iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

0
votes
1answer
68 views

Telnet: Unable to connect to remote host

Related Threads: SMTP server works, but telnet to port 25 does not Can't connect to SMTP server The problem I have a server running Debian 3.2.65-1 and i am having some problems to connect other ...
0
votes
1answer
57 views

Add latency and random packet drops excluding SSH packets

I want to add some random delay/drop to all packets excluding SSH packets. I can do that to all packets this way: tc qdisc change dev $NIC root netem delay 100ms 10ms 25% tc qdisc change dev $NIC ...
-1
votes
1answer
18 views

OpenVPN cannot route traffic

Scenario OpenVPN server running on Gentoo eno1: (server public ip) has static ip... NO dhcp eno2: vlan (down for now) tun0: openvpn tunnel interface server.conf local <external ip> port ...
-2
votes
0answers
32 views

netstat and retrieving user ip behind cloudflare

Im wondering if its possible to retrieve user ip behind cloudflare (HTTP_CF_CONNECTING_IP header) with netstat netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
2
votes
9answers
303 views

IP forwarding on Linux - anything important to make sure to do or know?

In moving a website with a dedicated IP from one server to another, to minimize downtime due to DNS propagation delays, there's the approach of using IP forwarding so that all traffic to the original ...
0
votes
0answers
23 views

Iptables Port redirection don't take effect

Im tying to setup a mitm proxy to sniff my Android smartphone. I found this helpful tutorial. At the point where I need to teach Ubuntu to redirect everything from port 8080 to 443 and 80 I'm running ...
0
votes
0answers
29 views

NFS on Ubuntu Server 14 LTS with iptables

I have a virtual server with Ubuntu Server 14 LTS. The provider has offered me NFS storage which I wanted to mount on the virtual server: mount -t nfs 192.0.2.4:/space /mnt/nfs However, I cannot ...
0
votes
0answers
24 views

openvpn pass ip to client like hidemyass does

I have a debian server with 64 external ips (ip blocks) and no internal IP. They go like eth0:1 eth0:2 (virtual interfaces) I have successfully setup an openvpn server on it so that I can connect from ...
0
votes
1answer
71 views

why fail2ban does not ban? (ubuntu, ssh)

I installed a fresh Ubuntu machine. Then I changed the ssh port which is no more 22 but 22111: Then I have installed fail2ban: apt-get install fail2ban -y cp /etc/fail2ban/jail.conf ...
2
votes
1answer
38 views

Basic forwarding on Ubuntu not working

I have the following setup, minimized to explain the problem: _________ |Desktop | ...
0
votes
1answer
27 views

CentOS server blocking own outgoing traffic

I've got a server (CentOS 6.7) running, which causes me some headaches. A few months ago, the website running on the server was unavailable. After some digging, it appeared that Iptables was blocking ...
-1
votes
0answers
26 views

IPTables Reverse Proxy Breaking PHP-FPM | nginx/php-fpm/iptables/centos

Information: I have been trying to make a reverse proxy on my server using iptables rules. I use nginx to reverse proxy on SSL to port 8080 where I run another nginx server. The problem: IPTables ...
0
votes
3answers
37 views

IPTables forward to dynamic IP

I have a server running on e.g. servera.example.com and one on serverb.example.com. I want to redirect all port 80 traffic to servera.example.com to serverb.example.com, and leave all other ports ...
0
votes
1answer
15 views

Pass ethernet interface to iptables rule in ansible playbook

I'm writing a pretty simple ansible playbook for setting up our iptables firewall in centos. Here is the playbook I wrote: --- - hosts: test remote_user: deploy sudo: True tasks: - name: Get ...
0
votes
2answers
60 views

Packets in bridge get up to the user space without being redirected there

I set up a bridge interface (br0) on PC-A (Linux Ubunutu 14.04) In addition I created an application with a TCP Listener on port 80 in the user-space on PC-A As what I understood from the ...
0
votes
2answers
48 views

Iptables forwarding with single interface

Is it possible to use Iptables to forward all traffic going to certain network to given ip address? I have Ubuntu server to act as router in network 192.168.1.0/24. Its IP is 192.168.1.254. (This ...
1
vote
1answer
38 views

IPTables Multiple source or Destination IP ranges?

first time post to ServerFault so I'll try and get it right :) I have multiple environments (e.g. prod, dev, test, etc) and I'm trying to write the IPTables file for my RHEL 6.6 servers which allows ...
1
vote
1answer
47 views

