iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

1
vote
1answer
23 views

How to perform NAT with inside interface as bridge

(dublicate question from AskUbuntu) I have a following network diagram: network diagram 192.168.0.0/24 network with 4 web servers (.1,.2,.3,.4). There are 2 Ubuntu 14.04 (VM1 and VM2) in it. They ...
-1
votes
1answer
31 views

Iptables DNS Input on localhost [closed]

Currently my IPtables Input chain settings on the server are: Chain INPUT (policy DROP 6 packets, 588 bytes) pkts bytes target prot opt in out source destination 202 ...
0
votes
0answers
44 views

ISP provides 400MB connection but behind iptables firewall I only get about 150MB

I have COX communications as my ISP and I have a 400 MB connection at work. I have had for years an iptables firewall I setup that runs great. CPU Info Intel® Core™ i5-2400 Processor (6M Cache, 3.10 ...
1
vote
1answer
44 views

Correct iptables rules to allow linking of docker containers

I have two Docker containers on a Debian 8.3 node. One is the official postgres image, one is a basic phoenix / elixir app. I'm linking both with a docker stack file. But phoenix is not able to ...
1
vote
1answer
43 views

Slow OpenVPN tunnel

I have a tunnel set up between two AWS regions. Using iperf, I saw that if I connect two machines directly (through the internet), I get about 100mb/s. If I use the tunnel, I get 10mb/s. Is there a ...
0
votes
0answers
13 views

UFW blank before.rules file

I am using UFW to configure my Debian IPTables firewall. I have issued the following command... ufw allow ssh This has successfully opened up Port 22 and I can now connect remotely via SSH. I ...
0
votes
0answers
21 views

DNS using GRE work 50%

l'm in a big issue here to make it work I'm already at least about 60% done, but it is difficult and I would like to count on the help guys here who may have already done this type of configuration. ...
8
votes
2answers
1k views

How to configure iptables so an unwanted port is not reported as filtered

I'd like to stop others from seeing my ports as filtered in the nmap standard scan (unprivileged). Let's say that I have the following ports open: 22, 3306, 995 and a firewall configured like this: ...
0
votes
0answers
47 views

Run node server on port 8080, use iptables to redirect traffic

I saw in several venues that in order to run node as a user, and yet get it to listen to port 80, you can do a simple IPTables trick: sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j ...
-1
votes
2answers
63 views

Multiple NIC same subnet [closed]

I have a setup as shown in the image. I know it is insane but i have to work on this configuration only. It is basically an ubuntu server acting as a router with 4 interfaces. 3 of them (eth0, eth1 ...
1
vote
1answer
51 views

Iptables: Difference between RELATED and ESTABLISHED state?

I've tried reading many articles on the internet but none of them are quite clear. I also know similar question has been posted here before but none of them explain my situation. Earlier I ended up ...
0
votes
1answer
90 views

Route outgoing connections from a docker container through a specific IP

I have a docker host machine with a single physical network interface (eth0) and multiple IP addresses assigned to it using IP aliasing (eth0:1, eth0:2, eth0:3). I would like to run several docker ...
-1
votes
1answer
62 views

Captive portal with iptables and local dns server

I'm trying to redirect all the browser's requests from my wifi interface wlan1 to a captive portal. I have a node web server running on my target on 10.4.30.34:4040. It has to redirect the browser ...
0
votes
0answers
17 views

IPTables debugging

I've got a weird problem. I've got a primary host in Nevada and a satellite site in Maryland. They both use the 192.168.21.0/24 subnet (as well as .18.0 and .101.0) and have some overlapping ...
0
votes
0answers
27 views

Port forwarding with different gateway

Here is my current setup: Public IP -> Iptables firewall_A with DNAT from Public IP to -> mail server Iptables rule: iptables -t nat -A PREROUTING -d PUB.LIC.IP.ADD -p tcp --dport 25 -j DNAT ...
-1
votes
1answer
31 views

iptables installed in centos 7 but nat table was not there [duplicate]

[root@localhost yum.repos.d]# iptables --version iptables v1.4.21 [root@localhost yum.repos.d]# iptables -L -t nat iptables v1.4.21: can't initialize iptables table `nat': Table does not exist (do ...
0
votes
1answer
41 views

Block access to port directly but allow access through subdomain

I've recently started using an Elastic search, Logstash and Kibana to help visualize the logs on my server. This is working out great, but the only catch is that this is all publicly accessible by ...
1
vote
2answers
59 views

