iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

0
votes
5answers
4k views

iptables logging not working?

OS: Ubuntu 10.04 Logging daemon: rsyslog For some reason i'm not getting any iptables logs, even thought i don't look through them very often i'd still like to get it working for the sake of it ...
0
votes
5answers
4k views

openVPN and multiple external IP addresses

I currently have an openVPN server with multiple external IP addresses. I'd like to have all VPN connections (tun0 interface, and/or 10.19.88.xx IP range) to take the 2nd external IP address as '...
9
votes
1answer
2k views

Limit ICMP Per Source IP with IPTables

I have mistakenly thought that the limit module is per source ip, but it appears to be based on all requests: 577 36987 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 ...
5
votes
4answers
694 views

iptables: change policy or use catch-all rule?

What do you do when setting up iptables: change the default policy (iptables -P INPUT DROP, for example) or add a catch-all rule at the end of the ruleset (iptables -A INPUT DROP)? If you do prefer ...
5
votes
2answers
667 views

Linux: Block IPv6 for certain applications / hostnames

Problem and aim We don't get IPv6 from our ISP thus I have an IPv6 tunnel which works fine but is, of course, not very fast. And not really reliable. I like to have IPv6 available "just in case" but ...
5
votes
2answers
2k views

Linux fails to interpret ACK, keeps resending SYN+ACK

The following is a wireshark dump of the problem occurring, IP-adresses replaced with 'client' and 'server': 4414.229553 client -> server TCP 62464 > http [SYN] Seq=0 Win=65535 Len=0 MSS=1452 ...
4
votes
3answers
2k views

two gateways / two providers with different ips

I want to route packets coming in on eth0 back over eth0 and the ones coming in to eth1 back over eth1. I don't care which gateway is used for outgoing connections. If i just enter two gateways in /...
4
votes
3answers
8k views

How long does it take for an iptables rule to apply?

How long does it take for an iptables rule to apply? I use a script with the code below in an attempt to block hosts, but they don't appear to take immediately. Is there some delay, is iptables not ...
4
votes
3answers
2k views

iptables: find out what packet is blocked by which rule?

How can I setup iptables in a way I know what packet is blocked by which rule? The one solution I know of is to -j LOG --log-prefix. Is there any other way?
4
votes
1answer
393 views

openvpn TLS handshake fails on client because firewall drops packets (but why?)

I seem to have problem with my openvpn server - client connection. now, the important information is in the log (verb3) of my client: Mon Mar 30 17:09:59 2015 OpenVPN 2.2.2 x86_64-slackware-linux-...
4
votes
3answers
2k views

pptpd not working externally on Ubuntu Server 11.10

I am trying to set up a pptpd vpn on our newly installed Ubuntu 11.10 64 bit server, but am not having success having a client connect via an iPhone to the VPN. Note that no clients have been able to ...
3
votes
4answers
4k views

How do I get the number of (currently) established TCP connections for a specific port?

How do I get the number of (currently) established TCP connections for a specific port? I have managed to get counters for traffic working by doing i.e for outgoing RTMP. iptables -N $CHAIN ...
3
votes
2answers
2k views

How do I forward localhost traffic to a remote host with iptables?

I would like to set up my CentOS 6.5 box to forward connections to localhost (127.0.0.1) to the same port on a remote machine (e.g. 10.0.3.10). I've tried the iptables rule below, but when I attempt ...
3
votes
3answers
13k views

Enabling http access on port 80 for centos 6.3 from console

Have a centos 6.3 box running on Parallels and I'm trying to open port 80 to be accesible from outside tried the gui solution from this post and it works, but I need to get it done from a script. ...
3
votes
1answer
5k views

Block all incoming DNS requests EXCEPT from IPs x,y,

I want to block all incoming requests on my two DNS servers APART FROM certain IP addresses e.g. IP of 1.2.3.4 will be allowed to make requests but NOBODY else will. How do you do this with iptables? ...
3
votes
2answers
2k views

Firewall rules not restricting access to Docker Web Apps

I have a problem where ports exposed to applications running on our system in docker containers remain open to the world despite the iptables configuration designed to restrict access. It seems to me ...
3
votes
1answer
2k views

iptables preroute localhost

I would like to forward all incoming traffic from a certain port to another one using iptables. The problem is that prerouting doesn't work for traffic from localhost. This topic suggests a solution: ...
2
votes
1answer
355 views

How does the iptables chain OUTPUT work?

