iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

0
votes
0answers
22 views

Iptables Port redirection don't take effect

Im tying to setup a mitm proxy to sniff my Android smartphone. I found this helpful tutorial. At the point where I need to teach Ubuntu to redirect everything from port 8080 to 443 and 80 I'm running ...
0
votes
0answers
29 views

NFS on Ubuntu Server 14 LTS with iptables

I have a virtual server with Ubuntu Server 14 LTS. The provider has offered me NFS storage which I wanted to mount on the virtual server: mount -t nfs 192.0.2.4:/space /mnt/nfs However, I cannot ...
0
votes
0answers
24 views

openvpn pass ip to client like hidemyass does

I have a debian server with 64 external ips (ip blocks) and no internal IP. They go like eth0:1 eth0:2 (virtual interfaces) I have successfully setup an openvpn server on it so that I can connect from ...
0
votes
1answer
68 views

why fail2ban does not ban? (ubuntu, ssh)

I installed a fresh Ubuntu machine. Then I changed the ssh port which is no more 22 but 22111: Then I have installed fail2ban: apt-get install fail2ban -y cp /etc/fail2ban/jail.conf ...
2
votes
1answer
38 views

Basic forwarding on Ubuntu not working

I have the following setup, minimized to explain the problem: _________ |Desktop | ...
0
votes
1answer
27 views

CentOS server blocking own outgoing traffic

I've got a server (CentOS 6.7) running, which causes me some headaches. A few months ago, the website running on the server was unavailable. After some digging, it appeared that Iptables was blocking ...
0
votes
0answers
24 views

IPTables Reverse Proxy Breaking PHP-FPM | nginx/php-fpm/iptables/centos

Information: I have been trying to make a reverse proxy on my server using iptables rules. I use nginx to reverse proxy on SSL to port 8080 where I run another nginx server. The problem: IPTables ...
-1
votes
0answers
2 views

Troubleshooting port forwarding [migrated]

I'm trying to run a web server from my home network, but I have some difficulty reaching my server from the WAN. If you have an idea where the problem could lie, or need more information, please let ...
0
votes
3answers
35 views

IPTables forward to dynamic IP

I have a server running on e.g. servera.example.com and one on serverb.example.com. I want to redirect all port 80 traffic to servera.example.com to serverb.example.com, and leave all other ports ...
-1
votes
0answers
22 views

Does ip route need the via clause when specifying a default gateway?

When creating a routing table with iproute2, I need to specify its default gateway. I keep coming across this syntax: ip route add default via SOME.IP.ADDRESS dev some_dev table mytable Why can't ...
0
votes
0answers
3 views

OpenVPN client on DD-WRT router. How to block all WAN traffic when VPN is disconnected? [migrated]

I've successfully configured the OpenVPN client on my DD-WRT router and verified that all traffic is being routed through the VPN. How would configure it such that all WAN traffic is dropped when the ...
0
votes
1answer
14 views

Pass ethernet interface to iptables rule in ansible playbook

I'm writing a pretty simple ansible playbook for setting up our iptables firewall in centos. Here is the playbook I wrote: --- - hosts: test remote_user: deploy sudo: True tasks: - name: Get ...
0
votes
2answers
58 views

Packets in bridge get up to the user space without being redirected there

I set up a bridge interface (br0) on PC-A (Linux Ubunutu 14.04) In addition I created an application with a TCP Listener on port 80 in the user-space on PC-A As what I understood from the ...
0
votes
2answers
47 views

Iptables forwarding with single interface

Is it possible to use Iptables to forward all traffic going to certain network to given ip address? I have Ubuntu server to act as router in network 192.168.1.0/24. Its IP is 192.168.1.254. (This ...
1
vote
1answer
35 views

IPTables Multiple source or Destination IP ranges?

first time post to ServerFault so I'll try and get it right :) I have multiple environments (e.g. prod, dev, test, etc) and I'm trying to write the IPTables file for my RHEL 6.6 servers which allows ...
1
vote
1answer
41 views

Iptables DNAT single port

I'm trying to redirect a single port to a local server via IPtables. Currently I have the following rules: iptables -t nat -A PREROUTING -p tcp -m tcp --dport 55555 -j DNAT --to-destination ...
0
votes
1answer
181 views

block DNS Amplification Attack by iptables

Last time I've got warings about DNS Amplification Attack from NFOservers.com DDoS notifier 2015-12-30 23:28:52.609178 IP (tos 0x0, ttl 54, id 42635, offset 0, flags [+], proto UDP (17), length ...
1
vote
0answers
31 views

