROUTING (policy ACCEPT) num target prot opt source destination Chain INPUT (policy ACCEPT) num target prot opt source ...
11
votes
3answers
6k views

Cannot Set UID on Shell Scripts

Can anyone help me find out what is going on here? I have some rules set up tracking packet counts. When I run the following script as root: #!/bin/bash iptables -t mangle -xnvL I get the output ...
3
votes
3answers
4k views

Advanced routing problem

I have 2 internet links using 2 ADSL routers and I need to give access to the Internet for the 192.168.0.0/24 network. I have to route outgoing traffic based on port number, protocol, … using ...
9
votes
3answers
7k views

How do you test iptables rules to prevent remote lockout and check matches?

As I'm learning about iptables I've made a couple of mistakes and locked myself out. What method(s) do you use to test rules without locking yourself out? I'm using ubuntu server 12.04 LTS All ...
8
votes
3answers
13k views

Iptables: “-p udp --state ESTABLISHED”

let's look at these two iptables rules which are often used to allow outgoing DNS: iptables -A OUTPUT -p udp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A ...
3
votes
3answers
2k views

Service can't connect to self using public IP, NAT problem

I have a dedicated server from serverloft.eu, but due to some network security I cannot use bridge networking on my server. So I have setup all my IPs to the main eth0, and used NAT to forward trafic ...
1
vote
4answers
12k views

iptables: IP alias and port forwarding

I can't figure out iptables and I don't know very much about networking and I'm really hoping that someone out there can help me. I have a server with two ip addresses associated with it: 1.1.1.1 and ...
8
votes
5answers
5k views

Copying packets from an interface to another

I have a Linux system (let it be A) with 2 ethernet cards, namely eth0 and eth1 which are attached to two totally unrelated LANs. Basically eth0 is used for normal application traffic and eth1 is ...
7
votes
2answers
5k views

Debian 'ignores' /etc/network/if-pre-up.d/iptables

I want my iptables rules to automatically be loaded on startup. According to the wiki on Debian this can be done by placing a script with the name iptables in /etc/network/if-pre-up.d/ So I did, this ...
6
votes
3answers
4k views

Firewall questions about state and policy?

I finally managed to install my VM host and now I am messing with iptables to create, test and learn. Does it matter if i put the below rules at the begin or at the end of my rules ? $IPT -P INPUT ...
5
votes
2answers
8k views

How many rules can iptables support?

Someone asked me this recently and I had no answer for it. I know this is kind of an open-ended question but is there a limit on the numnber of rules you can install in a table/chain? If so, how can I ...
5
votes
3answers
2k views

iptables — OK, **now** am I doing it right?

This is a follow up to a previous question where I asked whether my iptables config is correct. CentOS 5.3 system. Intended result: block everything except ping, ssh, Apache, and SSL. Based on ...
4
votes
2answers
12k views

iptables redirect local connections to remote system / port

I am trying to use SSH to port forward windows machines local port 3389 to a redhat server on some arbitrary port (in the unprivileged region) I have protected behind a firewall, then forward the ...
3
votes
2answers
224 views

ipTables: How to improve the current set-up?

It took a lot of time and digging to get my ipTables working fairly well. Current status: 'Works' w/ a noticeable, reproducible (almost unacceptable) delay on SSH connections. This delay goes away as ...
3
votes
3answers
6k views

How to log the ip addresses trying to connect to a port?

Is it possible to log all ip addresses that trying to connect or connected to port "5901" in linux debian? how can i do that? Regards
3
votes
3answers
223 views

Iptables rules with ! character

I have entered iptables rules to log a specific connection on our server, but it doesn't seem to be working as I want it to. Here are the rules: 1 LOG tcp -- !10.51.0.0/16 0.0.0.0/...
2
votes
1answer
18k views

Failed to retrieve directory listing in Filezilla connecting to vsftpd

newbie here. At first I was unable to connect to vsftpd but I added port 21 in iptables (i'm running on Centos 6) and managed to make it work. But now, I can't get past Command: LIST in Filezilla ...
2
votes
1answer
6k views

iptables change destination IP without DNAT

I'm trying to workaround a broken application which insists on connecting to the private address (and thus unreachable) of a server, instead of connecting to the public address (even if the relevant ...
1
vote
1answer
157 views

iptables logging doesn't log

I'm trying to log any requests to port 22 into my syslog, so I have following line in my iptables: LOG tcp -- anywhere anywhere tcp dpt:ssh LOG level debug yet, ...
1
vote
2answers
2k views

Using iptables to redirect incoming requests from port 2525 to port 25?

I'm a developer working from home on an application. One of the features of my app is that it sends outgoing notification emails. I'm attempting to relay these messages through one of our company's ...
10
votes
4answers
24k views

iptables nat does not exist

Today my iptables nat on the host system stopped working and I have no clue what happend! (That's very bad, I know) All commands are executed as root user. If I run $ iptables -t nat -L I get the ...
5
votes
1answer
5k views

iptables drop packet by hex string match

I got this packet captured with tcpdump but I'm not sure how to use the --hex-string param to match the packet. Can someone show me how to do it? 11:18:26.614537 IP (tos 0x0, ttl 17, id 19245, offset ...
4
votes
1answer
994 views

Network Bridge in dom0 can not ping domU's

I am using Debian wheezy with XEN 4.1. I have two network bridges xenbr0 and xenbr1. xenbr0 is linked to the real-eth0-nic so the domU's can talk to the outside world, which worked fine. xenbr1 was ...
3
votes
1answer
1k views

IPTables: No chain/target/match by that name

I am trying to execute the following command in iptables (it's the first command I have issued to IPTables since I setup my new VPS, but when I execute the command below: iptables -A INPUT ...
3
votes
2answers
3k views

Iptables port forwarding on OpenVZ CEntOS container

I am trying to setup a simple port forwarding on an OpenVZ container that is running CentOS 5.5. When I run a command I get errors. iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-...
2
votes
1answer
2k views

How do I redirect one port to another on a local computer using iptables?

