iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

0
votes
0answers
126 views

iptables forward port range through OpenVPN

I have a VPN server (the "host" - 10.8.1.1) on a public VPS instance running OpenVPN. The second instance I am running (the "client" - 10.8.1.2) is a local ESXi instance connected to the host vpn ...
0
votes
0answers
52 views

iptables on router: why does nat prerouting not intercept packets?

There is a Debian Wheezy box with OpenVZ kernel (IP 1.1.1.1), working as router between Internet and VPS'es (IPs 1.1.1.100 and 1.1.1.200). Incoming packets addressed directly to VPS'es are normally ...
-1
votes
1answer
64 views

How should I properly block outgoing http traffic with iptables

I'm experimenting with iptables, and I'm trying to allow all outgoing requests for HTTPS, but to block HTTP. I have the code below; Chain INPUT (policy ACCEPT) target prot opt source ...
1
vote
1answer
59 views

Does “TARPIT” have any known vulnerabilities or downsides?

TARPIT can be used to waste an attacker's resources, thus slowing down his attacks and lowering his ability to attack other hosts... looks like a good idea. It is provided as a Netfilter addon and ...
0
votes
0answers
27 views

What should be the correct http response code for custom proxy login/register page

I configured a firewall rule on a dd-wrt router to redirect http connections to a shell script, and drop the remaining ports, for the unregistered range of IPs. I am trying to tell the clients they ...
0
votes
4answers
81 views

Create IP nullroute blacklist from text file

I've seen various guides out there for how to nullroute a single IP address, and I've done that before. However, I'm not sure how to nullroute a group of IP addresses. Going through each one ...
0
votes
0answers
37 views

drop smtp live connection

So the problem is that I think my server got DDoS attack with SMTP packet (my mail server). What I can see is that the attacker abuse the smtp_connection_cache. The attacker keep connections (smtp) ...
0
votes
0answers
35 views

OpenVPN in bridged mode, confusion about interfaces

I'm trying to understand some fundamental OpenVPN/networking basics. Let's assume the following scenario: there is an openVPN server which is already configured properly it runs in bridged mode the ...
1
vote
0answers
42 views

Iptables multiport and source ip

I have a rule which does not seem to allow traffic as expected -A INPUT -p tcp -m state --state NEW -m multiport -s x.x.x.x -d y.y.y.y --dports 38000:38100 -j ACCEPT If I remove the -s argument ...
0
votes
1answer
53 views

sip unreachable after changing routes using linux router

SIP server was unreachable after changing routes. I have 2 ISP ,ISP 1 is my default and ISP 2 is my back-up. I have a dialer behind linux router linux. Linux router has 3 ethernet cards. Router ...
2
votes
0answers
43 views

Understanding an OpenVPN bridge from iptable's point of view

In my scenario, there is a machine which acts as both an iptables-based firewall and an OpenVPN-server at the same time. It has two network interfaces - eth1 is connected to the internet whereas eth0 ...
1
vote
0answers
47 views

Change sender-IP for VM in libvirt behind NAT

I have a server with my own public /28 IPv4 Network. On this server I have some vServers, done with KVM/libvirt. These vServers are connected with a virtual network, NATed to the internet. Every ...
3
votes
4answers
186 views

IPTables: allow outgoing SSH

I tried to write my rules for securing a web server with just http/https, apt-get updates, sending mails SSH access. So far I've done that: IPT=/sbin/iptables $IPT -F $IPT -X $IPT -t nat -F $IPT -t ...
0
votes
1answer
85 views

SecAst blocking IP's that fail2ban is not

I'm using SecAst on my Asterisk server as well as fail2ban. (Setup as an option as per the SecAst installation guide). I did this to test if SecAst is working right. I planned to remove fail2ban if ...
0
votes
0answers
35 views

Why can't some user accounts access certain remote ports?