CentOS + IPTables

I am trying to setup a CentOS 7 server with Squid as a proxy server. The proxy server is strictly private and doesn't need to be available to anyone other than myself and other 2 servers, therefore I ...
2
votes
1answer
81 views

Iptables are blocking WildFly10 on CentOS 7

I've CentOS 7 server without firewalld but with iptables installed. There's WildFly 10 is running with changed socket binding http port 8080 to 80 in standalone.xml. I'd open 80 port in iptables ...
2
votes
1answer
160 views

Channel all the traffic on an IP to a VM

Situation: I have a dedicated Server (CentOS 6) with couple of VMs(Cent OS 7 and Windows Server 2012 R2) in Virtual Box. Few applications are running in windows and reachable from the Main ...
7
votes
1answer
198 views

Iptables with -m and -p parameter

I have this rule in my iptables: iptables -A INPUT -p tcp -m tcp --dport 9191 -j DROP Do I really need "-m tcp"? I already am using "-p tcp", so should I use "-m tcp" to be more secure?
0
votes
2answers
54 views

block ip with iptables ubuntu server

I am trying to block one IP with iptables in my Ubuntu server 12.04. The foreign IP is 117.16.18.95.dyna. You can take a look at the next image: I have added this ip to iptables with the next ...
0
votes
0answers
42 views

How to set up routes and rules at Debian gateway to bypass VPN for certain hosts?

I built my own router running Debian 7, having two NICs: Internal ethernet, eth0: 192.168.42.0/24 External link to VDSL modem, eth1: 10.42.42.42/8 (address arbitrary, just used for PPPoE). I have ...
3
votes
1answer
74 views

How to forward traffic from tunnel interface to eth0

Network topology: Internet | | (eth0) IP: 202.xxx.xxx.xxx/255.255.255.0 A: Remote_Server(Debian) (tun0) IP: 10.10.1.1/255.255.255.0 | | (utun0) IP: ...
-2
votes
2answers
32 views

error iptables-restore: unable to initialize table filter

i have Debian 6.0.5 x86_64 on VPS and create file named 'iptables.rules' with following command: *filter -A INPUT -i lo -j ACCEPT -A INPUT -d 127.0.0.0/8 ! -i lo -j REJECT --reject-with ...
1
vote
3answers
115 views

Bots hitting xmlrpc.php and causing high load on the server

Recently we are having a lot of hits to wordpress xmlrpc.php which in end causes high load on the servers. We tried rewriting all xmlrpc.php to 127.0.0.1 but didn't help much. Since apache was ...
1
vote
2answers
36 views

Command-line utility to test fwmark in ip rule / ip route?

I am trying to find a tool that will allow me to find the route a packet will take that comes in on a device, and has a particular destination address. ip route get will do most of what I am looking ...
0
votes
1answer
33 views

How to prevent linux from dropping incoming packets that have a wrong mac address (promiscuous doesn't work)

I configured three machines in a static proxy_arp like manner: ----------------------+ +-----------------------------------------------+ +---------------------- Machine A | | ...
2
votes
2answers
73 views

IP Tables, is it possible to limit requests per minute and timeout IP?

I am trying to setup a firewall that limits to 3 connections per IP and also ban the IP for an hour if > 30 connection attempts in one minute. This is for port 80 only. Is this all possible with ...
0
votes
2answers
22 views

Is it possible to use iptables on Ubuntu to limit brute force attacks?

Is it possible to use iptables on Ubuntu to limit brute force attacks for certain URLs? Basically I want to detect where user calls same url over and over again and drop his connection or somehow slow ...
1
vote
1answer
33 views

Opensuse port forwarding 80 to 8080 not working

I've a glassfish server that use the port 8080. I need forward from port 80 to 8080 so I can access the content without put the :8080 port in the url. I've tried to put a masquerade rule, add ...
0
votes
0answers
22 views

how to forward multicast to multicast via iptables

I want to forward incoming multicast traffic to other multicast address listened on my server interface. My machine running on Ubuntu 14.04. Have a incoming traffic on 239.0.0.1 udp port 1001, want to ...
3
votes
1answer
229 views

Redirect to local network without allow_localnet

I'd like to redirect incoming external traffic to a service which listens on 127.0.0.1. The redirection is easy - just: iptables -t nat -A PREROUTING \ -d local_ip --dport 80 \ -j DNAT ...
3
votes
2answers
326 views

iptables doesn't close port 3000?

