iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

1
vote
0answers
265 views

Using ufw on OpenVZ-based VPSes

I'm facing with a problem to set up ufw on Ubuntu 12.04 running on an OpenVZ-based VPS. I know there is limitations for ufw. I googled a bunch of articles how to resolve the issue (like: ...
1
vote
0answers
105 views

Port corruption using iptables NAT on Enterprise Linux 6

I am trying to setup a captive web portal redirect on CentOS using the following configuration: This configuration works for the first few packets, but then suddenly the destination port is corrupted ...
1
vote
0answers
54 views

Open ports for VPN users

I have been looking around for some time for answer to this, and have yet to find one. The issue that I am having is that users that are connected to the VPN cannot do the following, as examples: ...
1
vote
0answers
59 views

Iptables and system-config-firewall

I had a set of netfilter rules set with iptables, but someone else told me to use system-config-firewall to add a rule for sharing files with Windows. (Samba) This rewrote the iptables rules file and ...
1
vote
0answers
774 views

How to stop NAT dropping idle connections?

I have a TCP connection that can be idle for many hours. The traffic is flowing from the server to the client only. One might say it's kind of push notification. My home router, however, tends to ...
1
vote
0answers
434 views

iptables & tc limit both upload & download together

I have the following for iptables & tc but it limits the upload speed to 2Mbits once the quota of 1GB has been hit. iptables -t mangle -A POSTROUTING -o eth0 -p tcp -m owner --uid-owner aaron ...
1
vote
0answers
131 views

Strange dropped packets coming from port 8888 and with ACK or ACK+PSH set

Background During an incident on a small privative network (1 router/FW + 1 server) my server got accidentally exposed to the internet. Fortunately it was protected by it's own UFW to allow only 1 ...
1
vote
0answers
240 views

How to Exclude Log Using Fail2Ban logpath with Wildcard Settings

I'm using wildcard in the logpath value as shown below: [http-get-dos] enabled = true filter = http-get-dos logpath = /var/log/ispconfig/httpd/*/access.log maxretry = 250 findtime = 300 #ban for 10 ...
1
vote
0answers
298 views

racoon pure IPSEC VPN, best way to give vpn server an IP address on the VPN?

We are testing a VPN server for DR. We have a rackspace cloud instance, with a pure IPSEC VPN server running in racoon, serving "road warrior" clients. We have some NAT going on on the server to route ...
1
vote
0answers
135 views

ip routing of multiple virtual IPs on one ethernet card

I am working on a live network of multiple boxes and routes with a long history of changes. I am trying to consolidate them with the minimum disruption. I'd like to get rid of some old routers and ...
1
vote
0answers
160 views

Send traffic over a specific port through a specific interface, using Shorewall

I have an application that does not support binding to a different interface. It currently sends outgoing connections over eth0, but I would like to send it over eth0:1 which is a virtual interface. ...
1
vote
0answers
111 views

iptables filter tftp's caps failed

i want use iptables to filter tftp client's OUTPUT package, but failed, could you help me? My rules: iptables -A OUTPUT -m udp -p udp --dport 69 -j NFQUEUE iptables -A OUTPUT -m string --algo kmp ...
1
vote
0answers
73 views

Linux iptables NAT

So I need to setup a server that servers a NAT server for IPMI network xxx.xxx.xxx.xxx = external IP(internet IP) aaa.aaa.aaa.aaa = internal IP A bbb.bbb.bbb.bbb = internal IP B User 1 -> ...
1
vote
0answers
213 views

What is Bonjour Linux IPTables Firewall Ports?

I'm trying to configure my iptables in order to allow Pidgin to use Bonjour protocol, now according to: Bonjour for Windows doesn't work due to firewall settings, I have to allow Multicast DNS / ...
1
vote
0answers
199 views

DD-WRT/TOMATO Whitelist openVPN connection for specified client MAC/IP

I will use these settings: # Allow these TRUSTED hosts unrestricted access iptables -A wanout -i `nvram get lan_ifname` -m mac --mac-source <allowed MAC #1> -j ACCEPT iptables -A wanout -i ...
1
vote
0answers
197 views

OpenStack Server Instances have internet access, but they are unable to access the internal network

I'm running an OpenStack Grizzly release with a Nova-Network configuration. [No Quantium]. My network is setup as follows: OpenStack Box (10.10.13.xx network)->OpenStack Internal Network ...
1
vote
0answers
404 views

CentOS 6 IPTables commands not responsive, firewall is down

We have had this issue before but we thought it was due to installing CSF. This has now happend again where none of the commands for IPTables return anything. 'iptables -L' doesn't display anything, ...
1
vote
0answers
303 views

