iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

0
votes
0answers
13 views

iptables ( help ACCEPT Rules and chain)

I have a flood on my server. I use iptables, I would like a help for it. I ACCEPT "Legitimate" IPS range but in this packets, there is some ips who flood. Next for to filter I want to limit with the ...
0
votes
0answers
69 views

Trouble with port 80 nating (XenServer to WebServer VM)

I have a rent server running XenServer 6.2 I only have 1 public IP so i did some NAT to redirect ports 22 and 80 to my WebServer VM. I have a problem with the port 80 redirection. When i use this ...
0
votes
1answer
58 views

Block rtmp and make it retry on port 80 via iptables

We have a proxy filtering connections but some sites use RTMP, which runs on port 1935. This cannot go through the proxy as proxies are port 80 only. As far as I know if RTMP fails, it will retry on ...
0
votes
2answers
33 views

IPtables - Sensible and non-contradictory rules?

This is my IPtable rules for my webserver with SSH installed, i've had help to get this far. My question is, are my rules contradictory. For example, I've been recommended to use these two lines: # ...
4
votes
3answers
187 views

IPtables locking down website allowing only SSH

I have written my first IPtables rule file to try and protect my server on all ports apart from SSH and the ports needed for the web. This is what I have come up with: i=/sbin/iptables # Flush all ...
1
vote
1answer
68 views

Iptables prerouting based on destination's DNS name?

I've got a question concerning iptable prerouting. I'm not that familiar with networking/routing/iptables so I hope this is not a stupid question, at all. So I ask for your understanding and ...
0
votes
1answer
147 views

Iptables config breaks Java + Elastic Search communication

I am trying to set up a firewall for a server hosting a java app and ES. Both are on the same server and communicate to each other. The problem I am having is that my firewall configuration prevents ...
0
votes
0answers
85 views

UDP packets are not reaching iptables NAT table

I'm trying to redirect UDP incoming packets to port 4000 to another IP with iptables: iptables -t nat -A PREROUTING -p udp --dport 4000 -j DNAT --to-destination 192.168.100.20 Unfortunately they ...
0
votes
1answer
84 views

Stop sending packets to private IPs

I have a problem that my server got locked down because it was sending packets to private IPs. My question is, what is the best solution to stop that? Here is the log that I got from my hosting ...
0
votes
1answer
98 views

SSH not working over IPSec tunnel (Strongswan)

I configured a small network on a cloud virtual machine. This virtual machine has a static IP address assigned to eth0 interface that I'll call $EXTIP. mydomain.com points to $EXTIP. Inside, I have ...
1
vote
1answer
141 views

Centos iptables configuration for Wordpress and Gmail smtp

Let me start off by saying that I'm a Centos newby, so all info, links and suggestions are very welcome! I recently set up a hosted server with Centos 6 and configured it as a webserver. The websites ...
0
votes
3answers
116 views

Why can blocked IPs get through my iptables? What's wrong with this configuration?

(Why can/How are) blocked IPs (get/getting) through my iptables? Hello and thanks for your consideration... I have configured iptables and included (below) output from the command "iptables ...
0
votes
0answers
213 views

VPN pptp connection Unable to pass through linux iptables

I have set up a windows VPN server behind Linux - Ubuntu box that is working as firewall and proxy server. Now I want people from outside to be able to connect to the VPN server, but the connection is ...
0
votes
0answers
30 views

Using NAT with iptables between corporate network and firewall'd corporate network

At work we have a firewall between two networks. I was told they opened up the two ports for me but I needed to modify the IPtables to allow packets to go through. I'm not familiar with the correct ...
9
votes
2answers
158 views

How can I write automated tests for iptables?

I am configuring a Linux router with iptables. I want to write acceptance tests for the configuration that assert things like: traffic from some guy on the internet is not forwarded, and TCP to port ...
0
votes
1answer
180 views

iptables to allow input and output traffic to and from web server only

I have an Elastic Search server which seems to have been exploited (it's being used for a DDoS attack having had NO firewall for about a month). As a temporary measure while I create a new one I was ...
6
votes
3answers
786 views

Prevent being locked out when configuring SSH and iptables [duplicate]

When you are configuring iptables or SSH over SSH and the data center is thousands of kilometers away (and getting someone there to plug in a KVM is hard), what are some standard practices to prevent ...
0
votes
2answers
74 views