Iptables DNAT single port

I'm trying to redirect a single port to a local server via IPtables. Currently I have the following rules: iptables -t nat -A PREROUTING -p tcp -m tcp --dport 55555 -j DNAT --to-destination ...
0
votes
1answer
221 views

block DNS Amplification Attack by iptables

Last time I've got warings about DNS Amplification Attack from NFOservers.com DDoS notifier 2015-12-30 23:28:52.609178 IP (tos 0x0, ttl 54, id 42635, offset 0, flags [+], proto UDP (17), length ...
1
vote
0answers
31 views

CentOS + IPTables

I am trying to setup a CentOS 7 server with Squid as a proxy server. The proxy server is strictly private and doesn't need to be available to anyone other than myself and other 2 servers, therefore I ...
2
votes
1answer
84 views

Iptables are blocking WildFly10 on CentOS 7

I've CentOS 7 server without firewalld but with iptables installed. There's WildFly 10 is running with changed socket binding http port 8080 to 80 in standalone.xml. I'd open 80 port in iptables ...
2
votes
1answer
163 views

Channel all the traffic on an IP to a VM

Situation: I have a dedicated Server (CentOS 6) with couple of VMs(Cent OS 7 and Windows Server 2012 R2) in Virtual Box. Few applications are running in windows and reachable from the Main ...
7
votes
1answer
198 views

Iptables with -m and -p parameter

I have this rule in my iptables: iptables -A INPUT -p tcp -m tcp --dport 9191 -j DROP Do I really need "-m tcp"? I already am using "-p tcp", so should I use "-m tcp" to be more secure?
0
votes
2answers
57 views

block ip with iptables ubuntu server

I am trying to block one IP with iptables in my Ubuntu server 12.04. The foreign IP is 117.16.18.95.dyna. You can take a look at the next image: I have added this ip to iptables with the next ...
0
votes
0answers
42 views

How to set up routes and rules at Debian gateway to bypass VPN for certain hosts?

I built my own router running Debian 7, having two NICs: Internal ethernet, eth0: 192.168.42.0/24 External link to VDSL modem, eth1: 10.42.42.42/8 (address arbitrary, just used for PPPoE). I have ...
3
votes
1answer
76 views

How to forward traffic from tunnel interface to eth0

Network topology: Internet | | (eth0) IP: 202.xxx.xxx.xxx/255.255.255.0 A: Remote_Server(Debian) (tun0) IP: 10.10.1.1/255.255.255.0 | | (utun0) IP: ...
-2
votes
2answers
33 views

error iptables-restore: unable to initialize table filter

i have Debian 6.0.5 x86_64 on VPS and create file named 'iptables.rules' with following command: *filter -A INPUT -i lo -j ACCEPT -A INPUT -d 127.0.0.0/8 ! -i lo -j REJECT --reject-with ...
1
vote
3answers
118 views

Bots hitting xmlrpc.php and causing high load on the server

Recently we are having a lot of hits to wordpress xmlrpc.php which in end causes high load on the servers. We tried rewriting all xmlrpc.php to 127.0.0.1 but didn't help much. Since apache was ...
1
vote
2answers
38 views

Command-line utility to test fwmark in ip rule / ip route?

I am trying to find a tool that will allow me to find the route a packet will take that comes in on a device, and has a particular destination address. ip route get will do most of what I am looking ...
0
votes
1answer
35 views

How to prevent linux from dropping incoming packets that have a wrong mac address (promiscuous doesn't work)

I configured three machines in a static proxy_arp like manner: ----------------------+ +-----------------------------------------------+ +---------------------- Machine A | | ...
2
votes
2answers
73 views

IP Tables, is it possible to limit requests per minute and timeout IP?

I am trying to setup a firewall that limits to 3 connections per IP and also ban the IP for an hour if > 30 connection attempts in one minute. This is for port 80 only. Is this all possible with ...
0
votes
2answers
23 views

Is it possible to use iptables on Ubuntu to limit brute force attacks?

