iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

1
vote
1answer
19 views

Linux iptables DNAT 53306 to 127.0.0.1 3306

mysql real port is 3306。 I want public network using 53306 to visit mysql,and 3306 not allowed access from public network. How to write the iptables rules DNAT 53306 to 127.0.0.1 3306 ? help me
0
votes
1answer
38 views

iptables slows down outgoing web request

Before I enabled iptables, requests via curl to this url were instant. But after configuring iptables it takes almost 30-40 seconds to get response. How do I make particular url white listed so it can ...
2
votes
1answer
72 views

Error: iptables: No chain/target/match by that name [duplicate]

I am trying to configure proxy server on RHEL Server 6.5 using Squid and iptables. Below is the command I executed and the error message it displayed: vzlptest01 root [root] > iptables -A INPUT -i ...
0
votes
1answer
58 views

Port forward remote desktop without a gateway over 3G modem router [closed]

I'm trying to connect from a laptop, through a VPN, and a 3G modem/router, to a remote PC / computer. PC (192.168.1.33) | 3G Modem (192.168.1.22) | [3G internet, connecting to VPN] | ...
0
votes
1answer
30 views

Using OpenVPN and iptables in combination

Let's imagine there are three networks, WAN, LAN-A and LAN-B. In between, there is a firewall server connecting the networks to each other. iptables ensures the following things: There is no way for ...
0
votes
0answers
23 views

Simple MASQUERADE NAT between 2 VM

I'm on a cloud service and I'm trying to set up NAT between two VM. I've never experienced issues in this simple step, but this time is different and I'm near to give up. The first VM had two ...
-1
votes
4answers
219 views

Is there anyway to tell what user will receive data from inbound packet?

In linux, considering this use case: 1. User initiates http request for webpage to remote server 2. Remote server answers request and sends packets Is there any reference to the user who started ...
0
votes
2answers
54 views

Forward SSH request to an External Server to an Internal Server

I have a VM config currently where I have 1 external IP pointing to a VM with an Nginx HTTP Reverse proxy serving HTTP Web Pages from several internal VMs without external IPs. I need a similar setup ...
0
votes
4answers
125 views

iptables not installed on centos

If a machine does not have iptables installed, is there still a firewall running? If yes, how to I disable / change rules? if I enter the command iptables I receive the response: iptables v1.4.7: ...
0
votes
1answer
52 views

No route to host centos

I am trying to allow a port through a firewall on centos 6. The error I am receiving is telnet: connect to address 80.xx.xx.xx: No route to host The port I am trying to allow is 5666. If I disable ...
0
votes
1answer
85 views

Is it possible to make the server accessible from two internet connections

how to make this: have: Centos 6.5 WAN1 eth0 44.44.44.44 (DEFROUTE=yes) WAN2 ppp0 95.95.95.95 (DEFROUTE=no) HTTP server work and available only in eth0 DNS server work but port 53 blocked in ...
0
votes
3answers
53 views

Packages drop when using iptables NAT

We are using NAT made with iptables. However when there are lots of connections (or sessions) through NAT server packages start to drop. There is no log in syslog etc. I think this is caused by sysctl ...
0
votes
1answer
20 views

squid3 with tcp_outgoing_address could not connect to anywhere

I have one server with 3 interfaces (3 physical lan card), which are connected to 3 different routers. Each router has a different subnet, i.e. the 3 interfaces of server belong to 3 different ...
-1
votes
0answers
27 views

DHCPREQUEST Operation not permitted

I am configuring iptables on a Ubuntu 14.10 VPS. However, I am having a few issues with the following: Jun 25 08:28:23 www dhclient: DHCPREQUEST of 1.2.3.4 on eth0 to 2.3.4.5 port 67 ...
0
votes
2answers
52 views

resetting iptables seems to make connections clear faster

I have iptables setup on 2 servers. Server#1 is public and Server#2 only allows the ip address of Server#1 to have ACCESS. Server#2 has a mySQL database that Server#1 queries. I ran a query and it ...
1
vote
0answers
16 views

How to test if packet has been tagged with classid

I'm trying to troubleshoot an issue I'm having related to IFB Mirroring which I'm attempting to deploy based on this question: Tc: ingress policing and ifb mirroring My theory is that since the ...
0
votes
0answers
14 views

forwarding an incoming ip multicast packet over another interface

Is it possible to forward an incoming IP multicast packet out of a specific interface using iptables rules if the incoming packet already has a TTL > 1? (The incoming interface is a GRE tunnel ...
-2
votes
0answers
29 views

iptables: Block all connections on port 8080, allow whitelisted IPs [duplicate]

Lets say I have a whitelist text file containing IPs. Ex: whitelist.txt 67.31.137.187 107.130.111.123 How do I use iptables to block all IPs on port 8080 and allow only whitelisted IPs? I was ...
1
vote
0answers
31 views

Firewall rejecting UDP “connections”?

