iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

2
votes
2answers
52 views

Check if iptables rules are working

I have three virtualboxs. 1) Virtual machine VM-A that works as a router with two interfaces: eth0 - 10.160.10.254 eth1 - 172.10.0.254 2) Virtual machine VM-B that works as an internal network ...
0
votes
0answers
30 views

netfilter, block port range [31000-32000] on public interface eth2

I need to block the port range [31000-32000] on my public interface eth2. Services can be accessed using private network interface eth3 I have tried : root@master-sbg-01:~/# iptables -A INPUT -i ...
1
vote
0answers
58 views

Drop fragmented packets in nftables

Using iptables is it possible to block fragmented packets with this rule: iptables -A INPUT -f -j DROP But there isn't a equivalent in nftables. There is any way to do it?
1
vote
1answer
80 views

Howto configure Ipset to block entire countries IPs

I need to block some countries using ipset and iptables. What I've done so far (create new ipset set 'geoblock'): sudo ipset create geoblock hash:net,port then I created the following script /usr/...
0
votes
0answers
33 views

How to isolate two containers connected to the same bridge?

I have several LXD containers which are bound to a single bridge (the default lxdbr0 or another one, it does not matter). The host itself has another two interfaces, one ultimately connecting it to ...
3
votes
2answers
107 views

Ubuntu as NAT Gateway with iptables

I'm trying to configure Ubuntu 14.04 to act as a NAT gateway between a private and public network. Public Interface -> eth0 (178.x.x.x) Private Interface -> eth0:0 (192.168.206.190/17) I've tried ...
0
votes
0answers
19 views

Iptables linux routing with 2 chain proxies

Im trying to setup a connection between a PCs in my local network, to foreign resource XYZ in a specific way. My network is currently configured like this: I have a pc behind the proxies -> Then I ...
1
vote
0answers
18 views

Iptables multiple port redirects based on destination address

I have iptables setup for selective routing. In the current configuration it checks if the dst address is listed in a specific chain and if it is not it redirects the traffic to my proxy port which is ...
1
vote
0answers
46 views

Route all traffic from virtual interface to temporary tun0

I'm trying setting up at home an automated torrent client to download some big GIS databases I produce at work and release as .torrent files. My home server is a Raspberry PI with one Ethernet ...
0
votes
1answer
14 views

Edited IpTables, now SFTP suddenly stopped working

I removed some things from my IPTables that were no longer needed and now my SFTP simply times out upon attempting to connect with FileZilla: Status: Connecting to ###.93.110.###... Response: ...
0
votes
1answer
214 views

OpenVPN Ubuntu Server Routing Problems No Internet

I'm running OpenVPN on Ubuntu 15.04. When I connect to the server, I can connect and authenticate correctly (I use PAM auth because I'm lazy). Once connected I can't ping the server or access the ...
0
votes
1answer
254 views

Can't establish SSH connection even on localhost

Having problems getting a simple SSH connection to even localhost on my Ubuntu 15.10. Server was set up many months ago and was able to create access for SSH with keys, but cannot duplicate that ...
-1
votes
1answer
48 views

How can I block access to the internet for static addresses?

I have a router on CentOS 7 which provides access to internet for several IP addresses, which are reserved at DHCP server. Other hosts are blocked. If someone put static address from the reservation ...
1
vote
1answer
240 views

ICMP ECHO REPLY is not being SNATed correctly

I am trying to provide L3 connectivity between two remote LAN networks (10.0.0.0/24, 10.0.1.0/24) using OpenVPN with the following setup: +----------------+ +---------------------+ +----------------...
0
votes
0answers
229 views

CentOS 5.11 apf/iptables; iptables sometimes fails when apf restarts

On one of our old servers, a CentOS 5.11 machine using apf as a front end for iptables, we're having an intermittent problem with iptables failing when apf restarts on occasion. When this happens, the ...
1
vote
1answer
182 views

Allow Docker containers to use IPSEC VPN on host

I have Docker and an IPSEC VPN tunnel on my workstation, but the containers can't access hosts behind the VPN. Is there anything I can do, e.g. with IPTables or routes to allow access? [Note: I'm ...
2
votes
2answers
286 views

iptables / KVM forward port

I have a server with one external IP address (e.g. 1.2.3.4). On that server I use libvirt to run virtual machines. Now I want to access a virtual server on my host via ssh (port 1234) from the outside....
0
votes
0answers
59 views

