iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

0
votes
1answer
66 views

Setting up iptables filter to allow Git

Sorry I am new at this server stuff, so bare with me and if I'm missing any info let me know! I'm trying to setup my Ubuntu 14.04.2 LTS server to have a solid iptables firewall. Right now I think it ...
-1
votes
2answers
101 views

iptables rule to send email

I have to send emails (and only send, not receive) from a linux server (SUSE Linux Enterprise Server 11) and I think I should add kind of the following rule to the iptables: iptables -A OUTPUT -p ...
0
votes
0answers
25 views

Increase Max prefix length for --log-prefix in iptables

I am using centos and iptables complains about the Max prefix length which is 29 for --log-prefix option. How can I increase this limit?
0
votes
0answers
21 views

OpenVZ container(s) and NAT

I have been trying to days to solve my NAT issue with OpenVZ. I have used their guide on their website/wiki, however I just seem to be unable to get it to work. My Linux box is running on CentOS 6 ...
1
vote
2answers
43 views

How do I drop requests from dig?

Basically I'm getting tons of request to my named/bind service, basically those requests are being rejected by named, Those are the messages i get, from tons of ips., How extacly can I drop those ...
0
votes
0answers
72 views

Source IP rate limiting in iptables: hashlimit vs recent

I want to perform rate limiting per source IP in iptables. For example, limit the rate at which a host can establish new SSH connections to 5 per minute. To my knowledge there are two ways of doing ...
0
votes
1answer
46 views

Why is port 443 (but not port 80) being exposed to nmap when iptables is configured to drop the traffic?

A Debian box is running web services on ports 80 and 443 and iptables is configured to allow web traffic only from white listed ip addresses. A second Debian box (that is not white listed) is using ...
2
votes
1answer
200 views

Docker - Exposed ports accessible from outside - iptables rules ignored

I have a docker container running like: docker run --name some_container_1 -p 8080:80 -d some_image Which works fine. The container exposes it's port 80 to 8080 and is accessible from localhost. ...
-2
votes
1answer
33 views

How to implement iptables using Puppet

i would like to implement these rules below in puppet from puppet master to clients Could anyone help me to get the script for this iptables rules, and in which file we want to have this below ...
0
votes
2answers
72 views

Redirecting RDP (port 3389) with iptables

I have a Debian server with an IP 10.10.10.5 and a Windows computer with an IP 10.10.10.7. My plan is to make the Debian server forward all RDP traffic to the Windows computer with these iptables ...
1
vote
1answer
50 views

iptables KVM prerouting SMTP

I have a host machine that has to manage traffic on port 25 and route to port 25 on the KVM machine for postfix deamon like this scheme: WAN --> (25) HOST_MACHINE --> (25) ...
0
votes
2answers
95 views

Ubuntu Iptables Dual Wan - Forward wan 1 & 2 to an internal server

I'm having problems configuring iptables rules on a double wan setup. The OS is Ubuntu 12.04 LTS. I have 2 Wan connections, both with static IP. Wan-1 is on eth2, Wan-2 is on eth4. I want both of ...
1
vote
0answers
78 views

Virtual IP Pool for NAT with StrongSwan VPN

I'm trying to wrap my head around a site-to-site VPN configuration using StrongSwan that will allow remote sites to connect to our AWS VPC. The catch is, the remote gateways will potentially be using ...
0
votes
0answers
44 views

iptables command to get bytes used by specific ip on port 443

I have hosted a WiFi network and i need to monitor data usage by every IP address on port 443(https) Here is the iptables rule used to share INTERNET from eth0 to wlan0 sudo iptables -t nat -A ...
2
votes
0answers
55 views

When is route lookup performed when a packet flows through iptables?

Iptables is often illustrated using diagram I fail to understand when route lookup (routing tables) is performed: inside the "Routing Decision" grey boxes? If so, does it mean a packet is routed ...
1
vote
2answers
42 views

iptables rules for StrongVPN-like VPN endpoint

Goal: To replicate the functionality I have with StrongVPN on my own Debian VPS. With StrongVPN, seemingly, all ports on the public IP provided are forwarded to the client, meaning, e.g, ssh :22 from ...
1
vote
2answers
44 views

How to use a server as a “tunnel” in between the clients and the router, in a small network?

