iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n
1
vote
2answers
39 views
iptables log ssh successful attempts that match known ips
I am unsure of how to log successful ssh attempts that match an IP address from GOOD_IPS. So far I am only logging incoming and outgoing attempts whether or not the related IP addresses are allowed or ...
0
votes
1answer
71 views
gateway iptables dns redirect
I'm having a problem with redirecting pc's dns requests to a local dns server. I want to block access to other dns services except my own. I've found different methods of doing this, none work here. ...
0
votes
1answer
31 views
How to configure iptables rules for connecting 2 eth to the net (forwarding & masquerading)
need some help on configuring iptables rule for forwarding and masquerading
Given I have these configuration:
switch1 ---- (eth1) ----- router ---- (eth2) ----- switch2
...
0
votes
0answers
25 views
SolusVM Slave - custom iptables
I want to add some custom lines to /etc/sysconfig/iptables.
I can do this but Solusvm flushes the rules using iptables-save every 5 minutes.
It does not always remove them and they survive a reboot ...
1
vote
1answer
58 views
iptables - sendmail send out only
I have had a look around and tried a number of things.
If I want a (centos) server to only be able to send emails (notifications to me) but have no other internet access in or out then what are the ...
-2
votes
1answer
26 views
connect to tap interface [closed]
Im working on proxy
I have this setup
LAN---[eth0 tap0]
LAN = 172.16.0.0/26
eth0 = no ip promisc
tap0 = 192.168.0.1/24
I want to communicate LAN with tap0 ?
-1
votes
1answer
52 views
Debian 6, ports closed anyway
I ran all the following commands
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT
iptables -P OUTPUT ...
0
votes
2answers
42 views
How to open all ports for specific length of time?
I'd like to open all ports for specific user for specific length of time using IPtable. The current rule i have is:
$IPTABLES -A FORWARD -i $LAN_IF -o $OUTSIDE_IF -p tcp -s 192.168.10.34 -m state ...
0
votes
0answers
51 views
Forward all incoming traffic from a specific IP to local port (in use by ssh proxy connection)
So what I'm trying to do is have tcp/udp incoming traffic from source IP 192.168.1.100 be routed to localhost:12345. localhost:12345 is used in an ssh socks proxy to my server with Internet access.
...
0
votes
0answers
70 views
apache + squid: captive portal with login page
I'm setting up a captive portal in which a user would be able to access the web only after a login.
The tools I'm using are apache and squid.
It seems that this could be achieved configuring iptables ...
0
votes
2answers
60 views
Debian router drops connection
I have a home network with a debian server running kernel 3.8 setup as a router, doing DHCP, DNS-caching, samba and Squid.
The motherboard is a Gigabyte GA-Z77X-UD5H with two ethernet ports, one Intel ...
0
votes
3answers
146 views
iptables rule to stop DDOS
My server is undergoing a ddos attack with the traffic in my apache logs appearing like:
ip address - - [11/Apr/2013:01:01:04 -0600] "POST / HTTP/1.1" 416 31 "-" "Microsoft Internet Explorer"
ip ...
1
vote
2answers
74 views
Iptables drops ACK FIN package in my AP
I have a Access Point on my Ubuntu machine with iptables. The machine has eth0 and wlan0 that is bridged to form the interface br0.
There should not be any firewall between eth0 and wlan0, I want the ...
0
votes
1answer
53 views
iptables nat taking 30 seconds to start redirecting
I am implementing a SIP Proxy that should be able to redirect all RTP traffic between two clients that can't reach each other. To implement that, I decided to manipulate the negotiated addresses in ...
2
votes
1answer
108 views
Configuring ufw or iptables to allow only outbound traffic to the Internet from an internal IPv6 network
How do I configure ufw or iptables to allow only outbound traffic from an IPv6 network to the Internet?
I have an office network with a traditional NAT setup for IPv4. I would like to add a PC ...
2
votes
1answer
89 views
Using IPtables to prevent users on your server from port scanning other servers
Some of our users are launching port scans on Internet servers. These users connect to our servers using ssh and openvpn. We obviously suspend their accounts where appropriate however I'd like to find ...
0
votes
1answer
99 views
How to reset Ubuntu 12.04 iptables to default without locking oneself out?
Could anyone kindly provide the commands to completely reset the iptables (firewall) for Ubuntu 12.04 to its default "factory" setting? From what I understand, doing this wrong would cause one to be ...
