iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

2
votes
1answer
1k views

How do I redirect one port to another on a local computer using iptables?

All of the port forwarding examples I can find are for NAT, which is not what I want. We have an HTTP server application that only binds to 1 port at a time. However, we need to bind to an additional ...
2
votes
3answers
1k views

Iptables massive 1:1 NAT

I have to connect two LANs: LAN1: 10.10.0.0/16 and LAN2: 192.168.0.0/16. I can't do simple routing, because 192.168.0.0/16 net is prohibited in LAN1, so I am thinking of using Full cone nat (1:1) to ...
1
vote
1answer
113 views

iptables logging doesn't log

I'm trying to log any requests to port 22 into my syslog, so I have following line in my iptables: LOG tcp -- anywhere anywhere tcp dpt:ssh LOG level debug yet, ...
1
vote
1answer
52 views

Block IPs if they access a resource

I own a server that it's costantly being attacked by scripts (that try to access to phpMyAdmin's setup file's and stuff like this). I've heard that many people get this kinds of attacks, but I'm ...
1
vote
1answer
331 views

redirection made by iptables take effect even after i removed the rule from the chain

for example i added the following rule to the PREROUTING chain: iptables -t nat -A PREROUTING -d 210.210.210.210 -j DNAT --to-destination 200.200.200.200 (lets say that both of the ip addresses are ...
1
vote
1answer
443 views

Why did my new iptables rules screw up outbound traffic?

I recently set up Tomcat on Port 80 using instructions provided by Werner Puschitz. In essence, I had to execute these two iptables commands: iptables -t nat -I PREROUTING -p tcp --dport 80 -j ...
0
votes
1answer
350 views

find common string to block IPs

Currently I have all these IPs coming in. Is there a way to find a common string in the content of the packets and then block the attack via IPTables? Oct 24 16:28:52 host kernel: [ 823.255566] ...
0
votes
4answers
7k views

iptables: IP alias and port forwarding

I can't figure out iptables and I don't know very much about networking and I'm really hoping that someone out there can help me. I have a server with two ip addresses associated with it: 1.1.1.1 and ...
0
votes
1answer
4k views

Openvpn - enabled redirect gateway but can't access any websites

First of all I'm a newbie to servers but not to stuff like programming so not totally alien to command lines etc. Second, I want to run openvpn on my remote server and connect from my ubuntu desktop ...
11
votes
4answers
3k views

iptables management tools for large scale environment

The environment I'm operating in is a large-scale web hosting operation (several hundred servers under management, almost-all-public addressing, etc -- so anything that talks about managing ADSL links ...
8
votes
4answers
14k views

Good iptables starting rules for a webserver?

I am installing a new centos 5.4 server and I would like to have a set of clean rules for mu iptables to startup. What would be the good rules to start with? Is this a good starting point : # ...
16
votes
5answers
4k views

Use IPtables or null route for blacklisting about 1 million IP addresses?

I've come across a situation where a client needs to blacklist a set of just under 1 million individual IP addresses (no subnets), and network performance is a concern. While I would conjecture that ...
24
votes
3answers
28k views

Windows equivalent of iptables?

Dumb question: Is there an equivalent of iptables on Windows? Could I install one via cygwin? The real question: how can I accomplish on Windows what I can accomplish via iptables? Just looking for ...
6
votes
7answers
3k views

How do you manage your Linux iptables configuration on a machine acting as a router?

I have a couple Linux machines that act as routers/firewalls for my networks and I have a script that runs all the iptables commands to set my rules. This seems to me like a really silly way to do it ...
13
votes
2answers
9k views

IPTables only allow localhost access

I have struggled throughout the years to get a solid understanding on iptables. Any time I try and read through the man pages my eyes start to glaze over. I have a service that I only want to allow ...
9
votes
5answers
14k views

How to Unban an IP properly with Fail2Ban

I'm using Fail2Ban on a server and I'm wondering how to unban an IP properly. I know I can work with IPTables directly: iptables -D fail2ban-ssh <number> But is there not a way to do it with ...
8
votes
5answers
10k views

iptables rules to allow HTTP traffic to one domain only

I need to configure my machine as to allow HTTP traffic to/from serverfault.com only. All other websites, services ports are not accessible. I came up with these iptables rules: #drop everything ...
6
votes
3answers
10k views

Throttle bandwidth via iptables

I have a need to throttle the bandwidth usage, similar to how some ISPs do it, so that after a couple of seconds, it throttles down the speed.
21
votes
2answers
6k views

Iptables, what's the difference between -m state and -m conntrack?

