iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

1
vote
1answer
98 views

iptables logging doesn't log

I'm trying to log any requests to port 22 into my syslog, so I have following line in my iptables: LOG tcp -- anywhere anywhere tcp dpt:ssh LOG level debug yet, ...
1
vote
2answers
78 views

Iptables blocking all my traffic for some reasson

I've installed stock Red Hat Linux 6 and I've installed lighttpd, it seems that my website loads only when i stop iptables (service iptables stop), I'm not sure what's going on, because I haven't done ...
1
vote
1answer
174 views

openvpn& iptables — portforwarding and gateway

The problem is similar to this scenario: iptables rule still take effect after deleted Scenario: There are several clients(C1~C10) providing some services, such as SSH,HTTP..... The clients are ...
1
vote
2answers
1k views

Unable to Create Rule in IPTables to Open Port 80

I'm trying to open port 80 in iptables but am running into a couple issues. I am running CentOS 5.7. First I tried to run this command: iptables -I RH-Firewall-1-INPUT -p tcp -m tcp --dport 80 -j ...
1
vote
3answers
746 views

SSH hosts.deny and hosts.allow

I have this content in hosts.deny (with a new line at the end): # # hosts.deny This file describes the names of the hosts which are # *not* allowed to use the local INET services, as decided ...
1
vote
1answer
593 views

iptables Ubuntu VPS SSH rule

I'm trying to configure a VPS Ubuntu server to connect to codebase GIT server, just like heroku codebase authentication is based on SSH RSA keys. I've uploaded the keys to the repository, and when ...
1
vote
0answers
473 views

nginx does not close loopback connections

I'm using nginx in reverse-proxy mode. Here's relevant part of config file: server { listen 80; server_name ~^web.redhelper\.ru$ ; access_log off; location /http-bind { ...
1
vote
3answers
2k views

iptables: No chain/target/match by that name

I'm trying to set iptables on Debian 6 Squeeze amd64 and I'm faced to this error message root@Vision:~/bin# iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables: No ...
1
vote
2answers
1k views

controlling the bandwidth using tc

I have two NICs. eth0 is connected to the internet and eth1 is connected to the LAN. I want to restrict the download limit using iptables and linux tc. So I wrote a test script to verify if it is ...
1
vote
1answer
161 views

confusion in setting up a firewall on bridge

I am having some confusion in putting up my IPTABLE rules. auto lo iface lo inet loopback # The primary network interface auto eth2 iface eth2 inet manual auto br0 iface br0 inet static ...
1
vote
2answers
649 views

iptables only allow smtp connections with start tls

Is it somehow possible to block/abort unencrypted smtp connections with iptables? effectively rejecting all connections which dont do a start tls.
1
vote
1answer
4k views

iptables https transparent proxy with privoxy?

So I have a privoxy running (on port 8080) on a box acting as a router. My goal is to route all HTTP & HTTPS traffic through privoxy on there. HTTP works with the following command iptables -t ...
1
vote
2answers
1k views

iptables command to clear all existing rules

My server is Red Hat Enterprise Linux Server release 5. What is the correct/proper command to clear all existing iptables rules defined in /etc/sysconfig/iptables (so that I can start defining/adding ...
1
vote
2answers
2k views

How can I block all traffic except web traffic?

I have wrote my rules like this: iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP iptables -A OUTPUT -i eth0 -p tcp --dport 80 -j ACCEPT What do I do next?
1
vote
2answers
3k views

Without iptables, telnet smtp.gmail.com 465 fine. With, no go. However, ports outbound open…?

Question here regarding iptables. I have ports 465 and 587 open in the OUTPUT chain for my iptables. However, trying to do a telnet smtp.gmail.com 465 or telnet smtp.gmail.com 587 from my Fedora Core ...
1
vote
2answers
4k views

How do I use IPTABLES to create a HTTPS (443) passthrough around Squid?

