iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

0
votes
1answer
36 views

VPN routed traffic, response goes outside of VPN?

Here's a weird one. Whenever I'm on a hotel network I tend to like to route all my traffic through my home network. Mainly since I'm not entirely sure all my passwords go through SSL all the time. ...
0
votes
2answers
64 views

iptables treating ssh and http requests differently

Here are the facts: server (IP 192.168.1.140) that runs openssh on port 22 and nginx on port 80 server sits behind firewall/router (IP 192.168.1.1) that has identical iptables rules for openssh and ...
0
votes
1answer
48 views

How to Add/Remove New Server behind Haproxy with Minimal Disruption

Haproxy is currently balancing the load between 2 servers, A an B. Clients are connecting to these servers via persistent TCP connections. Question: We want to upgrade from server A to a more ...
1
vote
1answer
39 views

iptables rule to set source IP depending on local userid

I have two users, alpha (uid 500) and beta (uid 501), and two IP addresses assigned as eth0 and eth0:1. I would like all outgoing packets originated by processes started by user alpha to be marked ...
0
votes
0answers
38 views

ISC DHCP Server - Client Uplink Is Not Working

Running a DHCP server, client(s) does not have up-link (0Mbps) and has a downlink (50Mbps.) I am setting up a gateway/router on a PC running Debian Wheezy with ISC-DHCP. I have 1 WAN (eth0) and 2 LAN ...
-1
votes
1answer
104 views

My server does not listen to port 25, even though iptables allows smtp traffic [closed]

My public server accepts traffic and relays them to other machines on the network with iptables PREROUTING rules. I recently added a mail server at 192.168.1.10 and made its iptables rules to accept ...
-1
votes
2answers
68 views

Can't configure httpd.conf

I have some problems with httpd and can't configure it(can't open in browser). I have done it a lot of times, but now I missing something. I have installed CentOS 6.5 on virtualbox with ubuntu 14. ...
1
vote
1answer
55 views

Bypass Transparent Squid With IPTables

Similar questions have been asked before but the answers received were not satisfying or didn't apply to my situation. I have a transparent squid proxy that filters all the http and , for some ...
-1
votes
2answers
35 views

Forward Clients to New Server using iptables

Clients are connected to a server A by connecting to the domain name address www.example.com:4444, where www.example.com resolves to the IP address of server A. Question: In order to provide a ...
0
votes
2answers
42 views

Assign IPs to programs/processes

I need to assign different IP addresses to different processes (mostly PHP & Ruby programs) running on my Linux server. They will be making queries to various servers, including the situation ...
-2
votes
1answer
45 views

iptables prerouting with match-set

I'm trying to create a iptables entry to redirect a list of ip's to another port. Using ipset I can setup and add lists of ip's and reject them with this command iptables -t nat -A INPUT -p tcp -m ...
3
votes
1answer
25 views

iptables tables — fixing a typo in lo handling

I spent some time today auditing my iptables script. I'm a software engineer, not an Ops guru, but I've tried to pick up the basics of iptables. I noticed something that must have been broken for a ...
0
votes
1answer
65 views

Multi-homed network?

I have a network with a layout like this: ******* ****** ******* ****** * SW1 * --------- * R1 * ---------- * SW2 * ---------- * R2 * ******* ****** ...
0
votes
1answer
39 views

Workaround for state ESTABLISHED,RELATED to allow downloads?

I'm trying work on a positive firewall and block the rest of the world with iptables. So, I've set INPUT chain default to DROP, allowing particular IPs which should have access. Basically, ...
0
votes
1answer
81 views

iptables configuration on Windows Azure (CentOS 6.5) for endpoint load-balanced set

I created 2 VMs (CentOS6.5) on Windows Azure for Postgresql database and HA cluster, everything works fine except when I set iptables service on, the endpoint load-balanced set is down. for security ...
1
vote
1answer
93 views

Hammered by botnet; iptables can't keep up [duplicate]

Fructis is a multi-site (and multi-software) VM (Xen) with 2 cores and like 6G of RAM. It hosts popular Drupal and Wordpress websites and is currently getting hammered. I will put all details below. ...
0
votes
1answer
137 views

iptables forward port range through OpenVPN

I have a VPN server (the "host" - 10.8.1.1) on a public VPS instance running OpenVPN. The second instance I am running (the "client" - 10.8.1.2) is a local ESXi instance connected to the host vpn ...
0
votes
0answers
61 views

iptables on router: why does nat prerouting not intercept packets?

