iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

0
votes
2answers
54 views

iptables to route/filter traffic by URL behind NAT

I have the following configuration: a DNS record of X.a.b.c pointing to an ip address I a DNS record of Y.a.b.c pointing to the same ip I. Internet---->(RT)--->(FW)--+-->(MN) ...
0
votes
1answer
65 views

OpenVPN Access Server connects and can browse all other ports than port HTTP and HTTPS

Hello dear Serverfault experts, I have a very frustrating issue with my recently installed OpenVPN Access Server ...
0
votes
0answers
25 views

Keepalived failover and broken pipe with NAT'd connection?

I have an active/active conntrackd setup with asymmetric routing. Which means some TCP flows can be split between 2 firewalls. i.e. outgoing packets flows out one firewall, and for the same ...
0
votes
1answer
148 views

Will this HAProxy “restart script” work as gracefully I think it will?

I put this script together from various places. What I am hoping is that it will do the following once run: Pause all "NEW" http traffic for ports 80 and 443 - just "pause" them, don't give any ...
1
vote
1answer
37 views

Why is conntrackd not replicating state?

I have a problem with an active/active firewall cluster where the connection tracking state in the firewall does not seem be be being replicated. It's active/active because I have two routers ...
0
votes
1answer
39 views

Iptables to UFW before.rules not working

I've got the follwing working iptables commands: iptables -t nat -i ppp0 -A PREROUTING -p tcp --dport 81 -j DNAT --to-destination 192.168.16.8:80 iptables -t nat -A POSTROUTING -p tcp --dport 80 -j ...
-1
votes
4answers
43 views

iptables - Unable to telnet out

I'm building a firewall rule that should drop all outgoing connection except telnet out. [ I know that I ultimately need to drop all input and allow some, but I need to filter output as well ( block ...
1
vote
0answers
28 views

Why do some outgoing IP traffic not contain UID information?

I am doing egress logging on my server using IPTABLES with the following line which is supposed to provide UID information on all traffic that is logged: -A OUTPUT -j LOG --log-prefix "IPTABLES(O): " ...
0
votes
1answer
51 views

apache rate limit best practice

I have the following business scenario: 1. apache http server load balances client request to application servers via ajp 2. all the resource intensive work is done on application servers for each ...
0
votes
2answers
31 views

use iptables to limit the number of concurrent http requests per ip

Currently my iptable is as follows to limit the number of concurrent connections per ip to 10 from any http client. However, I tried a simulated http test and I'm not getting dropped at all. what's ...
0
votes
2answers
74 views

Configuring port in iptables for websockets

I'm implementing Ratchet's push example in my server (websockets) on port 9090. These are current iptables policies: [root@myserver ~]# iptables -L -n -v Chain INPUT (policy ACCEPT 309 packets, 22420 ...
0
votes
1answer
170 views

Azure Site-to-Site VPN with a Linux based router to bridge the VPN ports to a RRAS server while keeping NAT for other traffic

I am trying to get an Azure Site-to-Site VPN up and running using RRAS but require help configuring my router's iptables to bridge the VPN ports and protocols to the RRAS server without using NAT ...
1
vote
1answer
82 views

Redirect all incoming traffic from a secondary public IP to an internal IP address using iptables

I'm currently trying to figure out how I can forward traffic from a secondary public IP address of my dedicated server to an internal IP of my network using iptables in order to make e.g. webservers ...
0
votes
1answer
47 views

blocking ip on linux(CENTOS) [closed]

I m blocking an ip from my centos server using iptables: iptables -A INPUT -s $ip -j DROP service iptables save however my ip is still able to access the ip and even view websites hosted on this ...
0
votes
0answers
26 views

Connection limiting on Kernel 3.10.53

I have upgraded a server from the stock CentOS 5 kernel to Kernel 3.10.53, compiled from source. I also upgraded IPtables from 1.3.5 to 1.4.20, also compiled from source. Since the upgrades, it seems ...
0
votes
0answers
56 views

Multiple dynamic IP & port forwarding ( iptables )

I have multiple internal servers using port 443 and am using 6 dynamic IP's (same provider) to allow me to forward without having to use a non-standard port.I am not load balancing any traffic. Right ...
0
votes
1answer
50 views

Redirecting Iptables [closed]

