iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

-1
votes
0answers
7 views

IPTables/CSF Firewall: Can not connect to Port 22 [duplicate]

I recently tried to configure CSF Firewall to allow connections to Port 22. This is the iptables-output for iptables -L -n | grep :22 tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 ...
0
votes
2answers
34 views

KVM - Access from an external computer to the Virtual Machine

I have the following setup: Notebook (IP: 192.168.1.100) Host: (IP:192.168.1.129) Both Notebook and Host are connected to a router (Internet IP:192.168.1.1)¨ The host (Host) has two virtual ...
1
vote
1answer
103 views

How would I get this routing to work between the two subnets? Unsure if i am over-complicating my network

I am attempting to operate 2 subnets, the first subnet on range 192.168.0.0/24 is free to access anything it wants, including machines on the second subnet. the second subnet on range 10.0.0.0/24 is ...
0
votes
1answer
24 views

PCI Scan failing at TCP Source Port Pass Firewall testing

I'm trying to get PCI scan PASS for my website, Scan failing at this step. The host responded 4 times to 4 TCP SYN probes sent to destination port 20 using source port 80. However, it did not ...
1
vote
1answer
22 views

utility of using ALL in --tcp-flags in iptables rule

I m wondering what is the difference between the following 2 --tcp-flags rules: 1) -p tcp --tcp-flags SYN,FIN,RST SYN,FIN,RST 2) -p tcp --tcp-flags ALL SYN,FIN,RST
-1
votes
1answer
36 views

Firewall rules on a hosting (dedicated server)

I am on Linux Debian Jessie 8.4. I have set up a web server. It seems to run fine. I'm just wondering, if I need the following firewall rules are ok for HTTP(S) server to be running fine. iptables ...
0
votes
0answers
22 views

multi gre tunnels to one IP

I have an issue with GRE tunnels after connecting multi-GRE tunnels with different IP's to the server, using this tutorial: http://wiki.buyvm.net/doku.php/gre_tunnel every GRE tunnel has interface ...
0
votes
1answer
22 views

OpenVPN block SMTP Access Server completely

I've tried almost all iptables rules to block smtp on openvpn server but still clients clients can access remote smtp servers on port 25. I'm using openvpn access server. It's creating two interfaces ...
3
votes
0answers
83 views

Hacker bypassing iptables

(moved from SO) I have iptables protecting a sip server. It blocks all IPs except ones I specifically opened, and it seems to work for almost everyone. I have tested from lots of ip addresses that ...
2
votes
1answer
31 views

IPTables Configuration to allow all connections, only close/deny once data is sent

I'm looking to set up my IPTables firewall in such a way that: Any new connect() is accepted Once data is received: If the destination port is on a whitelist, continue allowing the connection and ...
0
votes
0answers
11 views

DNS seems broken after iptables -t nat -A POSTROUTING -j SNAT --to-source SERVERIP -o eth+

During the setup of a L2PD VPN in Ubuntu 14.04, this line is entered iptables -t nat -A POSTROUTING -j SNAT --to-source PUBLIC_IP -o eth+ and then all the domains cannot be resolved in this ...
0
votes
1answer
26 views

ufw & iptables confusion

I have previously added some netfilter rules via iptables. I'd now like to manage these rules through ufw and to simplify things I wanted to get rid of the current rules and start afresh as if I was ...
1
vote
1answer
24 views

Allow winscp/filezilla through iptables and fail2ban

I just launched a website within my school community and woke up this morning to logs of someone trying to bruteforce into my server. I followed some guides on digitalocean to set up fail2ban and ...
1
vote
0answers
13 views

How do I use Client9's IPCat with IPTables

I'd like to block all ips of all datacenters in the world with this list: https://github.com/client9/ipcat But I don't know how to use that list, I'd like a bash script that checks if there's an ...
-1
votes
1answer
14 views

what could be the firewalld(RHEL7) equivalent command

what could be the firewalld(RHEL7) equivalent command of "iptables -A INPUT -p tcp -m tcp --dport 5666 -j ACCEPT" ?
0
votes
0answers
26 views

vpn-over-ssh ipv6 tunnel getting permission denied connecting to tcp

Using my script, I can establish a working vpn for ipv4 and even able to ping ipv6 addresses. However, trying to connect to an ipv6 address I get "permission denied". ➜ ping -6 ipv6.google.com -c1 ...
0
votes
1answer
22 views