Route all the trafic using iptables nat in linux

I'd like to route all the trafic through iptables NAT in linux, I'd like to route all the traffic through TOR. My script is accepting only TCP and UDP protocols, but I need to route all the protocols ...
0
votes
0answers
232 views

IPTables - Redirect ppp0 traffic to external side eth0

I've some servers on 2 differents networks. On the first network ( many servers ), I've only one public IP adress (ex: 193.193.192.192) and a small local network ( 172.16.1.0/24 ) ; On the second ...
1
vote
1answer
235 views

Port Forwarding on DROP policy

I'm trying to do a port forwarding on port 80 to a virtualmachine. If I set default policy to ACCEPT on input, output and forward chains the forwarding works. However, if I put the policy on DROP and ...
2
votes
1answer
169 views

Docker - This site can’t be reached

I installed a tomcat image and ran a container: [root@MY_IP ~]# docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS ...
1
vote
0answers
16 views

IPsec and pinging rightsubnets

I have been racking my brain about this. I have openswan running and I have been able to get tunnels up. Unfortunately, when I try to ping computers on my right subnet, I am not able to get any ...
0
votes
0answers
46 views

`systemctl restart iptables` blocks everything

Was connecting through ssh to a Fedora 23 server and decided to restart iptables after adding a new rule: systemctl restart iptables. However the iptables never restarted, or was very slow to restart (...
5
votes
0answers
86 views

IPset Alternatives and Firewall Management

I have CentOS 7, Plesk 12, 8GB RAM VPS. I have around 1000 rules in my IPtables to block abusive users. But when reloading IPtables it takes 15 seconds to reload all 1000 rules. First of all, is it ...
2
votes
0answers
44 views

Block incoming traffic in bonding mode when primary interface is down

My server running on latest kernel (4.4.6) has configured a bond device (bond0) with two enslaved interfaces eth0, wlan0 with primary interface eth0. cat /proc/net/bonding/bond0 Ethernet Channel ...
0
votes
1answer
45 views

policy routing to guests on other server

After long searching I've found the answer to my challenge, but the last step fails. I have two identical servers that both serve multiple guests. The servers have two interfaces: one for the ...
0
votes
2answers
51 views

KVM - Access from an external computer to the Virtual Machine

I have the following setup: Notebook (IP: 192.168.1.100) Host: (IP:192.168.1.129) Both Notebook and Host are connected to a router (Internet IP:192.168.1.1)¨ The host (Host) has two virtual ...
1
vote
1answer
134 views

How would I get this routing to work between the two subnets? Unsure if i am over-complicating my network

I am attempting to operate 2 subnets, the first subnet on range 192.168.0.0/24 is free to access anything it wants, including machines on the second subnet. the second subnet on range 10.0.0.0/24 is ...
0
votes
1answer
42 views

PCI Scan failing at TCP Source Port Pass Firewall testing

I'm trying to get PCI scan PASS for my website, Scan failing at this step. The host responded 4 times to 4 TCP SYN probes sent to destination port 20 using source port 80. However, it did not ...
1
vote
1answer
24 views

utility of using ALL in --tcp-flags in iptables rule

I m wondering what is the difference between the following 2 --tcp-flags rules: 1) -p tcp --tcp-flags SYN,FIN,RST SYN,FIN,RST 2) -p tcp --tcp-flags ALL SYN,FIN,RST
-1
votes
1answer
40 views

Firewall rules on a hosting (dedicated server)

I am on Linux Debian Jessie 8.4. I have set up a web server. It seems to run fine. I'm just wondering, if I need the following firewall rules are ok for HTTP(S) server to be running fine. iptables -...
0
votes
0answers
28 views

multi gre tunnels to one IP

I have an issue with GRE tunnels after connecting multi-GRE tunnels with different IP's to the server, using this tutorial: http://wiki.buyvm.net/doku.php/gre_tunnel every GRE tunnel has interface ...
0
votes
1answer
28 views

OpenVPN block SMTP Access Server completely

I've tried almost all iptables rules to block smtp on openvpn server but still clients clients can access remote smtp servers on port 25. I'm using openvpn access server. It's creating two interfaces ...
3
votes
0answers
150 views

