iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

3
votes
1answer
71 views

IPTABLES for multiple Public IP Addresses

Currently i have two servers Running Debian 7 with HA Active/Passive setup using Pacemaker and Corosync as follows: node1->IP->xx.xx.xx.1 node2->IP->xx.xx.xx.2 VIP(Floating IP) ...
-1
votes
2answers
68 views

Restricting internet access of some client systems of LAN to a few websites using gateway

How to limit internet access of most systems in my LAN to a few websites and block all the other websites? Also want to bypass that restrictions for some systems. All systems have static IP address ...
0
votes
1answer
43 views

Port 53 in Amazon Security Group

Everything works as expected. This question is for learning purposes only. Using Amazon Security Groups in a VPC. Outbound rules are: 0.0.0.0/0 Port 80 0.0.0.0/0 Port 443 Iptables allows OUTPUT ...
-1
votes
2answers
85 views

iptables -D POSTROUTING -t nat -o tun0 -j MASQUERADE

I was wondering if somone could explain what the purpose of MASQUERADE is. This rule is added and deleted as my openvpn connection goes up/down. iptables -A POSTROUTING -t nat -o tun0 -j MASQUERADE ...
1
vote
1answer
43 views

Two openvpn servers on the same machine, route traffic between the two subnets

I have two openvpn servers ( one on tcp, one on udp) running on the same machine - an OPENVZ vps. The first network A uses 10.10.0.0/24 and it is designed as an intranet. The second network B uses ...
0
votes
1answer
72 views

UFW deny all incoming except SSH

I am about to configure firewall with UFW. I am logged in over SSH so I don't know if the terminal will be locked out as soon as I do: sudo ufw default deny incoming If so, how can I deny all ...
0
votes
1answer
59 views

How to block HTTP floods using IP tables and perm block the attacking IP?

I want to find out how to block HTTP floods fully. I was using this code right here: iptables -A INPUT -i eth0 -p tcp --dport 80 -m state --state NEW -m recent --set --name HTTP iptables -A INPUT -i ...
5
votes
1answer
126 views

Load balancing network traffic using iptables

I am trying to load balance traffic from internal LAN on a linux router having two gateways. Initially I went for the iproute implementation which didnt balance the load as expected, reason being that ...
-2
votes
1answer
51 views

Iptables doesn't open port 53

I have been trying different ways of opening the port but for some reason doesn't work. The last set of lines that I have used is as follows: iptables -I OUTPUT -p udp --dport 53 -m state --state ...
0
votes
1answer
61 views

Port 80 doesn't work

I have a website in my ubuntu server 14.04, with apache2 server, and untils fews days go the site works fine but, today if I digit www.mydomain.com from my internal network it works but, if I try with ...
0
votes
0answers
28 views

Dropped TCP Packets over two-stage IKEv2 VPNs

Something of a weird setup this: There are two Virtual Private Clouds (10.100.240.0/20 = prod1 and 10.101.0.0/24 = control), which have a valid router between them. Control hosts a VPN that is meant ...
0
votes
2answers
117 views

ports 993 and 995 not open even though opened in iptables

Hi I have a problem with imaps and pops access of email clients to mail server (postfix/dovecot) telnet from the servers shell (ubuntu 12.04, postfix, dovecot, spamassassin, amavis) to ports 587, 25, ...
1
vote
1answer
53 views

Transparently forward local port to remote server

I have StatsD daemon running on a remote server (x.x.x.x) at 8125. I would like to forward 127.0.0.1:8125 to x.x.x.x:8125. I have already tried running the following on localhost echo 1 > ...
0
votes
0answers
71 views

Nodejs remote debugging ports closed

I have a problem with nodejs remote debugging. I'm using centos on remote server and phpstorm on my PC. When I open putty: I type in command: node --debug-brk=5858 main_server.js, and the output is: ...
0
votes
2answers
60 views

Load balancing IPTABLES POSTROUTING rules

I have an interface with 5 IP addresses assigned to it (as virtual adapters) let's call them x1,x2,x3,x4 and x5. Currently I have SNAT POSTROUTING forwarding rules from local source range to specific ...
0
votes
1answer
102 views

Access two web servers (VPS and Windows Server) through the same IP (PUBLIC AND VPN) using VPN [closed]

I have two servers: a hosted VPS with a website on port 80, and a home server running windows 7. See the diagram below. The home server is running WAMP on port 88, which works on my home's public ...
1
vote
1answer
42 views

Redirect packet that matches a pattern?