Is it possible to use iptables on Ubuntu to limit brute force attacks for certain URLs? Basically I want to detect where user calls same url over and over again and drop his connection or somehow slow ...
1
vote
1answer
37 views

Opensuse port forwarding 80 to 8080 not working

I've a glassfish server that use the port 8080. I need forward from port 80 to 8080 so I can access the content without put the :8080 port in the url. I've tried to put a masquerade rule, add ...
0
votes
0answers
22 views

how to forward multicast to multicast via iptables

I want to forward incoming multicast traffic to other multicast address listened on my server interface. My machine running on Ubuntu 14.04. Have a incoming traffic on 239.0.0.1 udp port 1001, want to ...
3
votes
1answer
262 views

Redirect to local network without allow_localnet

I'd like to redirect incoming external traffic to a service which listens on 127.0.0.1. The redirection is easy - just: iptables -t nat -A PREROUTING \ -d local_ip --dport 80 \ -j DNAT ...
3
votes
2answers
332 views

iptables doesn't close port 3000?

I wanted to configure iptables on my server in such a way that only specific ports are open. Nevertheless I can access e.g. port 3000, if I run a web app on it. What could be the reason why 3000 is ...
0
votes
0answers
38 views

iptables user-defined chain not working

I am testing rate limiting to outbound IP's using iptables with user defined chains. So far I have only been able to get this to work with inbound traffic to my server. I cant seem to rate limit ...
0
votes
0answers
11 views

How to provide connectivity to a bridge running in a different network namespace?

I have a bridge running in a different network namespace. I want to access this bridge in host system. For e.g: I have created a network namepsace: my_namespace. Now inside this network namepsace i ...
0
votes
0answers
13 views

Using DNAT with IPtables

I am trying to figure out a DNAT issue and I am hoping I can get a hand. Basically I have a OpenVZ box that connects to my LAN via the SoftEther Client. What I am trying to accomplish is a way to ...
0
votes
0answers
34 views

Not able to ping ips created inside docker container using namespace in centos7

I have a docker container running inside centOS7. Now docker creates a bridge by default named as docker0 in host system. Inside the docker container, we have created another bridge named as eth2 ...
0
votes
0answers
26 views

Cache domain GET requests using Squid

I'm trying to cache requests to remote package repository, so I can access it without internet connection. All calls are via http GET to remote repo. iptables entry to redirect requests to proxy ...
1
vote
1answer
41 views

Forwarding SOAP requests

I ran into the following situation. A client provides a soap service on port 80. It's unknown how their clients access the service exactly but it assumed that they have the uris hardcoded in their ...
3
votes
1answer
22 views

Can one create a rule in iptables for google's servers only?

I want to allow gmail (and only gmail or other Google properties, not other IPs) to access my pop3 server. Is there a way to setup iptables to allow all IPs controlled by Google through my firewall?
3
votes
1answer
24 views

UFW - Rules by Service Versus Port and Protocol

What is the difference between creating allow/deny rules via a service versus a port and protocol? For example: ufw allow ssh versus ufw allow 22/tcp or even, ufw allow ssh/tcp. Which is the 1) ...
2
votes
1answer
27 views

How to mimic “DMZ Host” or “Default Host” NAT funcionality with iptables?

My previous DSL modem had a function called "DMZ Host" (which in other platforms seems to be named Default Host). When you select a computer in your network to be the DMZ Host, it forwards every ...
0
votes
1answer
59 views

Squid 3.5: Preventing forwarding loop in intercept mode

I have set up a router and an intercepting HTTP squid proxy on different machines. Clients should use the proxy (without knowledge) in the following way: Client -> Router (DNATing to proxy server) -> ...
1
vote
2answers
29 views

iptables DNAT broadcast address

I'm having trouble using iptables to change the destination address of a broadcast packet. I have read several places that iptables/Linux won't forward broadcast packets, so I'm looking for ...
0
votes
1answer
40 views

Iptables stuck in D state all the time and causing server load

I am running iptables/csf on a centos 5.11 openvz vps. I can't start/stop/flush iptables/csf. Further looking into it I could see the csf is waiting for iptables. And iptables is stuck as you can see ...
0
votes
2answers
40 views

How can I DNAT a packet coming through a bridge back to its source with iptables? [duplicate]

I have a host1 that has a WAN interface eth0 (1.2.3.4) and a LAN interface eth1 (10.41.82.1). Inside the LAN is a host2 with the IP address 10.41.82.2. Incoming connections to 1.2.3.4:22 are ...
0
votes
0answers
24 views

iptables string match accept connection

With iptables I setup these rules: -A INPUT -s *my.ip.address*/24 -p tcp -m tcp --dport 80 -m string --string "/test.php" --algo kmp -j ACCEPT -A INPUT -p tcp -m tcp --dport 80 -j DROP When I go to ...