What's the practical difference between: iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT and iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT Which one is ...
0
votes
1answer
6k views

Using DD-WRT to connect to VPN and Forward all traffic of certain devices through VPN

I have been able to setup my dd-wrt router to connect to an openvpn server and route all traffic through the vpn to the internet. This makes it so all traffic comming in from the LAN to the ...
6
votes
3answers
7k views

Iptables - Bridge and Forward chain

I have setup ethernet bridge br0 that contains two interfaces eth0 and tap0 brctl addbr br0 brctl addif eth0 brctl addif tap0 ifconfig eth0 0.0.0.0 promisc up ifconfig tap0 0.0.0.0 promisc up ...
6
votes
4answers
17k views

Whitelist allowed IPs (in/out) using iptables

I have a few ip ranges to which I want my server to able to connect and users to connect from. Everything else should be blocked. How should I do that with iptables? My OS is Debian based linux ...
5
votes
3answers
9k views

transparent SSL proxy myths and facts

I've been searching for many hours now about a way to setup a transparent proxy for SSL (not Squid). The general answer is that I can't, but I know there are some ways, though. My purpose is only the ...
5
votes
2answers
1k views

iptables | Types of ICMP: which ones are (potentially) harmful?

I read that certain types┬╣ of ICMP packets can be harmful. Questions: Which ones and why? How should I layout an iptables ruleset to handle each type of ICMP packet? Should I rate-limit any of these ...
1
vote
2answers
1k views

How to block internet access to certain programs on Linux

Recently, I have encountered a problem of limiting Internet Access to specific programs. Could anybody recommend a good way of doing that, without using any particular software?
8
votes
1answer
3k views

iptables: Port forwarding with masquerading is not working

I'm having some issues with my port forwards. NAT seems to work ok and one out of the port forwards seem to work (udp port 7887 to machine 192.168.1.100). But not the others. I doubt that it matters, ...
7
votes
2answers
9k views

Increasing ip_conntrack_max safely?

I've see the following in my logs every so often: kernel: ip_conntrack: table full, dropping packet. Currently, I have ip_conntrack_max set to 65536 (default, RHEL5). Keeping memory usage in mind, ...
5
votes
2answers
2k views

Duplicate incoming TCP traffic on Debian Squeeze

I have to test a homebrew server that accepts a lot of incoming TCP traffic on a single port. The protocol is homebrew as well. For testing purposes, I'd like to send this traffic both : - to the ...
3
votes
1answer
722 views

UFW/IPTables: how to securely allow authenticated git access with github

This is how I setup my iptables with UFW: sudo ufw default deny incoming (deny all incoming) sudo ufw default deny outgoing (deny all outgoing) sudo ufw allow out 53 (accept outgoing DNS traffic, ...
3
votes
2answers
5k views

Should I rate-limit packets with iptables?

I'm using iptables on Ubuntu Server. It's a web server on a VPS. I'd like to know if I should rate-limit packets. If so, what should I rate-limit? And should I do so globally or per IP address? ...
3
votes
1answer
3k views

How can I rate limit SSH connections with iptables?

I'm trying to limit the number of possible SSH connections to my server but it just seems to lock me out every time. I'm not very familiar with iptables but I've been reading up on the rules that I ...
3
votes
2answers
2k views

Allowing apache to write with iptables [duplicate]

Since to days ago I'm receiving DDOS atacks in my server. I've installed mod_evasive in apache and it works right! It writes the log and send the email with de IPs. But there's a problem: Apache ...
3
votes
2answers
4k views

Limit total bandwidth use per user

I'm running a Linux server accessible to a wide range of users, and (due to some policies in place by my upstream Internet provider) I need to limit the total amount of data a user can transfer to ...
2
votes
1answer
5k views

OpenVPN server running on openvz. How to write iptables rule without masquerade?