I've got Ubuntu and Squid running on a machine acting as a transparent proxy and a default gateway for many pc's on my network, which means all internet bound activity comes through the interface to ...
0
votes
1answer
39 views

GW box not allowing internet from internal computers

I have a relatively new GW box ( CentOS 6.5 ) that can ping www.apple.com. When I change computers inside my network to use this GW as †he default GW, they cannot access the internet. So then I ...
0
votes
2answers
185 views

AWS VPC + IPtables + NAT: Port Forwarding is not working

Yesterday, I posted a question here but I think was not clear enough in my words. BTW, This question is not a duplicate. I have AWS VPC Setup as below. GOAL/PROBLEM: SSH to Server A from internet. ...
0
votes
2answers
48 views

IPtables: Forward port to another host is not working

I am trying out something so this is my test setup: Setup: I have AWS VPC with a public and private subnet. I have a host in public subnet with a public IP address (say Host A) I have a host in ...
0
votes
2answers
145 views

iptables packet forwarding to one of two gateways depending on origin

Given the following installation: old router 192.168.1.1 with NAT forward of tcp port 80 to 192.168.1.10:80 new router 192.168.1.2 with NAT forward of tcp port 80 to 192.168.1.10:80 web ...
0
votes
1answer
122 views

iptables mport module not found

I'm replacing a wireless router/firewall running Tomato with a Debian server, and I was excited to have found tomato's iptables config so I could directly import it to the new server (my question ...
0
votes
1answer
112 views

Retrieve malicious IP addresses from Apache logs and block them with iptables

Im trying to keep away some attackers that try to exploit XSS vulnerabilities from my website, I have found that most of the malicious attempts start with a classic "alert(document.cookie);\" test. ...
0
votes
1answer
333 views

Block SSH access from specific countries

I found this handy script online, and would like to modify it to only block SSH access but I don't know anything about iptables and Im afraid Ill kill my system as i have no physical access to it. ...
0
votes
1answer
138 views

How to route the traffic from a specific port through a socks 5 server?

I'm running oracle sql on port 1521. However I can connect on it from a remote server only through a socks5 proxy(due firewall restriction). The client that I use to connect to the sql server doesn't ...
0
votes
1answer
85 views

Unable to ping gateway from network

I got the following route table : #!/bin/bash IP=/sbin/ip # SST echo "SST: Setting up SST network ..." $IP route flush table 10 $IP route add table 10 to 10.45.13.0/26 dev eth0 $IP route add table ...
0
votes
1answer
815 views

iptables rule order

I have noticed the following iptables rule order executed by a program: iptables -A INPUT -p all -j ACCEPT iptables -A INPUT -p all -s ip_address -j REJECT I thought that based on the ordering ...
0
votes
0answers
13 views

Fedora Core 17 network interface names set weirdly, won't reset via documentation [duplicate]

Possible Duplicate: Fedora 17 ifconfig eth0 returns an error message, why did linux change eth0 to em1? An interface was added to this Fedora Core 17 system long after installation and it ...
0
votes
2answers
426 views

Confusion Post FedoraCore Upgrade: NAT / port forwarding trouble, and POSTROUTING MASQUERADE has unexpected influence on forwarding ports

Following a gateway / firewall system's hardware failure, a younger version of Fedora Core (17) was installed on new hardware, and the old 'iptables' and system-config-firewall files from ...
0
votes
1answer
472 views

mod_evasive DOSSystemCommand not working

I'm trying to get mod_evasive to fire off a script to add an iptables rule to deny the offending host. I've tried the suggestions from both answers here but I still can't get it working. Apart from ...
0
votes
1answer
98 views

iptables rule still take effect after deleted

Scenario: I built a server(S) with openvpn. And there might be several vpn clients(C1~C10) providing SSH/FTP/HTTP behind "S" Several users(U1~U10) on internet will login through 'S' to access their ...
0
votes
1answer
633 views

iptables: No chain/target/match by that name.

I am using this command to attempt to block this vulnerability scanner based on it's string, which is returning an error. # iptables -I INPUT -j DROP -d xxx.xxx.xxx.xxx -p tcp --dport 80 -m string ...
0
votes
1answer
953 views

iptables error: No chain/target/match by that name?