All of the port forwarding examples I can find are for NAT, which is not what I want. We have an HTTP server application that only binds to 1 port at a time. However, we need to bind to an additional ...
1
vote
3answers
194 views

IP tables - changes not persisting

I've tried to open port 8605 on my server (used for socket connections) using: iptables -I INPUT 2 -s 0/0 -p tcp --dport 8605 -j ACCEPT However the change is not persisting, the port closes itself ...
1
vote
1answer
528 views

why port forwarding is not working in this setup?

I'm trying to setup a docker virtualization environment. This is a follow up of this question. I have a virtual eth0:0 interface, and I would like to forward it using iptables. The public, main IP ...
1
vote
2answers
662 views

bridging LXC containers to host network with different IP range

I'm pretty new to linux, and I have been struggling with a problem for the past week or so... I am trying to setup a cluster of LXC containers on a workstation (host) which is has IP 192.168.10.33 ...
1
vote
1answer
114 views

Block IPs if they access a resource

I own a server that it's costantly being attacked by scripts (that try to access to phpMyAdmin's setup file's and stuff like this). I've heard that many people get this kinds of attacks, but I'm ...
0
votes
1answer
1k views

NAT / Port Forwarding with iptables firewall [duplicate]

I've got the following setup: firewall (iptables) eth0 internal interface, 192.168.2.10 ppp0 external interface, public_ip (IP masquerading) server1 (192.168.2.11), service 1 (port 443) server2 (...
0
votes
2answers
2k views

Forward SSH request to an External Server to an Internal Server [duplicate]

I have a VM config currently where I have 1 external IP pointing to a VM with an Nginx HTTP Reverse proxy serving HTTP Web Pages from several internal VMs without external IPs. I need a similar setup ...
0
votes
0answers
22 views

DNS using GRE work 50%

l'm in a big issue here to make it work I'm already at least about 60% done, but it is difficult and I would like to count on the help guys here who may have already done this type of configuration. ...
0
votes
1answer
5k views

Openvpn - enabled redirect gateway but can't access any websites

First of all I'm a newbie to servers but not to stuff like programming so not totally alien to command lines etc. Second, I want to run openvpn on my remote server and connect from my ubuntu desktop ...
-1
votes
1answer
556 views

iptables: REJECT not working, but DROP does

I have recently setup a server with fail2ban, and it is mostly working except I am getting errors whenever this command tries to execute: sudo iptables -D fail2ban-ssh -s xxx.xxx.xxx.xxx -j REJECT --...
66
votes
8answers
119k views

How to Unban an IP properly with Fail2Ban

I'm using Fail2Ban on a server and I'm wondering how to unban an IP properly. I know I can work with IPTables directly: iptables -D fail2ban-ssh <number> But is there not a way to do it with ...
14
votes
5answers
4k views

iptables management tools for large scale environment

The environment I'm operating in is a large-scale web hosting operation (several hundred servers under management, almost-all-public addressing, etc -- so anything that talks about managing ADSL links ...
37
votes
4answers
57k views

Windows equivalent of iptables?

Dumb question: Is there an equivalent of iptables on Windows? Could I install one via cygwin? The real question: how can I accomplish on Windows what I can accomplish via iptables? Just looking for ...
6
votes
3answers
38k views

howto only tunnel specific hosts route through openvpn client on tomato [closed]

I am relatively newbie in networking world although I did coding and know some sysadmin background for a long time. and here I'm only one step from my destination. The whole picture is : at home I ...
19
votes
6answers
8k views

Use IPtables or null route for blacklisting about 1 million IP addresses?

I've come across a situation where a client needs to blacklist a set of just under 1 million individual IP addresses (no subnets), and network performance is a concern. While I would conjecture that ...
6
votes
4answers
17k views

transparent SSL proxy myths and facts

I've been searching for many hours now about a way to setup a transparent proxy for SSL (not Squid). The general answer is that I can't, but I know there are some ways, though. My purpose is only the ...
23
votes
1answer
8k views

What is the point of the docker-proxy process? Why is a userspace tcp proxy needed?

I have noticed that there is docker-proxy process running for each published port. What is the purpose of this process? Why is a user space tcp proxy needed for this? $ ps -Af | grep proxy root ...
21
votes
3answers
43k views

What is the correct way to open a range of ports in iptables

I have come across articles advising for the following: iptables -A INPUT -p tcp 1000:2000 -j ACCEPT And others stating that the above will not work and iptables only supports multiple port ...
15
votes
5answers
45k views

Whitelist allowed IPs (in/out) using iptables

I have a few ip ranges to which I want my server to able to connect and users to connect from. Everything else should be blocked. How should I do that with iptables? My OS is Debian based linux ...
7
votes
7answers
4k views

How do you manage your Linux iptables configuration on a machine acting as a router?

I have a couple Linux machines that act as routers/firewalls for my networks and I have a script that runs all the iptables commands to set my rules. This seems to me like a really silly way to do it ...
5
votes
2answers
13k views

Stop DoS attacks with an IP tables rule?

I was wondering if I could prevent small (D)DoS attacks with a simple IP tables rule? By small I mean that they are flooding my web server with about 400+ requests from one or two IP addresses. I ...
14
votes
6answers
13k views

How to duplicate TCP traffic to one or multiple remote servers for benchmarking purposes?

Infrastructure: Servers in Datacenter, OS - Debian Squeeze, Webserver - Apache 2.2.16 Situation: The live server is in use by our cusotmers every day, which makes it impossible to test ...