iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

8
votes
2answers
1k views

How to configure iptables so an unwanted port is not reported as filtered

I'd like to stop others from seeing my ports as filtered in the nmap standard scan (unprivileged). Let's say that I have the following ports open: 22, 3306, 995 and a firewall configured like this: ...
3
votes
3answers
2k views

Service can't connect to self using public IP, NAT problem

I have a dedicated server from serverloft.eu, but due to some network security I cannot use bridge networking on my server. So I have setup all my IPs to the main eth0, and used NAT to forward trafic ...
2
votes
1answer
141 views

Can I use iptables to rate limit an ipset?

Is it possible to use iptable tables to rate limit an ipset ? I know you can use ipset to create a block list named blacklist i.e. ipset create blacklist hash:ip iptables -I INPUT -m set ...
0
votes
0answers
32 views

What rules do i need to allow ipsec in iptables firewall?

I have a server sitting on a private subnet behind a iptables firewall. On that server I am planning to create site to site VPN to Amazon VPN. I am not sure what rules do I need to put in my iptables ...
0
votes
0answers
13 views

iptables (nth) load balance, connect failed: Connection refused when many request

I try to use iptables as load-balancer using round robin scheduling. Block Diagram My itables configuration on 172.18.3.190 like this : *nat :PREROUTING ACCEPT [42:7044] :INPUT ACCEPT [26:4290] ...
0
votes
0answers
38 views

StrongSwan IPsec and NAT

I have an IPSec tunnel to the network of our customer running on a Linux box with StrongSwan. On there I have to do source NAT to translate our network addresses to the subnet they assigned us. This ...
1
vote
0answers
238 views

How to block hping3 SYN ACK efficiently with iptables?

I'm trying to execute a TCP SYN flood on my Debian web server with nginx. Executing tcpdump "tcp[tcpflags] & (tcp-syn) != 0" while flooding, I see all packets coming. iptables seem to work well ...
1
vote
1answer
31 views

Correct iptables rules to allow linking of docker containers

I have two Docker containers on a Debian 8.3 node. One is the official postgres image, one is a basic phoenix / elixir app. I'm linking both with a docker stack file. But phoenix is not able to ...
-1
votes
1answer
22 views

Iptables DNS Input on localhost [closed]

Currently my IPtables Input chain settings on the server are: Chain INPUT (policy DROP 6 packets, 588 bytes) pkts bytes target prot opt in out source destination 202 ...
5
votes
2answers
2k views

How to reset a tcp connection immediately on both ends on a certain condition using linux netfilter/iptables?

Dear Serverfault community, I have the following problem: I need to reset (disconnect) tcp connections on both network sides immediately if a certain string is encountered in the packet data. I don't ...
0
votes
0answers
40 views

ISP provides 400MB connection but behind iptables firewall I only get about 150MB

I have COX communications as my ISP and I have a 400 MB connection at work. I have had for years an iptables firewall I setup that runs great. CPU Info Intel® Core™ i5-2400 Processor (6M Cache, 3.10 ...
1
vote
1answer
38 views

Slow OpenVPN tunnel

I have a tunnel set up between two AWS regions. Using iperf, I saw that if I connect two machines directly (through the internet), I get about 100mb/s. If I use the tunnel, I get 10mb/s. Is there a ...
0
votes
0answers
20 views

DNS using GRE work 50%

l'm in a big issue here to make it work I'm already at least about 60% done, but it is difficult and I would like to count on the help guys here who may have already done this type of configuration. ...
0
votes
0answers
11 views

UFW blank before.rules file

I am using UFW to configure my Debian IPTables firewall. I have issued the following command... ufw allow ssh This has successfully opened up Port 22 and I can now connect remotely via SSH. I ...
0
votes
0answers
43 views

Run node server on port 8080, use iptables to redirect traffic

I saw in several venues that in order to run node as a user, and yet get it to listen to port 80, you can do a simple IPTables trick: sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j ...
-1
votes
1answer
43 views

Captive portal with iptables and local dns server

I'm trying to redirect all the browser's requests from my wifi interface wlan1 to a captive portal. I have a node web server running on my target on 10.4.30.34:4040. It has to redirect the browser ...
0
votes
1answer
937 views

ProFTPd server behind firewall returns internal IP address

I have 2 servers, one as gateway/router, the other one as server. I use iptables to port forward the following ports: 21, 20, 65500-65600. When I connect with Filezilla or Total Commander, the ftp ...
-1
votes
2answers
52 views

