iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

1
vote
0answers
66 views

Linux iptables NAT

So I need to setup a server that servers a NAT server for IPMI network xxx.xxx.xxx.xxx = external IP(internet IP) aaa.aaa.aaa.aaa = internal IP A bbb.bbb.bbb.bbb = internal IP B User 1 -> ...
1
vote
0answers
162 views

What is Bonjour Linux IPTables Firewall Ports?

I'm trying to configure my iptables in order to allow Pidgin to use Bonjour protocol, now according to: Bonjour for Windows doesn't work due to firewall settings, I have to allow Multicast DNS / ...
1
vote
0answers
156 views

DD-WRT/TOMATO Whitelist openVPN connection for specified client MAC/IP

I will use these settings: # Allow these TRUSTED hosts unrestricted access iptables -A wanout -i `nvram get lan_ifname` -m mac --mac-source <allowed MAC #1> -j ACCEPT iptables -A wanout -i ...
1
vote
0answers
174 views

OpenStack Server Instances have internet access, but they are unable to access the internal network

I'm running an OpenStack Grizzly release with a Nova-Network configuration. [No Quantium]. My network is setup as follows: OpenStack Box (10.10.13.xx network)->OpenStack Internal Network ...
1
vote
0answers
284 views

CentOS 6 IPTables commands not responsive, firewall is down

We have had this issue before but we thought it was due to installing CSF. This has now happend again where none of the commands for IPTables return anything. 'iptables -L' doesn't display anything, ...
1
vote
0answers
278 views

Using iptables to route all internal data to tun0 from eth0

Looking for a few answers ;) I'm running Zentyal on a gateway. The gateway is also an OpenVPN client, to a server I run out of another country. Interfaces are thus : External : eth1 (dhcp from the ...
1
vote
0answers
249 views

Static Public IP OpenVPN Client Needs to Accept Incoming Connections on His Public IP

I love serverfault, I have learned quite a bit from this website. Hopefully I can learn one more thing. OpenVPN Server has 30 Static WAN IP's each one has 1 user on it. Plus there is a main IP ...
1
vote
0answers
272 views

How can I use iptables to restrict access to .onion addresses in Tor?

I want to restrict outgoing network access (with the exception of connections to localhost) to TCP and UDP over Tor and block everything else (with the exception of the Tor application and localhost ...
1
vote
0answers
131 views

iptables log nowhere to be found

I'm trying to log when IPTables drops connections mostly for analysis. Problem is, my log seems to be written to... nowhere. By this time I know that iptables logs through kern facility and for this, ...
1
vote
0answers
672 views

Why are iptables rules needed for IPVS Load balancer to work?

I have setup a basic load balancer for http and https based on IPVS and linux virtual server. I start and configure ldirectord with the following configuration: virtual = 172.22.9.100:80 real ...
1
vote
0answers
169 views

Is there a tool to do packet mirroring in CentOS 5.9?

I know iptables + xtables can do it in more recent versions using the TEE target supplied by the xtables-addon package for iptables. However, the kernel in CentOS 5.9 is 2.6.18 and this version is not ...
1
vote
0answers
93 views

NAT Public ip to that many number of pvt ip

i have a Linux box with two interfaces one with ip 10.10.18.2 and other with ip 192.168.1.2,192.168.1.3 aliased. A xen host is connected with ip 10.10.18.3 and gateway 10.10.18.2 to this through a ...
1
vote
0answers
98 views

iptable DNAT poor performance

I have the following rule for PORT FORWARDING: root@foo:~# iptables -t nat -S -P PREROUTING ACCEPT -P INPUT ACCEPT -P OUTPUT ACCEPT -P POSTROUTING ACCEPT -A PREROUTING -p udp -m udp --dport 1:1024 ...
1
vote
0answers
284 views

iptables: how to decide what to log for a web server?

There are many ways to log traffic for a web server. For example, if I want to log all incoming traffic, I can place the following line as the first rule appended to the INPUT chain: -A INPUT -j LOG ...
1
vote
0answers
121 views

CSF: Changing portflood settings to deny IP longer than second interval?