Consider a small network with 1 router (192.168.1.1) and clients (192.168.1.x). The router (OpenWRT) provides Ethernet LAN and WiFi for the clients, to connect to the Internet. Now, I want to use a ...
0
votes
1answer
25 views

CentoOS - iptables issue when trying to enable specific IP

I've got the following iptables: num target prot opt source destination 1 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 2 ACCEPT all -- ...
1
vote
1answer
54 views

OpenVZ - SMTP - telnet - Connection timed out

I have problem with SMTP in my OpenVZ container. I've created OpenVZ container by Proxmox on dedicated server in OVH. This container will be as mail server. So I create on "mother-server" rules to ...
0
votes
0answers
77 views

HowTo: OpenWRT routing/tunneling all traffic through an inline Snort sensor

I want all traffic that hits the OpenWRT router redirecting/ tunnelin through a dedicated Snort/Suricata machine, before it leaves the local network. The Snort/Suricata machine should act as an inline ...
-1
votes
2answers
47 views

IPTables not blocking IPStresser [closed]

I have been trying four days to block DDoS attacks with no success. I want to block anything that isn't whitelisted. This is my idea on OS Centos 7: //Delete All Existing Rules iptables --flush ...
0
votes
0answers
32 views

Iptables forward traffic from A to B where A is not gateway for B

I want to forward ssh traffic from A port 2222 to B port 22. I do have ipv4 forwarding set to 1 on both interfaces. Still, this does not work. What is wrong? Machine A: eth0 192.168.0.150 eth1 ...
0
votes
0answers
52 views

Strange issue with nginx proxy upstream and ssh port forwarding

We were using nginx legacy till now, but we upgraded our system to 1.6.2 recently. We have a port forwarding of ssh as well as load balanced nginx server for two separate internal servers. The ...
1
vote
1answer
54 views

iptables can't NAT multiple IP addresses

I have a server with two network adaptors: eth0 and eth1. This server is running two distinct https webservers: One is listening on eth0 (172.29.49.112:8443) The other is listening on eth1 ...
-1
votes
1answer
26 views

how to configure fail login delay using iptables

Like in Subject, I need to set particular delay i.e. when wrong password is provided. I can't use PAM. Thanks for any help.
0
votes
0answers
19 views

How do I ban IP's that request files that do not exist using fail2ban? [duplicate]

I have recently started using Fail2Ban and need to configure a specific 'Jail'. My apache error logs are filled with requests for files within my /var/www folder. The folder doesn't contain any ...
0
votes
0answers
39 views

Ebtables to setup forwarding and nat

I would like to use ebtables to perform the following 2 things without using bridge-utils SCENARIO I: I would like to forward all the packets received from eth0 interface onto the eth1 interface. ...
0
votes
4answers
268 views

telnet cannot connect to port without firewall

If I try to connect to MySQL with telnet myhost.com 3306 I get a network not reachable error, even when I flush all iptables rules. I can reach other ports like ssh (with the same iptables rules ...
0
votes
1answer
130 views

Setting up Squid Transparent Proxy on a machine separate from the router

As explained in the title, I'm trying to set up a Squid Transparent Proxy on a machine separate from the router, and also separate from the private network I want to filter through the proxy. The ...
0
votes
0answers
24 views

Traffic accounting with iptables with multiple chains

I have a linux firewall setup with 3 zones: - green for LAN (192.168.0.0/24) - blue for WLAN (192.168.1.0/24) - orange for DMZ (192.168.2.0/24) All zones have systems running and I want to know what ...
1
vote
0answers
95 views

openvpn TLS handshake fails on client because firewall drops packets (but why?)

I seem to have problem with my openvpn server - client connection. now, the important information is in the log (verb3) of my client: Mon Mar 30 17:09:59 2015 OpenVPN 2.2.2 ...
2
votes
1answer
221 views

Can't access domain internally via public IP address [duplicate]

I have a dedicated server running Proxmox and a VM inside Proxmox running Debian 7 (Wheezy). As I only have one IP address, I'm using iptables to forward ports to the VM. My ...
0
votes
0answers
63 views

Modify iptables rules when docker container has started

On my debian host I have a few docker containers, which I ran with -restart=always so, they start after host has rebooted. Some of them have exposed ports, and docker host process adds certain ...
-1
votes
1answer
95 views

I have docker installed - how to edit iptables of machine?

