iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

1
vote
0answers
28 views

What would be the cause of openvpn network fault?

We have openvpn network for aproximately 1200 client connections. Basically everything is running fine but there exists 0-4 collapses per day (which occurs randomly), when we looses majority/all of ...
1
vote
0answers
53 views

Route 172.0.0.0 and 10.0.0.0 traffic through two NAT boxes

I have set up two NAT boxes in two separate AWS accounts and given the necessary security group permissions to allow both instances to talk to each other. In account A I have a service that needs to ...
1
vote
0answers
11 views

Anomalous iptables entry with fail2ban (is it misconfigured to block outward traffic?)

Overall we are very satisfied with fail2ban as it has accumulated several dozen neverdowell IP addresses in our iptables rules. However I notice the following rule has also appeared: Chain fail2ban-...
1
vote
0answers
109 views

Drop first packet for every IP with iptables

My servers are getting UDP-flooded with spoofed source IP addresses. They flood with real user packets so I cannot rate limit or block these packets. Is there a way to drop the first packet received ...
1
vote
0answers
49 views

Can iptables log all type of tcp connection?

Can iptables log tcp Split-Handshake and Simultaneous-Open connections as well as tcp Three Way Handshake? Here is these two kind of tcp connection descriptions. Here I find how to log new tcp ...
1
vote
0answers
37 views

VoIP Phones not working inside LAN

I have tried to read many documents on running a VoIP system behind a NAT'd router, going out to the Internet, then back through a dedicated connection for the VoIP server. I am not getting anywhere ...
1
vote
0answers
90 views

Migration of ebtables arp rule to nftables

I'd like to move to nftables (Ubuntu trusty, kernel 3.19). However I wonder how to migrate ebtables rules for ARP packets: -p ARP --arp-op Request --arp-ip-src 192.168.178.237 --arp-mac-src 2:fb:...
1
vote
0answers
21 views

Output traffic on different interfaces based on origin subnet

This a diagram of my current network, http://s1.postimg.org/5689b415b/actual_diagram.png Objective Route 172.16.0.x/18 subnet web traffic to ADSL connection What do you think of this approach, will ...
1
vote
0answers
33 views

IPtables on DD-WRT - Bridge communication

I have a Broadcom based Linksys WRT160n router running DD-WRT build 14896. The LAN and wireless clients get a 192.168.1.xxx IP address. They are on br0. I have a guest network in the 192.168.2.xxx ...
1
vote
0answers
84 views

How to prevent conntrack overflow on host with many qemu guests

Is there any way to make iptables conntrack use separate data structures for each network interface? Would network namespaces help here (put each guest together with its tap device in its own netns ...
1
vote
0answers
42 views

IP Tables forwarding tun0 over gre1 (OpenVPN)

I haven't found a very descriptive thread (and sorry if there is one in existence - in my several hours of searching I've found nothing to my specific situation). My main issue here is getting my ...
1
vote
0answers
72 views

Cannot install iptables-service

I cannot install iptable-service on fedora 22. When i type the command dnf install iptables-service , it throws the error mentioned below. Error: Failed to synchronize cache for repo 'updates' ...
1
vote
0answers
61 views

How to drop only DHCP packets between two bridges?

I have a broadband ADSL modem-router SagemCom F@st 2704 which has a lot of embeded options such as create different networks per interface ( 4 Ethnet ports and 5 Wireless SSID, and many over ...
1
vote
0answers
83 views

Unable to connect to web server hosted in private subnet of VPC via NAT hosted in public subnet

I have hosted my android/web application on a EC2 instance in the private subnet (10.0.1.0) of my VPC. This instance has apache-tomcat installed on it, but does not have a public IP. I also have a ...
1
vote
0answers
277 views

Docker's iptables=false option seems to have not the desired behavior

Good morning at all. I am running Ubuntu 14.04 server and Docker 1.8.1 and UFW is my front-end to manage iptables. I need to run an application into a container. I do need the following behavior: ...
1
vote
0answers
123 views

Can I use a reverse-proxy on a hosting service to redirect connections to multiple IPs while taking care of maintaining sessions?