How can I route an incoming udp packet with iptables that matches a pattern like: 53 41 4D 50 5B 79 95 DB 61 1E 69 from public interface (vmbr0) and port 7777 to 192.168.0.1:7777?
0
votes
1answer
59 views

Why port 22 redirection causes lxc containers to ssh to host?

I have a host A on which I have 2 lxc container (X and Y). I originally had port 22 on my host (A) forwarded to X. Using this configuration, I wasn't able to ssh out of the container X and when ...
1
vote
3answers
105 views

Forward Traffic in & out, NAT iptables

I have a box setup as DHCP Server with NAT ipv4 forwarding enabled. Currently the box uses eth0 to connect to a local network and has access to the internet, it has another 3 interfaces, eth1, eth2 ...
0
votes
2answers
51 views

Port forward with iptables

I got lo (127.0.0.1) and eth0 (172.17.0.8). I want to redirect packets that land on 127.0.0.1:80 to 172.17.42.1:80 (route from eth0). I tried iptables -t nat -A OUTPUT -p tcp --dport 80 -d 127.0.0.1 ...
0
votes
1answer
52 views

Ubuntu / node.js dropping incoming requests [closed]

I am getting dropped requests on a node.js server. I have simplified the test case to the point that it must be a problem with system setup. I am a developer and have very little experience with ...
6
votes
1answer
450 views

IPTables: Allow outgoing MySQL connections but not incoming connections

I have a server which doesn't allow connections to mysql from external sources - all of my databases and connections take place on localhost. The default policy of iptables is to drop connections for ...
1
vote
2answers
158 views

Add a VLAN tag to specific UDP port traffic

I'm running an application in Ubuntu12.04 that I've written that does some remote switch management. I have only a single NIC connected to the network of managed switches, eth0 which is set with IPv4 ...
-1
votes
1answer
119 views

IPTables Limit port speed

I want to limit a port's speed down to 5 kb/s per client connected (trying to share out the limited connection without smashing the network) I Have done research, mostly I find rules which drop ...
0
votes
1answer
48 views

iptables: service per physical interface

I have a vm on which I'm trying to configure (unsuccessfully) one service per physical device - i.e. ssh open only on eth0, http only on eth1 and ftp only on eth2. This has to happen regardless on the ...
0
votes
0answers
14 views

xen routed setup, no internet connectivity in domU

My server has 4 public ips, but I have 5 vms running, the vm which doesn't have an own public ip should be able to reach the internet and all other vms over private interfaces. I configured a private ...
0
votes
2answers
62 views

How to redirect a packet with iptables that match a certain pattern? (eg a QUERY command with UDP)

I have a certain packet that I want at all times to be redirected to a specific ip on my virtual network interface. As for now my iptables is setup like this: (the commands, I use \ as for now to ...
0
votes
0answers
75 views

Fail2Ban Correctly Attempts to Ban IP but IP does not get banned - iptables chain exists but not working

Running on Ubuntu 14.04 Server. So I have fail2ban correctly configured to process /var/log/auth.log for SSH login attempts. Upon 3 failed attempts I see this in the fail2ban log: 2014-11-19 ...
2
votes
2answers
308 views

Make CentOS 7.x a port forwarding NAT device

I would like to make CentOS a port forwarding NAT machine using iptables. This is the first time I've tried this and I think i might need a little help. This is the configuration i'm trying to ...
2
votes
1answer
155 views

Traffic shaping outbound clients source ip with tc / iptables

My question is I am trying to limit a users bandwidth on a server and wondering the best way to do this. Before I dive to far into the tc/iptables I was wondering if I could get any advice on this ...
0
votes
0answers
59 views

iptables on AWS - how to get traffic mirroring to work?

Has anyone successfully deployed 'iptables -t mangle -j TEE...' for monitoring traffic on AWS instances? If so, how? My objective is for client<->server traffic between external customers and EC2 ...
0
votes
0answers
108 views

Forwarding traffic from one ethernet interface to another

Earlier, I was trying to get traffic from one ethernet interface to another without using a bridge. Here is a link to the solution : ...
0
votes
2answers
102 views

CentOS, How to allow SSH through only one server-ip [closed]

I currently have a dedicated server with two pv4 IP addresses assigned to it. I want to make one public, and the other private for SSH/FTP related material. IP 1 (The public ip): 192.23.6.11 IP 2 ...
0
votes
1answer
63 views

How to drop first udp packet from a source with iptables?

