iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

3
votes
2answers
2k views

Service can't connect to self using public IP, NAT problem

I have a dedicated server from serverloft.eu, but due to some network security I cannot use bridge networking on my server. So I have setup all my IPs to the main eth0, and used NAT to forward trafic ...
1
vote
3answers
549 views

Server Firewall preventing sending of email [closed]

The firewall on my VPS appears to be preventing my site from sending email. It was working fine until the end of last month. My hosting provider (Webfusion) has been next to useless. I am able to ...
1
vote
2answers
2k views

How To Set iptables log rules for PSAD with UFW?

For PSAD to work, I need to add the following iptables rules and enable packet logging : iptables -A INPUT -j LOG iptables -A FORWARD -j LOG ip6tables -A INPUT -j LOG ip6tables -A FORWARD -j LOG I ...
0
votes
1answer
861 views

Is there any way to filter packets (eg. by iptables) after routing is complete?

I want to drop certain packet destined to an ip_address AFTER it has reached the POSTROUTING chain. However, for iptables, the "nat" table cannot be used for filtering so the following doesn't work: ...
6
votes
3answers
4k views

Firewall questions about state and policy?

I finally managed to install my VM host and now I am messing with iptables to create, test and learn. Does it matter if i put the below rules at the begin or at the end of my rules ? $IPT -P INPUT ...
5
votes
3answers
4k views

How do you test iptables rules to prevent remote lockout and check matches?

As I'm learning about iptables I've made a couple of mistakes and locked myself out. What method(s) do you use to test rules without locking yourself out? I'm using ubuntu server 12.04 LTS All ...
5
votes
3answers
2k views

iptables — OK, **now** am I doing it right?

This is a follow up to a previous question where I asked whether my iptables config is correct. CentOS 5.3 system. Intended result: block everything except ping, ssh, Apache, and SSL. Based on ...
5
votes
5answers
8k views

iptables port forwarding on debian

I'm trying to setup a simple port forwarding firewall and I can't make the basic non-firewall configuration to work. I have setup the iptables script as follows #!/bin/sh # interfaces LAN="eth1" ...
3
votes
4answers
3k views

Debian Squeeze ip6tables setup

I am setting up a firewall for ipv6 on Debian Squeeze. It is a webserver, so I think the only port that need to be open to the world for ipv6 is 80. This is what I have: *filter :INPUT DROP [0:0] ...
3
votes
1answer
3k views

How to create UDP proxy using iptables

I have a server running UDP server on port 50000. This server receives updates from clients, and pings back the clients every 5 seconds to the socket they were connected from. Now I want to redirect ...
2
votes
1answer
1k views

How do I allow only certain IPSet set's to access a certain port with iptables?

I'm using IPSet to build IP ranges for different countries as follows : # Canada ipset -F ca.zone ipset -N ca.zone nethash for IP in $(wget -O - http://www.ipdeny.com/ipblocks/data/countries/ca.zone) ...
2
votes
5answers
5k views

Route return traffic to correct gateway depending on service

On my office network I have two internet connections and one CentOS server running a website (HTTPS on port 443). The website should be publicly accessible through the public IP of the first internet ...
1
vote
1answer
142 views

iptables logging doesn't log

I'm trying to log any requests to port 22 into my syslog, so I have following line in my iptables: LOG tcp -- anywhere anywhere tcp dpt:ssh LOG level debug yet, ...
1
vote
3answers
3k views

fail2ban Error Gentoo

I've recently setup a new VPS running Gentoo (My first time using the distro so please forgive me is this is a really easy one) and as I've done with other servers installed fail2ban. Setting it up to ...
0
votes
2answers
2k views

iptables redirected port 80 to 8080 - How to disallow direct access to port 8080?

I've routed all requests from port 80 to port 8080 for my Tomcat server using iptables. iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080 Now http://mydomain.com/ ...
7
votes
1answer
2k views

With iptables, match packets arrived via IPSEC tunnel

I'm using IPSEC in a tunnel mode. How to make an iptables rule that will match only packets which arrived via IPSEC tunnel (i.e. after IPSEC decrypted them - not the IPSEC packets when they arrive ...
5
votes
3answers
1k views

Firewall still blocking port 53 despite listing otherwise?

