iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

2
votes
1answer
807 views

How do I allow only certain IPSet set's to access a certain port with iptables?

I'm using IPSet to build IP ranges for different countries as follows : # Canada ipset -F ca.zone ipset -N ca.zone nethash for IP in $(wget -O - http://www.ipdeny.com/ipblocks/data/countries/ca.zone) ...
1
vote
1answer
131 views

iptables logging doesn't log

I'm trying to log any requests to port 22 into my syslog, so I have following line in my iptables: LOG tcp -- anywhere anywhere tcp dpt:ssh LOG level debug yet, ...
1
vote
3answers
2k views

fail2ban Error Gentoo

I've recently setup a new VPS running Gentoo (My first time using the distro so please forgive me is this is a really easy one) and as I've done with other servers installed fail2ban. Setting it up to ...
0
votes
2answers
1k views

iptables redirected port 80 to 8080 - How to disallow direct access to port 8080?

I've routed all requests from port 80 to port 8080 for my Tomcat server using iptables. iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080 Now http://mydomain.com/ ...
5
votes
1answer
1k views

With iptables, match packets arrived via IPSEC tunnel

I'm using IPSEC in a tunnel mode. How to make an iptables rule that will match only packets which arrived via IPSEC tunnel (i.e. after IPSEC decrypted them - not the IPSEC packets when they arrive ...
5
votes
3answers
1k views

Firewall still blocking port 53 despite listing otherwise?

I have 3 nodes with virtually the same iptables rules loaded from a bash script, but one particular node is blocking traffic on port 53 despite listing it's accepting it: $ iptables --list -v Chain ...
5
votes
2answers
8k views

Iptables: “-p udp --state ESTABLISHED”

let's look at these two iptables rules which are often used to allow outgoing DNS: iptables -A OUTPUT -p udp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A ...
4
votes
2answers
3k views

How many rules can iptables support?

Someone asked me this recently and I had no answer for it. I know this is kind of an open-ended question but is there a limit on the numnber of rules you can install in a table/chain? If so, how can I ...
4
votes
3answers
3k views

How do you test iptables rules to prevent remote lockout and check matches?

As I'm learning about iptables I've made a couple of mistakes and locked myself out. What method(s) do you use to test rules without locking yourself out? I'm using ubuntu server 12.04 LTS
3
votes
1answer
904 views

IPTables: No chain/target/match by that name

I am trying to execute the following command in iptables (it's the first command I have issued to IPTables since I setup my new VPS, but when I execute the command below: iptables -A INPUT ...
3
votes
1answer
1k views

Linux IPv6 Transparent Proxy (but Linux doesn't support NAT on IPv6!?)

On Linux I can make a transparent proxy simply by adding a iptables -j REDIRECT command. To my surprise, I am needing to support IPv6. Simple enough right? iptables6 -j REDIRECT command not ...
3
votes
2answers
8k views

iptables redirect local connections to remote system / port

I am trying to use SSH to port forward windows machines local port 3389 to a redhat server on some arbitrary port (in the unprivileged region) I have protected behind a firewall, then forward the ...
3
votes
3answers
1k views

Open mysql only to localhost and a particular address

My config: ubuntu server 9 and msyql 5 my.cnf = bind-address = 0.0.0.0 my iptables script = iptables -A INPUT -i eth0 -s 99.88.77.66 -p tcp --destination-port 3306 -j ACCEPT I can connect from ...
2
votes
1answer
1k views

How do I redirect one port to another on a local computer using iptables?

All of the port forwarding examples I can find are for NAT, which is not what I want. We have an HTTP server application that only binds to 1 port at a time. However, we need to bind to an additional ...
1
vote
2answers
3k views

AWS VPC + IPtables + NAT: Port Forwarding is not working

Yesterday, I posted a question here but I think was not clear enough in my words. BTW, This question is not a duplicate. I have AWS VPC Setup as below. GOAL/PROBLEM: SSH to Server A from internet. ...
1
vote
1answer
71 views

Block IPs if they access a resource

I own a server that it's costantly being attacked by scripts (that try to access to phpMyAdmin's setup file's and stuff like this). I've heard that many people get this kinds of attacks, but I'm ...
1
vote
1answer
365 views

redirection made by iptables take effect even after i removed the rule from the chain

for example i added the following rule to the PREROUTING chain: iptables -t nat -A PREROUTING -d 210.210.210.210 -j DNAT --to-destination 200.200.200.200 (lets say that both of the ip addresses are ...
1
vote
1answer
448 views

Why did my new iptables rules screw up outbound traffic?