I have a situation where I am trying to host my own web server because I need some custom software, including telephony, WebRTC, node.js, etc. However, my net connection in the town and country where ...
1
vote
0answers
112 views

Forward port to virtual IP in namespace

So, I followed this guide to make a namespace where I can run my VPN: https://schnouki.net/posts/2014/12/12/openvpn-for-a-single-application-on-linux/ It works fine so far, but I have one problem. I ...
1
vote
0answers
63 views

Ping not reaching in OpenVpn clients to subnet and vice versa

I have a vpn server which is connected to vpn client having ip 10.30.0.x now. I want it to able to ping another private client connected to vpn server. Please note that other private client is private ...
1
vote
0answers
60 views

iptables rule limiting the number of connection in a broken pipe case

I am limiting the number of SSH connections using iptables but in case of, for example, a broken pipe (computer goes sleep mode, network problem, etc.) I am no longer able to reconnect. The rule I ...
1
vote
0answers
130 views

forward vpn traffic from tun1 to tun0

I've been banging my head on this for a while and gave up trying to figure it out. My knowledge about routing and iptables is just too limited to understand this it seems. I have configured a split ...
1
vote
0answers
129 views

Multicast destination NAT on same network interface, with netem

For testing purpose, in a big network where IT will shoot me if multicast data are not streamed in the right VLAN, I am trying to degrade multicast packets with a server running netem configuration. ...
1
vote
0answers
93 views

Ubuntu 12.04 Router Firewall TTFB Delay

I use Ubuntu Server as my router/firewall for my network for a number of reasons. Until recently, I was using 10.04 with great success for this purpose. The OS provides DNS lookup and DHCP using ...
1
vote
0answers
186 views

IPTables, route specific port through VPN

I'm running my own mail server at home on a dynamic IP. Dynamic IPs are often blacklisted, so I currently send out mails through my provider's relay. I want to change that to sending mail directly, ...
1
vote
0answers
76 views

Investigating connectivity issue

I'm trying to set a up a new service on a server that is running apache, however it seems like incoming traffic on that specific port is blocked, although I do not understand why. On the first server, ...
1
vote
0answers
46 views

Get Original Destination Port From iptables

I would like to create a local server that acts as a proxy for all trafic, but how would I determan the original ports when using iptables to rederect the network traffic. I need this for when the ...
1
vote
0answers
59 views

Fail to redirect requests to specific url to localhost

I have a server that listens on http://localhost:3000 and I want to forward all requests to http://api.lingualeo.com/addword from Chrome extension (some JSON data) to http://localhost:3000. What I ...
1
vote
0answers
864 views

How to configure iptables when running Docker

I have a difficult situation here, i have setup many containers on my docker host, running different applications like mailserver, databases, redis, and certain html applications using other ...
1
vote
0answers
84 views

iptables foward to multiple interfaces with NAT

I want to use iptables for provide NAT translation and forward the packets out a different interface. The network set-up is as follows: Alias: eth0:220 with IP address 10.1.1.220 / 255.255.252.0 ...
1
vote
0answers
512 views

Virtual IP Pool for NAT with StrongSwan VPN

I'm trying to wrap my head around a site-to-site VPN configuration using StrongSwan that will allow remote sites to connect to our AWS VPC. The catch is, the remote gateways will potentially be using ...
1
vote
0answers
272 views

How to block hping3 SYN ACK efficiently with iptables?

I'm trying to execute a TCP SYN flood on my Debian web server with nginx. Executing tcpdump "tcp[tcpflags] & (tcp-syn) != 0" while flooding, I see all packets coming. iptables seem to work well ...
1
vote
0answers
1k views

Squid intercept proxy stuck with forwarding loop

I'm trying to set up a debugging proxy using Squid, mainly to test our own client communications library for various proxy types (one possibility with our client, is to connect to an external ...
1
vote
0answers
18 views

Troubles with subnets and redirections

What I want to create is 2 subnets that communicate each other through a gateway. Here is my gateway: wlan0 Link encap:Ethernet IndirizzoHW c4:46:19:69:b7:a5 indirizzo inet:192.168....
1
vote
0answers
2k views

firewalld service is running, but firewall-cmd doesn't work

I am new to Centos 7/Server management. I am trying to figure out how to work with firewalld. my kernel release is: 2.6.32-042stab084.20(OpenVZ) And: #firewall-cmd --version #0.3.9 The problem is ...
1
vote
0answers
5k views

squid transparent proxy for https / ssl trafic

I am trying to configure squid as transparent proxy , I followed below steps to configure Downloaded squid3.5 from the website, As squid3.1 will not support for ssl bump ./configure --enable-linux-...
1
vote
0answers
92 views

iptables keeps using old nat rules

I use iptables snat on my gateway to change local source ip addresses to external. The trouble is that after I change the rules (or even if I flush iptables nat table) gateway keeps using the old rule ...
1
vote
0answers
475 views