I am configuring a VPS which is running on openvz as an OpenVPN server using a tun interface. I am having some trouble with the iptables rule as MASQUERADE is not available. If MASQUERADE were ...
2
votes
1answer
2k views

How to allow 6to4 through iptables firewall?

Im trying to allow 6to4 though my ipv4 firewall on Debian 6 (Squeeze) but without much luck, it seems most of the syntax used by other OS's isn't quite supported in Debian's iptables. I'v tried: (I ...
2
votes
3answers
5k views

How to create an Iptables rule using domain name

Can anyone please suggest a way to use a domain name in iptables rules.
2
votes
1answer
3k views

Iptables and SNAT

I am a newbie to iptables with NAT. My network setup is as shown below linuxbox2 (192.x.y.a) | (194.160.1.1) | linuxbox1(eth1)-------- Switch ...
2
votes
2answers
1k views

How to change routing for skype packets?

I can't seem to find a way to somehow change routing for Skype packets. I have following situation: host ha, in lan, runs skype. host ha has gateway "gw1" gw1 has 2 separate network connections - ...
1
vote
1answer
4k views

iptables allow all outgoing - still can't resolve dns or make a http request

I have setup iptables this way: Table: mangle Chain PREROUTING (policy ACCEPT) num target prot opt source destination Chain INPUT (policy ACCEPT) num target prot opt source ...
1
vote
6answers
395 views

Ultra Secure Linux Server SSH Only

I'm setting up a secure server for my use only to store encrypted files, but it will need to be accessed from the internet. The server itself is in a secure location with no physical access which is ...
0
votes
1answer
940 views

How to identify download traffic using iptables

How can I identify download traffic and set a mark so that I can route those packets using the fwmark through another link ?
12
votes
2answers
738 views

What is the difference between securing a linux box using hosts.[allow|deny] vs iptables?

As the title states, I have a linux box. As far as I can tell I can use hosts.allow / hosts.deny or iptables to secure. What's the difference? Is there another mechanism that can be used?
8
votes
4answers
6k views

Setting up a transparent SSL proxy

I've got a linux box set up with 2 network cards to inspect traffic going through port 80. One card is used to go out to the internet, the other one is hooked up to a networking switch. The point is ...
7
votes
4answers
13k views

iptables multiple source IPs

I'd like to create a single rule in iptables (if possible) that uses multiple source IP addresses. Is this possible?
5
votes
2answers
307 views

Linux: Block IPv6 for certain applications / hostnames

Problem and aim We don't get IPv6 from our ISP thus I have an IPv6 tunnel which works fine but is, of course, not very fast. And not really reliable. I like to have IPv6 available "just in case" but ...
5
votes
1answer
509 views

Block outgoing connections for certaing uids (root, apache, nobody)

With iptables in CentOS 5 and 6 Linux - how can you please prevent processes running as root, apache or nobody from initiating outgoing connections? On CentOS 5 Linux I've tried putting these lines ...
5
votes
2answers
1k views

Linux fails to interpret ACK, keeps resending SYN+ACK

The following is a wireshark dump of the problem occurring, IP-adresses replaced with 'client' and 'server': 4414.229553 client -> server TCP 62464 > http [SYN] Seq=0 Win=65535 Len=0 MSS=1452 ...
5
votes
4answers
432 views

iptables: change policy or use catch-all rule?

What do you do when setting up iptables: change the default policy (iptables -P INPUT DROP, for example) or add a catch-all rule at the end of the ruleset (iptables -A INPUT DROP)? If you do prefer ...
5
votes
4answers
3k views

Copying packets from an interface to another

I have a Linux system (let it be A) with 2 ethernet cards, namely eth0 and eth1 which are attached to two totally unrelated LANs. Basically eth0 is used for normal application traffic and eth1 is ...
4
votes
3answers
1k views

pptpd not working externally on Ubuntu Server 11.10

I am trying to set up a pptpd vpn on our newly installed Ubuntu 11.10 64 bit server, but am not having success having a client connect via an iPhone to the VPN. Note that no clients have been able to ...