There is a Debian Wheezy box with OpenVZ kernel (IP 1.1.1.1), working as router between Internet and VPS'es (IPs 1.1.1.100 and 1.1.1.200). Incoming packets addressed directly to VPS'es are normally ...
-1
votes
1answer
67 views

How should I properly block outgoing http traffic with iptables

I'm experimenting with iptables, and I'm trying to allow all outgoing requests for HTTPS, but to block HTTP. I have the code below; Chain INPUT (policy ACCEPT) target prot opt source ...
1
vote
1answer
59 views

Does “TARPIT” have any known vulnerabilities or downsides?

TARPIT can be used to waste an attacker's resources, thus slowing down his attacks and lowering his ability to attack other hosts... looks like a good idea. It is provided as a Netfilter addon and ...
0
votes
0answers
32 views

What should be the correct http response code for custom proxy login/register page

I configured a firewall rule on a dd-wrt router to redirect http connections to a shell script, and drop the remaining ports, for the unregistered range of IPs. I am trying to tell the clients they ...
0
votes
4answers
87 views

Create IP nullroute blacklist from text file

I've seen various guides out there for how to nullroute a single IP address, and I've done that before. However, I'm not sure how to nullroute a group of IP addresses. Going through each one ...
0
votes
0answers
37 views

drop smtp live connection

So the problem is that I think my server got DDoS attack with SMTP packet (my mail server). What I can see is that the attacker abuse the smtp_connection_cache. The attacker keep connections (smtp) ...
0
votes
0answers
39 views

OpenVPN in bridged mode, confusion about interfaces

I'm trying to understand some fundamental OpenVPN/networking basics. Let's assume the following scenario: there is an openVPN server which is already configured properly it runs in bridged mode the ...
1
vote
0answers
45 views

Iptables multiport and source ip

I have a rule which does not seem to allow traffic as expected -A INPUT -p tcp -m state --state NEW -m multiport -s x.x.x.x -d y.y.y.y --dports 38000:38100 -j ACCEPT If I remove the -s argument ...
0
votes
1answer
57 views

sip unreachable after changing routes using linux router

SIP server was unreachable after changing routes. I have 2 ISP ,ISP 1 is my default and ISP 2 is my back-up. I have a dialer behind linux router linux. Linux router has 3 ethernet cards. Router ...
2
votes
0answers
52 views

Understanding an OpenVPN bridge from iptable's point of view

In my scenario, there is a machine which acts as both an iptables-based firewall and an OpenVPN-server at the same time. It has two network interfaces - eth1 is connected to the internet whereas eth0 ...
1
vote
0answers
50 views

Change sender-IP for VM in libvirt behind NAT

I have a server with my own public /28 IPv4 Network. On this server I have some vServers, done with KVM/libvirt. These vServers are connected with a virtual network, NATed to the internet. Every ...
3
votes
4answers
197 views

IPTables: allow outgoing SSH

I tried to write my rules for securing a web server with just http/https, apt-get updates, sending mails SSH access. So far I've done that: IPT=/sbin/iptables $IPT -F $IPT -X $IPT -t nat -F $IPT -t ...
0
votes
1answer
88 views

SecAst blocking IP's that fail2ban is not

I'm using SecAst on my Asterisk server as well as fail2ban. (Setup as an option as per the SecAst installation guide). I did this to test if SecAst is working right. I planned to remove fail2ban if ...
0
votes
0answers
35 views

Why can't some user accounts access certain remote ports?

I am trying to troubleshoot a couple issues on RHEL 6.5 that seem related. In both cases, a user on a machine (seperate machines) cannot access a service (seperate services) on a remote machine. In ...
0
votes
2answers
118 views

iptables for ipv6 address port forwarding to localhost port

Say I want to redirect 2a00:1450:400c:c01::71 on Port 443 to localhost Port 12345. How to do that with Iptables? Update Okey, it's Weechat which running an SSL relay on a port >=1000. It can make ...
0
votes
0answers
45 views

Packets are not routed by iptables, how to debug

I'm using OpenStack and OVS. This is my case: From a remote host, I ping VM with IP A. Local gateway received the echo request, then send a packet with IP A and MAC address A' (based on a fixed ...
0
votes
1answer
37 views