I am trying to troubleshoot a couple issues on RHEL 6.5 that seem related. In both cases, a user on a machine (seperate machines) cannot access a service (seperate services) on a remote machine. In ...
0
votes
2answers
98 views

iptables for ipv6 address port forwarding to localhost port

Say I want to redirect 2a00:1450:400c:c01::71 on Port 443 to localhost Port 12345. How to do that with Iptables? Update Okey, it's Weechat which running an SSL relay on a port >=1000. It can make ...
0
votes
0answers
38 views

Packets are not routed by iptables, how to debug

I'm using OpenStack and OVS. This is my case: From a remote host, I ping VM with IP A. Local gateway received the echo request, then send a packet with IP A and MAC address A' (based on a fixed ...
0
votes
1answer
37 views

Cannot browse web server

I have a server running Apache on Centos 6.4 and I cannot get to browse the box - SSH works fine and as does FTP but nothing http will work. httpd is started, SELinux is not running and I have opened ...
1
vote
1answer
21 views

Linux iptables DNAT 53306 to 127.0.0.1 3306

mysql real port is 3306。 I want public network using 53306 to visit mysql,and 3306 not allowed access from public network. How to write the iptables rules DNAT 53306 to 127.0.0.1 3306 ? help me
0
votes
1answer
42 views

iptables slows down outgoing web request

Before I enabled iptables, requests via curl to this url were instant. But after configuring iptables it takes almost 30-40 seconds to get response. How do I make particular url white listed so it can ...
2
votes
1answer
109 views

Error: iptables: No chain/target/match by that name [duplicate]

I am trying to configure proxy server on RHEL Server 6.5 using Squid and iptables. Below is the command I executed and the error message it displayed: vzlptest01 root [root] > iptables -A INPUT -i ...
0
votes
1answer
99 views

Port forward remote desktop without a gateway over 3G modem router [closed]

I'm trying to connect from a laptop, through a VPN, and a 3G modem/router, to a remote PC / computer. PC (192.168.1.33) | 3G Modem (192.168.1.22) | [3G internet, connecting to VPN] | ...
0
votes
1answer
35 views

Using OpenVPN and iptables in combination

Let's imagine there are three networks, WAN, LAN-A and LAN-B. In between, there is a firewall server connecting the networks to each other. iptables ensures the following things: There is no way for ...
0
votes
0answers
28 views

Simple MASQUERADE NAT between 2 VM

I'm on a cloud service and I'm trying to set up NAT between two VM. I've never experienced issues in this simple step, but this time is different and I'm near to give up. The first VM had two ...
-1
votes
4answers
221 views

Is there anyway to tell what user will receive data from inbound packet?

In linux, considering this use case: 1. User initiates http request for webpage to remote server 2. Remote server answers request and sends packets Is there any reference to the user who started ...
0
votes
2answers
77 views

Forward SSH request to an External Server to an Internal Server

I have a VM config currently where I have 1 external IP pointing to a VM with an Nginx HTTP Reverse proxy serving HTTP Web Pages from several internal VMs without external IPs. I need a similar setup ...
0
votes
4answers
167 views

iptables not installed on centos

If a machine does not have iptables installed, is there still a firewall running? If yes, how to I disable / change rules? if I enter the command iptables I receive the response: iptables v1.4.7: ...
0
votes
1answer
112 views

No route to host centos

I am trying to allow a port through a firewall on centos 6. The error I am receiving is telnet: connect to address 80.xx.xx.xx: No route to host The port I am trying to allow is 5666. If I disable ...
0
votes
1answer
88 views

Is it possible to make the server accessible from two internet connections

how to make this: have: Centos 6.5 WAN1 eth0 44.44.44.44 (DEFROUTE=yes) WAN2 ppp0 95.95.95.95 (DEFROUTE=no) HTTP server work and available only in eth0 DNS server work but port 53 blocked in ...
0
votes
3answers
63 views

Packages drop when using iptables NAT

We are using NAT made with iptables. However when there are lots of connections (or sessions) through NAT server packages start to drop. There is no log in syslog etc. I think this is caused by sysctl ...
0
votes
1answer
38 views

squid3 with tcp_outgoing_address could not connect to anywhere

I have one server with 3 interfaces (3 physical lan card), which are connected to 3 different routers. Each router has a different subnet, i.e. the 3 interfaces of server belong to 3 different ...
0
votes
2answers
58 views

resetting iptables seems to make connections clear faster

I have iptables setup on 2 servers. Server#1 is public and Server#2 only allows the ip address of Server#1 to have ACCESS. Server#2 has a mySQL database that Server#1 queries. I ran a query and it ...
1
vote
0answers
22 views

How to test if packet has been tagged with classid

I'm trying to troubleshoot an issue I'm having related to IFB Mirroring which I'm attempting to deploy based on this question: Tc: ingress policing and ifb mirroring My theory is that since the ...
0
votes
0answers
20 views

forwarding an incoming ip multicast packet over another interface

Is it possible to forward an incoming IP multicast packet out of a specific interface using iptables rules if the incoming packet already has a TTL > 1? (The incoming interface is a GRE tunnel ...
1
vote
0answers
38 views

Firewall rejecting UDP “connections”?

