iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

2
votes
3answers
3k views

Block outgoing connections on RHEL7/CentOS7 with firewalld?

RHEL7/CentOS7 features a new firewalld firewall service, that replaces the iptables service (both of which use iptables tool to interact with kernel's Netfilter underneath). firewalld can be easily ...
-2
votes
0answers
28 views

iptables shell command from php, does not apply fully?

I run a shell script from php. shell_exec("/abs_path_to/lorem.sh"); When I run the script in Terminal # sh "/abs_path_to/lorem.sh", it works. The script consists in iptables rules. I checked it is ...
0
votes
1answer
24 views

No internet connection via my OpenVPN server (solved)

I have OpenVPN up and running on my server. I want all traffic from my clients to be routed trough the VPN server. The client connects just fine but is unable to connect to the internet. Server ...
2
votes
1answer
46 views

ipset not being applied to iptables

I'm trying to filter out a country that keeps probing my SMTP server (CentOS6) and I can't seem to get the ipset to work out right in iptables. I downloaded that countries IP addresses from ...
0
votes
0answers
5 views

CONFIG_NF_CONNTRACK is not set [migrated]

I am trying to setup iptables on udoo quad but I hit a brick wall and cannot find a fix anywhere: root@udoo:/# uname -a Linux udoo 3.0.35 #10 SMP PREEMPT Wed Jul 30 18:16:10 CEST 2014 armv7l ...
0
votes
1answer
35 views

can't initialize iptables table `nat' in Proxmox Openvz vm

When I tried to run an iptables command in the Proxmox OpenVZ vm, I got the following error: # iptables -t nat -A POSTROUTING -o venet -j MASQUERADE && iptables-save iptables v1.4.21: can't ...
0
votes
1answer
63 views

iptables not starting upon reboot

I've enabled iptables in systemd with: systemctl enable iptables but after restart when I try service iptables status, it shows: # service iptables status Redirecting to /bin/systemctl status ...
6
votes
1answer
259 views

Iptables rule-set so that a docker container can access a service on a host IP

I have troubles accessing a host private interface (ip) from a docker container. I'm fairly certain that it's related to my Iptables rules (or perhaps routing). When I add the --net=host flag to ...
13
votes
1answer
4k views

What is the point of the docker-proxy process? Why is a userspace tcp proxy needed?

I have noticed that there is docker-proxy process running for each published port. What is the purpose of this process? Why is a user space tcp proxy needed for this? $ ps -Af | grep proxy root ...
0
votes
1answer
2k views

iptables forwarding through virtual interfaces

I'm trying to configure my computer as a gateway between two networks, but I cannot make it working for some reasons Here is a representation of the network: 192.168.1.101 192.168.1.102 ...
0
votes
0answers
18 views

DNAT not forwarding to correct (local) IP address

I'm trying to port-forward a HTTPS service which uses different SSL certificates for each of the several IP addresses on the machine. Web server listens on each IP address on the internal port (444) ...
-1
votes
1answer
24 views

IPTABLES not working, fail2ban still notifying me of instrusions from those ips

I added 200 hundred iptable rules like these: iptables -A INPUT -s 108.62.150.0/24 -j DROP iptables -A INPUT -s 109.108.64.0/19 -j DROP iptables -A INPUT -s 109.110.32.0/19 -j DROP to block russian ...
2
votes
1answer
56 views

How to create a private network between a VPS and 4 IPs?

I own a VPS running Debian and i want to avoid security breaches from "outside" (via Internet). I want to guarantee these rules: Allow all outbound traffic; Allow HTTPS connections from IP 1, 2, 3; ...
2
votes
1answer
762 views

Disable kernel processing of TCP packets for raw socket

I'm working on a TCP/IP implementation, for an embedded device, that I want to test from a Linux user space process using raw sockets. raw(7) says that Raw sockets may tap all IP protocols in ...
0
votes
1answer
42 views

iptables, redirect all port 80 to an IP but let one IP forwards through

My router redirects all incoming traffic (interface eth0) to IP 1.2.3.4 : iptables -t NAT -A PREROUTING -i eth0 -p tcp --dport 80 --to-destination 1.2.3.4:80 When a client hits "100.80.77.8", I'd ...
0
votes
0answers
50 views

Centos 7 IPTABLES - SSH Lockout

I'm currently ruunning an OVH dedicated box, which specifically, has the following operation system installed: CentOS 7.1-1503 By default on CentOS 7 and above, the firewalld service is used ...
0
votes
1answer
72 views