Unable to access Node Server from external network

I have a VM with two public IPs. I have installed OpenStack controller node on the VM. I have access from the external network to Horizon and Keystone service running on apache2 web server on ports 80 ...
0
votes
0answers
32 views

iptables change source and destination ports

I would like to receive traffic on multiple UDP ports and also my application (which is listening on a single port) to know from which port the request came from. If the source port becomes the ...
0
votes
0answers
11 views

Capture no-modified packet with iptables

I have a user-space program in which I process packets. I send them there with help of iptables. The problem is that I capture not original packet but modified. I have wlan0 interface up with access ...
-1
votes
1answer
18 views

Blocking a specific external IP:Port connection in RedHat?

I know that in RedHat, in the IP tables I can block incoming connections to a local port. I can also block connections from a specific IP. But is it possible to block a connection from a specific IP ...
0
votes
0answers
60 views

Traffic on eth0 despite denying it with iptables

Despite having an iptables ruleset which should not allow it - DHCP is working on eth0. Given the below information can anyone give me an idea of why? tap0 is not up (not that it should make any ...
0
votes
0answers
15 views

haproxy, iptables & iproute2 as a mean to select a different src vIP for same default GW

Got a HAproxy 2 node cluster/setup, each node has an external and internal NIC. External has a default gw: .249 service service pool A pool B srv1..srvN srv1..srvM ...
0
votes
0answers
20 views

firewalld multiple public ips to multiple private ips routing

I'm trying to use CentOS 7 server as a firewall/nat for some sensitive servers on the LAN. The CentOS server has multiple public IPs (one per box on the LAN) and I'm trying to associate each external ...
-1
votes
1answer
23 views

Multiple NodeJS apps forward to port 80

I have a server running CentOS. There are a few NodeJS apps running on it. For example: example.com:8000 > My first app example.com:8080 > A second app example.com:8888 > Another one The problem ...
3
votes
1answer
19 views

Will it detriment my security if I allow all connections from localhost through iptables?

Under my current configuration, iptables will block every inbound connection, even if coming from localhost. In some cases, I need localhost to connect to itself. If I create a rule that allows all ...
0
votes
1answer
103 views

CentOS port forward

I have the following situation: Internet ----- Server ------- virtual machine (kvm) public ip 192.168.122.12 x.x.x.x I need to make service on the port 3333 ...
2
votes
1answer
70 views

How do I set up the default route on a Linux router with dual ISP links?

So, here's the situation. I have dual ISP links currently active and working for routing traffic from my network, with a very similar iptables setup to the accepted answer at Load balancing & ...
1
vote
0answers
25 views

How to use virtual interface as default interface

I've got a cloud SSD VPS @ OVH, and I'd like to change the default interface used for requests. I have two interfaces: eth0 (which is the default interface) and eth0:0 (which is the new virtual ...
1
vote
0answers
21 views

keep ossec iptables rules after restarting OSSEC

I have 6 OSSEC installations (5 agents + 1 server, all Debian 8) all configured to block repeated offenders using iptables from 10 minutes to 1 month. I have the need to restart one or more of the ...
0
votes
0answers
23 views

OpenVPN connect to OpenVPN client network

OpenVPN Server Ubuntu 14.04 In Digital Ocean (Public and Private interface) OpenVPN client Ubuntu 14.04 I can't SSH from Server to client via VPN connection. Ping works fine. Tunnel is up. Followed ...
0
votes
1answer
22 views

Identical DHCP leases, excessive dhcp traffic

Fresh install of CentOS 7, removed dnsmasq, installed dhcp server, iptables, webmin, apache. This is school and lot of switches and wifi (bridge mode) AP's connected to this router One network - ...
0
votes
0answers
22 views

Redirection of ports does not work

I have a VPS, and by some reasons common ports (1 - 1000) are closed. I installed iRedMail, but did not find any ways to change smtp submission ports, so I decided to just forward connection. I have ...
1
vote
1answer
40 views

How do I block traffic between two interfaces using iptables?