On a machine that has docker installed, I am doing a sudo iptables -L, and get: root@dockertest:~# iptables -nvL Chain INPUT (policy ACCEPT 8364 packets, 729K bytes) pkts bytes target prot opt ...
-2
votes
3answers
46 views

Web server is working, but ping returns a request timeout for icmp_seq [closed]

these are my current iptables settings: Chain INPUT (policy DROP) target prot opt source destination ACCEPT all -- anywhere anywhere state ...
-5
votes
1answer
44 views

IP Rotation using iptables on OpenVZ [duplicate]

I want to set IP Rotation using iptables so I am using below code.My server Virtualization Type is OpenVZ. My server provider has enabled all the options then also don't know what is the wrong, It is ...
0
votes
3answers
78 views

What is the most effective way to block IP address in Application Layer?

I understand that most Routers/Firewalls are able to block IP tables in the network level. IPtables for instance is quite effective. However, I want an application layer IP block.I have an HAproxy ...
1
vote
1answer
28 views

Route new outbound traffic

I am looking for some iptables rules which can help me to route some traffic from a server : Client 1 ----| Client 2 ----| |----------| Client N ----| ssh, ...
0
votes
1answer
66 views

Loading fail2ban rules to iptables using iptables-persistent

I am using iptables-persistent package to reload my iptables on boot. And I have been thinking should I add the fail2ban rules to the loaded config file? Now I am seeing they are duplicated. This is ...
1
vote
1answer
111 views

Amazon EC2: OpenVPN server won't route bridged packets from client to VPC subnet

I have a bridged OpenVPN setup on a Linux server in an Amazon EC2 VPC. (Spent hours on docs, reading similar problems, here, openVPN forums, no luck yet.) The bridged interface is up and contains ...
-1
votes
1answer
53 views

Forwarding ports and traffic to VPN tunnel

I've installed OpenVPN on my VPS. I have one question: how to forward traffic going to that VPS to go to VPN tunnel created with my local PC. I will use TCP connection. The whole traffic will be like ...
0
votes
1answer
21 views

Ping from OpenVZ host to container

I have a host with multiple containers. I would to ping from the host to container, and vice versa. Currently ping works only from inside a container to the host, e.g.: root@c1313s02:~# vzctl enter ...
-2
votes
2answers
50 views

how to change the special port output source address?

I want to change the my datapackage from port 25 to another internal address(192.168.2.253). iptables -A OUTPUT -o em1 -p tcp --dport 25 -j SNAT --to 192.168.2.253 But I get the output is: ...
0
votes
1answer
63 views

Squid running in intercept mode on same machine as browser keeps giving access denied

It's been a while since I last touched squid and I've been sitting here figuring out this problem since the last few hours why my squid setup on this standalone server machine (behind router nat) ...
1
vote
1answer
195 views

Using host's iptables to prevent access to docker-container's exposed ports

I have a host which runs a few docker's containers. This host has a few network interfaces, my goal is make some exposed ports from containers accessible only by certain interfaces, and prevent ...
0
votes
0answers
52 views

Access port forwarded http service inside host only network vbox (docker)

I used vagrant to create a host only network for my ubuntuserver machine with this option: config.vm.network "private_network", type: "dhcp" Inside this box I have a docker container which is port ...
0
votes
0answers
61 views

Make local subnet clients get redirected like public clients, when requesting a redirected outside port on the firewall

I have a server that also functions as a firewall for the 192.168.1.0/24 subnet via iptables. It also double as a VM Server. Both the VM's and the local machines share the subnet. The servers ...
0
votes
0answers
23 views

iptables improvement: log DROPped connections to unknown ports/destinations for banning with fail2ban

I'm testing the following iptables rules (ipv4) with support for logging of dropped packets. I log the drops to /var/log/iptables.log and then ban retrying/hammering IPs with fail2ban. I'm no expert ...
-2
votes
1answer
48 views

Routing FQDN to Web Server on Specific Port [closed]

I am running multiple web servers on a single machine. localhost:9000 localhost:8080 I want external requests (from the open net) to mysite.com to route to port 9000 and myevenbettersite.com to ...
-1
votes
1answer
52 views

Block everything except some ports and specific IP Addresses, server can't do HTTP GET

I can't get this firewall.sh script to work. It currently doesn't allow me to get a file at 'https://index.docker.io/v1/repositories/library/ubuntu/images' so either my DNS is flawed or I am blocking ...