How to use conntrack to allow SIP traffic

I have the following problem: Device (eth0)----> SWITCH(trunk)+VLAN120 ---> (PC1) +VLAN200 ---> (PC2) I am able to ping from PC1 to PC2 which are in ...
2
votes
1answer
2k views

CentOS error with iptables recent module

This is the rule in iptables for stop sync_flood attacks: iptables -A INPUT -m state --state NEW -p tcp -m tcp --syn \ -m recent --name synflood --set iptables -A INPUT -m state --state NEW -p tcp ...
0
votes
1answer
28 views

Seemingly acceptable iptables rule blocking NIS (ypbind) from operating

I am not an iptables expert. I have a use case to block all outgoing traffic that does not destined for either 10.0.0.0/8 or 167.114.0.0/16. I have two NIS servers (10.57.132.11, 10.57.132.40). I ...
0
votes
1answer
57 views

How to create advanced rules with firewall-cmd?

I want to create a rule using firewalld that uses criteria username or userID and maybe one other module criteria. In iptables, I think you can do things like iptables -A OUTPUT -m owner --uid-owner ...
0
votes
2answers
37 views

Iptables on Centos 7 doesn't work after reboot

I am on Centos 7, removed the new firewall and installed a classic iptables service. I have a guest machine in it with Debian 8.1 and static external ip. I do: echo 1 > ...
1
vote
0answers
40 views

Multicast destination NAT on same network interface, with netem

For testing purpose, in a big network where IT will shoot me if multicast data are not streamed in the right VLAN, I am trying to degrade multicast packets with a server running netem configuration. ...
0
votes
1answer
19 views

How do you sync ipset sets across two machines?

I would like to replicate IPSet sets from one machine (server01) to another machine (server02) using rsync or btsync or something similar. Is that possible? If so how do I do it? This is a redundancy ...
0
votes
1answer
37 views

Cant route traffic through OpenVPN on Debian 8

I have been trying to setup OpenVPN and have run into a bit of a hiccup, i have can't seem to route all my traffic through the server. I can connect to the server just fine but i can't seem to ping ...
3
votes
2answers
1k views

Shorewall: logging to custom file

I am running an Ubuntu Server 14.04 system with a shorewall firewall. Shorewall is essentially a front end to iptables, and it is iptables that does the logging via Netfilter (my understanding so ...
1
vote
0answers
41 views

Ubuntu 12.04 Router Firewall TTFB Delay

I use Ubuntu Server as my router/firewall for my network for a number of reasons. Until recently, I was using 10.04 with great success for this purpose. The OS provides DNS lookup and DHCP using ...
0
votes
1answer
29 views

Iptables time-based rules having no effect - Gateway with 2 NICs

I have a network with the following topology: - WAN Modem with NIC facing the gateway: 192.168.0.1 - Ubuntu 14.04 gateway with two NICs: 1) Eth0 (facing the modem): 192.168.0.201 2) Eth1 (facing ...
0
votes
1answer
39 views

Gateway can't ping client

I try setup a new gateway in my virtual network. But sure I' have a problem. The Gateway cannot ping client but client can ping other client and gateway. So I have check my iptables rule (I does'nt ...
0
votes
1answer
22 views

What rules do I need to remote desktop to a virtual machine where the host has iptables running?

I am attempting to remote desktop to a virtual Ubuntu install (headless on VirtualBox) that resides on a Linux host (Centos 6.6). I can reach it with no issue if I turn iptables off. I feel like I ...
0
votes
1answer
24 views

Why does iptables not doing DNAT for the same subnet? [duplicate]

I have the following NAT setup: +--------------+ +-----------------------+ +-------------------+ | | | | | | | | ...
0
votes
1answer
43 views

Iptables drop forwarded traffic destined for interface IP address

I have a small VPN setup where I use IP tables to nat traffic coming in the vpn0 interface to the IP address of the eth0 interface. These rules look like this: iptables -t nat -A POSTROUTING -o eth0 ...
0
votes
0answers
16 views

Isolate access point clients with iptables

Is there an effective and easy way to isolate access point clients so that they do not see each other over LAN ? I created an open access point with Kali Linux + Hostapd + dnsmask I want to make ...
0
votes
0answers
35 views

Simple IPtables Script for Whitelisting (Amazon Endpoints)