I have 3 nodes with virtually the same iptables rules loaded from a bash script, but one particular node is blocking traffic on port 53 despite listing it's accepting it: $ iptables --list -v Chain ...
5
votes
2answers
9k views

Iptables: “-p udp --state ESTABLISHED”

let's look at these two iptables rules which are often used to allow outgoing DNS: iptables -A OUTPUT -p udp --sport 1024:65535 --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A ...
4
votes
2answers
4k views

How many rules can iptables support?

Someone asked me this recently and I had no answer for it. I know this is kind of an open-ended question but is there a limit on the numnber of rules you can install in a table/chain? If so, how can I ...
4
votes
1answer
1k views

Linux IPv6 Transparent Proxy (but Linux doesn't support NAT on IPv6!?)

On Linux I can make a transparent proxy simply by adding a iptables -j REDIRECT command. To my surprise, I am needing to support IPv6. Simple enough right? iptables6 -j REDIRECT command not ...
4
votes
2answers
9k views

iptables redirect local connections to remote system / port

I am trying to use SSH to port forward windows machines local port 3389 to a redhat server on some arbitrary port (in the unprivileged region) I have protected behind a firewall, then forward the ...
3
votes
1answer
1k views

IPTables: No chain/target/match by that name

I am trying to execute the following command in iptables (it's the first command I have issued to IPTables since I setup my new VPS, but when I execute the command below: iptables -A INPUT ...
3
votes
3answers
1k views

Open mysql only to localhost and a particular address

My config: ubuntu server 9 and msyql 5 my.cnf = bind-address = 0.0.0.0 my iptables script = iptables -A INPUT -i eth0 -s 99.88.77.66 -p tcp --destination-port 3306 -j ACCEPT I can connect from ...
2
votes
2answers
4k views

AWS VPC + IPtables + NAT: Port Forwarding is not working

Yesterday, I posted a question here but I think was not clear enough in my words. BTW, This question is not a duplicate. I have AWS VPC Setup as below. GOAL/PROBLEM: SSH to Server A from internet. ...
2
votes
1answer
1k views

How do I redirect one port to another on a local computer using iptables?

All of the port forwarding examples I can find are for NAT, which is not what I want. We have an HTTP server application that only binds to 1 port at a time. However, we need to bind to an additional ...
1
vote
1answer
157 views

why port forwarding is not working in this setup?

I'm trying to setup a docker virtualization environment. This is a follow up of this question. I have a virtual eth0:0 interface, and I would like to forward it using iptables. The public, main IP ...
1
vote
1answer
82 views

Block IPs if they access a resource

I own a server that it's costantly being attacked by scripts (that try to access to phpMyAdmin's setup file's and stuff like this). I've heard that many people get this kinds of attacks, but I'm ...
1
vote
1answer
385 views

redirection made by iptables take effect even after i removed the rule from the chain

for example i added the following rule to the PREROUTING chain: iptables -t nat -A PREROUTING -d 210.210.210.210 -j DNAT --to-destination 200.200.200.200 (lets say that both of the ip addresses are ...
1
vote
1answer
454 views

Why did my new iptables rules screw up outbound traffic?

I recently set up Tomcat on Port 80 using instructions provided by Werner Puschitz. In essence, I had to execute these two iptables commands: iptables -t nat -I PREROUTING -p tcp --dport 80 -j ...
1
vote
2answers
4k views

How do I use IPTABLES to create a HTTPS (443) passthrough around Squid?

I've got Ubuntu and Squid running on a machine acting as a transparent proxy and a default gateway for many pc's on my network, which means all internet bound activity comes through the interface to ...
1
vote
3answers
161 views

IP tables - changes not persisting

I've tried to open port 8605 on my server (used for socket connections) using: iptables -I INPUT 2 -s 0/0 -p tcp --dport 8605 -j ACCEPT However the change is not persisting, the port closes itself ...
0
votes
2answers
605 views

Forward SSH request to an External Server to an Internal Server

I have a VM config currently where I have 1 external IP pointing to a VM with an Nginx HTTP Reverse proxy serving HTTP Web Pages from several internal VMs without external IPs. I need a similar setup ...
0
votes
1answer
679 views

NAT / Port Forwarding with iptables firewall [duplicate]

