iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

1
vote
1answer
230 views

Huge performance penalty in gbit link with ip forwarding / masquerade through clear VPN tunnel

I have a problem with IP forwarding between my home computer and a remote server (from online.net). My home connection is a 1 Gbit/s FTTH and the remote server has a 2.5 Gbit/s bandwidth. The context ...
1
vote
2answers
45 views

iptables nat same port, multiple providers

my configuration: # ip route sh zzz.zzz.zzz.0/24 dev eth3 proto kernel scope link src zzz.zzz.zzz.1 yyy.yyy.yyy.0/24 dev eth1 proto kernel scope link src yyy.yyy.yyy.146 xxx.xxx.xx8.0/23 dev ...
0
votes
1answer
63 views

Multiple Gateways for Single Subnet

Right, this might be a long one, so bare with me... I have 2 machines, lets call them local1 and cloud1. local1 has 3 Nics: 2 connected directly to cable modems with public IPS (call them eth0 and ...
1
vote
3answers
138 views

Forward traffic between VLANs with iptables

We're having the following 4 VLANs on my network, connected to an Ubuntu Linux box with DHCP. This Linux should act as the L3 router as well. VLAN 10 on interface eth1.10 with subnet 10.10.10.0/24 ...
1
vote
1answer
61 views

pacemaker virtual ip loadbalancing with clone and clusterip

I am trying to make a loadbalanced gateway for a group of natted machines. I have 3 centos nodes. Initially only one node was supposed to have the internal gateway ip and that works well. Traffic ...
0
votes
0answers
24 views

Route/Forward specific traffic to Interface

I want to use a Rasperry Pi as (Wlan-)Router. The Access Point is working so far: I have an Accesspoint with wlan0 (ip 10.10.0.0/255.255.0.0) and wlan1 connected to the internet. Now I want to route ...
0
votes
1answer
28 views

NFS mount internal error

I have a server that I use for NFS share. 4 servers use it without a problem. I configured a new server and that can't mount. I get this error mount.nfs: internal error In the logfile of the ...
2
votes
3answers
1k views

Reach LXC container from a virtualbox guest on the same host

Context I develop websites on my Ubuntu laptop (Ubuntu 13.04 64b). Each site runs within a dedicated LXC container¹ on network 10.0.3.x I sometimes need to reach those sites from a virtualbox guest ...
0
votes
1answer
23 views

Why is my ISP box talking to my DMZ host?

I have a setup where an internet connection is available via ISP box, which has a DMZ feature (one of the hosts can be exposed to Internet). The general setup is the following Internet - PublicIP - ...
0
votes
1answer
101 views

Iptables source mac match not always matching?

I have added some rules to my PREROUTING chain in NAT. Usually at the beginning of a new machine joining the network, these matches don't always match correctly? Im using iptables v1.4.21 on OpenWRT ...
1
vote
4answers
20k views

Error applying iptables rules using iptables-restore

Hi I'm using Ubuntu 9.04 on a VPS. I'm getting an error if I apply a iptables rule. Here is what I have done. 1.Saved the existing rules iptables-save > /etc/iptables.up.rules Created iptables....
0
votes
0answers
37 views

Docker is only listening locally on a container connected to a VPN

I've just nuked my CoreOS box and am rebuilding the setup as a Ubuntu Xenial (16.04) based docker platform. I'm happy with it so far but I'm now having to re-resolve a problem I already fixed on ...
0
votes
1answer
39 views

Forward outgoing traffic for port to another server using iptables

I'm trying to forward outgoing traffic 194.97.114.3:2010 to another server but with no luck. netstat -anup gives me udp 0 0 94.23.28.183:44174 194.97.114.3:2010 ESTABLISHED ...
14
votes
3answers
1k views

Debugging iptables and common firewall pitfalls?

This is a proposed Canonical Question about understanding and debugging the software firewall on Linux systems. In response to EEAA's answer and @Shog's comment that we need a suitable canonical ...
3
votes
1answer
2k views

What does nf_conntrack.acct really do?

I've found the kernel parameter nf_conntrack.acct interesting, in that the kernel documentation merely says "Enable connection tracking flow accounting". I've appended this to grub and rebooted and I ...
1
vote
0answers
20 views

How do I remove ufw blocked protocol 59 log noise?

The logfile on one of my private servers running Ubuntu 14.04 is being filled with messages of the following form: [UFW BLOCK] IN=eth0 OUT= MAC=[macaddr] SRC=[srcipv6addr] DST=[destipv6addr] LEN=40 ...
-1
votes
2answers
58 views

Iptables on a Debian machine, the delete command needs a networking restart to work?