I have a server that is aggregating logs from various other servers. It mostly works great, however from time-to-time (right after a reboot, but not all reboots) it will decide that various UDP ...
0
votes
0answers
35 views

iptables not forwarding traffic from 80 to 8000

iptables is proving to be a very complicated tool for me to use. I'm trying to do the following: Accept all packets on 80, 443, 22 Forward packets received from 80 to 8000 Accept packets from only ...
-2
votes
1answer
40 views

IPTables Block Many IPs Using Domain

DROP all -- 114-43-XXX-XXX.dynamic.hinet.net anywhere DROP all -- 118-161-XXX-XXX.dynamic.hinet.net anywhere These are just two of the several restrictions I have in IPTables right ...
0
votes
1answer
50 views

Iptables: Matching packets for bridged interface

I'm building a firewall configuration tool based on iptables, and trying to get a "bump in the wire" scenario working. Given a setup with eth0 and eth1 in a bridge br0 and a third interface eth2: ...
0
votes
0answers
52 views

Iptables - Port forwarding has no effect

I have a dedicated server with a single public IP (Say 1.2.3.4) running CentOS. Via virt-manager, I added a virtual machine, running CentOS as well. They are connected through a virtual network: ...
0
votes
1answer
48 views

Limit incoming connections using iptables per IP

I need to limit access to some port per IP. Let's say 5 connections per minute - not more. I've seen iptables recent, connlimit and limit, but all of them are not fitting exactly what I need. ...
-3
votes
0answers
11 views

Redirecting locally generated IP multicast over a GRE interface [duplicate]

On a linux box, I want to redirect locally-originating IP multicast traffic (OSPF hello) over a gre tunnel interface. How can I do this using iptables rules?
0
votes
0answers
44 views

Iptables INVALID packet from akamai and google to linux

I set up the firewall rules below (I also blacklisted the IPV6 Module): iptables -A INPUT -m conntrack --ctstate INVALID -j LOG --log-level debug --log-prefix '[FW INVALID]: ' iptables -A INPUT -m ...
-2
votes
3answers
34 views

How do I get iptables to allow a new port (for a webserver sockets handler)

In the local development server, I don't have any iptables rules (running on a Mac). The production server however, runs CentOS 6 with certain rules. I need to add a rule that allows the client to ...
0
votes
2answers
38 views

Reverse Proxy Linux Containers

I am trying to set up a reverse proxy on my ubuntu 14.04 host so that I can run multiple websites, each in their own LXC container (one day docker but one step at a time). In this example the ...
-1
votes
1answer
22 views

iptables: REJECT not working, but DROP does

I have recently setup a server with fail2ban, and it is mostly working except I am getting errors whenever this command tries to execute: sudo iptables -D fail2ban-ssh -s xxx.xxx.xxx.xxx -j REJECT ...
3
votes
1answer
65 views

Fail2Ban: already banned?

I have Fail2Ban running on my Centos Server. (Config below) In my var/log/messages I noticed something really weird: Jun 19 12:09:32 localhost fail2ban.actions: INFO [postfix] 114.43.245.205 ...
4
votes
1answer
67 views

Iptables counters restore, when using quotas, not working as expected

I've set a quota for a certain computer: iptables -A FORWARD -d 192.168.1.10 -m quota --quota 500000000 -j ACCEPT iptables -A FORWARD -d 192.168.1.10 -j DROP This works as expected. When the limit ...
-5
votes
1answer
35 views

How to route to next server? [closed]

I must route all traffic from first server to second server and next to third server. Like this: server1 -> server2 -> server3 I use Debian Wheezy. Can anyone tell how to do this with iproute?
0
votes
1answer
76 views

Connection tracking not working in a Debian 7 OpenVZ VPS

I have a small VPS instance (used for web hosting) that runs Debian 7, and for a few weeks I have issues with my firewall and connection tracking. I had no issue for months, but without any system ...
0
votes
2answers
36 views

Openning a port in my CentOS server [closed]