I'm attempting to lockdown an Amazon EC2 instance which has a single open port for Amazon SNS. I can't use security groups to restrict the port as the IP is forever changing, so it must be open to all ...
2
votes
1answer
45 views

Simulate 2 clusters in the same network

I have 4 pc´s and another pc, which will act as a proxy, all being in the same network: 172.16.96.0/20 . I can ping between each other. But, I want to separate them into two groups. That is: pc1 is ...
0
votes
1answer
63 views

How to route traffic between 2 VLANs on different subnet

I have the following problem: I have one interface eth0 with IP 172.20.51.61/24 I have configured 2 VLANS on the same machine: eth0.120 : 172.20.52.61/24 eth0.200 : 172.20.54.61/24 I also have a ...
1
vote
0answers
38 views

IPTables, route specific port through VPN

I'm running my own mail server at home on a dynamic IP. Dynamic IPs are often blacklisted, so I currently send out mails through my provider's relay. I want to change that to sending mail directly, ...
0
votes
1answer
57 views

Prevent squid forwarding twice with transparent and non-transparent setup

I'm running squid in a small network. I've setup a couple of squid listening ports for different scenarios: http_port 3128 - This is will be pushed to Windows clients via domain policy, with the ...
0
votes
1answer
54 views

Delaying packets with libnetfilter_queue

From my Raspberry Pi configured as an access point, I set the following rules: sudo iptables -I FORWARD -p tcp --sport 25 -j NFQUEUE --queue-num 0 sudo iptables -I FORWARD -p tcp --sport 80 -j ...
0
votes
1answer
40 views

How can I do site-to-site OpenVPN routing without NAT

I have two OpenVPN servers at different location. Each machine in one location can ping and connect to every machine in the other location. My problem is when I use SSH to connect from machine A in ...
0
votes
1answer
29 views

How to configure an nginx VHost to hang up on the client in the rudest possible way?

I have a, let's call it, "legacy" VHost configured on an nginx server. It used to be a full site, but it has since been decommissioned and all the content removed. The server block now looks something ...
0
votes
0answers
20 views

Forwarding Traffic from an PPTP Server to Another Server

I'm facing a problem here. I have 2 servers. Server 1 is a pptp server and server 2 is another without pptp service. I want to forward some of the traffic from server 1 to server 2 through a tunnel ...
1
vote
1answer
724 views

csf Integrated User Interface not working

I've installed CSF on ubuntu 14.04 using their official install guide. After disabling UFW with the following command: sudo ufw disable then I have modified csf.conf with the following values: ...
0
votes
0answers
39 views

Filter packets with layer 7 (raw) data with iptables

Let's suppose I've got the following iptables rule: iptables -A INPUT -p tcp -s $IP --sport $PORT -j DROP filtering (and dropping, in this case) packets coming from $IP:$PORT. This filter drop ...
0
votes
0answers
17 views

How to find which program invoke iptables command [duplicate]

My SUSE Linux server always add an iptables rule that deny itself automatic, but I do not know which program added it. So how to find which program invoke iptables command or how to find which program ...
0
votes
0answers
18 views

IPTABLES Forward a Input with specif dport to VPN and masquerade

Inside our company we have a XMPP server that works with source 10.0.0.0/8. But, What I want to do is redirect a package coming from WAN to the VPN (which is where our XMPP is located) but doing a ...
5
votes
2answers
14k views

What's the mangle table in iptables?

I am using iptable rules to filter & manipulate packets in my Ubuntu server. but I cannot understand the mangle table. Quoting from this iptables tutorial: This table should as we've already ...
0
votes
3answers
45 views

OpenVZ container - Can't set nf_conntrack_max

My question is does the Host Node and a container both have the same "nf_conntrack_max" ? When i check on the host vs the container these are the results: Host Node [root@echo ~]# cat ...
-1
votes
2answers
26 views

Can't access server through web access despite allowing ports 80 & 443?

Here is the server's iptables file *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [13:2648] -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A ...
0
votes
3answers
1k views

How to configure linux routing/filtering to send packets out one interface, over a bridge and into another interface on the same box

I'm trying to test a ethernet bridging device. I have multiple ethernet ports on a linux box. I would like to send packets out one interface, say eth0 with IP 192.168.1.1, to another interface, say ...
0
votes
0answers
28 views

Limiting bandwidth to a specific IP

My question is very similar to http://serverfault.com/a/191605/253872 however I wish not to limit someone on my network, but traffic from my server to a specific IP. In reference to the script in the ...