Hacker bypassing iptables

(moved from SO) I have iptables protecting a sip server. It blocks all IPs except ones I specifically opened, and it seems to work for almost everyone. I have tested from lots of ip addresses that ...
2
votes
1answer
38 views

IPTables Configuration to allow all connections, only close/deny once data is sent

I'm looking to set up my IPTables firewall in such a way that: Any new connect() is accepted Once data is received: If the destination port is on a whitelist, continue allowing the connection and ...
0
votes
0answers
19 views

DNS seems broken after iptables -t nat -A POSTROUTING -j SNAT --to-source SERVERIP -o eth+

During the setup of a L2PD VPN in Ubuntu 14.04, this line is entered iptables -t nat -A POSTROUTING -j SNAT --to-source PUBLIC_IP -o eth+ and then all the domains cannot be resolved in this ...
0
votes
1answer
38 views

ufw & iptables confusion

I have previously added some netfilter rules via iptables. I'd now like to manage these rules through ufw and to simplify things I wanted to get rid of the current rules and start afresh as if I was ...
1
vote
1answer
48 views

Allow winscp/filezilla through iptables and fail2ban

I just launched a website within my school community and woke up this morning to logs of someone trying to bruteforce into my server. I followed some guides on digitalocean to set up fail2ban and ...
1
vote
0answers
18 views

How do I use Client9's IPCat with IPTables

I'd like to block all ips of all datacenters in the world with this list: https://github.com/client9/ipcat But I don't know how to use that list, I'd like a bash script that checks if there's an ...
-1
votes
1answer
21 views

what could be the firewalld(RHEL7) equivalent command

what could be the firewalld(RHEL7) equivalent command of "iptables -A INPUT -p tcp -m tcp --dport 5666 -j ACCEPT" ?
0
votes
0answers
53 views

vpn-over-ssh ipv6 tunnel getting permission denied connecting to tcp

Using my script, I can establish a working vpn for ipv4 and even able to ping ipv6 addresses. However, trying to connect to an ipv6 address I get "permission denied". ➜ ping -6 ipv6.google.com -c1 ...
0
votes
1answer
64 views

Unable to access Node Server from external network

I have a VM with two public IPs. I have installed OpenStack controller node on the VM. I have access from the external network to Horizon and Keystone service running on apache2 web server on ports 80 ...
0
votes
0answers
37 views

iptables change source and destination ports

I would like to receive traffic on multiple UDP ports and also my application (which is listening on a single port) to know from which port the request came from. If the source port becomes the ...
0
votes
0answers
12 views

Capture no-modified packet with iptables

I have a user-space program in which I process packets. I send them there with help of iptables. The problem is that I capture not original packet but modified. I have wlan0 interface up with access ...
-1
votes
1answer
20 views

Blocking a specific external IP:Port connection in RedHat?

I know that in RedHat, in the IP tables I can block incoming connections to a local port. I can also block connections from a specific IP. But is it possible to block a connection from a specific IP ...
0
votes
0answers
66 views

Traffic on eth0 despite denying it with iptables

Despite having an iptables ruleset which should not allow it - DHCP is working on eth0. Given the below information can anyone give me an idea of why? tap0 is not up (not that it should make any ...
0
votes
0answers
23 views

haproxy, iptables & iproute2 as a mean to select a different src vIP for same default GW

Got a HAproxy 2 node cluster/setup, each node has an external and internal NIC. External has a default gw: .249 service service pool A pool B srv1..srvN srv1..srvM ...
0
votes
0answers
29 views

firewalld multiple public ips to multiple private ips routing

I'm trying to use CentOS 7 server as a firewall/nat for some sensitive servers on the LAN. The CentOS server has multiple public IPs (one per box on the LAN) and I'm trying to associate each external ...
-1
votes
1answer
40 views

Multiple NodeJS apps forward to port 80

I have a server running CentOS. There are a few NodeJS apps running on it. For example: example.com:8000 > My first app example.com:8080 > A second app example.com:8888 > Another one The problem ...
3
votes
1answer
27 views

Will it detriment my security if I allow all connections from localhost through iptables?

Under my current configuration, iptables will block every inbound connection, even if coming from localhost. In some cases, I need localhost to connect to itself. If I create a rule that allows all ...