I have a big problem with iptables, this the thing I try to make : PC windows (192.168.1.1) -> (192.168.1.2) PC Linux (192.168.2.1) -> (192.168.2.2) card I want to forward the messages from Windows ...
0
votes
1answer
70 views

What is the FIREWALLD equivalent to IPTABLES -NOTRACK

I recently converted to centos 7 and so far I am beginning to like the simplicity of zones in my firewall structure, however I can't seem to find a configuration parameter for firewalld like the ...
-1
votes
2answers
35 views

iptables for internet connection sharing

Objective: I am working on an embedded Linux device with the following network configuration. Interface-1: 'wlan0' acts as an access point. Interface-2: 'eth1' connected to Internet. Interface-3: '...
6
votes
4answers
1k views

Duplicate iptable rules

I have this iptable rules: -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -N fail2ban-ssh -A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh -A INPUT -p tcp -m multiport --dports 22 -j ...
-1
votes
1answer
27 views

Send local traffic from host A:3306 to host B:3306

I'm having trouble making sense of all the iptable examples out there. I simple want all requests from my machine to host A on port 3306 to actually go to host B on port 3306. How can I do this?
0
votes
1answer
40 views

Except some IPs from rule to not allow internet through openwrt + openvpn when vpn is disconnected

I have the following working setup on my network: A. ISP-Router (connected to inet, internal ip 192.168.0.1 ) <----> B. eth0 - OpenWrt Router (OpenVPN client running) br-lan (bridge eth1 + wlan0, ...
0
votes
0answers
11 views

iptables rules only work using -m owner

Let's say I have the following rules, since I only want to allow traffic going over my tun0 interface: iptables -A OUTPUT -o tun0 -j ACCEPT iptables -A OUTPUT -j REJECT Unfortunately, the above ...
-1
votes
1answer
52 views

Open port 8082 on ubuntu for remote access

I need to open port 8082 on my linux box for remote access. I can access the application on port 8082 locally, but not from my other box. Ports 8080 and 8081 are accessible locally as well as remote. ...
2
votes
1answer
48 views

iptables REDIRECT and only allow dport

Quick iptables question, I hope. We're running this in iptables: -A PREROUTING -i eth0 -p udp -m udp --dport 57875 -j REDIRECT --to-ports 5060 and then we also have: -A INPUT -p udp -m udp --...
3
votes
1answer
157 views

Create a multi-homed linux load balancer with two internet connections and one LAN connection

OK,... this has possibly been answered, unfortunately, I have not found anything that looks like it might be the resolution. Ive looked at these pages and they have some useful information, but not ...
0
votes
1answer
52 views

Linux server failing to send SYN/ACK after receiving SYN remotely, works locally

Problem: A server process can be accessed by a device on the LAN or by the server itself, but it cannot be accessed outside the LAN (port forwarding is configured correctly as the server does receive ...
15
votes
5answers
45k views

Whitelist allowed IPs (in/out) using iptables

I have a few ip ranges to which I want my server to able to connect and users to connect from. Everything else should be blocked. How should I do that with iptables? My OS is Debian based linux ...
0
votes
0answers
40 views

How to create an iptables rule for a specific bonded network interface?

I have a "bare metal" server with a popular cloud hosting provider. (Running Ubuntu 14 in case that's important.) This machine has a network interface that faces the public internet, and also ...
0
votes
1answer
21 views

Redirecting outbound traffic to specific IP to localhost

I'm mocking a service, which would in actuality run on 10.1.10.1, and in so doing am trying to redirect the traffic bound for 10.1.10.1 to 127.0.0.1. To create my rule, I'm running iptables -t nat -...
0
votes
0answers
15 views

Connection refused with both iptables and firewalld disabled on CentOS. Why? [duplicate]

My Rig Server A with Bacula Dir installed Server B with Bacula Client installed Both uses CentOS 7 Objective. Open port 9102 to be able to access Server B from Server A via Bacula Dir. The ...
3
votes
1answer
8k views

IPtables rules bad arguments

I'm trying to write IPtables rules,but I'm finding it difficult. I've got: iptables -A FORWARD -m state –state RELATED,ESTABLISHED -j ACCEPT which fails with Bad argument `–state' and iptables -...
1
vote
1answer
32 views

Loading Blacklist of IPs from a file into IPTABLES

In a separate file I'm creating a list of IP addresses to be blocked. This file will have IPs added in or removed on a daily basis. I want to "reference" this IP File into /etc/sysconfig/iptables, but ...
5
votes
3answers
2k views

How to reset a tcp connection immediately on both ends on a certain condition using linux netfilter/iptables?