0
votes
1answer
96 views
Unable to SFTP (but can SSH) - Using port other than 22
I followed the iptables here:
http://wiki.debian.org/iptables
I replaced the standard Port 22 in sshd_config with Port 1234
Currently I'm able to SSH via Port 1234, but unable to SFTP using ...
0
votes
1answer
30 views
Expressing iptables rule as shorewall rule
I have been working with a Centos server for a while now. I have set 3 subnetworks in my LAN through alias networks (etho:o, eth0:1, etc). I have a sharer printer in one of those networks, and I would ...
0
votes
0answers
85 views
Ubuntu 12.10: wvdial connection shared through NAT resets and reconnect with every packet request
I'm having this problem: I'm sharing my wvdial modem connection through NAT configuration with these commands:
$ sudo iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -o ppp0 -j MASQUERADE
$ sudo ...
0
votes
0answers
28 views
Some netfilter log messages are missing a log prefix
I added logging rules to all of netfilter's built-in chains using the following script:
https://gist.github.com/anonymous/5330491
All logging rules get the correct --log-prefix argument (verified by ...
0
votes
1answer
31 views
IPTABLES doesn't store the ip address entered inside the rule
I'm working on a debian server and when i add the following rules to forward a port to a lan address:
iptables -t nat -I PREROUTING -p tcp -d 192.168.1.1 --dport 3385 -j DNAT --to-destination ...
0
votes
1answer
94 views
I can connect, but cannot ping/route to remote VPN computers
Setup:
L2TP VPN Server on a Windows Server 2008 machine which is behind a router, which is behind a modem/router.
Modem/Router (IP: 192.168.2.1, Subnet: 255.255.255.0, DHCP serves 192.168.2.2 to ...
0
votes
1answer
60 views
Iptable forward configuration
I have OpenVPN and PPTP installed on a VPS. I'm having a few questions that I can't seem to get a firm answer on.
I want to install OpenVPN on 1.1.1.1 (eth0, public IP address) and PPTP on 1.1.1.2 ...
-2
votes
1answer
38 views
Allow LAN to access External Internet, Iptables
I have an internal network behind my router on eth0, and I have my router connected to the internet thorugh wlan0. I can't access the internet from inside the lan, how can I fix this?
wlan0: ...
0
votes
1answer
34 views
Aggregate switch ports to go through different iptables servers acting as firewalls?
Scenario: One internet connection with the need to firewall a very high number of pps, without having to invest in expensive hardware firewalls. I do not have a specific number of pps to aim after, ...
-2
votes
1answer
33 views
How to disable all Ip address except my ip address in linux iptables [closed]
I need to disable all ip address including all ports except few ip address. I want to access the server only from few ip address, i do not want to access the server from other ip address.
0
votes
1answer
126 views
NAT / Port Forwarding with iptables firewall [duplicate]
I've got the following setup:
firewall (iptables)
eth0 internal interface, 192.168.2.10
ppp0 external interface, public_ip (IP masquerading)
server1 (192.168.2.11), service 1 (port 443)
server2 ...
1
vote
2answers
69 views
OpenVPN Endpoint to endpoint using the real IPs
I want to connect two servers to eachother over the internet. For various reasons I cannot use IPSec for this.
I would like traffic to be transparently encrypted as if I was using IPSec transport ...
1
vote
1answer
106 views
DHCP reply packets do not make it into KVM instance in OpenStack
I'm running a KVM instance inside of OpenStack, and it isn't getting an IP address from the DHCP server.
Using tcpdump, I can see the request and reply packets on vnet0 of the compute host:
# ...
1
vote
1answer
65 views
Slow Network Transfer Through Linux Firewall VM
We have a RedHat 5.8 VM running on ESX on top of Cisco UCS that is acting as a firewall using iptables. The box has multiple nics, one nic serves as the gateway to our network with the other nics ...
1
vote
0answers
29 views
Ping respones to floating IPs don't reach the router (iptables/nat)
I'm running OpenStack, and I'm having trouble accessing my instances from floating IPs, from anywhere except the network controller node.
I've got a Folsom deployment with FlatDHCP, not running ...
0
votes
0answers
19 views
Preventing abuse on a local VPN Network [closed]
Are there ways to secure a public VPN to prevent people who are on from attempting to dos or port scan other hosts on the same local network on an OpenVPN VPN?
