iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

1
vote
0answers
191 views

Firewall rejecting UDP “connections”?

I have a server that is aggregating logs from various other servers. It mostly works great, however from time-to-time (right after a reboot, but not all reboots) it will decide that various UDP ...
1
vote
0answers
86 views

Is it possible to incorporate ndpi with iptables nfqueue?

I would like to know if it is possible to mark traffic with ndpi (ntop.org) classification engine with iptables nfqueue? Is there any example code out there? Thanks for helping.
1
vote
0answers
98 views

Can I use iptables to rate limit an ipset?

Is it possible to use iptable tables to rate limit an ipset ? I know you can use ipset to create a block list named blacklist i.e. ipset create blacklist hash:ip iptables -I INPUT -m set ...
1
vote
0answers
43 views

ospf hello not forwarded

I am trying to change the destination ip of ospf hello packet (224.0.0.5) to link local address using iptables rule (DNAT) . It does not seem to work. A similar rule for unicast packet (BGP control) ...
1
vote
0answers
92 views

Openstack instances, routing, packets not delivered for SPECIFIC services

I am taking over management of an existing openstack system at work and I have only a little prior experience with openstack. I have about 8 instances running and all of them appear to function ...
1
vote
0answers
164 views

Firewall and NAT settings in GSM modem for one server

I have a GSM Modem (PSI-MODEM-GSM/ETH) in field with one device behind, acting as a server. The situation is as follows: "PC" | \_________Dynamic IP: 10.103.153.122 | ...
1
vote
0answers
207 views

Routing LDAP traffic from Application server to Proxy to internet

I've included a drawing so you get an idea how it would work. (Red = LDAP connections , Blue = HTTP / AJP in the backend) Problem: We want to connect our customer application server to an LDAP of ...
1
vote
0answers
301 views

How to configure nDPI for iptables

I am new to nDPI, I have installed nDPI but when I add rules like; iptables -I OUTPUT -m ndpi --http -j REJECT it shows error iptables v1.4.7: Couldn't load match ...
1
vote
0answers
318 views

Confirm IPTables firewall settings for NFS v4 server?

This question has been asked here before but has conflicting and possibly outdated answers. It seems to depend on OS, version of OS, and version of NFS. On a CentOS 6.5 server, the default rules are ...
1
vote
0answers
98 views

LXC and proxying port 22 (ssh)

I have installed LXC on my Ubuntu 12.04 server and have created a couple of containers. I have only 1 external IP address, thus I am using nginx on my host machine to proxy HTTP requests from certain ...
1
vote
0answers
317 views

iptables - hashlimits, why it calculate all to seconds

I've tried to set 'synflood' limits with hashlimits, those are my snippet of rules: iptables -A SYNFLOOD_CHECK -p tcp --syn -m hashlimit --hashlimit-above 10/s --hashlimit-burst 6 \ ...
1
vote
0answers
142 views

strongswan packet get natted when ufw is enabled

I'm using strongswan 4.6.4 to connect road warriors to my server (ubuntu 13.10), which is natted behind a firewall. left=%defaultroute leftsubnet=10.10.1.0/24 right=%any ...
1
vote
0answers
172 views

iptables xt_recent change in kernel without modules

is it possible to change xt_recent module parameters when it is compiled into kernel ? most of the info on internet suggest setting it by modprobe but that is not the case in my setup as I have ...
1
vote
0answers
77 views

OpenVPN running on Internet Gateway, so all private clients can access VPN with no config

Our LAN connects to our office gateway machine (192.168.1.1), which is connected to the Internet. I have setup NAT/Masquerading for this purpose with no issue. We also use OpenVPN to connect to our ...
1
vote
0answers
640 views

Ports blocked on ubuntu 13.10 vps

I have been searching all over for an answer, i got a cheap vps server running ubuntu 13.10 and installed webmin which should allow me to go to serverip:10000 But i can't connect to it and ...
1
vote
0answers
60 views

Can IPtables (possibly with libnetfilter_queue library) do everything that snort does?

