iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

0
votes
0answers
38 views

NAT answers instead of remote host

Currently I have VPN client access set up on OpenSuSE 13.1 server to third-party remote Cisco VPN IPSec server. VPN Server is set up to provide access for a host only and to provide access for a local ...
1
vote
1answer
66 views

Firewall setup Huawei 4G with DMZ

Network topology: ISP1 | | Alternative ISP 4G | | | Huawei 4G with DMZ | | ...
0
votes
2answers
39 views

ssh connection to Debian machine hangs when updating firewall rules

I am running a script which updates firewall rules on a Debian machine via SSH as well as other actions. However, after the script runs, my connection just hangs. I am able to close the terminal and ...
0
votes
1answer
61 views

iptables blocks ip address even though it is specified to allow it. Why? [closed]

I'm at a loss to explain why these rules don't have the same effect as whitelisting ip addresses. Can anyone tell me why? # /etc/hosts.deny ...
2
votes
1answer
89 views

How to route traffic through OpenVPN for the server only

I have a number of services running on my server to which I want to restrict access to only those connecting through OpenVPN. I did manage to get routing to work to a second IP I added to the ...
2
votes
0answers
30 views

firehol simple config doesn't work on Debian 7

I'm trying to set up a very simple firehol setup under a brand new Debian7 server. I only installed ssh and sudo before this Installed firehol with sudo apt-get install firehol Changed the config ...
-2
votes
1answer
31 views

iptables blocking all outbound connections

I have the following rules set up: iptables -F iptables -A INPUT -s 192.168.0.0/16 -j ACCEPT iptables -A OUTPUT -d 192.168.0.0/16 -j ACCEPT iptables -A INPUT -p tcp --tcp-flags ALL NONE -j ...
1
vote
1answer
84 views

Iptables comment module not installed

I want to use -m comment --comment "message" in my iptables rule but do not have the module loaded. Through some searching, the module I need for this is "ipt_comment" but I do not have this ...
-1
votes
1answer
73 views

Can't access EC2 Instance through SSH After iptable Flush

Before i was able to connect to my EC2 instance, then after i flush the IPTABLE, i can't access it anymore, every time i try to connect, it get TIME OUT. Error i receive: FAIL: TIMEOUT [SSH] FAIL: ...
-1
votes
1answer
31 views

how to 2 ip virtual in public dan private with forward to different destination

Here my case, Server 1 public IP in 1 box (eth0) -> 203.x.x.55/28 and 57/28 gw 203.x.x.49 private IP (eth1) -> 10.10.8.1 Server 2 private IP in 1 box (eth0) -> 10.10.8.5/24 and 7/24 gw 10.10.8.1 ...
0
votes
1answer
53 views

Correct way to open ports for fastcgi using iptables

I'm running a server with nginx and fastcgi. I'm using TCP sockets for fastcgi rather than Unix sockets as I've read that this scales better. The fastcgi server is running on fastcgi://127.0.0.1:9000. ...
1
vote
3answers
182 views

How can I achieve OpenVPN client routing without NAT on Linode

I've set up an OpenVPN network, and it is working properly in the sense that I can access the inner/LAN machines from the remote client. However, my problem is that all traffic from the remote ...
0
votes
0answers
20 views

Moving domains to servers in the local network

I have to move some of the domains from a main server to the servers behind it, placed in a local network. Currently they are only database servers that keep the databases of the projects from the ...
1
vote
1answer
19 views

Disabling network access for a group of users but allowing smtp only

We have an environment where our users ssh into the system and their shell is set to simply launch Mutt on their $HOME/Maildir. We want to restrict our users to only be able to send/receive mail. We ...
2
votes
2answers
208 views

What is the correct way to open a range of ports in iptables

I have come across articles advising for the following: iptables -A INPUT -p tcp 1000:2000 -j ACCEPT And others stating that the above will not work and iptables only supports multiple port ...
2
votes
1answer
51 views

nftables alternative for iptables -F

Simply, is there any quick alternative of iptables -F command (that just "deletes everything") for nftables? Such thing wouldn't have much theoretical purposes, but it's usually a lifesaver for ...
0
votes
0answers
86 views

Apache bench failing with error “No route to host”

Got a new dedicated box. Installed CentOS 6.5 Installed KVM Installed a CentOS 6.5 guest rsync'd websites/database/settings etc over from existing VPS. Set up "dedi.mydomain.com" in DNS to test it ...
0
votes
1answer
94 views

Can't use yum on guest - suspect port 80 forwarding in iptables on host at fault?