Correctly opening port 443 to the internet

I need port 443 open to the internet on my server. When I check internally via netstat -tulpn | grep "nginx", I see that nginx is indeed LISTENing on that port. However, trying nmap -p443 mysite.com ...
0
votes
0answers
22 views

How to correctly configure iptables block output (wordpress)

I just cleaned my WordPress installation after attack. They used my server to attack other sites. I've cleaned everything but I want to use iptables to block outgoing requests from my server. I ...
0
votes
1answer
50 views

New iptables rules not showing up

I'm trying to use iptables to forward incoming traffic on port 80 to a web server running on another IP address and port. Not that it appears to make a difference, the web server is running in a ...
0
votes
1answer
11 views

Redirect to another port in iptables shows no chain error

I'm facing strange problem with iptables right now. Simply, I want to redirect traffic from port 514 to port 5140. I'm using this IPTables command to achieve it: iptables -t nat -A PREROUTING -p tcp ...
0
votes
1answer
62 views

Allow DNS queries to bind in iptables

I have a DNS server up and running with configured single DNS zone for example.com The following command, ran on the server returns the configured DNS Zone records: # dig example.com @ns1.example.com ...
1
vote
1answer
70 views

Limit number of incoming packets per second for a INPUT UDP port [per IP only, not globally] [Ubuntu IPTables]

I searched and I can't find a rule to limit the count of the incoming packets for a INPUT UDP port per second and per IP. I need that per all IPs that connect to my socket, not for a specific one. ...
0
votes
0answers
49 views

iptables. Bypass VPN

I use ssh to reach an amazon machine. I'd like to a VPN on this machine. Each time i run openvpn, i get logged of due to the fact that SSH packets are sent through the VPN tunnel. So the idea is to ...
1
vote
1answer
124 views

Why does this “netstat -tln” output show entries for “0.0.0.0:22” and “127.0.0.1:3306” [closed]

When I run the command netstat -tln I see the following output: Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 ...
0
votes
1answer
26 views

Enable gateway only for authenticated clients [closed]

I want my server to be usable as a gateway to the internet by certain clients. Enabling forwarding is not my concern, rather to restrict it only to certain clients. I don't want hardcoded iptables ...
0
votes
1answer
26 views

Log all forwarded traffic to new server with iptables

I rerouted all internet traffic from my old Debian 7 server to my new server with DEST_IP=123.123.123.123 for p in 25 110 143 587 993 995 80 443; do iptables -t nat -A PREROUTING -i eth0 -p tcp ...
0
votes
2answers
23 views

port rerouting with iptables not working

I want to reroute all traffic from a port e.g. 4445 (from localhost) to another port on another machine in the LAN e.g. 3305. I expected this should do the deal: iptables -A PREROUTING -t nat -i eth0 ...
3
votes
1answer
39 views

Unable to connect to apache from the web

I have an apache instance running with vhost configured, here is the httpd.conf: #Listen {the_server_ip}:80 Listen 80 # <VirtualHost *:80> ServerAdmin webmaster@example.com DocumentRoot ...
0
votes
1answer
62 views

lxc/lxd iptables ouput owner rule errors out with “Invalid argument.”

If I try to run the following command in my lxc/lxd Ubuntu 14.04 amd64 container: iptables -A OUTPUT -p tcp -m owner --uid-owner 0 -m tcp --dport 80 -j ACCEPT I get the following error message: ...
0
votes
1answer
64 views

Traceroute / Routing of a IP

so i just wondered, how i can route the whole traffic from server A through server B, so the traceroute looks like this: Server A IP is 33.33.33.33 and Server B IP is 55.55.55.55 1: 1.1.1.1 2: ...
-4
votes
1answer
29 views

How to open entire subnet with iptables [closed]

I want to enable the entire subnet 192.168.1.0/24 which is connected to eth0 in input. I'm very unfamiliar with iptables. If I add the rule: # iptables -A INPUT -s 192.168.1.0/24 -p tcp -m tcp ...
0
votes
0answers
54 views

solutions to filter traffic with group based rules

I have a 25 computer network with 1 pfsense box (with squid installed) and 1 openLDAP server configured & working , 70% of the network is wired the rest is password protected wireless. Right now ...
0
votes
0answers
32 views