I wanted to configure iptables on my server in such a way that only specific ports are open. Nevertheless I can access e.g. port 3000, if I run a web app on it. What could be the reason why 3000 is ...
0
votes
0answers
38 views

iptables user-defined chain not working

I am testing rate limiting to outbound IP's using iptables with user defined chains. So far I have only been able to get this to work with inbound traffic to my server. I cant seem to rate limit ...
0
votes
0answers
11 views

How to provide connectivity to a bridge running in a different network namespace?

I have a bridge running in a different network namespace. I want to access this bridge in host system. For e.g: I have created a network namepsace: my_namespace. Now inside this network namepsace i ...
0
votes
0answers
13 views

Using DNAT with IPtables

I am trying to figure out a DNAT issue and I am hoping I can get a hand. Basically I have a OpenVZ box that connects to my LAN via the SoftEther Client. What I am trying to accomplish is a way to ...
0
votes
0answers
33 views

Not able to ping ips created inside docker container using namespace in centos7

I have a docker container running inside centOS7. Now docker creates a bridge by default named as docker0 in host system. Inside the docker container, we have created another bridge named as eth2 ...
0
votes
0answers
26 views

Cache domain GET requests using Squid

I'm trying to cache requests to remote package repository, so I can access it without internet connection. All calls are via http GET to remote repo. iptables entry to redirect requests to proxy ...
1
vote
1answer
39 views

Forwarding SOAP requests

I ran into the following situation. A client provides a soap service on port 80. It's unknown how their clients access the service exactly but it assumed that they have the uris hardcoded in their ...
3
votes
1answer
22 views

Can one create a rule in iptables for google's servers only?

I want to allow gmail (and only gmail or other Google properties, not other IPs) to access my pop3 server. Is there a way to setup iptables to allow all IPs controlled by Google through my firewall?
3
votes
1answer
24 views

UFW - Rules by Service Versus Port and Protocol

What is the difference between creating allow/deny rules via a service versus a port and protocol? For example: ufw allow ssh versus ufw allow 22/tcp or even, ufw allow ssh/tcp. Which is the 1) ...
2
votes
1answer
27 views

How to mimic “DMZ Host” or “Default Host” NAT funcionality with iptables?

My previous DSL modem had a function called "DMZ Host" (which in other platforms seems to be named Default Host). When you select a computer in your network to be the DMZ Host, it forwards every ...
0
votes
1answer
56 views

Squid 3.5: Preventing forwarding loop in intercept mode

I have set up a router and an intercepting HTTP squid proxy on different machines. Clients should use the proxy (without knowledge) in the following way: Client -> Router (DNATing to proxy server) -> ...
1
vote
2answers
29 views

iptables DNAT broadcast address

I'm having trouble using iptables to change the destination address of a broadcast packet. I have read several places that iptables/Linux won't forward broadcast packets, so I'm looking for ...
0
votes
1answer
40 views

Iptables stuck in D state all the time and causing server load

I am running iptables/csf on a centos 5.11 openvz vps. I can't start/stop/flush iptables/csf. Further looking into it I could see the csf is waiting for iptables. And iptables is stuck as you can see ...
0
votes
2answers
36 views

How can I DNAT a packet coming through a bridge back to its source with iptables? [duplicate]

I have a host1 that has a WAN interface eth0 (1.2.3.4) and a LAN interface eth1 (10.41.82.1). Inside the LAN is a host2 with the IP address 10.41.82.2. Incoming connections to 1.2.3.4:22 are ...
0
votes
0answers
24 views

iptables string match accept connection

With iptables I setup these rules: -A INPUT -s *my.ip.address*/24 -p tcp -m tcp --dport 80 -m string --string "/test.php" --algo kmp -j ACCEPT -A INPUT -p tcp -m tcp --dport 80 -j DROP When I go to ...
0
votes
2answers
49 views

iptables: POSTROUTING rule not matching with mark

I have a host that sends packets to virtual machine say on 192.168.0.1/24 with either 192.168.0.11 or 192.168.0.12 as the destination IP. I'm trying to set up the virtual machine as a NAT. It routes ...
0
votes
1answer
74 views

What are the implications of using a default DROP rule on a public DNS server

RHEL 6.6 authoritative DNS server. Right now in IPtables I have the INPUT chain defaulting to ACCEPT. :INPUT ACCEPT [0:0] I have been having some issues with it being attacked lately and I am just ...