iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

0
votes
1answer
28 views

Iptables not routing GRE protocol

First things first, there might be a few English errors, considering it's not my native language. I'm having a problem with VPN(GRE protocol) passing through Iptables. I've done this at least a dozen ...
-1
votes
1answer
50 views

What's blocking the PCI compliance scanner from scanning my site? [closed]

(I am not sure if this question fits in serverfault.com. If not, forgive me.) I maintain my client's ecommerce website and the credit card processing company requires PCI compliance. For that, our ...
0
votes
1answer
21 views

Transfer traffic between iptable chains

My understanding is that normally any given packet will only ever interact with one iptables chain either INPUT FORWARD or OUTPUT. However I want to have all traffic on port 80 that has neither its ...
0
votes
2answers
38 views

Can I access a NAT addressed host behind a gateway from the WAN side without DNS or VPN (with DNS if it's not possible)?

I have a very simple gateway running a minimal Linux which is serving as an IP router with NAT and DHCP on the LAN, and a static IP on the WAN. The gateway router from the LAN side goes to a big ...
0
votes
0answers
17 views

why iptables SNAT doesn't help to answer ARP on the vlan tagged subnet?

I'm using iptables SNAT to setup a "router" on a linux box, it suppose to do NAT for 2 subnets. one untagged subnet 10.0.10.0/24, the other one is vlan tagged subnet 172.16.0.0/24. both subnet come ...
-1
votes
1answer
45 views

Adding an IP address to whitelist [closed]

I want to connect Humongous GUI to my MongoDB, but it prints the next error: Connection to your server refused. You need to whitelist the IP address 52.5.26.69. When I try the next: iptables -A ...
0
votes
1answer
30 views

Forward traffic from IP accessing specific port to other port

Sidenote This question is nearly the same to this question: Forward all traffic on a specific port depending on the domain to another port but I have a totally different aim with my one.* Schematic ...
0
votes
1answer
25 views

why is are there dns host names in my iptables entries? (fail2ban)

I recently installed fail2ban which has begun blocking bad ssh attempts. I also set up an additional filter to permanently ban repeat offenders. I notice now that there are some entries in my ...
0
votes
0answers
30 views

How to build via iptables an transparent reverse proxy [closed]

also ask the same question on linux/unix: I just use an Server with an public ip X.X.X.X to redirect without (changing the header ip) to another public ip Y.Y.Y.Y and the same back. My backend server ...
0
votes
1answer
25 views

Blocking IP addresses via iptables not taking effect

I am trying to ban various IP subnets on my Debian server by using the following command: iptables -A INPUT -s 222.128.0.0/10 -j DROP The command was taken correctly and a iptables -L -n command ...
1
vote
1answer
98 views

Rule to allow port 80 using IPV6

My server: 64 bit Ubuntu 12.04.4 LTS. Provider: Linode.com. No other firewall is present. I've these rules: *filter # Allow localhost traffic. This rule is for all protocols. -A INPUT -s ::1 -d ...
-1
votes
0answers
10 views

IPTables rule can not be rewritten

So I am trying to redirect a connection to another IP and port. It works great using the following code, but if I want to change the rule it doesn't work. Here is the working code sysctl ...
0
votes
1answer
16 views

How do I troubleshoot a VPN connection that won't forward DNS requests?

How do I troubleshoot a VPN connection that won't forward DNS requests? My network configuration without the VPN running works as desired. I have a Centos front-end NAT'ing outbound requests via ...
-3
votes
1answer
51 views

Linux Iptables writing new rule for limit a DoS Attack

Recently, I have experienced a DoS attack so i decide write a new rule to stop the attack but my knownledge is not enough to do this, so any hint or help will be appreciated Attack log attachment-ed ...
0
votes
0answers
62 views

How to modify traffic between two interfaces in Linux? [closed]

I have a laptop connected to internet via wlan0. I also have eth0 interface and with its help I share internet. I want to modify/filter all the traffic passing by the first laptop, something like ...
0
votes
2answers
30 views

iptables forwarding ignored

I'm having an issue forwarding traffic from one interface to another. It seems my forwarding rules are not being respected. sysctl net.ipv4.ip_forward net.ipv4.ip_forward = 1 Here's how my IPtable ...
-1
votes
1answer
34 views

Apache tomcat works temporary - restart iptables for work

I have an apache tomcat installed on CentOS linux on a VPS. I have opened port 8080 in iptables so that it will be visit-able from outside. My problem is that when I go to address example.com:8080 it ...
0
votes
1answer
25 views