Docker mapped port not available from host when iptables is up

I am banging my head to the wall and can't figure this out, probably something simple, but ran out of ideas, so I hope somebody will be able to help. I have a server running nginx and loadbalancing ...
-3
votes
1answer
59 views

iptables centos block one port and allow all [closed]

How should I build iptables rules with the following requirements? Filter traffic on port 12001 to allow tcp/udp Filter should allow only one single IP sending traffic to the port 12001. Any other ...
0
votes
1answer
90 views

Postfix/Dovecot Email Server (on Raspberry Pi) - Unable to configure POP3S connection with Gmail

I've been trying to configure my Raspberry Pi (Raspbian Jessie Lite) as a postfix/dovecot email server for my domain dominicgkerr.co.uk. Using a combination of the fantastic walkthroughs written by ...
0
votes
1answer
57 views

How to setup a whitelist using iptables and ipset

I'm trying to only accept connections from my whitelist on ports 53, 80 and 443. Here is my iptables file # Generated by iptables-save v1.4.21 on Thu Feb 25 18:28:29 2016 *filter :INPUT ACCEPT [0:0] ...
0
votes
1answer
139 views

Correct OpenWRT configuration for iptables PREROUTING rule

I've recently switch my router firmware from Tomato to OpenWRT. I had the iptable commands below which would intercept http requests to an internal ip (192.168.1.254) on port 80 and redirect to a ...
0
votes
0answers
51 views

Configuring iptables on dd-wrt router

I'm trying to setup a dd-wrt router to serve as a subnetwork for some custom built arduino devices. The idea is having the routers LAN/WIFI being open to the arduino devices and only allowing trafic ...
0
votes
2answers
54 views

youtube through google chrome can not be identified by ndpi-netfilter

I have ndpi-netfilter installed on ubuntu and i need to shape the youtube traffic to 100kbps using tc module. I cassify all youtube traffic to a one class through the iptables and apply tc class to ...
0
votes
1answer
114 views

iptables port forward prerouting - how to exclude local LAN?

I use several PREROUTING rules in Jessie Debian to do port forward from WAN to LAN ip with following rule iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 8088 -j DNAT --to-destination ...
0
votes
0answers
39 views

IP Tables, does it really need those rules?

I am just starting with IPTables, and I am wondering if I really have to create so many rules for a simple setup: DMZ (Reverse Proxy) port 80 + 443 Frontend Subnet: Apache Webserver The Reverse ...
1
vote
0answers
29 views

IP Aliassing - Multiple Public IP Address [closed]

I have a problem with IP Aliassing. I want that all IP addresses have ism traffic but it does not work except to redirect eth0 with iptables DNAT and SNAT which is ineffective. auto lo iface lo inet ...
3
votes
1answer
45 views

Forward traffic to VPN network

I have a cloud server running on Ubuntu 14.04 which is connected with an IPsec tunnel. The server has a real interface with a public IP x.x.x.x and a virtual interface 172.16.100.1 All the traffic to ...
1
vote
1answer
79 views

Getting SSL to work on Django project

I'm trying to get my Django website to move entirely to https (currently it's solely http). The webserver is nginx (reverse proxy) and gunicorn. However, even after correctly installing SSL, opening ...
0
votes
0answers
35 views

iptables doesn't recognize --log-prefix

I'm having difficulty getting iptables to log. Here are the relevant commands: /usr/sbin/iptables -N LOG_DROP /usr/sbin/iptables -A LOG_DROP -m limit --limit 2/min -j LOG --log-prefix "iptables ...
1
vote
1answer
97 views

iptables to allow only ssh and https

I'm trying to configure the iptables on my device in order to allow only SSH and HTTPS traffic. In particular, the HTTPS protocol is used to call some REST API toward a remote server from a java ...
0
votes
0answers
23 views

iptables: Allow private IP/VM external access and forward one port to this private IP/VM

I am running a server with 3 VMs having static IPs. All fine here :) I added a new private network with virsh: 192.168.100.0/24 connected with virbr1. All 4 machines have virtual NICs for internal ...
2
votes
1answer
35 views

iptables: add routing for internal guests and port forwarding [closed]

I have the following rules working fine - before I added a private network with a single VM (which can ping all machines on the host but not the outside). I want the VM (192.168.100.2) to reach the ...
0
votes
1answer
119 views

Dropping external connections to Docker container with iptables

I'm trying to set up iptables on a server running Docker containers. Default rules generated by Docker set default policy to ACCEPT but I'd prefer to have it in a more restrictive manner: set default ...