3
votes
1answer
51 views
iptables, what to open on INPUT for wget
I am configuring my iptables. The policy for OUTPUT is ACCEPT. Though INPUT is DROP. I am wondering what I need to open up on INPUT so I can receive responses on outgoing traffic (automatic or manual, ...
1
vote
1answer
94 views
how to load /etc/sysconfig/iptables on server reboot
To enable port 7070 on my server I've run
iptables -A INPUT -p tcp -m tcp --dport 7070 -j ACCEPT
through SSH and then
service iptables save
which saved rules to /etc/sysconfig/iptables file.
...
0
votes
2answers
52 views
Restricting ICMP using iptables
I have the following rule,which i believe will restrict icmp packets to 1/s.
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [7:988]
-A INPUT -i lo -j ACCEPT
-A INPUT -p icmp -m icmp ...
0
votes
1answer
135 views
Using iptables to forward traffic to a single IP address
The setup:
Debian; acting as the network's router using iptables, fail2ban
Because of external requirements, both networks are 192.168.1.x.
eth0: 192.168.1.1
eth1: 192.168.1.2
Ubuntu (192.168.1.3) ...
0
votes
1answer
74 views
Allowing port 22 on localhost VPN only
I rent a remote server, and run an OpenVPN service on this server. I am trying to secure my firewall (iptables) so the only person who can access SSH is somebody connected to the VPN (localhost). ...
0
votes
1answer
586 views
Setting up Firewall in CentOS 6.4
I need to ask a general question about installing certain packages and the need to make iptable adjustments in centOS; When I installed the apache package and put a simple test page in /var/www/html, ...
0
votes
1answer
35 views
clever way to update iptables firewall without clearing the counters
can I somehow reload firewall rules using iptables-save definition, without clearing the current runtime version counters?
I want some way to only add and remove different rules and keep the old ones ...
0
votes
2answers
122 views
ubuntu: open udp port 123
into my linux server (Ubuntu 8) I have top open the port 123 for ntp.
I have write this into /etc/iptables.rules:
:INPUT ACCEPT [7496:9080183]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [4393:322232]
[0:0] ...
1
vote
1answer
48 views
Is it insecure to use the following iptable rule for NAT?
I want to setup a VPN server for personal use, so I follow the blog article [1], and it work like a charm.
The only thing I am wondering is if the iptable's rule secure, e.g.
iptables -t nat -A ...
0
votes
3answers
84 views
iptables FORWARD 80 to 8080, no direct access on 8080
iptables -A INPUT -p tcp -m multiport --dports 80,443,8080,8181 -m state --state NEW -m limit --limit 50/minute --limit-burst 200 -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dports ...
0
votes
4answers
133 views
Configuring iptables: blocked out on SSH
I am trying to configure a testserver based on CentOS 6.4.
I have changed the default SSH port to another port, 56988. Now I am trying to create a set of rules in order to:
Allow connections on ...
0
votes
2answers
47 views
NAT from Pvt ip to PublicIP
I have a gateway machine with 2 NIC: eth0 with public IP and eth1 with private IP.
On eth0 I have 4 public IP aliased, I wanted to NAT public IP to private IP and I used DNAT to do that uisng ...
0
votes
1answer
32 views
Can't Access CouchDB Remotely
Please keep in mind that I have this installed on an Amazon EC2 instance running the latest version of Ubuntu Server.
I have changed the bind_address to 0.0.0.0.
netstat -an | grep 5984 yields the ...
0
votes
0answers
46 views
Problems configuring iptables to allow access to Facebook APIs
I'm currently working on an application that heavily relies on access to the Facebook API in order to function. Among other things, calls to the Facebook graph APIs are made, and images need to be ...
0
votes
0answers
43 views
Changing iptables on EC2, what are the consequences?
I was just going through some tutorials how to setup openvpn on ec2 and came across this iprouting:
sudo modprobe iptable_nat
echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward
sudo iptables-save > ...
0
votes
1answer
152 views
nf_conntrack: table full, dropping packet
Mar 24 03:29:26 kernel: [1557411.243821] TCP: time wait bucket table overflow (CT0)
Mar 24 03:29:26 kernel: [1557411.243828] TCP: time wait bucket table overflow (CT0)
Mar 24 03:29:26 kernel: ...
3
votes
1answer
131 views
Rotating outgoing IPs using iptables
I am trying to rotate outgoing IPs using iptables. I want to rotate outgoing connections between three IPs, one by one. Here is what I'm doing with iptables:
root@server:~# iptables -t nat -I ...