I have just started getting into network security, firewall, etc. So, please excuse me for asking this basic question. I looked at IPtables and got a good hang of it (nowhere close to becoming an ...
1
vote
0answers
828 views

Firewall/iptables rules for GlusterFS

A great pleasure would be to know which exact iptables rules to use for securing GlusterFS 3.4.2 (with Debian Wheezy) in shared environment. I'm running some dedicated servers at ISP. There are two ...
1
vote
0answers
120 views

Port corruption using iptables NAT on Enterprise Linux 6

I am trying to setup a captive web portal redirect on CentOS using the following configuration: This configuration works for the first few packets, but then suddenly the destination port is corrupted ...
1
vote
0answers
62 views

Open ports for VPN users

I have been looking around for some time for answer to this, and have yet to find one. The issue that I am having is that users that are connected to the VPN cannot do the following, as examples: ...
1
vote
0answers
62 views

Iptables and system-config-firewall

I had a set of netfilter rules set with iptables, but someone else told me to use system-config-firewall to add a rule for sharing files with Windows. (Samba) This rewrote the iptables rules file and ...
1
vote
0answers
539 views

iptables & tc limit both upload & download together

I have the following for iptables & tc but it limits the upload speed to 2Mbits once the quota of 1GB has been hit. iptables -t mangle -A POSTROUTING -o eth0 -p tcp -m owner --uid-owner aaron ...
1
vote
0answers
185 views

Strange dropped packets coming from port 8888 and with ACK or ACK+PSH set

Background During an incident on a small privative network (1 router/FW + 1 server) my server got accidentally exposed to the internet. Fortunately it was protected by it's own UFW to allow only 1 ...
1
vote
0answers
297 views

How to Exclude Log Using Fail2Ban logpath with Wildcard Settings

I'm using wildcard in the logpath value as shown below: [http-get-dos] enabled = true filter = http-get-dos logpath = /var/log/ispconfig/httpd/*/access.log maxretry = 250 findtime = 300 #ban for 10 ...
1
vote
0answers
370 views

racoon pure IPSEC VPN, best way to give vpn server an IP address on the VPN?

We are testing a VPN server for DR. We have a rackspace cloud instance, with a pure IPSEC VPN server running in racoon, serving "road warrior" clients. We have some NAT going on on the server to route ...
1
vote
0answers
147 views

ip routing of multiple virtual IPs on one ethernet card

I am working on a live network of multiple boxes and routes with a long history of changes. I am trying to consolidate them with the minimum disruption. I'd like to get rid of some old routers and ...
1
vote
0answers
204 views

Send traffic over a specific port through a specific interface, using Shorewall

I have an application that does not support binding to a different interface. It currently sends outgoing connections over eth0, but I would like to send it over eth0:1 which is a virtual interface. ...
1
vote
0answers
123 views

iptables filter tftp's caps failed

i want use iptables to filter tftp client's OUTPUT package, but failed, could you help me? My rules: iptables -A OUTPUT -m udp -p udp --dport 69 -j NFQUEUE iptables -A OUTPUT -m string --algo kmp ...
1
vote
0answers
83 views

Linux iptables NAT

So I need to setup a server that servers a NAT server for IPMI network xxx.xxx.xxx.xxx = external IP(internet IP) aaa.aaa.aaa.aaa = internal IP A bbb.bbb.bbb.bbb = internal IP B User 1 -> ...
1
vote
0answers
285 views

What is Bonjour Linux IPTables Firewall Ports?

I'm trying to configure my iptables in order to allow Pidgin to use Bonjour protocol, now according to: Bonjour for Windows doesn't work due to firewall settings, I have to allow Multicast DNS / ...
1
vote
0answers
275 views

DD-WRT/TOMATO Whitelist openVPN connection for specified client MAC/IP

I will use these settings: # Allow these TRUSTED hosts unrestricted access iptables -A wanout -i `nvram get lan_ifname` -m mac --mac-source <allowed MAC #1> -j ACCEPT iptables -A wanout -i ...
1
vote
0answers
245 views

OpenStack Server Instances have internet access, but they are unable to access the internal network

I'm running an OpenStack Grizzly release with a Nova-Network configuration. [No Quantium]. My network is setup as follows: OpenStack Box (10.10.13.xx network)->OpenStack Internal Network ...
1
vote
0answers
539 views

CentOS 6 IPTables commands not responsive, firewall is down

We have had this issue before but we thought it was due to installing CSF. This has now happend again where none of the commands for IPTables return anything. 'iptables -L' doesn't display anything, ...
1
vote
0answers
339 views

Using iptables to route all internal data to tun0 from eth0

Looking for a few answers ;) I'm running Zentyal on a gateway. The gateway is also an OpenVPN client, to a server I run out of another country. Interfaces are thus : External : eth1 (dhcp from the ...
1
vote
0answers
323 views

How can I use iptables to restrict access to .onion addresses in Tor?

