iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

0
votes
1answer
41 views

UFW deny all incoming except SSH

I am about to configure firewall with UFW. I am logged in over SSH so I don't know if the terminal will be locked out as soon as I do: sudo ufw default deny incoming If so, how can I deny all ...
0
votes
1answer
40 views

How to block HTTP floods using IP tables and perm block the attacking IP?

I want to find out how to block HTTP floods fully. I was using this code right here: iptables -A INPUT -i eth0 -p tcp --dport 80 -m state --state NEW -m recent --set --name HTTP iptables -A INPUT -i ...
5
votes
1answer
98 views

Load balancing network traffic using iptables

I am trying to load balance traffic from internal LAN on a linux router having two gateways. Initially I went for the iproute implementation which didnt balance the load as expected, reason being that ...
1
vote
0answers
42 views

iptables IP address (source and destination IP address) mangling [migrated]

I tried to understand the concept of iptables mangling part, but somehow failed to understand the IP header manipulative section. For example: Below is the system scenario which I'm trying to ...
-2
votes
1answer
46 views

Iptables doesn't open port 53

I have been trying different ways of opening the port but for some reason doesn't work. The last set of lines that I have used is as follows: iptables -I OUTPUT -p udp --dport 53 -m state --state ...
0
votes
1answer
56 views

Port 80 doesn't work

I have a website in my ubuntu server 14.04, with apache2 server, and untils fews days go the site works fine but, today if I digit www.mydomain.com from my internal network it works but, if I try with ...
0
votes
0answers
18 views

Dropped TCP Packets over two-stage IKEv2 VPNs

Something of a weird setup this: There are two Virtual Private Clouds (10.100.240.0/20 = prod1 and 10.101.0.0/24 = control), which have a valid router between them. Control hosts a VPN that is meant ...
0
votes
2answers
64 views

ports 993 and 995 not open even though opened in iptables

Hi I have a problem with imaps and pops access of email clients to mail server (postfix/dovecot) telnet from the servers shell (ubuntu 12.04, postfix, dovecot, spamassassin, amavis) to ports 587, 25, ...
1
vote
1answer
41 views

Transparently forward local port to remote server

I have StatsD daemon running on a remote server (x.x.x.x) at 8125. I would like to forward 127.0.0.1:8125 to x.x.x.x:8125. I have already tried running the following on localhost echo 1 > ...
0
votes
0answers
33 views

Nodejs remote debugging ports closed

I have a problem with nodejs remote debugging. I'm using centos on remote server and phpstorm on my PC. When I open putty: I type in command: node --debug-brk=5858 main_server.js, and the output is: ...
0
votes
0answers
15 views

DD-WRT route between vlan2:1 and vlan2 [migrated]

I've been trying to configure a Netgear R7000 with DD-WRT on board. My problem is the fact I have a private ip assigned to the WAN (vlan2) and a public ip assigned to vlan2:1 If I use only iptables ...
0
votes
2answers
36 views

Load balancing IPTABLES POSTROUTING rules

I have an interface with 5 IP addresses assigned to it (as virtual adapters) let's call them x1,x2,x3,x4 and x5. Currently I have SNAT POSTROUTING forwarding rules from local source range to specific ...
0
votes
1answer
62 views

Access two web servers (VPS and Windows Server) through the same IP (PUBLIC AND VPN) using VPN [closed]

I have two servers: a hosted VPS with a website on port 80, and a home server running windows 7. See the diagram below. The home server is running WAMP on port 88, which works on my home's public ...
-1
votes
0answers
19 views

iptables NATed traffic is not getting ack back

Ok, I'm trying to setup the classic iptables DNAT/SNAT scenario (RHEL 6.5, 2.6.32-431.17.1.el6.ppc64 kernel ): *Host A 172.16.0.0/24 nets Host B 172.16.0.0/24 + 192.168.0.0/24 nets Host C ...
1
vote
1answer
29 views

Redirect packet that matches a pattern?

How can I route an incoming udp packet with iptables that matches a pattern like: 53 41 4D 50 5B 79 95 DB 61 1E 69 from public interface (vmbr0) and port 7777 to 192.168.0.1:7777?
0
votes
1answer
26 views

Why port 22 redirection causes lxc containers to ssh to host?