First experience w/iptables, using it to reroute traffic from port 80 to 8080 so I can run an application server with just user permissions. I solved the problem, but I don't know why it works, and I ...
2
votes
2answers
5k views

iptables packet forwarding to one of two gateways depending on origin

Given the following installation: old router 192.168.1.1 with NAT forward of tcp port 80 to 192.168.1.10:80 new router 192.168.1.2 with NAT forward of tcp port 80 to 192.168.1.10:80 web ...
2
votes
1answer
202 views

Two openvpn servers on the same machine, route traffic between the two subnets

I have two openvpn servers ( one on tcp, one on udp) running on the same machine - an OPENVZ vps. The first network A uses 10.10.0.0/24 and it is designed as an intranet. The second network B uses ...
2
votes
2answers
2k views

UFW/IPTables: after setting default outgoing deny, and port 80 outgoing allow, curl still doesn't work

With UFW, I disabled all outgoing and ingoing traffic by default. However, I do allow port 80 in and out: sudo ufw default deny incoming (deny all incoming) sudo ufw default deny outgoing (deny all ...
2
votes
2answers
12k views

How can i forward the http and ssh port to my internal server using iptables

I do not have the router so i make the Linux system into router having centos 6.4 for forwarding the Public network traffic to my local LAN.It has the two NIC card. one for public ip (eth1) and ...
2
votes
3answers
6k views

IP tables modification to allow access to mysql on CENTOS 5 server

CentOS 5.4, with IP tables stopped, I can do it. What's the line I need to add to IPtables so I can keep it on and have remote (domain) access to the mysql databases? my current table: # Firewall ...
2
votes
5answers
7k views

Route return traffic to correct gateway depending on service

On my office network I have two internet connections and one CentOS server running a website (HTTPS on port 443). The website should be publicly accessible through the public IP of the first internet ...
2
votes
1answer
3k views

What is “state RELATED,ESTABLISHED” in iptables? [duplicate]

2064 871K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x00 0 0 DROP tcp -- * ...
2
votes
2answers
417 views

Using linux server as router for network

I would like to setup my Debian Lenny server as a router for my home network using iptables, but so far have been unsuccessful. Below is a diagram of the desired network architecture INTERNET - (...
1
vote
3answers
2k views

iptables rule to block incoming/outgoing traffic to a Xen container

I'm trying to setup IPTABLES on my xen host server that will block incoming and/or outgoing access to a xen client on the same machine. Specifically, I need to block outgoing port 25 traffic and ...
1
vote
1answer
1k views

Linux-KVM / iptables: prevent guest spoofing by matching ip+mac address on bridge?

I have my KVM guests on a standard br0 bridge setup: auto br0 iface br0 inet static address 192.168.1.117 netmask 255.255.255.0 network 192.168.1.1 broadcast 192.168.1.225 gateway 192....
1
vote
1answer
803 views

iptables NAT port fowarding and Apache log IPs

Thanks to quanta, I can now use iptables to port forward SSH through to servers behind the firewall using a single IP and multiple ports - original question here. However, if I use this technique to ...
1
vote
3answers
5k views

Linux policy routing - packets not coming back [closed]

i am trying to set up policy routing on my home server. My network looks like this: Host routed VPN gateway Internet link through VPN 192.168.0.35/24 ---> 192.168.0.5/24 ---&...
1
vote
1answer
901 views

iptables mport module not found

I'm replacing a wireless router/firewall running Tomato with a Debian server, and I was excited to have found tomato's iptables config so I could directly import it to the new server (my question ...
1
vote
1answer
7k views

iptables https transparent proxy with privoxy?

So I have a privoxy running (on port 8080) on a box acting as a router. My goal is to route all HTTP & HTTPS traffic through privoxy on there. HTTP works with the following command iptables -t ...
1
vote
3answers
5k views

Howto use ipset and iptables on Ubuntu 12.04 to block lots of IPs

I would like to use this tutorial: http://www.jsimmons.co.uk/2010/06/08/using-ipset-with-iptables-in-ubuntu-lts-1004-to-block-large-ip-ranges/ In Ubuntu 12.04 the package ipset-source is removed from ...
1
vote
3answers
683 views

Configure iptables over SSH without getting locked out?

