iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

0
votes
0answers
19 views

How to limit rapid-fire connections to HTTP port with iptables?

I'd like to prevent malicious bots from hitting my Apache server too quickly. A couple issues/problems: I don't fully understand the relationship between --limit and --limit-burst and how they work, ...
1
vote
2answers
131 views

Ubuntu 1404, iptables, block everything except specific ips

I'm trying to block anything on my server except for some specific ip ranges. There should be neither access from web nor to ssh or anything else. I searched already through different topics and ...
1
vote
1answer
34 views

Invisible for traceroute with iptables rule?

Can someone explain me why when i set on my host iptables rule like this: iptables -I PREROUTING -t mangle -j TTL --ttl-inc 1 ... it will be invisible for traceroute from this moment?
0
votes
2answers
53 views

use iptables's nat to proxy mysql

I find this similar thread but don't work: http://stackoverflow.com/questions/10864854/forwarding-mysql-connection-with-iptables-and-differents-network-interfaces?rq=1 My environment as follows: ...
1
vote
0answers
224 views

Client successfully connects to OpenVPN server but with no internet access over the VPN

I'm trying to setup OpenVPN with static key authentication(instead of TLS) on TCP port 443; but the client cannot access the internet over the VPN after connecting to the server. Here's my current ...
0
votes
0answers
979 views

Transparent Proxy squid TCP_MISS/503 Error in all pages

I m trying to make a squid proxy server with to work as a transparent proxy server, and i m facing some issues that i m unable to figure out the reasons. The setup i m using is several VLAN's with ...
3
votes
2answers
50 views

Why is my iptables config not accepting connections from the specified source iP?

From machine 192.168.1.2, I have this iptables configuration: $ hostname -I 192.168.1.2 $ iptables -L -n -v Chain INPUT (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out ...
2
votes
1answer
82 views

ifcfg-eth0.200 is not responding to arp broadcasts

I have a Centos router doing a stupendous job in a setup similar to this: eth0 --> no IP eth0.200 --> 192.168.200.1 eth0.201 --> 192.168.201.1 ... so on up to eth0.213 --> 192.168.213.1 I have ...
0
votes
2answers
176 views

VSFTPd 2.3.5 through iptables on Debian 7.6

Configured and running vsftpd 2.3.5 on Debian 7.6 behind IPtables and fail2ban with ssl_enabled I can't upload files properly because after a few I receive the following errors: Timeout or OOPS: ...
1
vote
1answer
51 views

How to forward a port to multiple internal ips

I have a Centos 6 64 bit server with OpenVPN installed. I'm using this iptables rule to forward a port for an OpenVPN user: iptables -t nat -A PREROUTING -p tcp -m tcp --dport PORT -j DNAT ...
0
votes
0answers
31 views

IP TABLES port forwaring corrupts my packets?

Here's my scenario. I have a WORKING DAEMON receiving packets through a proprietary protocol (mounted on the port 5000) that has been working flawlessly for over a decade. I have a weird problem ...
2
votes
1answer
70 views

Iptables and conditional statements. Is it possible?

I tried a search but i was unsuccessful, in the case i'm sorry and i will appreciate the redirect. I had this problem in mind: a computer with mac address M is sending packets through an openwrt ...
3
votes
2answers
528 views

How to enable traceroute in linux machine

I'm working on something in the transport layer and after i ran our custom policies for securing the policies i'm not able to do traceroute from the linux machine. root@keystone-evm:~# iptables ...
-1
votes
1answer
51 views

Sometimes this script fails to update the iptables [closed]

It does not happen often, but sometimes after running the below script, checking the iptables with service iptables status shows that they weren't updated and the script doesn't output any error. The ...
0
votes
0answers
33 views

Conflicting ip routes with local table on attaching a virtual network interface

I have an EC2 instance with these ip rules: $ sudo ip rule show 0: from all lookup local 32766: from all lookup main 32767: from all lookup default I can attach an elastic network interface to ...
0
votes
2answers
39 views

Open Specific Linux Port

Im trying to open a Port(2012) on my VPS so i can access it over the internet. This is the output of sudo iptables -L produces Chain INPUT (policy ACCEPT) target prot opt source ...
0
votes
0answers
31 views

iptables: Packet not being matched by neither INPUT nor FORWARD

How can it be, that a packet that gets matched by a mangle PREROUTING does not get matched by neither filter INPUT nor filter FORWARD? From this diagram ...
1
vote
1answer
166 views

Linux iptables - reject tcp SYN with RST

I am doing an implementation on a linux machine to reject incoming telnet requests from wan side telnet port 8023. The functionality is achieved by using the below iptables rules. The first rule in ...
0
votes
1answer
136 views

iptable CLUSTERIP doesn't work

We have some requirements which explained here. We tried to satisfy them without any success as described. Here is the brief information: Here are requirements: High Availability Load Balancing ...
-5
votes
1answer
139 views

ports I open with iptables appear closed [closed]

I opened the following ports with iptables on Debian 7: iptables -X iptables -F iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT ACCEPT iptables -A INPUT -m state --state ...
0
votes
1answer
28 views

Iptables and counters

I'm trying to use iptables counters with munin to monitor traffic of hosts on my local subnet. For each host I set up a rule like this: iptables -I OUTPUT -d $ip This should count the packets going ...
0
votes
0answers
36 views

is iptables-save rule dump deterministic?

is the order of the parameters of iptables rule line deterministic in the iptables-save output? -A CHAIN1 -m mod1 -m mod2 -j CHAIN2 will be always the same, or I can expect it to be -A CHAIN1 -m mod2 ...
2
votes
1answer
124 views

What is the correct iptables rule when NATing multiple private subnets?