I've recently been under attack and I'm configuring CSF firewall for my Ubuntu server (latest). I found out portflood settings only block the ip for the specified second count, but I would like ...
1
vote
0answers
158 views

Cloudmin GPL Xen PV with Nat Port Forwarding

I'm running Cloudmin GPL on CentOS 5 64bit and am trying to allow my Xen PV guest to access the internet via a NAT/port forwarding setup.. I've done the following: (on dom0) echo "1" > ...
1
vote
0answers
438 views

Apache died; Suspect is ulimit but cannot reproduce

Apache died last night. Error log shows this [alert] (11)Resource temporarily unavailable: setuid: unable to change to uid: 48 Browsing around the Internet, everyone seems to say this is is an issue ...
1
vote
0answers
203 views

ejabberd on vm not connect to another xmmp server (iptables dnat dport 5269)

i migrate a ejabberd server to a vm with only private ip. is work fine but not connect to anothers xmmp servers. log: s2s connection: xxxx -> gmail.com (remote server not found) telnet test: telnet ...
1
vote
0answers
95 views

Routes with PPTP

I have a server A that is running OpenVPN server, and a server B connected to it. Then on B I have eth0, the physical interface, and tap0, created by OpenVPN. I want some ip to go with eth0 while ...
1
vote
0answers
165 views

Netlink error while using IP queue

I seem to have an issue with IP queue. I have a linux machine that I am using to run some experiments. The linux machine is configured to be a router, having two NICs, connecting two other computers, ...
1
vote
0answers
178 views

Host name change breaking http? Fedora

OK so I have been messing around on my development server. It has been a while since I have had my head in linux and I suspect I have broken something. I have SSH running and that is working fine. I ...
1
vote
0answers
768 views

iptables - mark and route certain packets

Relevant to this reference http://lartc.org/howto/lartc.netfilter.html I want to mark packets sent to a certain port (80 for simplicity sake) and route them to tun0 (which is created by openvpn). ...
1
vote
0answers
250 views

iptables dynamic NAT, SNAT: force overload on exhaustion

Is there a way to specify the use of iptables NAT'ing where you can use SNAT for a pool of outside addresses, but when the last IP is about to be used it is used as an overloaded outside IP? I ...
1
vote
0answers
181 views

linux netfilter h323 module

In my system There is a Polycom HDC7000 video conferencing device and a VVX1500 ip phone. Incoming connection: Src:Any - Dst:ExtIP1 - Srv:Any -> DNAT to-destination IntIP7000 Src:Any - Dst:ExtIP2 ...
1
vote
0answers
776 views

OpenVPN enable split tunneling, client to overload over their own Internet connection

I am trying to enable split tunneling with my VPN network. I am using OpenVPN to host my VPN network and have follwed the steps to get split tunneling working however my clients still get the: 0.0.0.0 ...
1
vote
0answers
302 views

switch OFF syn cookies

We have several servers they have public IP's, but work together (one is with Load Balancer, orther with Apache Web server, other with MySQL and so on. Most of the ports are fire-walled, so only ...
1
vote
0answers
242 views

Default Gateway solution on NAT'd network (best options)

I've recently changed a network from a bunch of machines exposed to the net on a network to a more security conscious Firewall-fronted network with a DMZ for public services. Everything's mostly ...
1
vote
0answers
760 views

Why is my CentOS box rejecting some (but not all) ICMP ping requests from the same remote host?

CentOS 4.x I've got several old CentOS 4.x systems and have configured iptables to allow ICMP traffic. Originally, I had an iptables rule that looked like: -A RH-Firewall-1-INPUT -p icmp ...
1
vote
0answers
168 views

Using iptables to make a VPN router

I am attempting to make a VPN connection to a third party VPN site, then forward traffic from my internal computers (ssh and ping for now) out to the VPN site using IPTables. 3rd Party <-> ...
1
vote
0answers
603 views

linux firewall + load balance ISP connections

I'm trying to get a linux Mint computer with 4 NIC's to act as a load balance server. The idea is that we have three internet connections, and we want to use all of them so we can share usage of 50 ...
1
vote
0answers
507 views

iptables: limiting bytes downloaded per IP per day?

On a public-facing web server, I'd like to limit the total bytes downloaded per IP address per day. For example, after a visitor downloaded 100MB, any additional requests would be dropped or rejected ...
1
vote
0answers
172 views

Connect two networks

Connecting two different offices with a wireless link and linux boxes. Hardware: 2 CISCO RV42, 2 Dual Homed Linux Boxes running debian, 2 2Wire and 2 AirMax 5 Configuration is: Office A LAN A ...
1
vote
0answers
550 views

Disable kernel processing of TCP packets for raw socket

I'm working on a TCP/IP implementation, for an embedded device, that I want to test from a Linux user space process using raw sockets. raw(7) says that Raw sockets may tap all IP protocols in ...
1
vote
0answers
151 views