Multiple NIC same subnet [closed]

I have a setup as shown in the image. I know it is insane but i have to work on this configuration only. It is basically an ubuntu server acting as a router with 4 interfaces. 3 of them (eth0, eth1 ...
90
votes
2answers
44k views

IPTABLES - Limit rate of a specific incoming IP

I do not wish to limit the rate of a specific service. My goals is to limit rate based solely on the incoming IP address. For example using a pseudo-rule: john.domain.local (192.168.1.100) can only ...
0
votes
1answer
60 views

Route outgoing connections from a docker container through a specific IP

I have a docker host machine with a single physical network interface (eth0) and multiple IP addresses assigned to it using IP aliasing (eth0:1, eth0:2, eth0:3). I would like to run several docker ...
1
vote
1answer
37 views

Iptables: Difference between RELATED and ESTABLISHED state?

I've tried reading many articles on the internet but none of them are quite clear. I also know similar question has been posted here before but none of them explain my situation. Earlier I ended up ...
0
votes
1answer
134 views

VSFTPD - 0.00Kbyte/sec - intermittent

I can't get a good connection via FTP to my DigitalOcean server. I set it up following this guide. Symptoms: Sometimes I can upload the file I am working on, sometimes I can not. (same file, same ...
0
votes
0answers
17 views

IPTables debugging

I've got a weird problem. I've got a primary host in Nevada and a satellite site in Maryland. They both use the 192.168.21.0/24 subnet (as well as .18.0 and .101.0) and have some overlapping ...
0
votes
0answers
26 views

Port forwarding with different gateway

Here is my current setup: Public IP -> Iptables firewall_A with DNAT from Public IP to -> mail server Iptables rule: iptables -t nat -A PREROUTING -d PUB.LIC.IP.ADD -p tcp --dport 25 -j DNAT ...
-1
votes
1answer
25 views

iptables installed in centos 7 but nat table was not there [duplicate]

[root@localhost yum.repos.d]# iptables --version iptables v1.4.21 [root@localhost yum.repos.d]# iptables -L -t nat iptables v1.4.21: can't initialize iptables table `nat': Table does not exist (do ...
0
votes
0answers
54 views

solutions to filter traffic with group based rules

I have a 25 computer network with 1 pfsense box (with squid installed) and 1 openLDAP server configured & working , 70% of the network is wired the rest is password protected wireless. Right now ...
0
votes
2answers
160 views

CentOS, dual route, nat

The linux server eth0 set the default route(gateway). And the clients connected to eth2 should be able to access the internet(eth1) by nat. Interfaces: eth0 : LAN (default route) / IP:10.0.0.5, ...
1
vote
1answer
3k views

How to configure vsftpd and iptables to listen on port 21 but run on another port?

We have a Java process which contains an embedded FTP server which I'd like to run on a RHEL5 machine. I don't want to run the process as root and I don't want clients to have to specify a port when ...
1
vote
1answer
3k views

iptables forwarding through virtual interfaces

I'm trying to configure my computer as a gateway between two networks, but I cannot make it working for some reasons Here is a representation of the network: 192.168.1.101 192.168.1.102 ...
0
votes
1answer
1k views

Squid as Transparent Proxy Opens only https websites not normal http

I installed and configured squid proxy as transparent proxy server. when i tried using firefox the proxy server works fine and i can access both ports https and http. but when i transparnet, i can ...
7
votes
1answer
5k views

Iptables rule-set so that a docker container can access a service on a host IP

I have troubles accessing a host private interface (ip) from a docker container. I'm fairly certain that it's related to my Iptables rules (or perhaps routing). When I add the --net=host flag to ...
1
vote
2answers
55 views

Correctly opening port 443 to the internet

I need port 443 open to the internet on my server. When I check internally via netstat -tulpn | grep "nginx", I see that nginx is indeed LISTENing on that port. However, trying nmap -p443 mysite.com ...
5
votes
1answer
139 views

iptables is occasionally logging MAC addresses. Why?

