iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

-1
votes
3answers
283 views

iptables — am I doing this right?

UPDATE Boy am I glad I asked. OK, I'll try again and post another question. I'd like to set up a CentOS 5.3 host to allow only ping, ssh, httpd, and SSL connections. After reading a tutorial and ...
5
votes
1answer
786 views

How can I route different traffic over different interfaces (routes) by protocol?

I have two different WAN interfaces in a Linux (iptables) router. How could I achieve a situation where different traffic is routed over different interfaces, depending on the protocol (destination ...
5
votes
4answers
2k views

iptables: Allow connections on a port to only “safe” hosts

I have a centos machine and wish to only allow outbound connections to port 587 to certain remote machines, and drop packets trying to connect to all other hosts. I only want to allow access on port ...
4
votes
2answers
3k views

How many rules can iptables support?

Someone asked me this recently and I had no answer for it. I know this is kind of an open-ended question but is there a limit on the numnber of rules you can install in a table/chain? If so, how can I ...
4
votes
2answers
3k views

What the meaning of “policy ACCEPT” and “policy DROP” in iptables?

When running service iptables status on 2 CentOS server, one server has policy ACCEPT in Chain INPUT, Chain FORWARD, and Chain OUTPUT another server has policy DROP in Chain INPUT and Chain FORWARD; ...
4
votes
2answers
2k views

Persisting nf_conntrack_max Across Reboots

In /proc I have two entries for nf_conntrack_max: /proc/sys/net/netfilter/nf_conntrack_max /proc/sys/net/nf_conntrack_max The seem to point to the same value as changing one also changes the ...
4
votes
4answers
6k views

Iptables NAT logging

I have a box setup as a router using Iptables (masquerade), logging all network traffic. The problem: Connections from LAN IPs to WAN show fine, i.e. SRC=192.168.32.10 -> DST=60.242.67.190 but for ...
4
votes
5answers
2k views

iptables drops some packets on port 80 and i don't know the cause

We are running a firewall with iptables on our Debian Lenny system. I show you only the relevant entries of our firewall. Chain INPUT (policy DROP 0 packets, 0 bytes) target prot opt in out source ...
3
votes
3answers
6k views

Enabling http access on port 80 for centos 6.3 from console

Have a centos 6.3 box running on Parallels and I'm trying to open port 80 to be accesible from outside tried the gui solution from this post and it works, but I need to get it done from a script. ...
3
votes
1answer
579 views

Network Bridge in dom0 can not ping domU's

I am using Debian wheezy with XEN 4.1. I have two network bridges xenbr0 and xenbr1. xenbr0 is linked to the real-eth0-nic so the domU's can talk to the outside world, which worked fine. xenbr1 was ...
3
votes
2answers
142 views

Preventing endless forwarding with two routers

The network in quesiton looks basically like this: /----Inet1 / H1---[111.0/24]---GW1---[99.0/24] \----GW2-----Inet2 Device ...
3
votes
1answer
697 views

Possible for linux bridge to intercept traffic?

I have a linux machine setup as a bridge between a client and a server; brctl addbr0 brctl addif br0 eth1 brctl addif br0 eth2 ifconfig eth1 0.0.0.0 ifconfig eth2 0.0.0.0 ip link set br0 up I also ...
3
votes
2answers
483 views

Iptables Forwarding problem

I had initally asked question about sertting up my linux box for natting for my home network and was given suggestions in the thread here. Did not want to clutter the old question so starting a new ...
3
votes
3answers
4k views

How long does it take for an iptables rule to apply?

How long does it take for an iptables rule to apply? I use a script with the code below in an attempt to block hosts, but they don't appear to take immediately. Is there some delay, is iptables not ...
3
votes
7answers
1k views

Safely changing iptables firewall rules?