As a defense against distributed udp flood, I need to drop first udp packet from a source and accept other than first packet. Does iptables has capability of doing this? If yes, how?
1
vote
1answer
63 views

Are iptables prerouting (DNAT) packet changes visible to subsequent chains?

I was reading Rusty Russell's NAT Howto when I came across this section: 6.2. Destination NAT This is done in the PREROUTING chain, just as the packet comes in; this means that anything else on ...
0
votes
0answers
28 views

Error with IPTables command

I'm trying to run the following command iptables -A INPUT -i eth0 -j LOG --log-prefix "IPTables " And I get the following error: iptables: No chain/target/match by that name. I'm running Fedora 20 ...
1
vote
1answer
188 views

My iptable rules do not allow VPN connections

I have installed OpenVPN on my Archlinux server and modified my iptable rules to allow incoming traffic on port 1194 and forward it to the tun0 interface. When I disable/stop the iptables, the OpenVPN ...
0
votes
1answer
47 views

iptables setting output default to DROP

I have two servers: one web, one database. The db server is on a private network. I thought I needed to restrict the default OUTPUT on the web server to DROP and created OUTPUT rules to to ACCEPT ...
0
votes
0answers
47 views

IpTables -j REJECT to instantly block the loading on user browser

I have been searching for a solution to notify the browser on user that the request is Rejected so stop loading it. Because I have blocked facebook and every page that have a facebook plugin is ...
0
votes
1answer
44 views

General protection fault by __d_drop following SMTP attack

The SMTP port (Postfix) of my box running 3.16.5 is being hammered. The log repeats this over and over: Nov 14 09:16:25 [postfix/smtpd] lost connection after UNKNOWN from unknown[177.43.41.74] Nov 14 ...
1
vote
1answer
170 views

AWS EC2 Ubuntu 14.04 Instance smtp port forwarding from 25 to 2025

I am trying to step up port forwarding from port 25 to port 2025 on the same AWS EC2 Ubuntu 14.04 instance using iptables. I am using port 2025 to receive income emails using Alfresco. The first step ...
0
votes
1answer
31 views

APF Limit to Deny IPs?

So, I've been actively banning IPs of malicious users. Previously, I only used IPtables to do this, but since giving APF a whirl, I've been having issues. It appears that there is a limit to the ...
0
votes
0answers
45 views

Iptables - double REDIRECTING - is it possible?

I have 2 kinds of proxies in my local machine : stunnel and TOR-VPN. stunnel is listening on port 6666 TOR-VPN is listening on port 9040 The IP of stunnel server is a.b.c.d. I want to get web ...
2
votes
0answers
88 views

How to route traffic through different interfaces based on the port number?

iptables -A PREROUTING -i usb0 -t mangle -p tcp --dport 8080 -j MARK --set-mark 1 iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination Chain ...
0
votes
1answer
136 views

Local transparent proxy with squid and dansguardian

I am having trouble setting up a local web cache and filtering system using squid and dansguardian. It works perfectly when the browser is configured to use the proxy box's ip (192.168.1.2) but I ...
0
votes
0answers
69 views

Iptables - centos 5.8 - how to forward ports to internal lan

I'm trying to map port 8080 to another machine running a web server. ppp0 = ADSL internet connection eth0 = ethernet card of linux machine (ip address: 192.168.0.2) 192.168.0.105 = other machine ...
0
votes
0answers
125 views

Missing iptables rules for Strongswan routing for VPN for phone

I have a Centos 6.6 VPS out on the Internet that has a public IP. I have installed StrongSwan 5.1.3 to allow my BlackBerry10 phone to connect from hotspots and use the VPS' connection. The VPS' IP ...
2
votes
0answers
40 views

How to monitor the bandwidth per each iptables masqueraded device [closed]

Question: Which tool could I use to monitor and break-down in real-time which bandwidth is routed by iptables to which computers? Context: I have a linux box masquerading about 15 devices to ...
1
vote
1answer
41 views

Temporarily block communication with host if its connecting to port X

I have a Linux VPS, and it's constantly being scanned, bruteforced by some rogue IPs. This VPS is my private server, that serves only to me, and I'm the only user of it. Also I am the only user who ...
0
votes
0answers
107 views

OpenVPN Port forwarding on a OpenVZ VPS

I've been trying for the past 3 hours to forward the 443 port from my client to the 20443 port on my server (CentOS 7 on OpenVZ), so i can access it on myserverip:20443. I have OpenVPN Access ...