I have set up a Personal hotspot using Hostapd. But this hotspot is not connected to the internet but I do have Apache installed on it. What I am trying to achieve is to redirect all the clients (that ...
-1
votes
1answer
70 views

Docker Host iptables

Using our stock iptables based on a default DROP policy, Dockerfiles based on Ubuntu or Debian are unable to resolve hosts on apt-get commands, making it impossible to build the files. If I change the ...
1
vote
2answers
902 views

Centos 7 save iptables settings

Problem: iptables resets to default settings after server reboot. I'm trying to set rule like this: iptables -I INPUT -p tcp --dport 3000 -j ACCEPT after that I do: service iptables save and it ...
1
vote
0answers
32 views

Automatically add rules to iptables when an user logs in or logs out with ssh?

I'm looking for a solution to automatically add couple of rules to iptables when an user logs in and remove those rules when it logs out. I'd like to get somehow get the ip address of the user from ...
0
votes
1answer
47 views

Port forwarding with 2 interfaces not working

I'm running debian and I've got the following network configuration: eth0 Link encap:Ethernet inet addr:192.168.16.6 Bcast:192.168.16.255 Mask:255.255.255.0 inet6 addr: ...
-4
votes
2answers
21 views

Restrict access to path vi IPTables

I want to restrict access to a path via iptables - I try this one and its work on the whole site iptables -I INPUT -p tcp --dport 443 -m string --algo bm --string 'example.com' -j DROP but I want ...
0
votes
0answers
16 views

How to limit rapid-fire connections to HTTP port with iptables?

I'd like to prevent malicious bots from hitting my Apache server too quickly. A couple issues/problems: I don't fully understand the relationship between --limit and --limit-burst and how they work, ...
1
vote
2answers
84 views

Ubuntu 1404, iptables, block everything except specific ips

I'm trying to block anything on my server except for some specific ip ranges. There should be neither access from web nor to ssh or anything else. I searched already through different topics and ...
1
vote
1answer
26 views

Invisible for traceroute with iptables rule?

Can someone explain me why when i set on my host iptables rule like this: iptables -I PREROUTING -t mangle -j TTL --ttl-inc 1 ... it will be invisible for traceroute from this moment?
0
votes
2answers
51 views

use iptables's nat to proxy mysql

I find this similar thread but don't work: http://stackoverflow.com/questions/10864854/forwarding-mysql-connection-with-iptables-and-differents-network-interfaces?rq=1 My environment as follows: ...
1
vote
0answers
193 views

Client successfully connects to OpenVPN server but with no internet access over the VPN

I'm trying to setup OpenVPN with static key authentication(instead of TLS) on TCP port 443; but the client cannot access the internet over the VPN after connecting to the server. Here's my current ...
0
votes
0answers
560 views

Transparent Proxy squid TCP_MISS/503 Error in all pages

I m trying to make a squid proxy server with to work as a transparent proxy server, and i m facing some issues that i m unable to figure out the reasons. The setup i m using is several VLAN's with ...
3
votes
2answers
42 views

Why is my iptables config not accepting connections from the specified source iP?

From machine 192.168.1.2, I have this iptables configuration: $ hostname -I 192.168.1.2 $ iptables -L -n -v Chain INPUT (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out ...
1
vote
1answer
55 views

ifcfg-eth0.200 is not responding to arp broadcasts

I have a Centos router doing a stupendous job in a setup similar to this: eth0 --> no IP eth0.200 --> 192.168.200.1 eth0.201 --> 192.168.201.1 ... so on up to eth0.213 --> 192.168.213.1 I have ...
0
votes
2answers
147 views

VSFTPd 2.3.5 through iptables on Debian 7.6

Configured and running vsftpd 2.3.5 on Debian 7.6 behind IPtables and fail2ban with ssl_enabled I can't upload files properly because after a few I receive the following errors: Timeout or OOPS: ...
1
vote
1answer
40 views

How to forward a port to multiple internal ips

I have a Centos 6 64 bit server with OpenVPN installed. I'm using this iptables rule to forward a port for an OpenVPN user: iptables -t nat -A PREROUTING -p tcp -m tcp --dport PORT -j DNAT ...
0
votes
0answers
31 views

IP TABLES port forwaring corrupts my packets?

