iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

1
vote
0answers
277 views

iptables: how to decide what to log for a web server?

There are many ways to log traffic for a web server. For example, if I want to log all incoming traffic, I can place the following line as the first rule appended to the INPUT chain: -A INPUT -j LOG ...
1
vote
0answers
104 views

CSF: Changing portflood settings to deny IP longer than second interval?

I've recently been under attack and I'm configuring CSF firewall for my Ubuntu server (latest). I found out portflood settings only block the ip for the specified second count, but I would like ...
1
vote
0answers
134 views

Cloudmin GPL Xen PV with Nat Port Forwarding

I'm running Cloudmin GPL on CentOS 5 64bit and am trying to allow my Xen PV guest to access the internet via a NAT/port forwarding setup.. I've done the following: (on dom0) echo "1" > ...
1
vote
0answers
385 views

Apache died; Suspect is ulimit but cannot reproduce

Apache died last night. Error log shows this [alert] (11)Resource temporarily unavailable: setuid: unable to change to uid: 48 Browsing around the Internet, everyone seems to say this is is an issue ...
1
vote
0answers
166 views

ejabberd on vm not connect to another xmmp server (iptables dnat dport 5269)

i migrate a ejabberd server to a vm with only private ip. is work fine but not connect to anothers xmmp servers. log: s2s connection: xxxx -> gmail.com (remote server not found) telnet test: telnet ...
1
vote
0answers
92 views

Routes with PPTP

I have a server A that is running OpenVPN server, and a server B connected to it. Then on B I have eth0, the physical interface, and tap0, created by OpenVPN. I want some ip to go with eth0 while ...
1
vote
0answers
153 views

Netlink error while using IP queue

I seem to have an issue with IP queue. I have a linux machine that I am using to run some experiments. The linux machine is configured to be a router, having two NICs, connecting two other computers, ...
1
vote
0answers
172 views

Host name change breaking http? Fedora

OK so I have been messing around on my development server. It has been a while since I have had my head in linux and I suspect I have broken something. I have SSH running and that is working fine. I ...
1
vote
0answers
391 views

iptables - mark and route certain packets

Relevant to this reference http://lartc.org/howto/lartc.netfilter.html I want to mark packets sent to a certain port (80 for simplicity sake) and route them to tun0 (which is created by openvpn). ...
1
vote
0answers
213 views

iptables dynamic NAT, SNAT: force overload on exhaustion

Is there a way to specify the use of iptables NAT'ing where you can use SNAT for a pool of outside addresses, but when the last IP is about to be used it is used as an overloaded outside IP? I ...
1
vote
0answers
128 views

linux netfilter h323 module

In my system There is a Polycom HDC7000 video conferencing device and a VVX1500 ip phone. Incoming connection: Src:Any - Dst:ExtIP1 - Srv:Any -> DNAT to-destination IntIP7000 Src:Any - Dst:ExtIP2 ...
1
vote
0answers
615 views

OpenVPN enable split tunneling, client to overload over their own Internet connection

I am trying to enable split tunneling with my VPN network. I am using OpenVPN to host my VPN network and have follwed the steps to get split tunneling working however my clients still get the: 0.0.0.0 ...
1
vote
0answers
279 views

switch OFF syn cookies

We have several servers they have public IP's, but work together (one is with Load Balancer, orther with Apache Web server, other with MySQL and so on. Most of the ports are fire-walled, so only ...
1
vote
0answers
220 views

Default Gateway solution on NAT'd network (best options)

I've recently changed a network from a bunch of machines exposed to the net on a network to a more security conscious Firewall-fronted network with a DMZ for public services. Everything's mostly ...
1
vote
0answers
681 views

Why is my CentOS box rejecting some (but not all) ICMP ping requests from the same remote host?

CentOS 4.x I've got several old CentOS 4.x systems and have configured iptables to allow ICMP traffic. Originally, I had an iptables rule that looked like: -A RH-Firewall-1-INPUT -p icmp ...
1
vote
0answers
160 views

Using iptables to make a VPN router

I am attempting to make a VPN connection to a third party VPN site, then forward traffic from my internal computers (ssh and ping for now) out to the VPN site using IPTables. 3rd Party <-> ...
1
vote
0answers
565 views

linux firewall + load balance ISP connections

I'm trying to get a linux Mint computer with 4 NIC's to act as a load balance server. The idea is that we have three internet connections, and we want to use all of them so we can share usage of 50 ...
1
vote
0answers
464 views

iptables: limiting bytes downloaded per IP per day?

