iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

4
votes
3answers
2k views

two gateways / two providers with different ips

I want to route packets coming in on eth0 back over eth0 and the ones coming in to eth1 back over eth1. I don't care which gateway is used for outgoing connections. If i just enter two gateways in ...
3
votes
2answers
828 views

LXC networking with public IP

I have installed LXC in ubuntu server 12.04 using this link. It was installed successfully and i am able login using ubutu/ubuntu as username and password. Then I tried to setup network for LXC ...
3
votes
4answers
2k views

How do I get the number of (currently) established TCP connections for a specific port?

How do I get the number of (currently) established TCP connections for a specific port? I have managed to get counters for traffic working by doing i.e for outgoing RTMP. iptables -N $CHAIN ...
3
votes
2answers
4k views

Secure IPTables rules for Corosync

I have two HA load balancers (hollywood and wolfman) running Corosync and Pacemaker. The eth1 interfaces are connected to the WAN, and the eth0 interfaces to the LAN, using a virtual IP as the gateway ...
3
votes
1answer
3k views

Block all incoming DNS requests EXCEPT from IPs x,y,

I want to block all incoming requests on my two DNS servers APART FROM certain IP addresses e.g. IP of 1.2.3.4 will be allowed to make requests but NOBODY else will. How do you do this with iptables? ...
3
votes
3answers
4k views

Easy way to “edit” the traffic coming from a tcp host (linux)

I need to make some small modification to incoming traffic from a known tcp host:port before the process handling the connection get the stream. For example, let 192.168.1.88 be a remote host which ...
2
votes
2answers
3k views

iptables packet forwarding to one of two gateways depending on origin

Given the following installation: old router 192.168.1.1 with NAT forward of tcp port 80 to 192.168.1.10:80 new router 192.168.1.2 with NAT forward of tcp port 80 to 192.168.1.10:80 web ...
2
votes
1answer
4k views

OpenVPN not redirecting all traffic through VPN

I have just finished setting up my VPN, and google shows my IP to be that of my VPN, so this works fine. However, when I log in through SSH to the VPN server, it shows my last login to be that of my ...
2
votes
3answers
2k views

Does NAT-ing rewrite the source IP in packets?

I'm trying to set up port forwarding so that a specific IP (e.g 1.2.3.4/32) can SSH via a bastion (e.g 5.5.5.5:2222) to an app server (10.3.3.3:22). The bastion and app server are running in a VPC in ...
2
votes
1answer
1k views

mod_evasive DOSSystemCommand not working

I'm trying to get mod_evasive to fire off a script to add an iptables rule to deny the offending host. I've tried the suggestions from both answers here but I still can't get it working. Apart from ...
2
votes
2answers
2k views

UFW/IPTables: after setting default outgoing deny, and port 80 outgoing allow, curl still doesn't work

With UFW, I disabled all outgoing and ingoing traffic by default. However, I do allow port 80 in and out: sudo ufw default deny incoming (deny all incoming) sudo ufw default deny outgoing (deny all ...
2
votes
2answers
465 views

Issue NATing server private interface to loopback (for MySQL)

I'm trying to NAT traffic sent to the server's private interface to the loopback (because MySQL bind-address is on 127.0.0.1 and can't be changed but I still need to reach it via the private ...
2
votes
1answer
6k views

How to make iptables ALLOW rule for multicast?

I have two servers that uses ucarp as failover. On each server eth1:1 is reserved for ucarp's keepalive connection. ucarp uses the destination IP as multicast address 224.0.0.18. On ucarp master ...
2
votes
1answer
14k views

iptables rules to allow L2TP/IPSEC VPN behind firewall

I asked about this on the Smoothwall Express forums but they are understandably reluctant to provide to much help. After all, they really want to sell the commercial version. I need to provide an ...
2
votes
2answers
411 views

Using linux server as router for network

I would like to setup my Debian Lenny server as a router for my home network using iptables, but so far have been unsuccessful. Below is a diagram of the desired network architecture INTERNET - ...
2
votes
1answer
331 views

How does the iptables chain OUTPUT work?

