iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

0
votes
1answer
23 views

http requests working on KVM virtual machine, mysql not?

I have an Ubuntu server with KVM virtual machines. I allowed SSH in the firewall so I could access the host. Also I allowed incoming traffic that has state related, established. This is the full ...
1
vote
0answers
36 views

How to use iptables or IFB to mark incoming traffic by device?

I'm trying to use iptables to mark incoming packets based on the device where those packets arrived (rather than their originating IP address or port etc), but haven't found a way of getting this to ...
0
votes
1answer
97 views

iptables v1.4.21: Couldn't load match `-d':No such file or directory

i am running kerenl 3.14.18 and using iptables 1.4.21, built with these options --static-enable --disable-shared. when i run this command: /sbin/iptables -A PREROUTING -m -d 127.3.0.2/24 -j DNAT ...
0
votes
1answer
33 views

New iptables rules only affect new spawned process

Is there a way to update iptables rules to block a connexion without the need of restarting it? Here is an example of the behavior I want to avoid: On shell#1: I start a ping command 8.8.8.8 On ...
-1
votes
1answer
55 views

iptables and routing mechanics [closed]

At what stages of handling a data packet does the linux kernel apply the different iptables chains and routing? I am looking for a schematic overview of the process.
1
vote
2answers
52 views

NAT-ing with iptables rewrites source IP in logs

I have the following infrastructure in place: internet [outside 81.x.x.x] router [inside 192.168.1.1] | [network 192.168.1.0/24] ...
0
votes
1answer
27 views

ports to open to access samba share

When I turn off my iptables service, I can successfully list my samba shares. But when I turn it back on, I cannot access them at all. Also, my SELINUX is set to permissive Here is my current ...
0
votes
1answer
56 views

redsocks + socks server on different machine

I have the following setup: Host-X (192.168.1.100) running ssh -D so that it can be used as a socks server. Host-Y (192.168.1.101) running redsocks configured with Host-X as socks. They are in the ...
0
votes
0answers
38 views

iptables, outside and inside NAT; Return traffic going out incorrect gateway

Overview (TL;DR at bottom) I have a third party firewall/proxy appliance which is running Linux (Ubuntu), and its routing and firewall engine is backed by iptables and the Linux (source)routing ...
-4
votes
1answer
88 views

Applying firewall rules: iptables-restore: line 1 failed [closed]

I'm trying to do Port forwarding on my centOS machine. When i'm restarting iptables i'm getting the error iptables: Applying firewall rules: iptables-restore: line 1 failed [FAILED]. My iptables file ...
0
votes
0answers
24 views

Temporary IPTable Rules when Process Runs

Struggling to find the solution for this and maybe it's easier than I'm making it out to be. I need to open ports in the firewall when a process runs. That process could be requesting the usage of a ...
0
votes
0answers
102 views

OpenVPN - open ports for clients only via iptables

OpenVPN server running on my ubuntu server (tun mode). My problem is that i cannot set some ports be accessible only for VPN clients. I have a dirty solution, but i want better. I have no iptables ...
0
votes
0answers
55 views

Forwarding traffic between interfaces inside a docker container

I have created a docker container executing the following command docker run -it --net=none --cap-add=NET_ADMIN --name firewall ubuntu /bin/bash after I have attached it two interfaces eth0 and ...
0
votes
1answer
53 views

How to allow only subnet for port with iptables

What i am trying to do is to DROP any packets to specific UDP port, except those one from my secured subnet 10.8.0.0/24. iptables -t nat -A --src 10.8.0.0/24 -p udp --destination-port 63210 -j ACCEPT ...
1
vote
1answer
43 views

Routing between two servers via a virtual interface

I have two servers, each running an openvpn service, the first one (uno) has the vpn range 10.170.0.0/16 tied to UDP 1194, and the second one (dos) has 10.180.0.0/16 tied to TCP 443. I would like to ...
0
votes
1answer
42 views

iptables - Redirect except list MAC Address

I'm using iptables on my router to redirect all web traffic to my page. But i don't know how to except my mac address list. I did command like this iptables -t nat -A PREROUTING -m mac ! ...
1
vote
1answer
20 views

iptables log established connections

I have a rule in my iptables which logs denied connections i.e. -A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7 I want a similar rule that logs all established ...
0
votes
0answers
32 views