Forward external traffic to 127.0.0.1 [closed]

I have an HTTP server running on 127.0.0.1:8000. How can I use iptables or something to route external traffic to it? I want to be able to access my.ip.addr:8000 from my browser. iptables -A ...
0
votes
0answers
99 views

Traffic shaping of nodejs socket.io not based on IP or Port

I have an architecture based on multiple stateless webservices loadbalanced with haproxy. Theses webservices host a cloud storage system that allow users to upload files at a predefined bandwidth ...
-2
votes
1answer
71 views

My current iptable configuration doesn't work CentOS 6, clean install [FIXED] [closed]

This is working now. ### Login as Super User su chkconfig iptables off /etc/init.d/iptables on ### Clear/flush iptables iptables -F iptables -P INPUT ACCEPT iptables -P OUTPUT ACCEPT iptables ...
1
vote
1answer
145 views

How to stabilish a VPN connection, only on port 8080

Infrastructure: Here's what I want, be able to connect to the website 10.10.100.32:8080 from my LAN on 'Router 1', and all the traffic outside the port 8080 should go to the default gateway 'Router ...
1
vote
0answers
15 views

Limit connection per domain source [duplicate]

I would like to limit my http request for only one virtualhost on apache, is it possible to do this via iptables for only one virtualhost ? I prefer to do not use apache if it's possible for better ...
0
votes
0answers
73 views

iptables: “Protocol wrong type for socket”

When I run the following command: iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT I get the following error: iptables: Protocol wrong type for socket. I've run the command ...
0
votes
1answer
45 views

rules iptables limit connection by second

Hello I have this rule: -I INPUT -m string --hex-string "|XXX|" --algo bm --dport 7777 -j DROP work's but there is some false positive. So I want to limit this rule to 5 connections accepted by ...
1
vote
1answer
309 views

CentOS 6.5 Iptables conntrack module [duplicate]

I have a VPS server on which CentOS 6.5 x64 is installed. Kernel version from uname command is 2.6.18-028stab107. When I want to use iptables rate limiting like in the following command, I got the ...
2
votes
1answer
60 views

Iptables drop hex-string udp

00:00:40.283608 IP (tos 0x0, ttl 116, id 49680, offset 0, flags [none], proto UDP (17), length 32) ip > ip: UDP, length 4 0x0000: 4500 0020 c21a 0000 6f11 1a1e 902b 4cdb E.......o....+L. 0x0010: ...
1
vote
1answer
87 views

iptables: unknown option “--dport”

When I try to run iptables -A control_in -p tcp --dport 22 -j ACCEPT I get the error message iptables v1.4.20: unknown option "--dport". Everything I've found on the internet and serverfault relating ...
3
votes
2answers
335 views

fail2ban not working on fresh install of ubuntu 14.04, why?

After installing and configuring fail2ban, I tried to login to my server through ssh with a wrong password. After a few attempts, I tried with the correct password with success. So, fail2ban didn't ...
1
vote
1answer
40 views

Relax ssh rate-limit rules for certain ip addresses

We've written some tools to automate common development tasks. One tool, for example, ensures all our git repositories are up-to-date. For this to work, our tool needs to connect to our git server and ...
0
votes
0answers
43 views

NAT answers instead of remote host

Currently I have VPN client access set up on OpenSuSE 13.1 server to third-party remote Cisco VPN IPSec server. VPN Server is set up to provide access for a host only and to provide access for a local ...
1
vote
1answer
75 views

Firewall setup Huawei 4G with DMZ

Network topology: ISP1 | | Alternative ISP 4G | | | Huawei 4G with DMZ | | ...
0
votes
2answers
48 views

ssh connection to Debian machine hangs when updating firewall rules

I am running a script which updates firewall rules on a Debian machine via SSH as well as other actions. However, after the script runs, my connection just hangs. I am able to close the terminal and ...
0
votes
1answer
64 views

iptables blocks ip address even though it is specified to allow it. Why? [closed]

I'm at a loss to explain why these rules don't have the same effect as whitelisting ip addresses. Can anyone tell me why? # /etc/hosts.deny ...
2
votes
1answer
99 views