What do people do when they are changing their firewall rules to make sure they don't accidentally lock themselves out? For example, is there a way to load firewall rules so that they're only active ...
2
votes
1answer
79 views

Iptables bang position

I am trying to set up this rule : iptables -A INPUT -i eth1 -p tcp -s ! 10.111.11.0/24 --dport ssh --syn -m state --state NEW -j ACCEPT but it doesnt work. When i change place of ! iptables -A ...
2
votes
2answers
979 views

Iptables: Forwarding packets doesn't work

I have 3 Linux Systems A, B and C. A is a TCP Client and sends a message to TCP Server on C. A can see only the external IP of B which is at wlan0 interface, 192.168.0.3 ------------------ ...
2
votes
2answers
1k views

NAT with iptables to Xen DomU

I am trying to forward packets arriving on the host machine to a virtual machine. Current aim is to forward xxx.xxx.xxx.xxx:3022 to the vm 192.168.10.2:22. I tried adding the following rules through ...
2
votes
2answers
204 views

iptables rejects everything it should accept

Everybody, hello! I'm trying to setup my server firewall using iptables (I have to admit that last time I used iptables was a year ago), but iptables acts contrary to what I ask. Here is my test ...
2
votes
2answers
3k views

iptables and multiple ports

This doesn't work for me: # iptables -A INPUT -p tcp --dports 110,143,993,995 -j ACCEPT iptables v1.4.7: unknown option `--dports' Try `iptables -h' or 'iptables --help' for more information. ...
2
votes
3answers
888 views

SSH hosts.deny and hosts.allow

I have this content in hosts.deny (with a new line at the end): # # hosts.deny This file describes the names of the hosts which are # *not* allowed to use the local INET services, as decided ...
2
votes
2answers
2k views

How to set up internal routing between virtual interfaces and real ethernet interface (Linux)

I have a Linux box with one real (as opposes to virtual, a.k.a. aliased) Ethernet interface I can use (eth0 is used for other purposes - can't use it, nor can I add more NICs). Say it's eth1 I need ...
2
votes
1answer
2k views

SNAT through Racoon IPSec VPN

I am trying to route traffic from a device (that I will call "target") connected to my Ubuntu box (that I will call "host") to servers at a remote office. The host uses a Racoon IPSec VPN, connected ...
2
votes
1answer
656 views

Allow a range of IP's with IPTABLES from a file

I would like to allow only certain ip ranges (CIDR) and block everything else, however, I have those IPs that I want to allow on a text file. How could I load them up from the allow.file to IPTABLES ...
2
votes
1answer
638 views

iptables: block traffic by IP range for specific website

there is a web-hosting server with several sites on it. I need to block some subnets (IP ranges) for some website(s). Is it possible at all? I've tried something like this: iptables -A OUTPUT -m ...
2
votes
1answer
7k views

Linux: routing traffic between two networks with iptables

Ok, so this is a strange network setup, but I`m trying to get the internets from one network to another. headless server ((((( wireless router (other network)-----internet | | router ...
2
votes
1answer
2k views

Port Forwarding with iptables is not working

I´m using an Ubuntu Server Box (10.04) to route my network to internet. This box has 2 ethernet cards (eth0 for internet connection, eth1 for lan - 192.168.1.1) and I would like to forward port 80 to ...
2
votes
1answer
987 views

Iptables - Forwarding + Masquerading

I am new to iptables and trying to set my linux server as a gateway for my other computers.So naturally I am playing with iptables and needed some help My server has 2 NIC cards, eth0(WAN) and ...
2
votes
1answer
2k views

Allow traffic on one port from one IP address with iptables

I am using the following iptables rule to try allowing access to port 8080 from one IP address: iptables -A INPUT -s 12.34.56.78 -p tcp -m tcp --dport 8080 -j ACCEPT However, this rule isn't ...
2
votes
2answers
380 views

How long does a blocked connection from Iptables last? Is there a way to set the timeout?

iptables -A INPUT -m state --state NEW -m recent --set # If we receive more than 10 connections in 10 seconds block our friend. iptables -A INPUT -m state --state NEW -m recent ...
2
votes
1answer
875 views

openvz and iptables

http://wiki.openvz.org/Setting_up_an_iptables_firewall mentions to load xt_state before starting a container in order to run iptables in containers. so I ran modprobe xt_state on the host and ...
2
votes
1answer
13k views

How to forward connection from one interface to another under linux

I have linux box which has two network interface, eth0, eth1. from eth1 I can access an internal website, say under port 8080. from outside the box, I can't access that network. my question is, is ...
2
votes
2answers
2k views

How can I block all traffic except web traffic?