I'm trying to open a port in my CentOS server... I tried using iptables, adding the "-A INPUT -p udp -m udp --dport portnum -j ACCEPT" and didn't work. I tried installing CSF, adding the ports and ...
0
votes
1answer
34 views

Unable to get out of rescue mode after a spontaneous reboot

I am experiencing a weird problem where the CentOS 6.5 system I was using spontaneously underwent a restart that was not authorized by me, and then enters Rescue Mode, where I am unable to diagnose ...
0
votes
1answer
34 views

Simultaneous iptables POSTROUTING for SNAT and MASQUERADE block outgoing ssh

I am using iptables on a virtualized host to distribute services using one IP to different virtual machines(VMs). This works well with DNAT in PREROUTING and SNAT in POSTROUTING. Furthermore I am ...
0
votes
3answers
131 views

My webserver is getting flooded with invalid requests

My webserver (nginx) keeps getting requests like this: 23.244.104.206 - - [15/Jun/2014:21:21:47 -0400] "GET ...
1
vote
1answer
69 views

All connections to a bridged domU originate from the dom0 public IP instead of real IP

I have a Dom0 with a mixed configuration: bridged networking and NAT is set up. There is one NIC connected to the internet (& 3 more that are unused). This is my interfaces file: # The primary ...
2
votes
1answer
153 views

How do I set up an IPv6 DMZ with iptables without a static allocation?

I have several networks which are on Comcast's residential network. I need to access those networks from a variety of environments, via an SSH proxy on one of the hosts. (As it happens I'm using ...
0
votes
2answers
46 views

How to I forward requests on a IPv6 port to a IPv4 host behind NAT?

I run a Xen Dom0 with 2 VMs NATted (other VMs are bridged, and are ok). This Dom0 has an IPv6 and IPv4 address. Requests to, for example port 25 are forwarded to a LAN address that one of the VMs ...
0
votes
0answers
11 views

Is it necessary to open all used ports when using one Node.JS application to route from port 80 to apps on different ones?

I'm working with an Ubuntu 12.04 LTS, 64 Bit server there I have used the following commands to send all http request on port 80 to port 8080 Commands: cat /proc/sys/net/ipv4/ip_forward #returns 1 ...
1
vote
1answer
58 views

Why doesn't this first iptables rule match repeated connection attempts?

Trying to mitigate SSH brute-force attacks on my box, I copied/pasted the following rules into my iptables (without really understanding them, I must confess): $> iptables-save # Generated by ...
0
votes
1answer
19 views

Block an outbound destination IP to prevent connections waiting timeout duration [duplicate]

It seems like with the basic "DROP" iptables rule, an outbound attempt will still wait the duration of its timeout. For instance, if I block an IP address outbound, then attempt to connect to it via ...
1
vote
1answer
42 views

iptables connection limit does not work on debian

I'm trying to set up some basic DOS protection. The following iptables rule works on a CentOS box but NOT on debian (wheezy). #limit the parallel http requests to 50 per class C sized network ...
-2
votes
1answer
25 views

Allow outgoing connections for DNS [closed]

I'm new to IPtables, but I am trying to setup a secure server to host a website and allow SSH. This is what I have so far: #!/bin/sh i=/sbin/iptables # Flush all rules $i -F $i -X # Setup default ...
0
votes
0answers
13 views

iptables ( help ACCEPT Rules and chain)

I have a flood on my server. I use iptables, I would like a help for it. I ACCEPT "Legitimate" IPS range but in this packets, there is some ips who flood. Next for to filter I want to limit with the ...
0
votes
0answers
66 views

Trouble with port 80 nating (XenServer to WebServer VM)

I have a rent server running XenServer 6.2 I only have 1 public IP so i did some NAT to redirect ports 22 and 80 to my WebServer VM. I have a problem with the port 80 redirection. When i use this ...
0
votes
1answer
53 views

Block rtmp and make it retry on port 80 via iptables

We have a proxy filtering connections but some sites use RTMP, which runs on port 1935. This cannot go through the proxy as proxies are port 80 only. As far as I know if RTMP fails, it will retry on ...
0
votes
2answers
33 views

IPtables - Sensible and non-contradictory rules?

This is my IPtable rules for my webserver with SSH installed, i've had help to get this far. My question is, are my rules contradictory. For example, I've been recommended to use these two lines: # ...
4
votes
3answers
184 views

IPtables locking down website allowing only SSH

I have written my first IPtables rule file to try and protect my server on all ports apart from SSH and the ports needed for the web. This is what I have come up with: i=/sbin/iptables # Flush all ...