Using iptables to route all internal data to tun0 from eth0

Looking for a few answers ;) I'm running Zentyal on a gateway. The gateway is also an OpenVPN client, to a server I run out of another country. Interfaces are thus : External : eth1 (dhcp from the ...
1
vote
0answers
298 views

Static Public IP OpenVPN Client Needs to Accept Incoming Connections on His Public IP

I love serverfault, I have learned quite a bit from this website. Hopefully I can learn one more thing. OpenVPN Server has 30 Static WAN IP's each one has 1 user on it. Plus there is a main IP ...
1
vote
0answers
298 views

How can I use iptables to restrict access to .onion addresses in Tor?

I want to restrict outgoing network access (with the exception of connections to localhost) to TCP and UDP over Tor and block everything else (with the exception of the Tor application and localhost ...
1
vote
0answers
136 views

iptables log nowhere to be found

I'm trying to log when IPTables drops connections mostly for analysis. Problem is, my log seems to be written to... nowhere. By this time I know that iptables logs through kern facility and for this, ...
1
vote
0answers
888 views

Why are iptables rules needed for IPVS Load balancer to work?

I have setup a basic load balancer for http and https based on IPVS and linux virtual server. I start and configure ldirectord with the following configuration: virtual = 172.22.9.100:80 real ...
1
vote
0answers
172 views

Is there a tool to do packet mirroring in CentOS 5.9?

I know iptables + xtables can do it in more recent versions using the TEE target supplied by the xtables-addon package for iptables. However, the kernel in CentOS 5.9 is 2.6.18 and this version is not ...
1
vote
0answers
93 views

NAT Public ip to that many number of pvt ip

i have a Linux box with two interfaces one with ip 10.10.18.2 and other with ip 192.168.1.2,192.168.1.3 aliased. A xen host is connected with ip 10.10.18.3 and gateway 10.10.18.2 to this through a ...
1
vote
0answers
110 views

iptable DNAT poor performance

I have the following rule for PORT FORWARDING: root@foo:~# iptables -t nat -S -P PREROUTING ACCEPT -P INPUT ACCEPT -P OUTPUT ACCEPT -P POSTROUTING ACCEPT -A PREROUTING -p udp -m udp --dport 1:1024 ...
1
vote
0answers
286 views

iptables: how to decide what to log for a web server?

There are many ways to log traffic for a web server. For example, if I want to log all incoming traffic, I can place the following line as the first rule appended to the INPUT chain: -A INPUT -j LOG ...
1
vote
0answers
143 views

CSF: Changing portflood settings to deny IP longer than second interval?

I've recently been under attack and I'm configuring CSF firewall for my Ubuntu server (latest). I found out portflood settings only block the ip for the specified second count, but I would like ...
1
vote
0answers
169 views

Cloudmin GPL Xen PV with Nat Port Forwarding

I'm running Cloudmin GPL on CentOS 5 64bit and am trying to allow my Xen PV guest to access the internet via a NAT/port forwarding setup.. I've done the following: (on dom0) echo "1" > ...
1
vote
0answers
515 views

Apache died; Suspect is ulimit but cannot reproduce

Apache died last night. Error log shows this [alert] (11)Resource temporarily unavailable: setuid: unable to change to uid: 48 Browsing around the Internet, everyone seems to say this is is an issue ...
1
vote
0answers
245 views

ejabberd on vm not connect to another xmmp server (iptables dnat dport 5269)

i migrate a ejabberd server to a vm with only private ip. is work fine but not connect to anothers xmmp servers. log: s2s connection: xxxx -> gmail.com (remote server not found) telnet test: telnet ...
1
vote
0answers
100 views

Routes with PPTP

I have a server A that is running OpenVPN server, and a server B connected to it. Then on B I have eth0, the physical interface, and tap0, created by OpenVPN. I want some ip to go with eth0 while ...
1
vote
0answers
179 views

Netlink error while using IP queue

I seem to have an issue with IP queue. I have a linux machine that I am using to run some experiments. The linux machine is configured to be a router, having two NICs, connecting two other computers, ...
1
vote
0answers
179 views

