iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

-1
votes
1answer
48 views

How to make a specific website access only via IPTABLES in Linux? [closed]

I want only - www.thinkwell.com website to be accessed and want to disable all other website access. I am using fedora core 19. Here are the steps, I tried doing it, but it turned out to be that ...
0
votes
0answers
16 views

Couldn't load target `DNAT':No such file or directory

Trying to do some ipv6 nat and running into an error from ip6tables $ip6tables -t nat -N IPV6-BRIDGE $ip6tables -t nat -A PREROUTING -p all -d 2600:3c01::f03c:91ff:fe6e:2563 -j IPV6-BRIDGE $ip6tables ...
0
votes
0answers
31 views

Pinging to google.com from a particular interface

I am connected to the internet via wlan0(wifi) and also have an ethernet port(not connected to the internet). I am looking for some iptables rule / route addition, which will let me do a ping via eth1 ...
0
votes
1answer
65 views

iptables port forwarding (prerouting port 80) and firewall not working together

I have read many articles and answers on this topic and I have been in discussion with Linode support, but no one seems to be able to answer my exact problem. Seems easy - I'd like to use a iptables ...
0
votes
2answers
35 views

IPTables in Ubuntu SURVIVE restart

I'm trying to find out why the rule -A POSTROUTING -o eth0 -j MASQUERADE keeps surviving reboots. I don't have iptables-persistent installed, there is no /etc/iptables.rules file or additional lines ...
0
votes
1answer
39 views

GW box not allowing internet from internal computers

I have a relatively new GW box ( CentOS 6.5 ) that can ping www.apple.com. When I change computers inside my network to use this GW as †he default GW, they cannot access the internet. So then I ...
0
votes
1answer
43 views

Forward a port to another server using iptables

I have a server that is configured to block any port, and exceptions are configured like this (for mongo): iptables -A INPUT -p tcp --dport 27017 -s 10.20.1.0/8 -j ACCEPT ...
0
votes
1answer
23 views

iptables forwarding through virtual interfaces

I'm trying to configure my computer as a gateway between two networks, but I cannot make it working for some reasons Here is a representation of the network: 192.168.1.101 192.168.1.102 ...
0
votes
0answers
44 views

Squid 3 - NetFilterInterception in cache.log

EDIT: after a day or so, it started happening again and I had to disable iptables for now cause everyone in the family was having no internet. I route all web traffic from my router (10.0.0.1) to my ...
1
vote
1answer
29 views

Reply on the same interface as incoming with DNATed IP

A server has 3 ifaces, 2 internal (eth1/2) in different public networks, one external (eth0). There is a service (openvpn) that can't bind to some IPs/ifaces, only to all or one, but I need it to ...
1
vote
0answers
20 views

LXC and proxying port 22 (ssh)

I have installed LXC on my Ubuntu 12.04 server and have created a couple of containers. I have only 1 external IP address, thus I am using nginx on my host machine to proxy HTTP requests from certain ...
1
vote
0answers
48 views

Port Scanning/Telnet login attempts [closed]

I have set iptables to block and log all inputs other than HTTP/HTTPS/SSH. The logs have many entries with DPT=23. Most entries are like: DATE-TIME * kernel: [*] IPTables-Dropped: IN=venet0 OUT= ...
-1
votes
2answers
57 views

Suspect traffic from 185.0.0.0/8 [closed]

I have a server/gateway running Debian 7. There is a big incoming traffic (for a homemade server) from an ip address located at 185.0.0.0/8 network for more than 40k packets in 24h. I have blocked all ...
1
vote
1answer
38 views

Can't send email via PHPMailer

I'm using the PHPMailer class to send email from an online application, it works fine on development server, and if I disable iptables. However whenever iptables is started, no mail sends - it seems ...
0
votes
1answer
16 views

VSFTPD - 0.00Kbyte/sec - intermittent

I can't get a good connection via FTP to my DigitalOcean server. I set it up following this guide. https://www.digitalocean.com/community/articles/how-to-set-up-vsftpd-on-centos-6--2 Symptoms: ...
1
vote
3answers
67 views

drop ips with iptables from awk result [closed]