Configuring Iptables for Litespeed port offset with varnish

I am trying to get varnish to work with Litespeed on both HTTP and HTTPS. The problem I am having is that Litespeed offset's BOTH the HTTP and HTTPS port. So in my current setup, I have set the ...
1
vote
0answers
127 views

Can someone give me advice on these rules to prevent DDOS where fragmented packets are sent without the initial SYN fragment ?

iptables -N NEW_TCP_PACKETS_NO_SYN iptables -A INPUT NEW_TCP_PACKETS_NO_SYN -p tcp ! --syn -m state --state NEW -m limit --limit 10/day -j LOG --log-prefix "New packets but not syn:" iptables ...
1
vote
0answers
77 views

shorewall prevents routing from protected zone entities to other protected zone entities

I'm using shorewall as the firewall and gateway for a production site. The site also has a couple of VPNs running into it that are hosted on a different server on the same site (in the protected ...
1
vote
0answers
247 views

OpenVPN Configure on DD-WRT router

I have a TL_WR1043ND router with DD-WRT firmware. I've successfully configured OpenVpn on my router. I've got openVpn from a commercial VPN provider. I VOIP GSM gateway is connected with the eht0 ...
1
vote
0answers
932 views

Redirect OpenVPN gateway traffic to Privoxy

I would like to redirect the traffic that goes through my OpenVPN gateway to Privoxy, like so: OpenVPN client->Internet->OpenVPN gateway->Privoxy->Internet->Webserver (and vice versa) So far I ...
1
vote
0answers
75 views

HTTP Logging Proxies

I want to implement a proxy that records and replays requests made to specific hosts. So that I can stub out external service requests when testing an application. What is the best way to do this? ...
1
vote
0answers
552 views

nginx does not close loopback connections

I'm using nginx in reverse-proxy mode. Here's relevant part of config file: server { listen 80; server_name ~^web.redhelper\.ru$ ; access_log off; location /http-bind { ...
1
vote
0answers
883 views

bypass ip destination squid tproxy bridge

I have configured a squid transparent tproxy. All works fine. Now I need all the traffic going to an external IP (internet) does not pass through the proxy. Do I need to modify iptables, ebetables ...
1
vote
0answers
262 views

iptables - Forward back to dmz from dmz

I have a firewall with two network cards. From internet it's possible to access the external-ip and then be forwarded to an internal server. But when on the DMZ and accessing the external-ip, I'm not ...
1
vote
0answers
634 views

Is this firewall for openvpn tunnel ok?

Here is the script I want to use to setup secure firewall for openvpn tunnel in which all my internet traffic goes through the vpn. I have a couple of questions below: #!/bin/sh # # iptables example ...
1
vote
0answers
445 views

Load balancer unable to contact a server through http

In our infrastructure we have a load balancer(apache mod_balancer) and three backend servers that run apache as a web service and iptables as firewall, Lately ONE of them is giving a lot of " ...
1
vote
0answers
2k views

ufw deny all incoming and outgoing not working!

I'm sure I'm doing something wrong. I'm expecting my current rules of "denying all incoming/outgoing" to cripple anything network related, but it's not. First, I did: sudo ufw default deny incoming ...
1
vote
0answers
393 views

DD-WRT setup access restrictions but allow VPN connections freely

I have two sites with DD-WRT connected via routed VPN. Clients on both routers have Internet Access Restrictions set. This works and correctly blocks internet access. But this also blocks connection ...
1
vote
0answers
1k views

Routing only some local IPs through VPN on dd-wrt

Much similar to this entry: http://serverfault.com/questions/94283/using-dd-wrt-to-connect-to-vpn-and-forward-all-traffic-of-certain-devices-through , I have set up my router with dd-wrt + OpenVPN to ...
1
vote
0answers
260 views

Troubleshooting iptables and configuring it to drop the priority of long-term connections

I'm somewhat familiar with the general concepts of iptables, and would like to learn it in more detail. I'm hoping that my learning experience can also be useful. The situation: I'm running dd-wrt ...
0
votes
0answers
30 views

IP TABLES port forwaring corrupts my packets?

Here's my scenario. I have a WORKING DAEMON receiving packets through a proprietary protocol (mounted on the port 5000) that has been working flawlessly for over a decade. I have a weird problem ...
0
votes
0answers
18 views

Conflicting ip routes with local table on attaching a virtual network interface

I have an EC2 instance with these ip rules: $ sudo ip rule show 0: from all lookup local 32766: from all lookup main 32767: from all lookup default I can attach an elastic network interface to ...