I want to block all traffic between my two interfaces. I am using erpxe on the eth1 interface and it seems that when I boot into erpxe, it pulls an ip address from eth0. How can I accomplish this via ...
0
votes
0answers
23 views

Ldap server cannot accept Public IP

I have this LDAP server and 10 clients in the network. 2 clints can connect to server using server's private ip (10.10.10.10), but the other clients cannot ping private ip, so they use public ip ...
0
votes
1answer
37 views

AWS EC2 and OpenVPN

I've been trying for a few hours to get OpenVPN working with AWS EC2 without any luck. Its the same setup as anyone would think of: Openvpn running on a server to gain access to resources within the ...
-1
votes
1answer
32 views

How are IP packets routed from LAN to WAN? [closed]

I have OpenWRT set up on a router, with a wireless client connected on the LAN, and connected to another network on the WAN. wlan1 is bridged on the br-lan interface, and typically forwards to the LAN ...
-2
votes
1answer
84 views

How Temporarily block an IP address making too many hits on the Server with iptables?

this is my first question here. I made this follow script to protect my server against Slowloris and some DDOS. #!/bin/sh # It does not allow more than 10 connections per IP on ports 80 and 443. And ...
-1
votes
1answer
26 views

Clone http traffic to another port on same server transparently

I am experimenting with following setup. Clone/copy (but not redirect) all incoming HTTP requests from port 80 to another port say 8080 on same machine. I have a simple NGINX + Lua based WAF which is ...
3
votes
1answer
82 views

Reject all except for whitelist policy with firewalld

I've been reading on firewalld for about the whole morning, and I came up with the following public zone: <?xml version="1.0" encoding="utf-8"?> <zone> <short>Public</short> ...
-1
votes
1answer
38 views

How to route LAN traffic for OpenVPN?

Network Environment Setup Image Speedtest.net without OpenVPN - 300Mbps Speedtest.net with OpenVPN - 10Mbps Accessing \\192.168.0.223 through Windows Explorer with OpenVPN - 80-100MB/s Is accessing ...
3
votes
1answer
47 views

fallback route to drop packets if output interface that is NATed to goes down?

Background: I establish a connection to a 3rd party VPN and NAT packets marked as part of a particular cgroup (in order to selectively run processes through the VPN or not) to the 3rd party's VPN tun ...
2
votes
3answers
83 views

What does -P INPUT ACCEPT mean with regards to iptables?

I'm fairly new to iptables, and am trying to figure out if I've configured my ruleset appropriately. With regards to the -P INPUT ACCEPT part of my question, I am trying to determine if this is valid ...
-1
votes
1answer
54 views

Minimal requirements to firewall rules for running dhcpd server in linux container

I want to run isc dhcpd server in lxd (lxc) container. But it does not recive clients requests (DHCPDISCOVER, DHCPREQUEST) from clients without this rule: iptables -I FORWARD -m physdev ...
0
votes
1answer
61 views

Network configuration fault

I'm moving my router from Rpi with Rasbian to another pc device with ubuntu server 14. I have: - local network 10.0.0.0/16, with my router gateway 10.0.0.1 - lte usb device 192.168.8.1 in network ...
0
votes
0answers
53 views

iptables: still all ports open even if access had been restricted

Server: Debian 8.0 iptables v1.4.21 Scenario: I restricted access for aliens to all ports except 80/433. But aliens still can see all ports as "Open" when they use port scanner. But they can't use ...
0
votes
1answer
57 views

Squid - Forward Port 80 to SquidServer:3128

I have a -squid ProxyServer (Hostname: SquidProxy - 10.160.54.1 SM /16) -and a Client (Client1 10.160.55.1 SM /16) At the Client i have configured the proxy in /etc/sysconfig/proxy with the ...
0
votes
1answer
65 views

iptables is marking packets with wrong number while copying file by scp

[Case1] When copying file from server (being on client) to client, packets are marked incorrect with 3 (root). [Case2] When copying file from server (being on server) to client, packets are marked ...
0
votes
0answers
33 views

CentO7 multiple TCP port forwarding entries, does not allow certain ports

I have CentOS7 KVM setup that is using TCP port forwarding to forward SSH sessions to three guests running behind a NAT virtual bridge. This is the setup i'm looking establish 2020 -> ...
1
vote
0answers
24 views

IPsec: hide private IP behind Gateway IP

I have an IPsec Gateway to a customer, and the VPN tunnel is up, the problem is that they don't allow me to use my private address because it used by another VPN they use. Our gateway is an EC2 ...
1
vote
1answer
62 views

Iptables forward all traffic to a specified port, to another device

How can I modify this iptables rule, so that all traffic which coming for this computer will be forwarded to 192.168.42.10? iptables -t nat -A PREROUTING -s 192.168.46.0/24 -p tcp --dport 80 -j DNAT ...