Dear Serverfault community, I have the following problem: I need to reset (disconnect) tcp connections on both network sides immediately if a certain string is encountered in the packet data. I don't ...
0
votes
0answers
23 views

Multiple IP failover on VPN PPTP

I have a server at SoYouStart, I ordered an IP failover. I want to setup a PPTP VPN so I could be able to have one connection to the "normal" IP and one to the failover IP I couldn't manage to do ...
0
votes
0answers
37 views

Configuration SNAT iptables in ubuntu

I have 2 PC be created by VMWARE 1. PC1 (make iptables router): eth0 's IP: 192.168.1.4/24 (network connection is bridged) eth1 's IP: 192.168.2.2/24. (network connection is wmnet9) 2. PC2: ...
0
votes
0answers
12 views

How do I get default LXC iptable rules into Shorewall?

I'm setting up a server which will be hosting multiple LXC containers. However, starting Shorewall results in loss network access from within the LXC containers. If I reboot the LXC host and leaves ...
0
votes
0answers
81 views

Forwarding UPnP, DLNA traffic via computer to server

I'm about to tear out what is left of my hair with this. I was able to finally see traffic coming through, but not working in full, when using socat but this setup is not ideal. The idea: I have a ...
0
votes
2answers
58 views

Redirecting log from /var/log/kern.log to a separate log file for iptables log

I am trying to redirect iptables log to another file. Based upon my reading on the net, I did the following: In my iptables rule, I have rules like: iptables -A INPUT -s ... -j LOG --log-prefix "...
3
votes
4answers
6k views

Almost working: How to set up iptables and iproute2 rules on dual WAN linux server?

I have a Raspberry Pi (running Raspbian) with three network interfaces (one ethernet and two USB wifi nics). What I want to achieve is this: I have two WAN connections to the internet (DSL + Cable), ...
1
vote
1answer
22 views

DNAT for connecting a subnet via proxy to the internet

DNAT for connecting a subnet via proxy to the internet I want to connect a server in a subnet to the internet via a proxy-server. But I can’t ping a host on the internet (www). Actually the subnet-...
0
votes
0answers
24 views

How can i measure maximum connection, throughput on iptables?

As the title, I have a linux firewall as router. How can I measure maximum connection, throughput on my server? Thanks
7
votes
3answers
25k views

What's the mangle table in iptables?

I am using iptable rules to filter & manipulate packets in my Ubuntu server. but I cannot understand the mangle table. Quoting from this iptables tutorial: This table should as we've already ...
1
vote
0answers
35 views

MySQL on Ubuntu. 10061 error on 3306

A fresh install of Ubuntu inside of a Virtualbox with LAMP option selected. I am unable to connect to the server via telnet on this port or via ODBC from my host machine. I can ping and SSH both ...
0
votes
0answers
33 views

iptables, ufw, and psad - scanned UDP port alerts from router and devices on home network

I have a fresh install of Ubuntu 16.04. I configured iptables, ufw (with gufw), and psad using instructions from https://www.thefanclub.co.za/how-to/how-secure-ubuntu-1604-lts-server-part-1-basics and ...
0
votes
2answers
677 views

Setting up iptables filter to allow Git

Sorry I am new at this server stuff, so bare with me and if I'm missing any info let me know! I'm trying to setup my Ubuntu 14.04.2 LTS server to have a solid iptables firewall. Right now I think it ...
0
votes
2answers
62 views

iptables - access to port 3306 timeout

I cannot connect to mysql from a remote server. I have bind-address commented out but when I add rules in iptables to block other connections the requesting server's connection times out. I tried ...
0
votes
3answers
94 views

IP forwarding on Linux

I have three machines Source Machine Destination Machine - IP 10.20.30.40 Intermediate Machine - Host server1.test.com Source machine has SSH access to Intermediate machine and Intermediate machine ...
0
votes
0answers
89 views

OpenVPN DNS resolution not working

I'm currently trying to get a simple OpenVPN setup working and I'm almost there, except for a DNS (or routing) issue I seem to be having. The client connects to the server just fine, and I can ping ...
0
votes
0answers
116 views

iptables: Redirect traffic from destination IP to new IP

I have a PC client. I like to redirect outgoing TCP connections on port 80 with the target IP 1.1.1.1 to the target IP 2.2.2.2. The full connection should be redirected, which means also the answer ...