I recently set up Tomcat on Port 80 using instructions provided by Werner Puschitz. In essence, I had to execute these two iptables commands: iptables -t nat -I PREROUTING -p tcp --dport 80 -j ...
1
vote
2answers
4k views

How do I use IPTABLES to create a HTTPS (443) passthrough around Squid?

I've got Ubuntu and Squid running on a machine acting as a transparent proxy and a default gateway for many pc's on my network, which means all internet bound activity comes through the interface to ...
1
vote
3answers
149 views

IP tables - changes not persisting

I've tried to open port 8605 on my server (used for socket connections) using: iptables -I INPUT 2 -s 0/0 -p tcp --dport 8605 -j ACCEPT However the change is not persisting, the port closes itself ...
0
votes
2answers
265 views

Forward SSH request to an External Server to an Internal Server

I have a VM config currently where I have 1 external IP pointing to a VM with an Nginx HTTP Reverse proxy serving HTTP Web Pages from several internal VMs without external IPs. I need a similar setup ...
0
votes
1answer
377 views

find common string to block IPs

Currently I have all these IPs coming in. Is there a way to find a common string in the content of the packets and then block the attack via IPTables? Oct 24 16:28:52 host kernel: [ 823.255566] ...
0
votes
4answers
8k views

iptables: IP alias and port forwarding

I can't figure out iptables and I don't know very much about networking and I'm really hoping that someone out there can help me. I have a server with two ip addresses associated with it: 1.1.1.1 and ...
0
votes
1answer
4k views

Openvpn - enabled redirect gateway but can't access any websites

First of all I'm a newbie to servers but not to stuff like programming so not totally alien to command lines etc. Second, I want to run openvpn on my remote server and connect from my ubuntu desktop ...
13
votes
4answers
3k views

iptables management tools for large scale environment

The environment I'm operating in is a large-scale web hosting operation (several hundred servers under management, almost-all-public addressing, etc -- so anything that talks about managing ADSL links ...
17
votes
2answers
12k views

IPTables only allow localhost access

I have struggled throughout the years to get a solid understanding on iptables. Any time I try and read through the man pages my eyes start to glaze over. I have a service that I only want to allow ...
10
votes
4answers
15k views

Good iptables starting rules for a webserver?

I am installing a new centos 5.4 server and I would like to have a set of clean rules for mu iptables to startup. What would be the good rules to start with? Is this a good starting point : # ...
26
votes
3answers
35k views

Windows equivalent of iptables?

Dumb question: Is there an equivalent of iptables on Windows? Could I install one via cygwin? The real question: how can I accomplish on Windows what I can accomplish via iptables? Just looking for ...
17
votes
5answers
5k views

Use IPtables or null route for blacklisting about 1 million IP addresses?

I've come across a situation where a client needs to blacklist a set of just under 1 million individual IP addresses (no subnets), and network performance is a concern. While I would conjecture that ...
15
votes
6answers
25k views

How to Unban an IP properly with Fail2Ban

I'm using Fail2Ban on a server and I'm wondering how to unban an IP properly. I know I can work with IPTables directly: iptables -D fail2ban-ssh <number> But is there not a way to do it with ...
7
votes
7answers
3k views

How do you manage your Linux iptables configuration on a machine acting as a router?

I have a couple Linux machines that act as routers/firewalls for my networks and I have a script that runs all the iptables commands to set my rules. This seems to me like a really silly way to do it ...
3
votes
1answer
3k views

How to block internet access to certain programs on Linux

Recently, I have encountered a problem of limiting Internet Access to specific programs. Could anybody recommend a good way of doing that, without using any particular software?
6
votes
3answers
12k views

Throttle bandwidth via iptables

I have a need to throttle the bandwidth usage, similar to how some ISPs do it, so that after a couple of seconds, it throttles down the speed.
6
votes
4answers
12k views

how do I disable the nf_conntrack kernel module in CentOS 5.3 without recompiling the kernel

I'm running CentOS 5.3 and want to disable the nf_conntrack module to improve network performance for haproxy. I'm running iptables with some simple rules. I don't really need the connection ...
21
votes
2answers
8k views

Iptables, what's the difference between -m state and -m conntrack?