How to bypass OpenVPN per application

I have a linux machine that routes its whole internet traffic through an openVPN connection. It was explicitly configured to work that way. However, the machine has a few applications that should not ...
0
votes
1answer
47 views

Using a pfSense guest to firewall/route traffic for other guests

I was curious if this falls into the "why..." category or not. I have a dedicated, hardware UTM (Untangle) that's serving as an edge device with two hosts and a dozen guests behind it. Right now, I ...
-1
votes
1answer
34 views

What is the recommended method for securing a Crate.io installation

I have installed an instance of Crate.io via docker on a CentOS 6.6 machine. By default Crate.io runs on port 4200 and is open to the world. I would like to secure this, so only the localhost can ...
-1
votes
1answer
31 views

How to redirect all incoming packets to sniffer in Linux using iptables?

I need to redirect all incoming tcp packets from eth0 to current host (change ip address from 1.1.1.1 to 1.1.1.2) and outgoing tcp packets from sniffer from eth1 to another host(from 2.2.2.2 to ...
0
votes
2answers
30 views

DNAT on the POSTROUTING chain

What happens if I try to do a DNAT in the POSTROUTING chain of the NAT table in iptables? Suppose I change the destination IP of the packet in the POSTROUTING chain to an address that should get ...
0
votes
1answer
33 views

Iptables: some ports are closed despite being open by my iptables; can it be something else?

Beginner question. I set up the following iptables rules: #!/bin/sh # Réinitialise les règles sudo iptables -t filter -F sudo iptables -t filter -X # Bloque tout le trafic sudo iptables -t ...
-1
votes
2answers
48 views

Differences between iptables and ip6tables processing of packets

I've reviewed a variety of netfilter, iptables, and ip6tables resources. I've searched Google, including StackExchange websites for information, and, I can't find easy or clear links to information ...
15
votes
6answers
2k views

Will blocking all connections outside of the US, aside from port 80 cause a high server load?

Like most servers (I assume), we have people trying to brute force our services 24/7. I have cpHulk blacklist their IP's, but it seems like it'd be better if they didn't get that far in the first ...
0
votes
1answer
42 views

transparent proxy (SSL error)

Right now we are having transparent proxy in our network environment. we have been set proxy settings to browsers in all systems. While accessing the https sites in browsers no issue but few of ...
0
votes
1answer
27 views

General approach for isolating a WLAN with iptables? [closed]

I'm trying to use a 2-port plus WiFi adapter NAS as a home router, and I'd like to know roughly how big an undertaking the following would be using iptables: forward masqueraded client traffic from ...
0
votes
1answer
188 views

Linux: Bridge two NICs and route traffic through VPN tunnel except specific destinations and ports

I have a Linux PC (Debian Wheezy) with two Ethernet adapters. Adapter eth0 is connected to the Internet (modem/router/DHCP/firewall thingy) and eth1 is connected to an WiFi access point. All other ...
0
votes
0answers
30 views

PCI says port 36141:TCP is blocked. But 36141:TCP open on iptables

PCI compliant scan fails due to port 36141:TCP is being blocked on website. I verified I cannot connection via 36141 on same server to itself: # nc -zv 127.0.0.1 36141 nc: connect to 127.0.0.1 port ...
2
votes
1answer
44 views

Squid problems with iptables

I've installed and configured Squid on Fedora Server 21 with full updates. My proxy's IP is 145.130.33.133 with port 3128. First I modified my squid.conf with my rules and everything. On my laptop ...
0
votes
1answer
53 views

iptables - openvpn can't access port 80

I have a server set up with OpenVPN. While connected to the VPN, all external websites work great, but when I try access a site that is hosted on the same server, it fails to connect. I can ssh into ...
3
votes
3answers
160 views

Advanced dynamic routing with external program

I need to build a system in which i am able to route packets based on a number of parameters, such as port/protocol etc, which are somehow "normal", but also on other aspects, such as queue length, ...
0
votes
1answer
43 views

Port redirection with iptables to localhost / blocking the destination port

I like to forward all traffic coming to 80 to be redirected to 8000. I used iptables -tnat -A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8000 But then port 8000 is still open to ...
1
vote
1answer
38 views

Why can't I connect to my remote MySQL Server?

