iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

1
vote
1answer
211 views

CentOS 6.5 Iptables conntrack module [duplicate]

I have a VPS server on which CentOS 6.5 x64 is installed. Kernel version from uname command is 2.6.18-028stab107. When I want to use iptables rate limiting like in the following command, I got the ...
1
vote
1answer
36 views

Relax ssh rate-limit rules for certain ip addresses

We've written some tools to automate common development tasks. One tool, for example, ensures all our git repositories are up-to-date. For this to work, our tool needs to connect to our git server and ...
5
votes
3answers
3k views

How to regain SSH access after beeing locked out by iptables?

TL:DR I made changes to my iptables config and now SSH is refusing all connections. Can I fix this without contacting my hosting company? Long Version Ok, this is most likely 100% my own fault... ...
0
votes
2answers
39 views

ssh connection to Debian machine hangs when updating firewall rules

I am running a script which updates firewall rules on a Debian machine via SSH as well as other actions. However, after the script runs, my connection just hangs. I am able to close the terminal and ...
1
vote
0answers
68 views

iptables: unknown option “--dport”

When I try to run iptables -A control_in -p tcp --dport 22 -j ACCEPT I get the error message iptables v1.4.20: unknown option "--dport". Everything I've found on the internet and serverfault relating ...
3
votes
2answers
236 views

fail2ban not working on fresh install of ubuntu 14.04, why?

After installing and configuring fail2ban, I tried to login to my server through ssh with a wrong password. After a few attempts, I tried with the correct password with success. So, fail2ban didn't ...
0
votes
0answers
38 views

NAT answers instead of remote host

Currently I have VPN client access set up on OpenSuSE 13.1 server to third-party remote Cisco VPN IPSec server. VPN Server is set up to provide access for a host only and to provide access for a local ...
1
vote
1answer
66 views

Firewall setup Huawei 4G with DMZ

Network topology: ISP1 | | Alternative ISP 4G | | | Huawei 4G with DMZ | | ...
5
votes
3answers
4k views

Forward FTP with IPTables

I'm trying to forward an FTP-server with IPTables. The FTP-Server is running on a Windows 2008 box (Cerberus). Details Win Box: IP: 192.168.220.51 FTP-Port: 21 PASV-Ports: 11000-13000 The ...
2
votes
1answer
89 views

How to route traffic through OpenVPN for the server only

I have a number of services running on my server to which I want to restrict access to only those connecting through OpenVPN. I did manage to get routing to work to a second IP I added to the ...
0
votes
1answer
61 views

iptables blocks ip address even though it is specified to allow it. Why? [closed]

I'm at a loss to explain why these rules don't have the same effect as whitelisting ip addresses. Can anyone tell me why? # /etc/hosts.deny ...
1
vote
3answers
181 views

How can I achieve OpenVPN client routing without NAT on Linode

I've set up an OpenVPN network, and it is working properly in the sense that I can access the inner/LAN machines from the remote client. However, my problem is that all traffic from the remote ...
1
vote
2answers
1k views

how to limit upload bandwidth per user in linux?

Can anyone provide the tc command to limit upload bandwidth per user in Debian Lenny? I found that to mark packets per user with iptables I can use the following command iptables -t mangle -A OUTPUT ...
2
votes
0answers
30 views

firehol simple config doesn't work on Debian 7

I'm trying to set up a very simple firehol setup under a brand new Debian7 server. I only installed ssh and sudo before this Installed firehol with sudo apt-get install firehol Changed the config ...
-2
votes
1answer
31 views

iptables blocking all outbound connections

I have the following rules set up: iptables -F iptables -A INPUT -s 192.168.0.0/16 -j ACCEPT iptables -A OUTPUT -d 192.168.0.0/16 -j ACCEPT iptables -A INPUT -p tcp --tcp-flags ALL NONE -j ...
1
vote
1answer
2k views

Failed to retrieve directory listing in Filezilla connecting to vsftpd

newbie here. At first I was unable to connect to vsftpd but I added port 21 in iptables (i'm running on Centos 6) and managed to make it work. But now, I can't get past Command: LIST in Filezilla ...
1
vote
1answer
84 views