I have logging enabled on specific iptables packet drops. The rules I'm using are IP/port related only and this is what I can easily see in the logs, however occasionally I do get MAC address ...
0
votes
0answers
21 views

How to correctly configure iptables block output (wordpress)

I just cleaned my WordPress installation after attack. They used my server to attack other sites. I've cleaned everything but I want to use iptables to block outgoing requests from my server. I ...
0
votes
1answer
57 views

Allow DNS queries to bind in iptables

I have a DNS server up and running with configured single DNS zone for example.com The following command, ran on the server returns the configured DNS Zone records: # dig example.com @ns1.example.com ...
0
votes
1answer
39 views

New iptables rules not showing up

I'm trying to use iptables to forward incoming traffic on port 80 to a web server running on another IP address and port. Not that it appears to make a difference, the web server is running in a ...
0
votes
1answer
10 views

Redirect to another port in iptables shows no chain error

I'm facing strange problem with iptables right now. Simply, I want to redirect traffic from port 514 to port 5140. I'm using this IPTables command to achieve it: iptables -t nat -A PREROUTING -p tcp ...
1
vote
1answer
49 views

Limit number of incoming packets per second for a INPUT UDP port [per IP only, not globally] [Ubuntu IPTables]

I searched and I can't find a rule to limit the count of the incoming packets for a INPUT UDP port per second and per IP. I need that per all IPs that connect to my socket, not for a specific one. ...
5
votes
3answers
257 views

Iptables LOG rule inside a network namespace

I'm trying to setup iptables rules for a docker container. I'm using nsenter to execute the iptables command inside of the container's network namespace: # log access to port 8080 PID=$(docker ...
0
votes
2answers
272 views

Can I use iptables, Shorewall and ipset on the same time?

I'm using iptables for years, because it is a straightforward solution without any magic. But now I'm building a router for myself, I found there are many useful features provided by Shorewall. Is it ...
0
votes
1answer
49 views

lxc/lxd iptables ouput owner rule errors out with “Invalid argument.”

If I try to run the following command in my lxc/lxd Ubuntu 14.04 amd64 container: iptables -A OUTPUT -p tcp -m owner --uid-owner 0 -m tcp --dport 80 -j ACCEPT I get the following error message: ...
0
votes
0answers
39 views

iptables. Bypass VPN

I use ssh to reach an amazon machine. I'd like to a VPN on this machine. Each time i run openvpn, i get logged of due to the fact that SSH packets are sent through the VPN tunnel. So the idea is to ...
0
votes
1answer
25 views

Enable gateway only for authenticated clients [closed]

I want my server to be usable as a gateway to the internet by certain clients. Enabling forwarding is not my concern, rather to restrict it only to certain clients. I don't want hardcoded iptables ...
0
votes
1answer
26 views

Log all forwarded traffic to new server with iptables

I rerouted all internet traffic from my old Debian 7 server to my new server with DEST_IP=123.123.123.123 for p in 25 110 143 587 993 995 80 443; do iptables -t nat -A PREROUTING -i eth0 -p tcp ...
3
votes
1answer
39 views

Unable to connect to apache from the web

I have an apache instance running with vhost configured, here is the httpd.conf: #Listen {the_server_ip}:80 Listen 80 # <VirtualHost *:80> ServerAdmin webmaster@example.com DocumentRoot ...
0
votes
2answers
23 views

port rerouting with iptables not working

I want to reroute all traffic from a port e.g. 4445 (from localhost) to another port on another machine in the LAN e.g. 3305. I expected this should do the deal: iptables -A PREROUTING -t nat -i eth0 ...
0
votes
1answer
63 views

Traceroute / Routing of a IP

so i just wondered, how i can route the whole traffic from server A through server B, so the traceroute looks like this: Server A IP is 33.33.33.33 and Server B IP is 55.55.55.55 1: 1.1.1.1 2: ...
-4
votes
1answer
28 views

How to open entire subnet with iptables [closed]

I want to enable the entire subnet 192.168.1.0/24 which is connected to eth0 in input. I'm very unfamiliar with iptables. If I add the rule: # iptables -A INPUT -s 192.168.1.0/24 -p tcp -m tcp ...
1
vote
2answers
1k views

How efficient is iptables' hashlimit module?

I'm looking for a solution to rate-limit on an ip basis. How many packets can the hashlimit iptables module handle on a recent Intel x86_64 CPU core? 1.000/sec? 1.000.000/sec?
0
votes
1answer
49 views

How to setup a whitelist using iptables and ipset

I'm trying to only accept connections from my whitelist on ports 53, 80 and 443. Here is my iptables file # Generated by iptables-save v1.4.21 on Thu Feb 25 18:28:29 2016 *filter :INPUT ACCEPT [0:0] ...