I have a asterisk server that is set up in on a VPS provider. I need one of my local applications to connect to the database to pull reports, but I am having dificulty getting a read only connection ...
1
vote
1answer
123 views

Configuring IPtables to mirror traffic in CentOS

I'm trying to set up iptables to mirror traffic coming into eth2 and send to 10.1.4.4. I have been reading a lot of documentation on this but am having some issues. Here is the command I am trying ...
-1
votes
1answer
25 views

Redirect port without opening it

I have the following iptables configuration iptables -P INPUT DROP iptables -A INPUT -i eth0 -p TCP --dport 443 -j ACCEPT iptables -A INPUT -i eth0 -p TCP --dport 10001 -j ACCEPT iptables -A ...
-1
votes
1answer
76 views

UDP reverse proxy on Linux [duplicate]

I have a dedicated server which hosts game servers, and is vulnerable to DDoS attacks. I want to get a DDoS-protected VPS to act as a reverse proxy for UDP. The dedicated server's IP address is ...
1
vote
1answer
56 views

iptables connlimit: exclude multiple IP addresses

I have currently this IPTABLES command: iptables -A INPUT -s ! 192.168.0.2 -p tcp --syn -m connlimit [...] -j DROP As far as I know, such rule limit some number of connections following various ...
0
votes
1answer
36 views

Iptables overridden after reboot in Ubuntu server

On my Ubuntu server (installed KVM and Kimchi), I noticed that the iptables are changed after a reboot. Unfortunately I did not find out which script is responsible for these changes. I tried to ...
0
votes
1answer
22 views

Inbound IPTables rules based on queried domain

I have an odd situation and I'm not entirely sure if it is even possible in IPTables. If it isn't, that's fine and I can do without. If it is, fantastic, I'd love to see how to implement it. So, my ...
1
vote
1answer
78 views

Port suddenly closed. How to re-open?

I've written a software module in PHP that manages the saving of data in different data stores (MySQL, ElasticSearch and Redis). To test the module, I've created several test plans in Apache JMeter, ...
0
votes
0answers
49 views

Why iptables block my port 80 traffic?

I've setup a configuration on iptables to allow only the traffic I need. I opened the port 80... but with iptables enabled, I cannot reach my site. This is the configuration... Where I've made some ...
0
votes
3answers
62 views

How to route all local trafic to Squid?

I have a working squid caching server which is accessile through 127.0.0.1:3128. I'm trying to route all my trafic(and if possible all my virtual machines) to 127.0.0.1:3128. I'm using vagrant and ...
0
votes
1answer
18 views

Linux Traffic Shaping: ceil rate never reached

My application run on port 8080. I have this iptables command: iptables -A OUTPUT -t mangle -p tcp --sport 8080 -j MARK --set-mark 10 I have also theses TC rules: tc qdisc add dev eth0 root handle ...
0
votes
1answer
35 views

IPTables Rules Being Loaded From Somewhere

I'm having troubles connecting (meaning I can't connect to any IP or port) to my server and it appears that the problem was to do with CSF. I uninstalled CSF (by running /etc/csf/uninstall.sh) and ...
3
votes
1answer
63 views

Forwarding a port on the loopback interface to a remote IP/port

I have two Docker containers that I'm trying to network together in a specific way. Container A is running a Redis server on port 6379. Container B is running an interactive shell and needs to access ...
0
votes
1answer
35 views

Connecting to web server through eth1

So I am having issues with connecting to my web server via eth1. ifconfig eth0 Link encap:Ethernet HWaddr 00:50:c2:27:bf:6e inet addr:10.8.105.8 Bcast:0.0.0.0 Mask:255.255.0.0 UP ...
0
votes
0answers
62 views

Does firewalld handle the common attack rules of iptables by default?

I'm in the process of migrating servers to CentOS 7 from 6.5 and the most major change appears to be the shift from iptables to firewalld. My prior experience with iptables tells me that there are a ...
1
vote
0answers
46 views

OpenVZ : live migration fails

I can't launch live migration of OpenVZ container between two proxmox nodes... Feb 05 03:30:27 starting migration of CT 102 to node 'madrid' (xx.xx.xx.xx) Feb 05 03:30:27 container is running - using ...
1
vote
0answers
25 views

Clone and then route SNMP traps to new destination

We have 2 SNMP trap servers 10.0.0.1 and 10.0.0.2 which are the SNMP trap servers for close to 500 devices that we monitor.In all these 500 devices,10.0.0.1 and 10.0.0.2 are configured as the trap ...