I have a server that is aggregating logs from various other servers. It mostly works great, however from time-to-time (right after a reboot, but not all reboots) it will decide that various UDP ...
0
votes
0answers
45 views

iptables not forwarding traffic from 80 to 8000

iptables is proving to be a very complicated tool for me to use. I'm trying to do the following: Accept all packets on 80, 443, 22 Forward packets received from 80 to 8000 Accept packets from only ...
-2
votes
1answer
45 views

IPTables Block Many IPs Using Domain

DROP all -- 114-43-XXX-XXX.dynamic.hinet.net anywhere DROP all -- 118-161-XXX-XXX.dynamic.hinet.net anywhere These are just two of the several restrictions I have in IPTables right ...
0
votes
1answer
89 views

Iptables: Matching packets for bridged interface

I'm building a firewall configuration tool based on iptables, and trying to get a "bump in the wire" scenario working. Given a setup with eth0 and eth1 in a bridge br0 and a third interface eth2: ...
0
votes
0answers
72 views

Iptables - Port forwarding has no effect

I have a dedicated server with a single public IP (Say 1.2.3.4) running CentOS. Via virt-manager, I added a virtual machine, running CentOS as well. They are connected through a virtual network: ...
0
votes
1answer
60 views

Limit incoming connections using iptables per IP

I need to limit access to some port per IP. Let's say 5 connections per minute - not more. I've seen iptables recent, connlimit and limit, but all of them are not fitting exactly what I need. ...
0
votes
0answers
68 views

Iptables INVALID packet from akamai and google to linux

I set up the firewall rules below (I also blacklisted the IPV6 Module): iptables -A INPUT -m conntrack --ctstate INVALID -j LOG --log-level debug --log-prefix '[FW INVALID]: ' iptables -A INPUT -m ...
-2
votes
3answers
45 views

How do I get iptables to allow a new port (for a webserver sockets handler)

In the local development server, I don't have any iptables rules (running on a Mac). The production server however, runs CentOS 6 with certain rules. I need to add a rule that allows the client to ...
0
votes
3answers
69 views

Reverse Proxy Linux Containers

I am trying to set up a reverse proxy on my ubuntu 14.04 host so that I can run multiple websites, each in their own LXC container (one day docker but one step at a time). In this example the ...
-1
votes
1answer
36 views

iptables: REJECT not working, but DROP does

I have recently setup a server with fail2ban, and it is mostly working except I am getting errors whenever this command tries to execute: sudo iptables -D fail2ban-ssh -s xxx.xxx.xxx.xxx -j REJECT ...
3
votes
1answer
116 views

Fail2Ban: already banned?

I have Fail2Ban running on my Centos Server. (Config below) In my var/log/messages I noticed something really weird: Jun 19 12:09:32 localhost fail2ban.actions: INFO [postfix] 114.43.245.205 ...
4
votes
1answer
85 views

Iptables counters restore, when using quotas, not working as expected

I've set a quota for a certain computer: iptables -A FORWARD -d 192.168.1.10 -m quota --quota 500000000 -j ACCEPT iptables -A FORWARD -d 192.168.1.10 -j DROP This works as expected. When the limit ...
-5
votes
1answer
37 views

How to route to next server? [closed]

I must route all traffic from first server to second server and next to third server. Like this: server1 -> server2 -> server3 I use Debian Wheezy. Can anyone tell how to do this with iproute?
0
votes
1answer
114 views

Connection tracking not working in a Debian 7 OpenVZ VPS

I have a small VPS instance (used for web hosting) that runs Debian 7, and for a few weeks I have issues with my firewall and connection tracking. I had no issue for months, but without any system ...
0
votes
2answers
41 views

Openning a port in my CentOS server [closed]

I'm trying to open a port in my CentOS server... I tried using iptables, adding the "-A INPUT -p udp -m udp --dport portnum -j ACCEPT" and didn't work. I tried installing CSF, adding the ports and ...
0
votes
1answer
47 views

Unable to get out of rescue mode after a spontaneous reboot

I am experiencing a weird problem where the CentOS 6.5 system I was using spontaneously underwent a restart that was not authorized by me, and then enters Rescue Mode, where I am unable to diagnose ...