Docker open ports in iptables (rabbitmq)

I'm having a docker image based on rabbitmq. Nothing in my Dockerfile specifies anything about ports. I bind the usual rabbitmq ports (5671, 5672 and 15672) to my custom ports by running my instance ...
1
vote
0answers
163 views

Connect AWS and Azure via OpenVPN

I am trying to connect two networks (AWS and Azure) together via OpenVPN. I am aware of other implementations (OpenSwan+Azure GW etc.) but I need maximal portability as I will be expanding this to ...
1
vote
0answers
463 views

OpenVPN - open ports for clients only via iptables

OpenVPN server running on my ubuntu server (tun mode). My problem is that i cannot set some ports be accessible only for VPN clients. I have a dirty solution, but i want better. I have no iptables ...
1
vote
0answers
157 views

OpenVZ : live migration fails

I can't launch live migration of OpenVZ container between two proxmox nodes... Feb 05 03:30:27 starting migration of CT 102 to node 'madrid' (xx.xx.xx.xx) Feb 05 03:30:27 container is running - using ...
1
vote
0answers
63 views

Clone and then route SNMP traps to new destination

We have 2 SNMP trap servers 10.0.0.1 and 10.0.0.2 which are the SNMP trap servers for close to 500 devices that we monitor.In all these 500 devices,10.0.0.1 and 10.0.0.2 are configured as the trap ...
1
vote
0answers
134 views

Redirect incoming WAN connection to other WAN host with iptables

I have router with Linux. I want to redirect incoming WAN connections with specified port to some other WAN host:port. I've tryed do this standard way: iptables -t nat -A PREROUTING -p tcp --dport ...
1
vote
0answers
166 views

iptables traffic after forwarding

I have 2 servers Server A and Server B ServerA = 1.1.1.1 ServerB = 2.2.2.2 I am using ip-tables to send all traffic on port 80 to Server B on Server (A) 1.1.1.1 i have done iptables -t nat -A ...
1
vote
0answers
529 views

Does netfilter reassemble IP fragments when packet is forwarded?

IP datagram should be reassemble in the termination of the path because the fragments may arrive from different paths. I think Netfilter need to reassemble a IP datagram to inspect the whole payload ...
1
vote
0answers
37 views

How can I proxy requests to a specific IP to a different IP on OS X?

On OS X how can I setup a route so that when I make a request to 10.0.0.1 it is redirected to localhost? Right now I can do curl localhost:3000 and get back a blob of HTML from my running node web ...
1
vote
0answers
86 views

Strange entries in Squid3 access.log

My WiFi network for guests is transparently proxied by Squid3. There's now a girl from Indonesia with her Samsung GT-B5330 running Android 4.0.4, who gets blocked by "The requested URL could not be ...
1
vote
0answers
191 views

linux not replying to an arp request

I am running linux 3.14 on a system with 2 interfaces. on the first interface, i can access our local network. on the second interface, arp packets come in but linux doesn't send out reply. is it ...
1
vote
0answers
258 views

amazon ec2 instance going to a remote ip using openswan tunnel is up but no traffic being established on the remote ip

I having establishing a vpn tunnel to a remote peer/public ip using amazon ec2 openswan. The tunnel is up but no traffic has been seen on our side or the remote side? Is there I been missing? Please ...
1
vote
0answers
144 views

Dovecot/Postfix mail server replies to [SYN] with [RST, ACK] when user attempts to connect (POP3). Likely iptables?

Currently I am trying to trouble shoot an e-mail server that will allow users to send e-mail, but not log in to the server (POP3) or receive e-mail using their Outlook clients. Previously this was ...
1
vote
0answers
303 views

Forward single port between subnets on dd-wrt router

I have a DD-WRT router with two subnets, 192.168.0.0/24 and 192.168.8.0/24. The latter is used for a 'guest' WiFi network. Traffic between subnets is filtered using iptables. What I would like to ...
1
vote
0answers
200 views

What does Nginx Proxy Filter in Fail2ban really do?

What does Nginx Proxy Filter in Fail2ban really do? I am currently setting up Fail2Ban for Nginx. Almost everywhere I've read, they all have included a setting for [nginx-proxy] proxy filter. From ...