After running following command: iptables -t nat -I POSTROUTING -m state --state NEW -p tcp --dport 25 -o eth0 -m statistic --mode nth --every 5 -j SNAT --to-source 173.224.222.45 I get following ...
0
votes
2answers
752 views

How to configure linux routing/filtering to send packets out one interface, over a bridge and into another interface on the same box

I'm trying to test a ethernet bridging device. I have multiple ethernet ports on a linux box. I would like to send packets out one interface, say eth0 with IP 192.168.1.1, to another interface, say ...
0
votes
1answer
1k views

IP Table, what does this construct mean ::INPUT ACCEPT [0:0]

I am looking at an IP Table construct, what does the following mean : :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] thanks
0
votes
1answer
124 views

iptables: How to create a rule for a single website that does not apply to other websites?

Virtual Dedicated Server hosts 10 websites. 1 firewall made with iptables If one of those 10 websites gets hit by too many ping requests coming from one IP address, how do I limit or drop it without ...
0
votes
1answer
762 views

UFW/IPTables: after setting default outgoing deny, and port 80 outgoing allow, curl still doesn't work

With UFW, I disabled all outgoing and ingoing traffic by default. However, I do allow port 80 in and out: sudo ufw default deny incoming (deny all incoming) sudo ufw default deny outgoing (deny all ...
0
votes
1answer
2k views

iptables has port 80 open but nmap shows it closed

I'm having some troubles getting a Debian webserver to open up port 80 for HTTP traffic. In my iptables, I opened up port 80 using the following commands: iptables -A INPUT -p tcp --dport 80 -j ...
0
votes
0answers
253 views

Fowarding port in iptables to internal server

I'm running cPanel/WHM with ConfigServer Firewall (csf). I want to forward port 8080 on my webserver to an internal server with an IP of lets say 10.1.1.1 thats running a webserver on port 80. How ...
0
votes
1answer
513 views

Firewall on a KVM host, prevent access to VM:s

I have a Linux machine running KVM with several VM:s, all have public IP:s. For the time being I have everything routed through a bridge (br0) and this works well. I also need a firewall on the host ...
0
votes
2answers
2k views

How to use iptables to forward requests to a jBoss server running on a different machine?

I have 3 machines with the following IP addresses : - Machine 1 : - 10.10.10.20 Machine 2 :- 10.10.10.21 Machine 3 : - 10.10.10.22 The jBoss server is started on Machine 1 and Machine 3 is client. ...
0
votes
1answer
641 views

How to translate unicast to broadcast via DNAT with iptables?

How to translate UDP unicast packet to a broadcast address via DNAT with iptables or something else?
0
votes
5answers
2k views

Querying a DHCP server in C#

I have a really large network. Class A network and due to security reasons broadcast and any other PING has been blocked. I want to get all the PC IP that are alive. Is there any way to query DHCP ...
-1
votes
1answer
176 views

How to Setup iptables for a squid proxy with just one HW-NIC

I got a Server with a static ipadress for rent and now i want to setup a transparent proxy on this server. after i configured the squid for testing purposes with the listener "http_access allow all", ...
-1
votes
2answers
2k views

Destination NAT Onto the Same Network from internal clients

I have a DSL router which acts as NAT (SNAT & DNAT). I have setup a server on internal network (10.0.0.2 at port 43201). DSL router was configured to "port forward" (or DNAT) all incoming ...
-1
votes
2answers
120 views

Iptables rules sometimes are reset automatically

Can't figure out why iptables rules are dropped. sudo iptables -A INPUT -s 89.111.3.48 -j DROP Any suggestions are welcome.
-2
votes
2answers
3k views

how to redirect to an URL using iptables?

I want to redirect all the incoming requests to an URL instead of an IP address how can i archive this.. And when I redirect using IP address the redirection is happening but the redirected IP/URL is ...
-2
votes
1answer
295 views

Options for non-virtualized network interface isolation? [closed]

My server has two physical NICs, interfaces are eth0 192.168.1/24 (lan) and eth1 192.168.3/24 (dmz). Both NICs are connected to a router via wire. Router has two vlans for lan and dmz with separated ...
-3
votes
2answers
393 views

iptables No chain target match by name [closed]

Hi all into my Ubuntu server I want to block ftp port for all but I when I launch command: iptables -A INPUT -p tcp --destination-port 21 -j DROP Return me this error: iptables: No ...