Iptables comment module not installed

I want to use -m comment --comment "message" in my iptables rule but do not have the module loaded. Through some searching, the module I need for this is "ipt_comment" but I do not have this ...
-1
votes
1answer
31 views

how to 2 ip virtual in public dan private with forward to different destination

Here my case, Server 1 public IP in 1 box (eth0) -> 203.x.x.55/28 and 57/28 gw 203.x.x.49 private IP (eth1) -> 10.10.8.1 Server 2 private IP in 1 box (eth0) -> 10.10.8.5/24 and 7/24 gw 10.10.8.1 ...
0
votes
1answer
53 views

Correct way to open ports for fastcgi using iptables

I'm running a server with nginx and fastcgi. I'm using TCP sockets for fastcgi rather than Unix sockets as I've read that this scales better. The fastcgi server is running on fastcgi://127.0.0.1:9000. ...
-1
votes
1answer
71 views

Can't access EC2 Instance through SSH After iptable Flush

Before i was able to connect to my EC2 instance, then after i flush the IPTABLE, i can't access it anymore, every time i try to connect, it get TIME OUT. Error i receive: FAIL: TIMEOUT [SSH] FAIL: ...
18
votes
3answers
14k views

iptables port redirect not working for localhost

I want to redirect all traffic from port 443 to the internal port 8080. I'm using this config for iptables: iptables -t nat -I PREROUTING --source 0/0 --destination 0/0 -p tcp ...
0
votes
0answers
20 views

Moving domains to servers in the local network

I have to move some of the domains from a main server to the servers behind it, placed in a local network. Currently they are only database servers that keep the databases of the projects from the ...
1
vote
1answer
19 views

Disabling network access for a group of users but allowing smtp only

We have an environment where our users ssh into the system and their shell is set to simply launch Mutt on their $HOME/Maildir. We want to restrict our users to only be able to send/receive mail. We ...
2
votes
1answer
51 views

nftables alternative for iptables -F

Simply, is there any quick alternative of iptables -F command (that just "deletes everything") for nftables? Such thing wouldn't have much theoretical purposes, but it's usually a lifesaver for ...
2
votes
2answers
2k views

iptables and multiple ports

This doesn't work for me: # iptables -A INPUT -p tcp --dports 110,143,993,995 -j ACCEPT iptables v1.4.7: unknown option `--dports' Try `iptables -h' or 'iptables --help' for more information. ...
0
votes
0answers
133 views

Iptables - limiting connections to port range

I want to limit connections to my server to one connection per second on every port in range 10000:65535 I started using this rule: iptables -A INPUT -p tcp --syn --dport 10000:65535 \ -m ...
0
votes
2answers
202 views

IPTables Range of Ports

-A INPUT -m state --state NEW -m tcp -p tcp --dport 20000:25000 -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 20004 -j ACCEPT Those are my two rules I made in my iptables in an ...
2
votes
2answers
208 views

What is the correct way to open a range of ports in iptables

I have come across articles advising for the following: iptables -A INPUT -p tcp 1000:2000 -j ACCEPT And others stating that the above will not work and iptables only supports multiple port ...
20
votes
6answers
17k views

Denyhosts vs fail2ban vs iptables- best way to prevent brute force logons?

I'm setting up a LAMP server and need to prevent SSH/FTP/etc. brute-force logon attempts from succeeding. I've seen many recommendations for both denyhosts and fail2ban, but few comparisons of the ...
0
votes
0answers
86 views

Apache bench failing with error “No route to host”

Got a new dedicated box. Installed CentOS 6.5 Installed KVM Installed a CentOS 6.5 guest rsync'd websites/database/settings etc over from existing VPS. Set up "dedi.mydomain.com" in DNS to test it ...
0
votes
1answer
94 views

Can't use yum on guest - suspect port 80 forwarding in iptables on host at fault?

What's wrong with this set-up? Both host and guest are CentOS 6.5 Specifically, I can't run yum on the guest. I can ping happily to/from the guest, including pinging mirrorlist.centos.org If I ...
0
votes
0answers
172 views

“Network error: connection refused” when trying to SSH to guest VM

CentOS 6.5 host, CentOS 6.5 guest. Using kvm. VM gets a local IP from the virbr0 interface. I've set up some port forwarding in iptables. port 80 forward works, but my SSH forward does not. ...
0
votes
0answers
30 views

Forward incoming email traffic

I have two CentOS servers - one for email and one for web hosting. One domain, which we do not control, has the MX record incorrectly pointing to the web host. What iptables config is needed to ...
1
vote
2answers
70 views

How to remove all rules referring to a chain in iptables?