Blocking LAN client WAN access with a exception rule

I'm trying to block a specific client access to the WAN with this: iptables -I FORWARD -s 192.168.X.X -o $WAN_INTERFACE -j DROP I however need a exception to allow outbound connections to a ...
0
votes
1answer
23 views

KVM guest static ip with ports forwarded to another guest

Im on host-machine with Centos 7 and 2 guests on Centos 6.6. I want one of my guests have static external ip but some his ports must be routed to another guest. On host machine I do: iptables -t nat ...
0
votes
0answers
91 views

Transparent Proxy Issues w/ HAProxy Centos 7

Having issues following steps to transparent proxy outlined here: Howto transparent proxying and binding with HAProxy and ALOHA Load-Balancer | HAProxy Technologies – Aloha Load Balancer Believe to ...
2
votes
1answer
35 views

Is it possible (how?) to Route incoming UDP packets with one target IP to a destination IP that is resolved through a DNS query for a static URL?

I have a set of mobile devices that are configured to send UDP messages to an IP-address that is set in their SRAM. They don't have the capability to either store a URL, or resolve a URL to an IP ...
0
votes
1answer
60 views

How to Route certain traffic to a VPN and else to the internet

I currently have a linux server with fedora 22, which I intend to use as a router, and right now I have openswan conected with ipsec to a remote fortigate 60c, what I would like to know is how to go ...
0
votes
1answer
32 views

How iptables work when DNAT and REDIRECT are both set with the same rule?

$ iptables -t nat -L -n Chain KUBE-PORTALS-CONTAINER (1 references) target prot opt source destination … REDIRECT tcp -- 0.0.0.0/0 11.1.1.88 /* service-nginx */ ...
0
votes
1answer
18 views

Proper iptables rules to allow Guests network connection

I have a KVM running on Ubuntu 14.04 with a few guests (mostly CentOS7) behind NAT configuration. It seems the guests can't reach the internet connection if the following firewall rules are activated ...
0
votes
0answers
16 views

iptables open port to an LXC container with public IP

I've encountered a strange problem I have no idea how to fix. I'm trying to close all ports on my server, and open only the ports I need in the directions I need. Thus, I ended up with: IF=eth0 ...
0
votes
1answer
58 views

Setting ToS/QoS for VoIP on Mikrotik

I have a Mikrotik router which looks like iptables. I need to setup QoS to ensure VoIP phones get top traffic priority. How do I know what ToS to use and how would I get it? I searched and can't seem ...
0
votes
0answers
15 views

How to make name resolving faster when querying a huge iptables log file

My daily iptables log files are 1-1.5 GB, which as you see is a huge size. And the amount of logs will get more and more each day. I often need to extract source and destination ip addresses, resolve ...
0
votes
1answer
29 views

Centos 6.6 Web Server iptables FTP issue

I have finished setting up my iptables, but the FTP login/connection does not work. the NAT/Firewall at the hardware/router level is forwarded correctly. I have added an entry for ftp but it appears ...
0
votes
1answer
32 views

adding extra ip address with different port number

I am connected to a NAS system that it is set to static IP address 192.168.2.41 and the ports 80 and 443 of its static ip are reserved for the NAS configuration webpage. So if I insert ...
2
votes
2answers
43 views

iptables setup forwarding between two ethernet interface

I want to create a gateway on linux which has 2 interfaces eth0 and eth1. Eth1 is created by a lte modem and once the lte modem attaches to the network and gets an ip address. Then a dhcp server is ...
0
votes
2answers
47 views

Forward Port on Guest Operating system With Libvirt

I am currently running a Xen Hypervisor underneath Ubuntu 14.04. On the host machine I am running a guest VM. From what I understand, In order to be able to receive incoming connections on the ...
1
vote
2answers
45 views

UDP packet comes to VPN interface and is not delivered to the process

I have a server X (45.55.245.182) which is connected to server Y by VPN. VPN interface on X is tap0 with ip 10.200.0.2; VPN interface on Y is tap0 with ip 10.200.0.1. I run netcat on server Y to ...
1
vote
0answers
33 views

forward vpn traffic from tun1 to tun0

I've been banging my head on this for a while and gave up trying to figure it out. My knowledge about routing and iptables is just too limited to understand this it seems. I have configured a split ...
0
votes
1answer
12 views