Here's my scenario. I have a WORKING DAEMON receiving packets through a proprietary protocol (mounted on the port 5000) that has been working flawlessly for over a decade. I have a weird problem ...
2
votes
1answer
61 views

Iptables and conditional statements. Is it possible?

I tried a search but i was unsuccessful, in the case i'm sorry and i will appreciate the redirect. I had this problem in mind: a computer with mac address M is sending packets through an openwrt ...
3
votes
2answers
227 views

How to enable traceroute in linux machine

I'm working on something in the transport layer and after i ran our custom policies for securing the policies i'm not able to do traceroute from the linux machine. root@keystone-evm:~# iptables ...
-1
votes
1answer
45 views

Sometimes this script fails to update the iptables [closed]

It does not happen often, but sometimes after running the below script, checking the iptables with service iptables status shows that they weren't updated and the script doesn't output any error. The ...
0
votes
0answers
26 views

Conflicting ip routes with local table on attaching a virtual network interface

I have an EC2 instance with these ip rules: $ sudo ip rule show 0: from all lookup local 32766: from all lookup main 32767: from all lookup default I can attach an elastic network interface to ...
0
votes
2answers
37 views

Open Specific Linux Port

Im trying to open a Port(2012) on my VPS so i can access it over the internet. This is the output of sudo iptables -L produces Chain INPUT (policy ACCEPT) target prot opt source ...
0
votes
0answers
23 views

iptables: Packet not being matched by neither INPUT nor FORWARD

How can it be, that a packet that gets matched by a mangle PREROUTING does not get matched by neither filter INPUT nor filter FORWARD? From this diagram ...
1
vote
1answer
81 views

Linux iptables - reject tcp SYN with RST

I am doing an implementation on a linux machine to reject incoming telnet requests from wan side telnet port 8023. The functionality is achieved by using the below iptables rules. The first rule in ...
0
votes
1answer
84 views

iptable CLUSTERIP doesn't work

We have some requirements which explained here. We tried to satisfy them without any success as described. Here is the brief information: Here are requirements: High Availability Load Balancing ...
-4
votes
1answer
84 views

Because when I open ports with iptables appear closed

I opened the following ports with iptables on Debian 7: iptables -X iptables -F iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT ACCEPT iptables -A INPUT -m state --state ...
0
votes
1answer
21 views

Iptables and counters

I'm trying to use iptables counters with munin to monitor traffic of hosts on my local subnet. For each host I set up a rule like this: iptables -I OUTPUT -d $ip This should count the packets going ...
0
votes
0answers
32 views

is iptables-save rule dump deterministic?

is the order of the parameters of iptables rule line deterministic in the iptables-save output? -A CHAIN1 -m mod1 -m mod2 -j CHAIN2 will be always the same, or I can expect it to be -A CHAIN1 -m mod2 ...
2
votes
1answer
104 views

What is the correct iptables rule when NATing multiple private subnets?

I have a Centos minimal 6.5 acting as a router. eth0 is connected to a Cisco switch trunk port, allowing VLANs 200-213. I have several VLAN interfaces just as this link suggests: ...
0
votes
1answer
57 views

BROUTING's target “redirect” in ebtables behaving in a strange way

Situation (host A)-------(bridge B)------(host C) where: A has MAC A on it's interface C has MAC C on it's interface B has MAC BA and MAC BC on it's two interfaces (depending on who it's facing) ...
0
votes
1answer
135 views

iptables and TPROXY support

I'm running iptables v1.4.21 on Ubuntu 14.04 and is trying to setup iptables to use TPROXY. How can I check whether my current build of iptables supports TPROXY? I can check TPROXY support for ...
1
vote
0answers
263 views

TPROXY Not working with HAProxy, Ubuntu 14.04

I'm trying to use HAProxy as a fully transparent proxy using TPROXY in Ubuntu 14.04. HAProxy will be setup on the first server with eth0 111.111.250.250 and eth1 10.111.128.134. The single balanced ...
0
votes
1answer
42 views

fail2ban block ports rules iptable

I just installed Ubuntu Server 14.04 and don't have much experience with IPtables. I am trying to get a basic setup going where I only accept SSH connections on port 22 and 2222. I actually have that ...
0
votes
1answer
90 views

Using 2 Transparent HAProxy for load balancing

We can configure HAProxy to be a transparent proxy by using the guide here, where one of the steps says ...to put the backend servers in a different subnet to the front end clients and make sure that ...