What's wrong with this set-up? Both host and guest are CentOS 6.5 Specifically, I can't run yum on the guest. I can ping happily to/from the guest, including pinging mirrorlist.centos.org If I ...
0
votes
0answers
178 views

“Network error: connection refused” when trying to SSH to guest VM

CentOS 6.5 host, CentOS 6.5 guest. Using kvm. VM gets a local IP from the virbr0 interface. I've set up some port forwarding in iptables. port 80 forward works, but my SSH forward does not. ...
0
votes
0answers
30 views

Forward incoming email traffic

I have two CentOS servers - one for email and one for web hosting. One domain, which we do not control, has the MX record incorrectly pointing to the web host. What iptables config is needed to ...
1
vote
2answers
70 views

How to remove all rules referring to a chain in iptables?

I have a set of scripts I designed for network monitoring, control and so on. One thing I do in these scripts is create an iptables chain like iptables -N mychain. I then insert rules into the main ...
0
votes
2answers
39 views

Saving manually edited iptables

Ok, so I'm the kind of person that changes IPTABLES by editing /etc/sysconfig/iptables, what's the way to make them save so that someone accidentally using "iptables save" doesn't overwrite them?
0
votes
1answer
43 views

How do I test my firewall rules?

I've setup some rules in ufw and I've turned it on. Now I want to ensure my rules actually block traffic. However, when running nmap -PN -p <my_port> <ip> from my local workstation it ...
2
votes
1answer
45 views

iptables traversal and the chain policies, manual editing

I like editing the iptables file manually, but there's something that confuses me a bit. From how I have understood iptables from the manual, it traverses the rules from top to bottom, and if no ...
0
votes
1answer
150 views

Linux Port Forwarding to different IPs

this is my scenario: Netbook (192.168.1.2) ===> (192.168.1.1) Linux Server (192.168.0.4) ===> NAS (192.168.0.2) Netbook (192.168.1.2) ===> (192.168.1.1) Linux Server (192.168.0.4) ===> Router ...
0
votes
3answers
161 views

Routing between two subnets using a Linux box with two NICs

I have a Linux box with two NICs, each connected to a different LAN: Network A: 192.168.1.0 255.255.255.0 Network B: 192.168.2.0 255.255.255.0 The routers are: 192.168.1.1 192.168.2.1 Linux NICs are ...
4
votes
3answers
1k views

iptables nat does not exist

Today my iptables nat on the host system stopped working and I have no clue what happend! (That's very bad, I know) All commands are executed as root user. If I run $ iptables -t nat -L I get the ...
0
votes
0answers
14 views

Impact of iodined settings to server

I would like to install iodined, the IP tunnel via DNS, on a working web server. However, the configuration requires to set IP forwarding add NAT masquerading rules to iptables (and open DNS port) ...
2
votes
1answer
94 views

Redirect all traffic sent to an unallocated alias IP within a VPN subnet, to a fixed IP within another VPN

I have a server hosting multiple bridged (i.e. tap) VPNs using openvpn, where each VPN has a different 10.8.X.0/24 subnet. I wish to redirect traffic sent to a specific, unallocated IP address (e.g. ...
0
votes
1answer
67 views

Block ip forwarding for specific remote ip address

I use ubuntu as gateway for several hosts. I need advise how to block ip forwarding for specific ip address or specific ip range? I tried to block ip via ufw deny rules, but it looks like ip ...
0
votes
1answer
87 views

Why does the DOCKER chain show in `ufw raw` but not using `iptables -L`

If I run sudo ufw raw, I can see an iptables chain called 'DOCKER': Chain DOCKER (2 references) pkts bytes target prot opt in out source destination 0 0 DNAT ...
2
votes
4answers
331 views

Can't set SSH port to something other than 22

When I try to set my SSH port to something other than 22 (editing /etc/sysconfig/iptables and /etc/ssh/sshd_config) I end up locked out of my server and having to boot into rescue mode to rectify the ...
0
votes
0answers
29 views

Is it possible to incorporate ndpi with iptables nfqueue?