I have a set of scripts I designed for network monitoring, control and so on. One thing I do in these scripts is create an iptables chain like iptables -N mychain. I then insert rules into the main ...
3
votes
2answers
1k views

Debian 'ignores' /etc/network/if-pre-up.d/iptables

I want my iptables rules to automatically be loaded on startup. According to the wiki on Debian this can be done by placing a script with the name iptables in /etc/network/if-pre-up.d/ So I did, this ...
5
votes
3answers
5k views

How do I delete a blocked IP?

I'm trying to remove a blocked IP from our server. 405 35964 DROP all -- !lo * IP ADDRESS 0.0.0.0/0 19 988 DROP all -- * !lo 0.0.0.0/0 ...
1
vote
1answer
41 views

Segregating web traffic between internet and LAN using Netfilter

I have a corporate "web appliance" which allows handheld devices to connect to it over wifi. I'm trying to figure out how to allow the appliance access to the internet (so it can download vendor ...
0
votes
2answers
39 views

Saving manually edited iptables

Ok, so I'm the kind of person that changes IPTABLES by editing /etc/sysconfig/iptables, what's the way to make them save so that someone accidentally using "iptables save" doesn't overwrite them?
0
votes
1answer
43 views

How do I test my firewall rules?

I've setup some rules in ufw and I've turned it on. Now I want to ensure my rules actually block traffic. However, when running nmap -PN -p <my_port> <ip> from my local workstation it ...
2
votes
1answer
45 views

iptables traversal and the chain policies, manual editing

I like editing the iptables file manually, but there's something that confuses me a bit. From how I have understood iptables from the manual, it traverses the rules from top to bottom, and if no ...
-2
votes
2answers
110 views

IPtables - opening ports not working

I am writing a script to open ports based on a textfile, and am having problems opening these ports. For instance, I have tried opening port 18819 by entering the command /sbin/iptables -A INPUT -m ...
2
votes
1answer
94 views

Redirect all traffic sent to an unallocated alias IP within a VPN subnet, to a fixed IP within another VPN

I have a server hosting multiple bridged (i.e. tap) VPNs using openvpn, where each VPN has a different 10.8.X.0/24 subnet. I wish to redirect traffic sent to a specific, unallocated IP address (e.g. ...
0
votes
3answers
158 views

Routing between two subnets using a Linux box with two NICs

I have a Linux box with two NICs, each connected to a different LAN: Network A: 192.168.1.0 255.255.255.0 Network B: 192.168.2.0 255.255.255.0 The routers are: 192.168.1.1 192.168.2.1 Linux NICs are ...
0
votes
1answer
149 views

Linux Port Forwarding to different IPs

this is my scenario: Netbook (192.168.1.2) ===> (192.168.1.1) Linux Server (192.168.0.4) ===> NAS (192.168.0.2) Netbook (192.168.1.2) ===> (192.168.1.1) Linux Server (192.168.0.4) ===> Router ...
4
votes
3answers
1k views

iptables nat does not exist

Today my iptables nat on the host system stopped working and I have no clue what happend! (That's very bad, I know) All commands are executed as root user. If I run $ iptables -t nat -L I get the ...
0
votes
0answers
14 views

Impact of iodined settings to server

I would like to install iodined, the IP tunnel via DNS, on a working web server. However, the configuration requires to set IP forwarding add NAT masquerading rules to iptables (and open DNS port) ...
0
votes
1answer
66 views

Block ip forwarding for specific remote ip address

I use ubuntu as gateway for several hosts. I need advise how to block ip forwarding for specific ip address or specific ip range? I tried to block ip via ufw deny rules, but it looks like ip ...
1
vote
3answers
265 views

ipv6 on Ubuntu server - how do I secure?

On our Ubuntu server, ipv4 & ipv6 are enabled. We have taken these steps so far. Enabled iptables & ip6tables Copied the rules exactly from our iptables to ip6tables Do we need to make ...
0
votes
1answer
86 views

Why does the DOCKER chain show in `ufw raw` but not using `iptables -L`

If I run sudo ufw raw, I can see an iptables chain called 'DOCKER': Chain DOCKER (2 references) pkts bytes target prot opt in out source destination 0 0 DNAT ...
2
votes
4answers
331 views

Can't set SSH port to something other than 22

When I try to set my SSH port to something other than 22 (editing /etc/sysconfig/iptables and /etc/ssh/sshd_config) I end up locked out of my server and having to boot into rescue mode to rectify the ...