On a public-facing web server, I'd like to limit the total bytes downloaded per IP address per day. For example, after a visitor downloaded 100MB, any additional requests would be dropped or rejected ...
1
vote
0answers
168 views

Connect two networks

Connecting two different offices with a wireless link and linux boxes. Hardware: 2 CISCO RV42, 2 Dual Homed Linux Boxes running debian, 2 2Wire and 2 AirMax 5 Configuration is: Office A LAN A ...
1
vote
0answers
431 views

Disable kernel processing of TCP packets for raw socket

I'm working on a TCP/IP implementation, for an embedded device, that I want to test from a Linux user space process using raw sockets. raw(7) says that Raw sockets may tap all IP protocols in ...
1
vote
0answers
139 views

Configuring Iptables for Litespeed port offset with varnish

I am trying to get varnish to work with Litespeed on both HTTP and HTTPS. The problem I am having is that Litespeed offset's BOTH the HTTP and HTTPS port. So in my current setup, I have set the ...
1
vote
0answers
118 views

Can someone give me advice on these rules to prevent DDOS where fragmented packets are sent without the initial SYN fragment ?

iptables -N NEW_TCP_PACKETS_NO_SYN iptables -A INPUT NEW_TCP_PACKETS_NO_SYN -p tcp ! --syn -m state --state NEW -m limit --limit 10/day -j LOG --log-prefix "New packets but not syn:" iptables ...
1
vote
0answers
72 views

shorewall prevents routing from protected zone entities to other protected zone entities

I'm using shorewall as the firewall and gateway for a production site. The site also has a couple of VPNs running into it that are hosted on a different server on the same site (in the protected ...
1
vote
0answers
239 views

OpenVPN Configure on DD-WRT router

I have a TL_WR1043ND router with DD-WRT firmware. I've successfully configured OpenVpn on my router. I've got openVpn from a commercial VPN provider. I VOIP GSM gateway is connected with the eht0 ...
1
vote
0answers
781 views

Redirect OpenVPN gateway traffic to Privoxy

I would like to redirect the traffic that goes through my OpenVPN gateway to Privoxy, like so: OpenVPN client->Internet->OpenVPN gateway->Privoxy->Internet->Webserver (and vice versa) So far I ...
1
vote
0answers
73 views

HTTP Logging Proxies

I want to implement a proxy that records and replays requests made to specific hosts. So that I can stub out external service requests when testing an application. What is the best way to do this? ...
1
vote
0answers
473 views

nginx does not close loopback connections

I'm using nginx in reverse-proxy mode. Here's relevant part of config file: server { listen 80; server_name ~^web.redhelper\.ru$ ; access_log off; location /http-bind { ...
1
vote
0answers
811 views

bypass ip destination squid tproxy bridge

I have configured a squid transparent tproxy. All works fine. Now I need all the traffic going to an external IP (internet) does not pass through the proxy. Do I need to modify iptables, ebetables ...
1
vote
0answers
241 views

iptables - Forward back to dmz from dmz

I have a firewall with two network cards. From internet it's possible to access the external-ip and then be forwarded to an internal server. But when on the DMZ and accessing the external-ip, I'm not ...
1
vote
0answers
616 views

Is this firewall for openvpn tunnel ok?

Here is the script I want to use to setup secure firewall for openvpn tunnel in which all my internet traffic goes through the vpn. I have a couple of questions below: #!/bin/sh # # iptables example ...
1
vote
0answers
432 views

Load balancer unable to contact a server through http

In our infrastructure we have a load balancer(apache mod_balancer) and three backend servers that run apache as a web service and iptables as firewall, Lately ONE of them is giving a lot of " ...
1
vote
0answers
2k views

ufw deny all incoming and outgoing not working!