I would like to know if it is possible to mark traffic with ndpi (ntop.org) classification engine with iptables nfqueue? Is there any example code out there? Thanks for helping.
0
votes
1answer
36 views

Unable to get OpenVPN working on Ubuntu on an OpenVZ VPS

I have TUN/TAP enabled server.conf port 1194 proto udp dev tun ca ca.crt cert server.crt key server.key dh dh1024.pem server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt push ...
0
votes
0answers
88 views

iptables redirect to 80 but origin port is still available

I've got a node.js process running at port 9500. I'm using iptables to redirect 80 to 9500 so - iptables -t nat -L outputs: Chain PREROUTING (policy ACCEPT) target prot opt source ...
1
vote
1answer
41 views

Segregating web traffic between internet and LAN using Netfilter

I have a corporate "web appliance" which allows handheld devices to connect to it over wifi. I'm trying to figure out how to allow the appliance access to the internet (so it can download vendor ...
0
votes
1answer
80 views

Why does installing vzctl on a fresh Centos6.5-minimal break network connectivity?

I seem to have encountered a bug in vzctl's installation. Upon installing it in a clean CentOS6.5-minimal installation according to the official wiki, network connectivity is limited to pinging IP ...
0
votes
3answers
672 views

Block range of IP Addresses

I am getting bombarded with attempted hacks from China all with similar IPs. How would I block the IP range with something like 116.10.191.* etc. I am running Ubuntu Server 13.10. The current line ...
0
votes
1answer
37 views

IPtables mail is not working though i allow smtp traffic

I'm working server Centos 6.5. I allowed incoming and outgoing traffic for SMTP as below though i'm unable to sent mail from server if iptables are switch on. My IPtables files rules are as below ...
1
vote
0answers
34 views

Can I use iptables to rate limit an ipset?

Is it possible to use iptable tables to rate limit an ipset ? I know you can use ipset to create a block list named blacklist i.e. ipset create blacklist hash:ip iptables -I INPUT -m set ...
0
votes
1answer
51 views

Drop all connections for a specific IP that aren't from a single source in iptables on EC2

I'm using amazon EC2 and looking to set up some firewall rules for my scenario. EC2 is strange - in case you aren't familiar with EC2 - amazon offers elastic IP addresses that resolve to private IP ...
1
vote
1answer
111 views

Shorewall: logging to custom file

I am running an Ubuntu Server 14.04 system with a shorewall firewall. Shorewall is essentially a front end to iptables, and it is iptables that does the logging via Netfilter (my understanding so ...
0
votes
2answers
57 views

iptables rules advice in debian linux

please advice: I add next iptables rules: iptables -I OUTPUT 2 -p udp --dport 53 -j ACCEPT iptables -I OUTPUT 2 -p udp --dport 1700:1750 -j ACCEPT iptables -I OUTPUT 3 -p udp -m udp --dport 1812 -j ...
0
votes
1answer
81 views

ProFTPd server behind firewall returns internal IP address

I have 2 servers, one as gateway/router, the other one as server. I use iptables to port forward the following ports: 21, 20, 65500-65600. When I connect with Filezilla or Total Commander, the ftp ...
0
votes
1answer
36 views

Logging connections on a port of a openvz container by iptables

I'm trying to log the connections that are made on the container with the IP x.x.x.x I'm sending an email using postfix by the mail command but I don't see any logs. Here is my configuration: ...
0
votes
1answer
123 views

IPTables block all traffic and only allow certain ports

I am trying to configure iptables on a CentOS 6.5. I am trying to block all traffic to the server and then only open certain ports that I need, such as port 80. At the moment I've removed port 80 from ...
0
votes
1answer
206 views

Blocking Facebook on certain IP Addresses with iptables

Here's my current environment: I have a VM running Ubuntu Server/Squid, and it is set as non-transparent. I have some IP Addresses which need to bypass Squid authentication so they have unrestricted ...
0
votes
1answer
81 views

iptables dual stack - ipv6 not working

I have problem with my iptables setup. I want to have completely dual stacked server so I use same rules for IPv4 and IPv6. However all IPv6 connections are just being dropped while IPv4 are working ...
0
votes
0answers
17 views

Redirection of nfstraffic to different host ip

I am setting up an environment with NFS. I have a setting where a SVR1 has two interfaces. I receive NFS-requests on one interface(192.168.122.2). I need to redirect these nfs request via the other ...
1
vote
1answer
504 views

proxmox KVM routed network with multiple public IPs

I have a dedicated hosting with hetzner. Additionally i have bought a 6IP subnet. My main IP is: 148.111.111.200 My main subnet is: 255.255.255.224 My additional IPs are 148.222.222.1 to ...