First experience w/iptables, using it to reroute traffic from port 80 to 8080 so I can run an application server with just user permissions. I solved the problem, but I don't know why it works, and I ...
2
votes
3answers
4k views

IP tables modification to allow access to mysql on CENTOS 5 server

CentOS 5.4, with IP tables stopped, I can do it. What's the line I need to add to IPtables so I can keep it on and have remote (domain) access to the mysql databases? my current table: # Firewall ...
2
votes
1answer
4k views

iptables change destination IP without DNAT

I'm trying to workaround a broken application which insists on connecting to the private address (and thus unreachable) of a server, instead of connecting to the public address (even if the relevant ...
1
vote
0answers
52 views

iptables keeps using old nat rules

I use iptables snat on my gateway to change local source ip addresses to external. The trouble is that after I change the rules (or even if I flush iptables nat table) gateway keeps using the old rule ...
1
vote
1answer
690 views

iptables mport module not found

I'm replacing a wireless router/firewall running Tomato with a Debian server, and I was excited to have found tomato's iptables config so I could directly import it to the new server (my question ...
1
vote
1answer
2k views

Block SSH access from specific countries

I found this handy script online, and would like to modify it to only block SSH access but I don't know anything about iptables and Im afraid Ill kill my system as i have no physical access to it. ...
1
vote
3answers
462 views

Configure iptables over SSH without getting locked out?

I need to provision servers via SSH, and in the process, configure iptables. More precisely, I want to run the following commands in this order: iptables -F iptables -P INPUT DROP iptables -A INPUT ...
1
vote
3answers
3k views

Linux policy routing - packets not coming back [closed]

i am trying to set up policy routing on my home server. My network looks like this: Host routed VPN gateway Internet link through VPN 192.168.0.35/24 ---> 192.168.0.5/24 ...
1
vote
3answers
3k views

Howto use ipset and iptables on Ubuntu 12.04 to block lots of IPs

I would like to use this tutorial: http://www.jsimmons.co.uk/2010/06/08/using-ipset-with-iptables-in-ubuntu-lts-1004-to-block-large-ip-ranges/ In Ubuntu 12.04 the package ipset-source is removed from ...
1
vote
1answer
2k views

Limit bandwidth using tc, iptables, and htb

I'm running a Debian server and was wondering if there are good resources out there, to which you can point me, where I can read about traffic limitations. I have couple users sharing one server. ...
1
vote
1answer
865 views

Linux-KVM / iptables: prevent guest spoofing by matching ip+mac address on bridge?

I have my KVM guests on a standard br0 bridge setup: auto br0 iface br0 inet static address 192.168.1.117 netmask 255.255.255.0 network 192.168.1.1 broadcast 192.168.1.225 gateway ...
1
vote
2answers
2k views

controlling the bandwidth using tc

I have two NICs. eth0 is connected to the internet and eth1 is connected to the LAN. I want to restrict the download limit using iptables and linux tc. So I wrote a test script to verify if it is ...
1
vote
2answers
2k views

Using iptables to redirect incoming requests from port 2525 to port 25?

I'm a developer working from home on an application. One of the features of my app is that it sends outgoing notification emails. I'm attempting to relay these messages through one of our company's ...
0
votes
2answers
66 views

IPtables - Sensible and non-contradictory rules?

This is my IPtable rules for my webserver with SSH installed, i've had help to get this far. My question is, are my rules contradictory. For example, I've been recommended to use these two lines: # ...
0
votes
1answer
3k views

iptables for Windows to redirect traffic

I am currently testing my server traffic and would like to route all incoming+outgoing traffic so as to be picked up by Burpsuite for analysis. Ideally, all traffic from ports 80 and 443 should be ...
0
votes
1answer
215 views

TCP packet filter based on TCP sequence

I need to build a test environment with a very precise packet loss based on specific TCP sequence or, optionally, on payload content. I couldn't figure out how to do it with tc or iptables. What tool ...
0
votes
2answers
665 views

ConfigServer Security and Firewall — after setup, how much daily management required?

I'm looking at using ConfigServer Security and Firewall (CSF; iptables-based). After I configure it properly, how much daily ongoing management is required of me to keep my server secure? Am I going ...
0
votes
1answer
235 views

Running root script upon ssh'ing as a particular user, but not upon standard login

I would like to do the following : If I login as user ABC via the login screen, do nothing. However if I ssh as ABC, then I want to run a root script, without being prompted for roots password, and ...
0
votes
1answer
602 views

iptables NAT port fowarding and Apache log IPs

Thanks to quanta, I can now use iptables to port forward SSH through to servers behind the firewall using a single IP and multiple ports - original question here. However, if I use this technique to ...
0
votes
5answers
4k views

iptables logging not working?