I'm sure I'm doing something wrong. I'm expecting my current rules of "denying all incoming/outgoing" to cripple anything network related, but it's not. First, I did: sudo ufw default deny incoming ...
1
vote
0answers
377 views

DD-WRT setup access restrictions but allow VPN connections freely

I have two sites with DD-WRT connected via routed VPN. Clients on both routers have Internet Access Restrictions set. This works and correctly blocks internet access. But this also blocks connection ...
1
vote
0answers
881 views

Routing only some local IPs through VPN on dd-wrt

Much similar to this entry: http://serverfault.com/questions/94283/using-dd-wrt-to-connect-to-vpn-and-forward-all-traffic-of-certain-devices-through , I have set up my router with dd-wrt + OpenVPN to ...
1
vote
0answers
249 views

Troubleshooting iptables and configuring it to drop the priority of long-term connections

I'm somewhat familiar with the general concepts of iptables, and would like to learn it in more detail. I'm hoping that my learning experience can also be useful. The situation: I'm running dd-wrt ...
0
votes
0answers
36 views

debian multiple network interface multiple networks

I have a virtual environment with 3 virtual machines on one host. One of my virtual machines has 2 network interface. I need the virtual machine with two interfaces to connect to two different ...
0
votes
0answers
21 views

How to configure nDPI for iptables

I am new to nDPI, I have installed nDPI but when I add rules like; iptables -I OUTPUT -m ndpi --http -j REJECT it shows error iptables v1.4.7: Couldn't load match ...
0
votes
0answers
16 views

customised client to client connection configuration inside OpenVPN server

I have two clients with common names [client_sina] and [client_extra] that are connecting to an OpenVPN server on remote place via (TUN21) running on Tomato Router The only physical port of the ...
0
votes
0answers
15 views

Couldn't load target `DNAT':No such file or directory

Trying to do some ipv6 nat and running into an error from ip6tables $ip6tables -t nat -N IPV6-BRIDGE $ip6tables -t nat -A PREROUTING -p all -d 2600:3c01::f03c:91ff:fe6e:2563 -j IPV6-BRIDGE $ip6tables ...
0
votes
0answers
30 views

Pinging to google.com from a particular interface

I am connected to the internet via wlan0(wifi) and also have an ethernet port(not connected to the internet). I am looking for some iptables rule / route addition, which will let me do a ping via eth1 ...
0
votes
0answers
40 views

Squid 3 - NetFilterInterception in cache.log

EDIT: after a day or so, it started happening again and I had to disable iptables for now cause everyone in the family was having no internet. I route all web traffic from my router (10.0.0.1) to my ...
0
votes
0answers
34 views

FTP Traffic routing through NAT prevents me from logging in

I need to send all FTP traffic to a particular server from a NAT. Server A connects via FTP to an IP which is routed to the NAT and then over a VPN. That traffic then comes back and gets routed from ...
0
votes
0answers
6 views

How to route packets from a service (media service) based on the UID of the app that is using media service using IPTABLES

I am redirecting application packets through different PDN's based on their UID's (Process ID's) using IPtables. So my App1 is using PDN1 for its data transmission. and App2 is using PDN2 for its ...
0
votes
0answers
21 views

OpenVPN on Ubuntu: IP Forwarding not working

I have successfully set up a VPN connection between a Windows 8 client and my Ubuntu server running OpenVPN. However, I just cannot get IP forwarding to work. I have adjusted all settings as desribed ...
0
votes
0answers
18 views

Forward connecting IP address to KVM guests

I'm running kvm with iptables configured to use DNAT and masquerading. However the guest machines are logging the host bridge ip not the connecting client IP address. Is there a way to configure ...
0
votes
0answers
20 views

Can IPtables (possibly with libnetfilter_queue library) do everything that snort does?

I have just started getting into network security, firewall, etc. So, please excuse me for asking this basic question. I looked at IPtables and got a good hang of it (nowhere close to becoming an ...
0
votes
0answers
46 views

Can't run CSF on the host machine using Open VZ

I managed to configure CSF on my three VM inside OpenVZ, but when I try to run it on the host, all the VMs become unreachable. I can see that the host is been attacked, and it would be critical if it ...
0
votes
0answers
33 views

enable user to connect to external pptp VPN server

I want to enable local user to connect to remote VPN server I added those rules to the iptables but still not able to connect -A OUTPUT -p gre -j ACCEPT -A OUTPUT -p tcp -m tcp --dport 1723 -j ACCEPT ...
0
votes
0answers
56 views

Load-balancing PPTP connections

I'm trying to load balance two PPTP connections, connected to the same server. I use the following script, but there is no send and receive via PPTP connections. What part am I doing wrong? Are there ...
0
votes
0answers
20 views

Output traffic on different alias based on user

I have a server running Debian with two IP addresses aliased on a single NIC. eth0 254.71.11.134 eth0:0 185.14.16.132 I want all traffic form a specific user to go through eth0:0. I figure I ...