Opening a port to access a service in an isolated LAN

There is an isolated LAN (completely isolated, does not access outside and outside can't access it). But one of the server has 2 NICs, one of which is on our dev LAN and the other one in the isolated ...
0
votes
1answer
50 views

iptables TEE UDP traffic to a different subnet

I'm looking for a way to replicate UDP traffic received by one host to another host in a different subnet. The TEE target in iptables only works with gateways in the same subnet, i.e.: On the ...
0
votes
2answers
33 views

Simplest way to secure debian server on LAN

I currently have a basic debian server setup and connected to my LAN. Am I right in thinking that if I remove the gateway from the network configuration then the box will be unable to communicate ...
0
votes
1answer
41 views

Route HTTP(S) traffic to specific IP based on requested URL on Linux

I have an Ubuntu Server in the cloud. Let's call it ServerA. ServerA has an apache2 installed and is serving a default page on HTTP requests. mydomain.com is pointing to the ServerA's IP and thus the ...
2
votes
0answers
102 views

pf (Mac OS X) rule to redirect all traffic to a specific ip/port

I'm trying to recreate this iptables setup (from https://github.com/darkk/redsocks) with pf: iptables -t nat -A REDSOCKS -p tcp -d 10.0.0.0/8 -j REDIRECT --to-ports 12345 iptables -t nat -A OUTPUT -p ...
0
votes
1answer
16 views

iptables DNAT to external IP without masquerading does not work

On server 1.1.1.1: iptables -t nat -A PREROUTING -p tcp --dport 20000 -j DNAT --to-destination: 2.2.2.2:20000 iptables -t nat -A PREROUTING -p tcp --dport 20000 -j LOG --log-prefix pre20k iptables ...
0
votes
0answers
15 views

local port forwarding with failover

There is a number of similar though not identical processes (worker processes) running on the localhost and listening each on its own TCP port, let's say process1 is listening on port 10001 process2 ...
1
vote
1answer
38 views

Port forward linux iptables

My current network setup consists of a physical nic eth1 receiving my public ip from the modem. Next I have kvm/qemu virtual machines running on a virtual network using the ip range 192.168.122.0 - ...
1
vote
1answer
43 views

Forward connections from docker container on specific port to local interface on host

I am attempting to run services in containers within a cloud provider. I would like the containerised applications to authenticate with an on-premises LDAP server, which is (currently) available via ...
0
votes
2answers
65 views

IPtables on Linux for mysql server private interface

Looking to make a mysql database server for web-servers. The server has a public & private interface and I need some assistance writing the rules. I want to only allow SSH, mysql via private ...
0
votes
1answer
63 views

iptables not starting upon reboot

I've enabled iptables in systemd with: systemctl enable iptables but after restart when I try service iptables status, it shows: # service iptables status Redirecting to /bin/systemctl status ...
0
votes
1answer
35 views

can't initialize iptables table `nat' in Proxmox Openvz vm

When I tried to run an iptables command in the Proxmox OpenVZ vm, I got the following error: # iptables -t nat -A POSTROUTING -o venet -j MASQUERADE && iptables-save iptables v1.4.21: can't ...
2
votes
1answer
46 views

ipset not being applied to iptables

I'm trying to filter out a country that keeps probing my SMTP server (CentOS6) and I can't seem to get the ipset to work out right in iptables. I downloaded that countries IP addresses from ...
0
votes
0answers
18 views

DNAT not forwarding to correct (local) IP address

I'm trying to port-forward a HTTPS service which uses different SSL certificates for each of the several IP addresses on the machine. Web server listens on each IP address on the internal port (444) ...
-1
votes
1answer
24 views

IPTABLES not working, fail2ban still notifying me of instrusions from those ips

I added 200 hundred iptable rules like these: iptables -A INPUT -s 108.62.150.0/24 -j DROP iptables -A INPUT -s 109.108.64.0/19 -j DROP iptables -A INPUT -s 109.110.32.0/19 -j DROP to block russian ...
2
votes
1answer
56 views

How to create a private network between a VPS and 4 IPs?

I own a VPS running Debian and i want to avoid security breaches from "outside" (via Internet). I want to guarantee these rules: Allow all outbound traffic; Allow HTTPS connections from IP 1, 2, 3; ...
0
votes
1answer
42 views

iptables, redirect all port 80 to an IP but let one IP forwards through

My router redirects all incoming traffic (interface eth0) to IP 1.2.3.4 : iptables -t NAT -A PREROUTING -i eth0 -p tcp --dport 80 --to-destination 1.2.3.4:80 When a client hits "100.80.77.8", I'd ...