Host name change breaking http? Fedora

OK so I have been messing around on my development server. It has been a while since I have had my head in linux and I suspect I have broken something. I have SSH running and that is working fine. I ...
1
vote
0answers
1k views

iptables - mark and route certain packets

Relevant to this reference http://lartc.org/howto/lartc.netfilter.html I want to mark packets sent to a certain port (80 for simplicity sake) and route them to tun0 (which is created by openvpn). ...
1
vote
0answers
284 views

iptables dynamic NAT, SNAT: force overload on exhaustion

Is there a way to specify the use of iptables NAT'ing where you can use SNAT for a pool of outside addresses, but when the last IP is about to be used it is used as an overloaded outside IP? I ...
1
vote
0answers
216 views

linux netfilter h323 module

In my system There is a Polycom HDC7000 video conferencing device and a VVX1500 ip phone. Incoming connection: Src:Any - Dst:ExtIP1 - Srv:Any -> DNAT to-destination IntIP7000 Src:Any - Dst:ExtIP2 ...
1
vote
0answers
930 views

OpenVPN enable split tunneling, client to overload over their own Internet connection

I am trying to enable split tunneling with my VPN network. I am using OpenVPN to host my VPN network and have follwed the steps to get split tunneling working however my clients still get the: 0.0.0.0 ...
1
vote
0answers
319 views

switch OFF syn cookies

We have several servers they have public IP's, but work together (one is with Load Balancer, orther with Apache Web server, other with MySQL and so on. Most of the ports are fire-walled, so only ...
1
vote
0answers
258 views

Default Gateway solution on NAT'd network (best options)

I've recently changed a network from a bunch of machines exposed to the net on a network to a more security conscious Firewall-fronted network with a DMZ for public services. Everything's mostly ...
1
vote
0answers
839 views

Why is my CentOS box rejecting some (but not all) ICMP ping requests from the same remote host?

CentOS 4.x I've got several old CentOS 4.x systems and have configured iptables to allow ICMP traffic. Originally, I had an iptables rule that looked like: -A RH-Firewall-1-INPUT -p icmp ...
1
vote
0answers
171 views

Using iptables to make a VPN router

I am attempting to make a VPN connection to a third party VPN site, then forward traffic from my internal computers (ssh and ping for now) out to the VPN site using IPTables. 3rd Party <-> ...
1
vote
0answers
642 views

linux firewall + load balance ISP connections

I'm trying to get a linux Mint computer with 4 NIC's to act as a load balance server. The idea is that we have three internet connections, and we want to use all of them so we can share usage of 50 ...
1
vote
0answers
534 views

iptables: limiting bytes downloaded per IP per day?

On a public-facing web server, I'd like to limit the total bytes downloaded per IP address per day. For example, after a visitor downloaded 100MB, any additional requests would be dropped or rejected ...
1
vote
0answers
176 views

Connect two networks

Connecting two different offices with a wireless link and linux boxes. Hardware: 2 CISCO RV42, 2 Dual Homed Linux Boxes running debian, 2 2Wire and 2 AirMax 5 Configuration is: Office A LAN A ...
1
vote
0answers
601 views

Disable kernel processing of TCP packets for raw socket

I'm working on a TCP/IP implementation, for an embedded device, that I want to test from a Linux user space process using raw sockets. raw(7) says that Raw sockets may tap all IP protocols in ...
1
vote
0answers
156 views

Configuring Iptables for Litespeed port offset with varnish

I am trying to get varnish to work with Litespeed on both HTTP and HTTPS. The problem I am having is that Litespeed offset's BOTH the HTTP and HTTPS port. So in my current setup, I have set the ...
1
vote
0answers
130 views

Can someone give me advice on these rules to prevent DDOS where fragmented packets are sent without the initial SYN fragment ?

iptables -N NEW_TCP_PACKETS_NO_SYN iptables -A INPUT NEW_TCP_PACKETS_NO_SYN -p tcp ! --syn -m state --state NEW -m limit --limit 10/day -j LOG --log-prefix "New packets but not syn:" iptables ...
1
vote
0answers
80 views

shorewall prevents routing from protected zone entities to other protected zone entities

I'm using shorewall as the firewall and gateway for a production site. The site also has a couple of VPNs running into it that are hosted on a different server on the same site (in the protected ...
1
vote
0answers
256 views

OpenVPN Configure on DD-WRT router

I have a TL_WR1043ND router with DD-WRT firmware. I've successfully configured OpenVpn on my router. I've got openVpn from a commercial VPN provider. I VOIP GSM gateway is connected with the eht0 ...
1
vote
0answers
1k views

Redirect OpenVPN gateway traffic to Privoxy

I would like to redirect the traffic that goes through my OpenVPN gateway to Privoxy, like so: OpenVPN client->Internet->OpenVPN gateway->Privoxy->Internet->Webserver (and vice versa) So far I ...