What's the practical difference between: iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT and iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT Which one is ...
8
votes
3answers
9k views

How to configure a custom NAT for use in Amazon VPC

I have an Ubuntu box I wish to use as NAT instance (among other things). I would prefer to avoid using the NAT AMIs provided by Amazon, and instead configuring NAT myself. Currently, my host has a ...
0
votes
1answer
6k views

Using DD-WRT to connect to VPN and Forward all traffic of certain devices through VPN

I have been able to setup my dd-wrt router to connect to an openvpn server and route all traffic through the vpn to the internet. This makes it so all traffic comming in from the LAN to the ...
8
votes
4answers
22k views

Whitelist allowed IPs (in/out) using iptables

I have a few ip ranges to which I want my server to able to connect and users to connect from. Everything else should be blocked. How should I do that with iptables? My OS is Debian based linux ...
5
votes
3answers
11k views

transparent SSL proxy myths and facts

I've been searching for many hours now about a way to setup a transparent proxy for SSL (not Squid). The general answer is that I can't, but I know there are some ways, though. My purpose is only the ...
9
votes
2answers
189 views

How can I write automated tests for iptables?

I am configuring a Linux router with iptables. I want to write acceptance tests for the configuration that assert things like: traffic from some guy on the internet is not forwarded, and TCP to port ...
8
votes
1answer
12k views

Can I use ufw to setup a port forward?

Im currently using ufw to enforce some basic firewall rules. Is it possible to also use ufw to do port forwarding? Specifically im wanting to forward incoming traffic to my server (same machine ...
6
votes
2answers
12k views

What is the correct way to load modules for iptables on Centos 6

Where should I load iptables modules, for example ip_conntrack and ip_conntrack_ftp. Places I have found that might be candidates, but are they? The IPTABLES_MODULES variable in ...
5
votes
2answers
2k views

iptables | Types of ICMP: which ones are (potentially) harmful?

I read that certain types¹ of ICMP packets can be harmful. Questions: Which ones and why? How should I layout an iptables ruleset to handle each type of ICMP packet? Should I rate-limit any of these ...
3
votes
2answers
5k views

Should I rate-limit packets with iptables?

I'm using iptables on Ubuntu Server. It's a web server on a VPS. I'd like to know if I should rate-limit packets. If so, what should I rate-limit? And should I do so globally or per IP address? ...
3
votes
3answers
6k views

How to create an Iptables rule using domain name

Can anyone please suggest a way to use a domain name in iptables rules.
9
votes
2answers
15k views

How to enable iptables (instead of firewalld) services on RHEL 7 and Fedora 18?

The newest fedora has firewalld as new firewall aplication. I liked old iptables services. I want them back but have no idea how to do that. I have tried : systemctl disable firewalld.service ...
8
votes
1answer
4k views

iptables: Port forwarding with masquerading is not working

I'm having some issues with my port forwards. NAT seems to work ok and one out of the port forwards seem to work (udp port 7887 to machine 192.168.1.100). But not the others. I doubt that it matters, ...
8
votes
6answers
16k views

iptables multiple source IPs

I'd like to create a single rule in iptables (if possible) that uses multiple source IP addresses. Is this possible?
7
votes
2answers
10k views

Increasing ip_conntrack_max safely?

I've see the following in my logs every so often: kernel: ip_conntrack: table full, dropping packet. Currently, I have ip_conntrack_max set to 65536 (default, RHEL5). Keeping memory usage in mind, ...
5
votes
2answers
2k views

Duplicate incoming TCP traffic on Debian Squeeze

I have to test a homebrew server that accepts a lot of incoming TCP traffic on a single port. The protocol is homebrew as well. For testing purposes, I'd like to send this traffic both : - to the ...