I have a host A on which I have 2 lxc container (X and Y). I originally had port 22 on my host (A) forwarded to X. Using this configuration, I wasn't able to ssh out of the container X and when ...
1
vote
3answers
87 views

Forward Traffic in & out, NAT iptables

I have a box setup as DHCP Server with NAT ipv4 forwarding enabled. Currently the box uses eth0 to connect to a local network and has access to the internet, it has another 3 interfaces, eth1, eth2 ...
0
votes
2answers
44 views

Port forward with iptables

I got lo (127.0.0.1) and eth0 (172.17.0.8). I want to redirect packets that land on 127.0.0.1:80 to 172.17.42.1:80 (route from eth0). I tried iptables -t nat -A OUTPUT -p tcp --dport 80 -d 127.0.0.1 ...
0
votes
1answer
40 views

Ubuntu / node.js dropping incoming requests [closed]

I am getting dropped requests on a node.js server. I have simplified the test case to the point that it must be a problem with system setup. I am a developer and have very little experience with ...
6
votes
1answer
333 views

IPTables: Allow outgoing MySQL connections but not incoming connections

I have a server which doesn't allow connections to mysql from external sources - all of my databases and connections take place on localhost. The default policy of iptables is to drop connections for ...
0
votes
0answers
4 views

linux: how to troubleshoot forwarded port? [migrated]

My home internet connection has a static IP address (eg: 123.123.123.123) I have configured my router to forward port 9000 to an internal host (192.168.1.101). That host is running Ubuntu 14-04. ...
1
vote
2answers
76 views

Add a VLAN tag to specific UDP port traffic

I'm running an application in Ubuntu12.04 that I've written that does some remote switch management. I have only a single NIC connected to the network of managed switches, eth0 which is set with IPv4 ...
-1
votes
1answer
64 views

IPTables Limit port speed

I want to limit a port's speed down to 5 kb/s per client connected (trying to share out the limited connection without smashing the network) I Have done research, mostly I find rules which drop ...
0
votes
1answer
41 views

iptables: service per physical interface

I have a vm on which I'm trying to configure (unsuccessfully) one service per physical device - i.e. ssh open only on eth0, http only on eth1 and ftp only on eth2. This has to happen regardless on the ...
0
votes
0answers
7 views

xen routed setup, no internet connectivity in domU

My server has 4 public ips, but I have 5 vms running, the vm which doesn't have an own public ip should be able to reach the internet and all other vms over private interfaces. I configured a private ...
0
votes
2answers
46 views

How to redirect a packet with iptables that match a certain pattern? (eg a QUERY command with UDP)

I have a certain packet that I want at all times to be redirected to a specific ip on my virtual network interface. As for now my iptables is setup like this: (the commands, I use \ as for now to ...
0
votes
0answers
46 views

Fail2Ban Correctly Attempts to Ban IP but IP does not get banned - iptables chain exists but not working

Running on Ubuntu 14.04 Server. So I have fail2ban correctly configured to process /var/log/auth.log for SSH login attempts. Upon 3 failed attempts I see this in the fail2ban log: 2014-11-19 ...
2
votes
2answers
143 views

Make CentOS 7.x a port forwarding NAT device

I would like to make CentOS a port forwarding NAT machine using iptables. This is the first time I've tried this and I think i might need a little help. This is the configuration i'm trying to ...
2
votes
1answer
85 views

Traffic shaping outbound clients source ip with tc / iptables

My question is I am trying to limit a users bandwidth on a server and wondering the best way to do this. Before I dive to far into the tc/iptables I was wondering if I could get any advice on this ...
0
votes
0answers
35 views

iptables on AWS - how to get traffic mirroring to work?

Has anyone successfully deployed 'iptables -t mangle -j TEE...' for monitoring traffic on AWS instances? If so, how? My objective is for client<->server traffic between external customers and EC2 ...
0
votes
0answers
80 views

Forwarding traffic from one ethernet interface to another

Earlier, I was trying to get traffic from one ethernet interface to another without using a bridge. Here is a link to the solution : ...
0
votes
2answers
72 views

CentOS, How to allow SSH through only one server-ip [closed]

I currently have a dedicated server with two pv4 IP addresses assigned to it. I want to make one public, and the other private for SSH/FTP related material. IP 1 (The public ip): 192.23.6.11 IP 2 ...
-1
votes
1answer
51 views

How to drop first udp packet from a source with iptables?

As a defense against distributed udp flood, I need to drop first udp packet from a source and accept other than first packet. Does iptables has capability of doing this? If yes, how?
1
vote
1answer
36 views

Are iptables prerouting (DNAT) packet changes visible to subsequent chains?