I have a log file like this : Frq:15 IP:0.0.0.0 Date: 2014-03-21 12:19:31 AM Frq:9 IP:198.252.206.25 Date: 2014-03-21 12:19:31 AM Now i get column of ip addresses with awk : cat /tmp/test | awk ...
9
votes
2answers
620 views

linux command to prevent dos attack by using netstat and iptables

I want to DROP more than 200 requests per ip to prevent ddos attack. this is command that i used to detect requests count per ip : netstat -alpn | grep :80 | awk '{print $5}' |awk -F: '{print ...
1
vote
0answers
24 views

Do I need a firewall if the service doesn't listen on all interfaces? [duplicate]

Short version: I have a CentOS 6.5 with two NICs, one connected to the internet and one connected to the internal network. The services that shouldn't be accessible to the internet don't listen on ...
3
votes
0answers
60 views

SNMP query - operation not permitted

I am working on API that reads a lot of data via SNMP (routes, interfaces, QoS policies, etc...). Lately, I have experienced a random error stating: Operation not permitted Now, I use SNMP4J as ...
0
votes
1answer
25 views

ufw instead of pure iptables

I am running an Ubuntu server VPS that several people with varying networking skills need to manage. Currently the server is protected by iptables. I am considering using ufw to gain simplicity. What ...
0
votes
1answer
75 views

fail2ban not banning, time is off, how do I sync them?

In searching for why fail2ban is not banning patterns, I found that when I run /etc/init.d/fail2ban status it reports over an hour behind my 'date' command. 'date' says its: Tue Mar 18 20:45:02 MST ...
0
votes
1answer
40 views

Blocking incoming traffic for interface

I have created an interface eth0:2 and I want to make curl requests from that interface only so I want to block all ports and incoming traffic on that interface. This iptables rule used to work, but ...
0
votes
1answer
105 views

access same subnet on different interfaces

I have a router with external (WAN connection) subnet 192.168.1.0/24 and also on same router a tunnel to a remote location which have the exact same subnet (192.168.1.0/24), and i need from my LAN to ...
0
votes
0answers
35 views

FTP Traffic routing through NAT prevents me from logging in

I need to send all FTP traffic to a particular server from a NAT. Server A connects via FTP to an IP which is routed to the NAT and then over a VPN. That traffic then comes back and gets routed from ...
0
votes
1answer
29 views

Cannot access Asterisk sip from remote location

I've used this tutorial to configure my iptables so I can access asterisk sip from outside of my server. My iptables -L looks like this Chain INPUT (policy ACCEPT) target prot opt source ...
-1
votes
2answers
28 views

CentOS, dual route, nat

The linux server eth0 set the default route(gateway). And the clients connected to eth2 should be able to access the internet(eth1) by nat. Interfaces: eth0 : LAN (default route) / IP:10.0.0.5, ...
1
vote
1answer
21 views

How do I accept two different types of network connections using iptables

I need to setup iptables for a mongodb database server, such that it allows only two types of INPUT connections: one connection to port 27017, monogdb's default port, from our main web-app one ssh ...
0
votes
2answers
29 views

APF and iptables on router - disallow SSH on specific subnet host

I have a CentOS terminal working as a router with APF installed. Also 1 terminal with 3 NICs (3 IPs) is using that router as a Gateway to access the internet. What I want is APF to block SSH access, ...
-1
votes
2answers
35 views

tcp port 12202 not opening on ubuntu EC2 instance

I created an EC2 ubuntuu 12.04 instance. i have opened TCP 12202 port through security group console of AWS .But i am unable to open instance port . I tried below commands to open the port . sudo ...
1
vote
2answers
27 views

The output of ifconfig for a Internet USB dongle

This question has been asked on the net before but the answers are simply not convincing or even accurate. I get the following output for ifconfig for the ppp0 device (of course, x, y, a, b are ...
1
vote
3answers
79 views

Despite of several attempts, unable to open port 25

This question may have been asked many times here but after several failed attempts, I repeat the history: How do I open port 25 port on my server running CentOS. Here is my iptables config: Chain ...
0
votes
1answer
40 views

force an application to use a given VPN tunnel

trying to have traffic from a specific user on a linux machine run through a vpn tunnel. Have tried without and with the update-resolv-conf / dhcp-options ~$ cat /etc/openvpn/pia.conf client dev tun ...
1
vote
0answers
32 views

iptables - hashlimits, why it calculate all to seconds

I've tried to set 'synflood' limits with hashlimits, those are my snippet of rules: iptables -A SYNFLOOD_CHECK -p tcp --syn -m hashlimit --hashlimit-above 10/s --hashlimit-burst 6 \ ...
1
vote
0answers
21 views

strongswan packet get natted when ufw is enabled

I'm using strongswan 4.6.4 to connect road warriors to my server (ubuntu 13.10), which is natted behind a firewall. left=%defaultroute leftsubnet=10.10.1.0/24 right=%any ...
1
vote
3answers
83 views

How to block ALL communications with an IP-address using iptables?