Cannot browse web server

I have a server running Apache on Centos 6.4 and I cannot get to browse the box - SSH works fine and as does FTP but nothing http will work. httpd is started, SELinux is not running and I have opened ...
1
vote
1answer
21 views

Linux iptables DNAT 53306 to 127.0.0.1 3306

mysql real port is 3306。 I want public network using 53306 to visit mysql,and 3306 not allowed access from public network. How to write the iptables rules DNAT 53306 to 127.0.0.1 3306 ? help me
0
votes
1answer
43 views

iptables slows down outgoing web request

Before I enabled iptables, requests via curl to this url were instant. But after configuring iptables it takes almost 30-40 seconds to get response. How do I make particular url white listed so it can ...
2
votes
1answer
151 views

Error: iptables: No chain/target/match by that name [duplicate]

I am trying to configure proxy server on RHEL Server 6.5 using Squid and iptables. Below is the command I executed and the error message it displayed: vzlptest01 root [root] > iptables -A INPUT -i ...
0
votes
1answer
114 views

Port forward remote desktop without a gateway over 3G modem router [closed]

I'm trying to connect from a laptop, through a VPN, and a 3G modem/router, to a remote PC / computer. PC (192.168.1.33) | 3G Modem (192.168.1.22) | [3G internet, connecting to VPN] | ...
0
votes
1answer
36 views

Using OpenVPN and iptables in combination

Let's imagine there are three networks, WAN, LAN-A and LAN-B. In between, there is a firewall server connecting the networks to each other. iptables ensures the following things: There is no way for ...
0
votes
0answers
31 views

Simple MASQUERADE NAT between 2 VM

I'm on a cloud service and I'm trying to set up NAT between two VM. I've never experienced issues in this simple step, but this time is different and I'm near to give up. The first VM had two ...
-1
votes
4answers
223 views

Is there anyway to tell what user will receive data from inbound packet?

In linux, considering this use case: 1. User initiates http request for webpage to remote server 2. Remote server answers request and sends packets Is there any reference to the user who started ...
0
votes
2answers
78 views

Forward SSH request to an External Server to an Internal Server

I have a VM config currently where I have 1 external IP pointing to a VM with an Nginx HTTP Reverse proxy serving HTTP Web Pages from several internal VMs without external IPs. I need a similar setup ...
-1
votes
4answers
183 views

iptables not installed on centos

If a machine does not have iptables installed, is there still a firewall running? If yes, how to I disable / change rules? if I enter the command iptables I receive the response: iptables v1.4.7: ...
0
votes
1answer
141 views

No route to host centos

I am trying to allow a port through a firewall on centos 6. The error I am receiving is telnet: connect to address 80.xx.xx.xx: No route to host The port I am trying to allow is 5666. If I disable ...
0
votes
1answer
89 views

Is it possible to make the server accessible from two internet connections

how to make this: have: Centos 6.5 WAN1 eth0 44.44.44.44 (DEFROUTE=yes) WAN2 ppp0 95.95.95.95 (DEFROUTE=no) HTTP server work and available only in eth0 DNS server work but port 53 blocked in ...
0
votes
3answers
70 views

Packages drop when using iptables NAT

We are using NAT made with iptables. However when there are lots of connections (or sessions) through NAT server packages start to drop. There is no log in syslog etc. I think this is caused by sysctl ...
0
votes
1answer
46 views

squid3 with tcp_outgoing_address could not connect to anywhere

I have one server with 3 interfaces (3 physical lan card), which are connected to 3 different routers. Each router has a different subnet, i.e. the 3 interfaces of server belong to 3 different ...
0
votes
2answers
59 views

resetting iptables seems to make connections clear faster

I have iptables setup on 2 servers. Server#1 is public and Server#2 only allows the ip address of Server#1 to have ACCESS. Server#2 has a mySQL database that Server#1 queries. I ran a query and it ...
1
vote
0answers
23 views

How to test if packet has been tagged with classid

I'm trying to troubleshoot an issue I'm having related to IFB Mirroring which I'm attempting to deploy based on this question: Tc: ingress policing and ifb mirroring My theory is that since the ...
0
votes
0answers
21 views

forwarding an incoming ip multicast packet over another interface

Is it possible to forward an incoming IP multicast packet out of a specific interface using iptables rules if the incoming packet already has a TTL > 1? (The incoming interface is a GRE tunnel ...