I need to provision servers via SSH, and in the process, configure iptables. More precisely, I want to run the following commands in this order: iptables -F iptables -P INPUT DROP iptables -A INPUT -...
1
vote
3answers
463 views

What is the best way to get PRECISE domain name from ip address logged in iptables log

In iptables I am logging certain public IP addresses... say of websites visited from different workstations, depending on destination port number... All this is not really relevant to the question but ...
1
vote
1answer
3k views

Limit bandwidth using tc, iptables, and htb

I'm running a Debian server and was wondering if there are good resources out there, to which you can point me, where I can read about traffic limitations. I have couple users sharing one server. ...
1
vote
2answers
2k views

controlling the bandwidth using tc

I have two NICs. eth0 is connected to the internet and eth1 is connected to the LAN. I want to restrict the download limit using iptables and linux tc. So I wrote a test script to verify if it is ...
1
vote
0answers
92 views

iptables keeps using old nat rules

I use iptables snat on my gateway to change local source ip addresses to external. The trouble is that after I change the rules (or even if I flush iptables nat table) gateway keeps using the old rule ...
0
votes
1answer
1k views

How to relax firewall for UDP connections/ports for a specific IP address?

My server is Red Hat Enterprise Linux Server release 5. iptables version is v1.3.5. I want to allow all UDP connections / port for the IP address 192.168.0.200. This IP address is configured in my ...
0
votes
2answers
2k views

iptables redirected port 80 to 8080 - How to disallow direct access to port 8080?

I've routed all requests from port 80 to port 8080 for my Tomcat server using iptables. iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080 Now http://mydomain.com/ ...
0
votes
1answer
291 views

Port redirection with iptables to localhost / blocking the destination port

I like to forward all traffic coming to 80 to be redirected to 8000. I used iptables -tnat -A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8000 But then port 8000 is still open to ...
0
votes
1answer
6k views

iptables for Windows to redirect traffic

I am currently testing my server traffic and would like to route all incoming+outgoing traffic so as to be picked up by Burpsuite for analysis. Ideally, all traffic from ports 80 and 443 should be ...
0
votes
1answer
249 views

Running root script upon ssh'ing as a particular user, but not upon standard login

I would like to do the following : If I login as user ABC via the login screen, do nothing. However if I ssh as ABC, then I want to run a root script, without being prompted for roots password, and ...
0
votes
1answer
430 views

TCP packet filter based on TCP sequence

I need to build a test environment with a very precise packet loss based on specific TCP sequence or, optionally, on payload content. I couldn't figure out how to do it with tc or iptables. What tool ...
0
votes
2answers
354 views

How to close certain TCP/UDP ports (incoming) for ALL networks except listed through IPTABLES

How to close certain TCP/UDP ports (incoming) for ALL networks except listed through IPTABLES. I have a small set of NETWORKS I'd like to leave THE ports to be open. But want to close for all other ...
-1
votes
3answers
5k views

SNAT in IP6Tables

Netfilter says they have support for SNAT and DNAT for ipv6. I look under the man pages of ip6tables and see that there is SNAT and DNAT listed. So my question is how do you make rules for them? I ...
-1
votes
2answers
265 views

How to block access to a local user to a local port?

How to block access to a local user to a local port? Example: user Elvis should not have access to the port 25600 on the same server.
-1
votes
1answer
865 views

How to set up port forwarding from Windows host to Vagrant Linux VM to Docker containers?

I'm using a Windows host, running CoreOS in Vagrant with VirtualBox provider, and in that CoreOS, I have Kubernetes 0.14.2 single-node cluster running (I couldn't get latest version, 0.15, to work ...
-1
votes
3answers
289 views

iptables — am I doing this right?

UPDATE Boy am I glad I asked. OK, I'll try again and post another question. I'd like to set up a CentOS 5.3 host to allow only ping, ssh, httpd, and SSL connections. After reading a tutorial and ...
-4
votes
2answers
2k views

iptables: open port 25 CentOS 7 [closed]

I have problems opening port 25 for sendmail on my CentOS 7 machine. Here's my iptables configuration: *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A INPUT -m state --...