I have wrote my rules like this: iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP iptables -A OUTPUT -i eth0 -p tcp --dport 80 -j ACCEPT What do I do next?
1
vote
1answer
109 views

Hammered by botnet; iptables can't keep up [duplicate]

Fructis is a multi-site (and multi-software) VM (Xen) with 2 cores and like 6G of RAM. It hosts popular Drupal and Wordpress websites and is currently getting hammered. I will put all details below. ...
1
vote
1answer
513 views

iptables mport module not found

I'm replacing a wireless router/firewall running Tomato with a Debian server, and I was excited to have found tomato's iptables config so I could directly import it to the new server (my question ...
1
vote
1answer
188 views

puppet service not stopping service

notice ("This should be echoed") service { "iptables": ensure => "stopped", } This does not stop iptables, I am not sure why. service iptables stop works fine. Puppet 2.6.17 on CentOS 6.3. ...
1
vote
1answer
267 views

Can TC limit bandwidth by the Qos field of IP header

We are developing a client/server applications. There are three types of network data in our server app: Realtime data such as those of Video/audio, Critical Data such as those of Database data and ...
1
vote
2answers
884 views

squid: can't connect to peer with tcp_outgoing_address

I encountered the problem with configuration of two squid servers. I have the following scheme - The main idea is to download all files from rackspace and amazon through parent squid and store all ...
1
vote
2answers
91 views

Iptables blocking all my traffic for some reasson

I've installed stock Red Hat Linux 6 and I've installed lighttpd, it seems that my website loads only when i stop iptables (service iptables stop), I'm not sure what's going on, because I haven't done ...
1
vote
1answer
182 views

openvpn& iptables — portforwarding and gateway

The problem is similar to this scenario: iptables rule still take effect after deleted Scenario: There are several clients(C1~C10) providing some services, such as SSH,HTTP..... The clients are ...
1
vote
2answers
1k views

Unable to Create Rule in IPTables to Open Port 80

I'm trying to open port 80 in iptables but am running into a couple issues. I am running CentOS 5.7. First I tried to run this command: iptables -I RH-Firewall-1-INPUT -p tcp -m tcp --dport 80 -j ...
1
vote
1answer
3k views

iptables has port 80 open but nmap shows it closed

I'm having some troubles getting a Debian webserver to open up port 80 for HTTP traffic. In my iptables, I opened up port 80 using the following commands: iptables -A INPUT -p tcp --dport 80 -j ...
1
vote
1answer
747 views

iptables Ubuntu VPS SSH rule

I'm trying to configure a VPS Ubuntu server to connect to codebase GIT server, just like heroku codebase authentication is based on SSH RSA keys. I've uploaded the keys to the repository, and when ...
1
vote
0answers
569 views

nginx does not close loopback connections

I'm using nginx in reverse-proxy mode. Here's relevant part of config file: server { listen 80; server_name ~^web.redhelper\.ru$ ; access_log off; location /http-bind { ...
1
vote
3answers
2k views

iptables: No chain/target/match by that name

I'm trying to set iptables on Debian 6 Squeeze amd64 and I'm faced to this error message root@Vision:~/bin# iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables: No ...
1
vote
2answers
1k views

controlling the bandwidth using tc

I have two NICs. eth0 is connected to the internet and eth1 is connected to the LAN. I want to restrict the download limit using iptables and linux tc. So I wrote a test script to verify if it is ...
1
vote
1answer
173 views

confusion in setting up a firewall on bridge

I am having some confusion in putting up my IPTABLE rules. auto lo iface lo inet loopback # The primary network interface auto eth2 iface eth2 inet manual auto br0 iface br0 inet static ...
1
vote
2answers
718 views

iptables only allow smtp connections with start tls

Is it somehow possible to block/abort unencrypted smtp connections with iptables? effectively rejecting all connections which dont do a start tls.
1
vote
1answer
5k views

iptables https transparent proxy with privoxy?

So I have a privoxy running (on port 8080) on a box acting as a router. My goal is to route all HTTP & HTTPS traffic through privoxy on there. HTTP works with the following command iptables -t ...
1
vote
2answers
1k views

iptables command to clear all existing rules

My server is Red Hat Enterprise Linux Server release 5. What is the correct/proper command to clear all existing iptables rules defined in /etc/sysconfig/iptables (so that I can start defining/adding ...