I have a FreeBSD system behind a Linux-based router (using DD-WRT firmware). The FreeBSD system is running sshd and is regularly probed by various script-kiddies. It currently runs a script, that, ...
0
votes
1answer
103 views

Iptables rule for squid transparent proxy block http requests

I have some iptables rules in a linux gateway (ubuntu server 12.04) and all works good. I configured a transparent squid proxy and works too. I'm using this rule. $IPT -t nat -A PREROUTING -p tcp ...
2
votes
3answers
78 views

wget and port forwarding

I have a weird problem. I can run this command just fine from various servers: wget --debug '--http-user=USER123' '--http-passwd=PASSWORD' http://GW-BOX:9091/weijhkdsvn/v9_odbc//CRONTAB.2014020 ...
1
vote
0answers
20 views

iptables xt_recent change in kernel without modules

is it possible to change xt_recent module parameters when it is compiled into kernel ? most of the info on internet suggest setting it by modprobe but that is not the case in my setup as I have ...
0
votes
1answer
28 views

ssh communication ports and iptables forwarding

I want to make possible communication from a client computer C1 to server S via router R. On my R i have set ip forwarding and with iptables I want to restrict communications only for ssh (and say web ...
0
votes
1answer
19 views

Iptables REJECT doesn't let the ftp server list files

I had to comment these 2 lines in my iptables file, because for some reason it was denying ftp listing (it does connect to the ftp server, but it never lists the files and then it just times out): -A ...
0
votes
1answer
56 views

IPTables: Firewall with just one Eth device? [closed]

Admittedly I am a novice in the area of firewalls. But I have read on the IPtables and Firewall theory and command options. There is a general diagram by Rusty Russell, the creator of IPtables: ...
0
votes
1answer
22 views

Forward a host network traffic to another host with the exception of the ssh service

I am trying to redirect all the network traffic received in a old host to a different new host. For that i created two new rules on iptables of the old host: echo 1 > /proc/sys/net/ipv4/ip_forward ...
1
vote
0answers
26 views

OpenVPN running on Internet Gateway, so all private clients can access VPN with no config

Our LAN connects to our office gateway machine (192.168.1.1), which is connected to the Internet. I have setup NAT/Masquerading for this purpose with no issue. We also use OpenVPN to connect to our ...
0
votes
1answer
78 views

Limiting outgoing connections by port to control nf_conntrack usage

I would like to make my system more resilient against certain failure. When the system makes rapid outbound TCP connections fail, the nf_conntrack table fills up with TIME_WAIT entries. This ...
0
votes
1answer
21 views

Firewall issue for port 25 on Fedora FC15

I am trying to test/set up my mail server. I am currently running into an issue when trying to telnet into my server on port 25. Here is netstat output for port 25 # netstat -plnt | grep :25 tcp ...
0
votes
1answer
48 views

What is maximum legitimate SYN traffic rate

Recently my server gets syn flood attack. I use hitcount limitation, but I wonder what is the maximum rate of legitimate syn traffic for a single user IP. The source-IP based rule I use is blow; ...
0
votes
1answer
71 views

DansGuardian+Squid3 (Ubuntu 12.04) on external VPS won't work transparently

My goal is to have an externally located DansGuardian + Squid setup to be used by only certain machines (the kids, especially) in my home. I've managed to install both on a cheap VPS, and I've had ...
0
votes
1answer
18 views

OpenVPN On Dual Wan

I have a Dual-WAN Linux Box WAN1 & WAN2, Installed on it OpenVPN Server, is there a way to make OpenVPN server accept connections from both interfaces, as it now it only accepts connection from ...
1
vote
1answer
94 views

Port forwarding not working on zentyal

I have tried to setup port forwarding from my zentyal server (port 5000) to my synology NAS (port 5000) too. Here is the result in terms of iptables rules : Chain fredirects (1 references) target ...
1
vote
1answer
30 views

For what is a general allow ACK rule in iptables good for?

I've encountered some iptables configuration with incoming rules starting with a rule that allows all TCP packets with ACK flag, followed by all the obvius service port rules. Why is that? The server ...