I want to restrict outgoing network access (with the exception of connections to localhost) to TCP and UDP over Tor and block everything else (with the exception of the Tor application and localhost ...
1
vote
0answers
139 views

iptables log nowhere to be found

I'm trying to log when IPTables drops connections mostly for analysis. Problem is, my log seems to be written to... nowhere. By this time I know that iptables logs through kern facility and for this, ...
1
vote
0answers
187 views

Is there a tool to do packet mirroring in CentOS 5.9?

I know iptables + xtables can do it in more recent versions using the TEE target supplied by the xtables-addon package for iptables. However, the kernel in CentOS 5.9 is 2.6.18 and this version is not ...
1
vote
0answers
97 views

NAT Public ip to that many number of pvt ip

i have a Linux box with two interfaces one with ip 10.10.18.2 and other with ip 192.168.1.2,192.168.1.3 aliased. A xen host is connected with ip 10.10.18.3 and gateway 10.10.18.2 to this through a ...
1
vote
0answers
119 views

iptable DNAT poor performance

I have the following rule for PORT FORWARDING: root@foo:~# iptables -t nat -S -P PREROUTING ACCEPT -P INPUT ACCEPT -P OUTPUT ACCEPT -P POSTROUTING ACCEPT -A PREROUTING -p udp -m udp --dport 1:1024 ...
1
vote
0answers
288 views

iptables: how to decide what to log for a web server?

There are many ways to log traffic for a web server. For example, if I want to log all incoming traffic, I can place the following line as the first rule appended to the INPUT chain: -A INPUT -j LOG ...
1
vote
0answers
168 views

CSF: Changing portflood settings to deny IP longer than second interval?

I've recently been under attack and I'm configuring CSF firewall for my Ubuntu server (latest). I found out portflood settings only block the ip for the specified second count, but I would like ...
1
vote
0answers
195 views

Cloudmin GPL Xen PV with Nat Port Forwarding

I'm running Cloudmin GPL on CentOS 5 64bit and am trying to allow my Xen PV guest to access the internet via a NAT/port forwarding setup.. I've done the following: (on dom0) echo "1" > ...
1
vote
0answers
567 views

Apache died; Suspect is ulimit but cannot reproduce

Apache died last night. Error log shows this [alert] (11)Resource temporarily unavailable: setuid: unable to change to uid: 48 Browsing around the Internet, everyone seems to say this is is an issue ...
1
vote
0answers
295 views

ejabberd on vm not connect to another xmmp server (iptables dnat dport 5269)

i migrate a ejabberd server to a vm with only private ip. is work fine but not connect to anothers xmmp servers. log: s2s connection: xxxx -> gmail.com (remote server not found) telnet test: telnet ...
1
vote
0answers
104 views

Routes with PPTP

I have a server A that is running OpenVPN server, and a server B connected to it. Then on B I have eth0, the physical interface, and tap0, created by OpenVPN. I want some ip to go with eth0 while ...
1
vote
0answers
185 views

Netlink error while using IP queue

I seem to have an issue with IP queue. I have a linux machine that I am using to run some experiments. The linux machine is configured to be a router, having two NICs, connecting two other computers, ...
1
vote
0answers
182 views

Host name change breaking http? Fedora

OK so I have been messing around on my development server. It has been a while since I have had my head in linux and I suspect I have broken something. I have SSH running and that is working fine. I ...
1
vote
0answers
2k views

iptables - mark and route certain packets

Relevant to this reference http://lartc.org/howto/lartc.netfilter.html I want to mark packets sent to a certain port (80 for simplicity sake) and route them to tun0 (which is created by openvpn). ...
1
vote
0answers
334 views

iptables dynamic NAT, SNAT: force overload on exhaustion

Is there a way to specify the use of iptables NAT'ing where you can use SNAT for a pool of outside addresses, but when the last IP is about to be used it is used as an overloaded outside IP? I ...
1
vote
0answers
272 views

linux netfilter h323 module

In my system There is a Polycom HDC7000 video conferencing device and a VVX1500 ip phone. Incoming connection: Src:Any - Dst:ExtIP1 - Srv:Any -> DNAT to-destination IntIP7000 Src:Any - Dst:ExtIP2 ...
1
vote
0answers
1k views

OpenVPN enable split tunneling, client to overload over their own Internet connection

I am trying to enable split tunneling with my VPN network. I am using OpenVPN to host my VPN network and have follwed the steps to get split tunneling working however my clients still get the: 0.0.0.0 ...