OS: Ubuntu 10.04 Logging daemon: rsyslog For some reason i'm not getting any iptables logs, even thought i don't look through them very often i'd still like to get it working for the sake of it ...
0
votes
1answer
1k views

How to relax firewall for UDP connections/ports for a specific IP address?

My server is Red Hat Enterprise Linux Server release 5. iptables version is v1.3.5. I want to allow all UDP connections / port for the IP address 192.168.0.200. This IP address is configured in my ...
-1
votes
1answer
194 views

re-route requests on filtered smtp port 25 [closed]

My VPN filters port 25 (to prevent spam) but my ISP doesn't. The VPN takes over all traffic and changes the default gateway? How can I bypass the VPN to send mail? I want all outgoing traffic except ...
-1
votes
3answers
3k views

SNAT in IP6Tables

Netfilter says they have support for SNAT and DNAT for ipv6. I look under the man pages of ip6tables and see that there is SNAT and DNAT listed. So my question is how do you make rules for them? I ...
-1
votes
3answers
286 views

iptables — am I doing this right?

UPDATE Boy am I glad I asked. OK, I'll try again and post another question. I'd like to set up a CentOS 5.3 host to allow only ping, ssh, httpd, and SSL connections. After reading a tutorial and ...
7
votes
2answers
6k views

What the meaning of “policy ACCEPT” and “policy DROP” in iptables?

When running service iptables status on 2 CentOS server, one server has policy ACCEPT in Chain INPUT, Chain FORWARD, and Chain OUTPUT another server has policy DROP in Chain INPUT and Chain FORWARD; ...
5
votes
1answer
1k views

How can I route different traffic over different interfaces (routes) by protocol?

I have two different WAN interfaces in a Linux (iptables) router. How could I achieve a situation where different traffic is routed over different interfaces, depending on the protocol (destination ...
5
votes
4answers
3k views

iptables: Allow connections on a port to only “safe” hosts

I have a centos machine and wish to only allow outbound connections to port 587 to certain remote machines, and drop packets trying to connect to all other hosts. I only want to allow access on port ...
5
votes
2answers
11k views

IPTables and DHCP questions?

On my other thread I was talking about some interesting things about the iptables policy and states, now I would like to understand more about how the DHCP works and how iptables understands it. ETH0 ...
5
votes
3answers
3k views

Persisting nf_conntrack_max Across Reboots

In /proc I have two entries for nf_conntrack_max: /proc/sys/net/netfilter/nf_conntrack_max /proc/sys/net/nf_conntrack_max The seem to point to the same value as changing one also changes the ...
5
votes
4answers
7k views

Iptables NAT logging

I have a box setup as a router using Iptables (masquerade), logging all network traffic. The problem: Connections from LAN IPs to WAN show fine, i.e. SRC=192.168.32.10 -> DST=60.242.67.190 but for ...
4
votes
3answers
4k views

fail2ban not working on fresh install of ubuntu 14.04, why?

After installing and configuring fail2ban, I tried to login to my server through ssh with a wrong password. After a few attempts, I tried with the correct password with success. So, fail2ban didn't ...
4
votes
1answer
643 views

iptables blocking ssh tunnel

Server: Ubuntu Server 10.04 LTS I have my iptables locked down so only ssh and http traffic is allowed in. Im trying to tunnel sql example: ssh -L 3306:127.0.0.1:3306 my@domain.com it works fine if I ...
4
votes
5answers
2k views

iptables drops some packets on port 80 and i don't know the cause

We are running a firewall with iptables on our Debian Lenny system. I show you only the relevant entries of our firewall. Chain INPUT (policy DROP 0 packets, 0 bytes) target prot opt in out source ...
3
votes
1answer
1k views

Rotating outgoing IPs using iptables

I am trying to rotate outgoing IPs using iptables. I want to rotate outgoing connections between three IPs, one by one. Here is what I'm doing with iptables: root@server:~# iptables -t nat -I ...
3
votes
3answers
9k views

Enabling http access on port 80 for centos 6.3 from console

Have a centos 6.3 box running on Parallels and I'm trying to open port 80 to be accesible from outside tried the gui solution from this post and it works, but I need to get it done from a script. ...