I was reading Rusty Russell's NAT Howto when I came across this section: 6.2. Destination NAT This is done in the PREROUTING chain, just as the packet comes in; this means that anything else on ...
0
votes
0answers
25 views

Error with IPTables command

I'm trying to run the following command iptables -A INPUT -i eth0 -j LOG --log-prefix "IPTables " And I get the following error: iptables: No chain/target/match by that name. I'm running Fedora 20 ...
1
vote
1answer
116 views

My iptable rules do not allow VPN connections

I have installed OpenVPN on my Archlinux server and modified my iptable rules to allow incoming traffic on port 1194 and forward it to the tun0 interface. When I disable/stop the iptables, the OpenVPN ...
0
votes
1answer
40 views

iptables setting output default to DROP

I have two servers: one web, one database. The db server is on a private network. I thought I needed to restrict the default OUTPUT on the web server to DROP and created OUTPUT rules to to ACCEPT ...
0
votes
0answers
42 views

IpTables -j REJECT to instantly block the loading on user browser

I have been searching for a solution to notify the browser on user that the request is Rejected so stop loading it. Because I have blocked facebook and every page that have a facebook plugin is ...
0
votes
1answer
38 views

General protection fault by __d_drop following SMTP attack

The SMTP port (Postfix) of my box running 3.16.5 is being hammered. The log repeats this over and over: Nov 14 09:16:25 [postfix/smtpd] lost connection after UNKNOWN from unknown[177.43.41.74] Nov 14 ...
1
vote
1answer
145 views

AWS EC2 Ubuntu 14.04 Instance smtp port forwarding from 25 to 2025

I am trying to step up port forwarding from port 25 to port 2025 on the same AWS EC2 Ubuntu 14.04 instance using iptables. I am using port 2025 to receive income emails using Alfresco. The first step ...
0
votes
1answer
25 views

APF Limit to Deny IPs?

So, I've been actively banning IPs of malicious users. Previously, I only used IPtables to do this, but since giving APF a whirl, I've been having issues. It appears that there is a limit to the ...
0
votes
0answers
39 views

Iptables - double REDIRECTING - is it possible?

I have 2 kinds of proxies in my local machine : stunnel and TOR-VPN. stunnel is listening on port 6666 TOR-VPN is listening on port 9040 The IP of stunnel server is a.b.c.d. I want to get web ...
2
votes
0answers
52 views

How to route traffic through different interfaces based on the port number?

iptables -A PREROUTING -i usb0 -t mangle -p tcp --dport 8080 -j MARK --set-mark 1 iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination Chain ...
0
votes
1answer
78 views

Local transparent proxy with squid and dansguardian

I am having trouble setting up a local web cache and filtering system using squid and dansguardian. It works perfectly when the browser is configured to use the proxy box's ip (192.168.1.2) but I ...
0
votes
0answers
40 views

Iptables - centos 5.8 - how to forward ports to internal lan

I'm trying to map port 8080 to another machine running a web server. ppp0 = ADSL internet connection eth0 = ethernet card of linux machine (ip address: 192.168.0.2) 192.168.0.105 = other machine ...
0
votes
0answers
90 views

Missing iptables rules for Strongswan routing for VPN for phone

I have a Centos 6.6 VPS out on the Internet that has a public IP. I have installed StrongSwan 5.1.3 to allow my BlackBerry10 phone to connect from hotspots and use the VPS' connection. The VPS' IP ...
2
votes
0answers
32 views

How to monitor the bandwidth per each iptables masqueraded device [closed]

Question: Which tool could I use to monitor and break-down in real-time which bandwidth is routed by iptables to which computers? Context: I have a linux box masquerading about 15 devices to ...
1
vote
1answer
36 views

Temporarily block communication with host if its connecting to port X

I have a Linux VPS, and it's constantly being scanned, bruteforced by some rogue IPs. This VPS is my private server, that serves only to me, and I'm the only user of it. Also I am the only user who ...
0
votes
0answers
75 views

OpenVPN Port forwarding on a OpenVZ VPS

I've been trying for the past 3 hours to forward the 443 port from my client to the 20443 port on my server (CentOS 7 on OpenVZ), so i can access it on myserverip:20443. I have OpenVPN Access ...
1
vote
1answer
44 views

Conntrack shows no result

I tried the command conntrack -L and it returns nothing when I have a ping www.google.com running. I also tried to load the module by modprobe nf_conntrack. But it still always returns conntrack ...