How to route traffic through OpenVPN for the server only

I have a number of services running on my server to which I want to restrict access to only those connecting through OpenVPN. I did manage to get routing to work to a second IP I added to the ...
2
votes
0answers
38 views

firehol simple config doesn't work on Debian 7

I'm trying to set up a very simple firehol setup under a brand new Debian7 server. I only installed ssh and sudo before this Installed firehol with sudo apt-get install firehol Changed the config ...
-2
votes
1answer
33 views

iptables blocking all outbound connections

I have the following rules set up: iptables -F iptables -A INPUT -s 192.168.0.0/16 -j ACCEPT iptables -A OUTPUT -d 192.168.0.0/16 -j ACCEPT iptables -A INPUT -p tcp --tcp-flags ALL NONE -j ...
1
vote
1answer
91 views

Iptables comment module not installed

I want to use -m comment --comment "message" in my iptables rule but do not have the module loaded. Through some searching, the module I need for this is "ipt_comment" but I do not have this ...
-1
votes
1answer
88 views

Can't access EC2 Instance through SSH After iptable Flush

Before i was able to connect to my EC2 instance, then after i flush the IPTABLE, i can't access it anymore, every time i try to connect, it get TIME OUT. Error i receive: FAIL: TIMEOUT [SSH] FAIL: ...
-1
votes
1answer
32 views

how to 2 ip virtual in public dan private with forward to different destination

Here my case, Server 1 public IP in 1 box (eth0) -> 203.x.x.55/28 and 57/28 gw 203.x.x.49 private IP (eth1) -> 10.10.8.1 Server 2 private IP in 1 box (eth0) -> 10.10.8.5/24 and 7/24 gw 10.10.8.1 ...
0
votes
1answer
60 views

Correct way to open ports for fastcgi using iptables

I'm running a server with nginx and fastcgi. I'm using TCP sockets for fastcgi rather than Unix sockets as I've read that this scales better. The fastcgi server is running on fastcgi://127.0.0.1:9000. ...
1
vote
3answers
248 views

How can I achieve OpenVPN client routing without NAT on Linode

I've set up an OpenVPN network, and it is working properly in the sense that I can access the inner/LAN machines from the remote client. However, my problem is that all traffic from the remote ...
0
votes
0answers
20 views

Moving domains to servers in the local network

I have to move some of the domains from a main server to the servers behind it, placed in a local network. Currently they are only database servers that keep the databases of the projects from the ...
1
vote
1answer
19 views

Disabling network access for a group of users but allowing smtp only

We have an environment where our users ssh into the system and their shell is set to simply launch Mutt on their $HOME/Maildir. We want to restrict our users to only be able to send/receive mail. We ...
2
votes
2answers
222 views

What is the correct way to open a range of ports in iptables

I have come across articles advising for the following: iptables -A INPUT -p tcp 1000:2000 -j ACCEPT And others stating that the above will not work and iptables only supports multiple port ...
2
votes
1answer
55 views

nftables alternative for iptables -F

Simply, is there any quick alternative of iptables -F command (that just "deletes everything") for nftables? Such thing wouldn't have much theoretical purposes, but it's usually a lifesaver for ...
0
votes
0answers
95 views

Apache bench failing with error “No route to host”

Got a new dedicated box. Installed CentOS 6.5 Installed KVM Installed a CentOS 6.5 guest rsync'd websites/database/settings etc over from existing VPS. Set up "dedi.mydomain.com" in DNS to test it ...
0
votes
1answer
105 views

Can't use yum on guest - suspect port 80 forwarding in iptables on host at fault?

What's wrong with this set-up? Both host and guest are CentOS 6.5 Specifically, I can't run yum on the guest. I can ping happily to/from the guest, including pinging mirrorlist.centos.org If I ...
0
votes
0answers
260 views

“Network error: connection refused” when trying to SSH to guest VM

CentOS 6.5 host, CentOS 6.5 guest. Using kvm. VM gets a local IP from the virbr0 interface. I've set up some port forwarding in iptables. port 80 forward works, but my SSH forward does not. ...
0
votes
0answers
30 views

Forward incoming email traffic

I have two CentOS servers - one for email and one for web hosting. One domain, which we do not control, has the MX record incorrectly pointing to the web host. What iptables config is needed to ...
1
vote
2answers
78 views

How to remove all rules referring to a chain in iptables?

I have a set of scripts I designed for network monitoring, control and so on. One thing I do in these scripts is create an iptables chain like iptables -N mychain. I then insert rules into the main ...