I've got the following setup: firewall (iptables) eth0 internal interface, 192.168.2.10 ppp0 external interface, public_ip (IP masquerading) server1 (192.168.2.11), service 1 (port 443) server2 ...
0
votes
1answer
392 views

find common string to block IPs

Currently I have all these IPs coming in. Is there a way to find a common string in the content of the packets and then block the attack via IPTables? Oct 24 16:28:52 host kernel: [ 823.255566] ...
0
votes
4answers
9k views

iptables: IP alias and port forwarding

I can't figure out iptables and I don't know very much about networking and I'm really hoping that someone out there can help me. I have a server with two ip addresses associated with it: 1.1.1.1 and ...
0
votes
1answer
4k views

Openvpn - enabled redirect gateway but can't access any websites

First of all I'm a newbie to servers but not to stuff like programming so not totally alien to command lines etc. Second, I want to run openvpn on my remote server and connect from my ubuntu desktop ...
-1
votes
1answer
209 views

iptables: REJECT not working, but DROP does

I have recently setup a server with fail2ban, and it is mostly working except I am getting errors whenever this command tries to execute: sudo iptables -D fail2ban-ssh -s xxx.xxx.xxx.xxx -j REJECT ...
-3
votes
1answer
64 views

iptables rules for blocking specific packets [closed]

Im using the following iptables rule: iptables -A INPUT -p tcp -m tcp --tcp-flags PSH,ACK PSH,ACK -m length --length 52 -m state --state ESTABLISHED -j DROP It does it's job for blocking the ...
14
votes
4answers
3k views

iptables management tools for large scale environment

The environment I'm operating in is a large-scale web hosting operation (several hundred servers under management, almost-all-public addressing, etc -- so anything that talks about managing ADSL links ...
21
votes
6answers
42k views

How to Unban an IP properly with Fail2Ban

I'm using Fail2Ban on a server and I'm wondering how to unban an IP properly. I know I can work with IPTables directly: iptables -D fail2ban-ssh <number> But is there not a way to do it with ...
20
votes
2answers
15k views

IPTables only allow localhost access

I have struggled throughout the years to get a solid understanding on iptables. Any time I try and read through the man pages my eyes start to glaze over. I have a service that I only want to allow ...
11
votes
4answers
16k views

Good iptables starting rules for a webserver?

I am installing a new centos 5.4 server and I would like to have a set of clean rules for mu iptables to startup. What would be the good rules to start with? Is this a good starting point : # ...
28
votes
3answers
39k views

Windows equivalent of iptables?

Dumb question: Is there an equivalent of iptables on Windows? Could I install one via cygwin? The real question: how can I accomplish on Windows what I can accomplish via iptables? Just looking for ...
4
votes
1answer
5k views

How to block internet access to certain programs on Linux

Recently, I have encountered a problem of limiting Internet Access to specific programs. Could anybody recommend a good way of doing that, without using any particular software?
7
votes
7answers
3k views

How do you manage your Linux iptables configuration on a machine acting as a router?

I have a couple Linux machines that act as routers/firewalls for my networks and I have a script that runs all the iptables commands to set my rules. This seems to me like a really silly way to do it ...
5
votes
3answers
12k views

transparent SSL proxy myths and facts

I've been searching for many hours now about a way to setup a transparent proxy for SSL (not Squid). The general answer is that I can't, but I know there are some ways, though. My purpose is only the ...
9
votes
4answers
26k views

Whitelist allowed IPs (in/out) using iptables

I have a few ip ranges to which I want my server to able to connect and users to connect from. Everything else should be blocked. How should I do that with iptables? My OS is Debian based linux ...
7
votes
3answers
13k views

Throttle bandwidth via iptables

I have a need to throttle the bandwidth usage, similar to how some ISPs do it, so that after a couple of seconds, it throttles down the speed.
6
votes
4answers
14k views

how do I disable the nf_conntrack kernel module in CentOS 5.3 without recompiling the kernel

I'm running CentOS 5.3 and want to disable the nf_conntrack module to improve network performance for haproxy. I'm running iptables with some simple rules. I don't really need the connection ...
8
votes
3answers
11k views

How to configure a custom NAT for use in Amazon VPC

I have an Ubuntu box I wish to use as NAT instance (among other things). I would prefer to avoid using the NAT AMIs provided by Amazon, and instead configuring NAT myself. Currently, my host has a ...