I have a Centos minimal 6.5 acting as a router. eth0 is connected to a Cisco switch trunk port, allowing VLANs 200-213. I have several VLAN interfaces just as this link suggests: ...
0
votes
1answer
98 views

BROUTING's target “redirect” in ebtables behaving in a strange way

Situation (host A)-------(bridge B)------(host C) where: A has MAC A on it's interface C has MAC C on it's interface B has MAC BA and MAC BC on it's two interfaces (depending on who it's facing) ...
0
votes
1answer
221 views

iptables and TPROXY support

I'm running iptables v1.4.21 on Ubuntu 14.04 and is trying to setup iptables to use TPROXY. How can I check whether my current build of iptables supports TPROXY? I can check TPROXY support for ...
1
vote
0answers
428 views

TPROXY Not working with HAProxy, Ubuntu 14.04

I'm trying to use HAProxy as a fully transparent proxy using TPROXY in Ubuntu 14.04. HAProxy will be setup on the first server with eth0 111.111.250.250 and eth1 10.111.128.134. The single balanced ...
0
votes
1answer
63 views

fail2ban block ports rules iptable

I just installed Ubuntu Server 14.04 and don't have much experience with IPtables. I am trying to get a basic setup going where I only accept SSH connections on port 22 and 2222. I actually have that ...
0
votes
1answer
166 views

Using 2 Transparent HAProxy for load balancing

We can configure HAProxy to be a transparent proxy by using the guide here, where one of the steps says ...to put the backend servers in a different subnet to the front end clients and make sure that ...
1
vote
0answers
49 views

Policy routing local user's traffic down a tunnel

I've got a Linux based Firewall/Router running iptables and SNAT for traffic passing through it to the Internet via a single uplink - This is working fine. There is also a small number of applications ...
1
vote
1answer
47 views

Need help translating rate limiting iptables rules to Puppet format

I use Puppet Iptables module to manage Iptables rules on my machine. I'd like to implement to rate limit failed SSH connections as described here: iptables -A INPUT -p tcp --dport 22 -m recent ...
0
votes
1answer
442 views

How can I reload IPTables without interrupting existing connections?

I will be adding and removing entries to the script below automatically (adding ports 80/443 with different IP addresses). If I run this script, I am "assuming" that connections will be uninterrupted, ...
0
votes
1answer
185 views

Ubuntu 14.04 UWF for iptables

Can I still use the init.d iptables stop? It seems that init.d is replaced by systemd. Is that correct? The iptables is part of the kernel right and not a service. On redhat based systems it is a ...
-1
votes
2answers
42 views

Allow connection only from 2 ips [closed]

I need to block all connection on port 30000. I alredy did that , with command like that iptables -I INPUT ! -s IP_HERE -p tcp --dport 30001 -j DROP but now i need 2 ips , how i could do that? ...
0
votes
0answers
57 views

rkhunter reports suspicious activity /bin/usr/wget and killall permissions changed

Sorry about the long post but please bear with me. I'm wondering if my system has been compromised. I've had issues in the past on this VM server with a Linux.BackDoor.Gates.5 Trojan that was DDoSing ...
2
votes
2answers
218 views

How to setup IPTables on KVM host - iptables-persistent is being ignored

I'm trying to setup some specific IPTables rules on an ubuntu 14.04.1 host that runs some KVM guests. The box has multiple NICs with multiple IP addresses and the guests use different addresses based ...
0
votes
0answers
38 views

Iptables and PREROUTING-Chain. Checking only the first (SYN-) packet of a connection?

Assume for simplicity that there is only this one rule described below. Is it possible that the PREROUTING Chain of ip-tables checks only the first packet of connection A and then allows all ...
3
votes
2answers
1k views

Iptables management with ansible in huge environment

What is the best way to manage iptables from one point and have the ability to edit something on local server. We need to add some rules centralized on all servers, but we have specific servers with ...
0
votes
1answer
68 views

iptables DROP statement causing issues

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -p tcp --dport ssh -j ACCEPT iptables -A INPUT -p tcp --dport 80 -j ACCEPT iptables -A INPUT -j DROP I have the ...
1
vote
1answer
59 views

Unknown arg `--hashlimit-upto'

I'm trying to prevent loic attackes by using this command iptables -A INPUT -p tcp --dport 80 -m hashlimit --hashlimit-upto 50/min \ --hashlimit-burst 500 --hashlimit-mode srcip --hashlimit-name http ...
-2
votes
1answer
43 views

Multiport negation in iptables

Consider I want to make a rule that if destination port of the incomming packet is any of the ports 80,120,130 for established or related states the system should drop it but other ports should be ...
-1
votes
1answer
14 views

How to redirect ip to address iptables

I would like to know if is there a way to redirect the internal ip to another ip, but the second ip is Dynamically so i need to put an address, is there a way? Example: iptables -t nat -I OUTPUT ...
-1
votes
1answer
35 views

command not foundbles-config error on service firewall restart

This is a follow-up question after I fixed my initial problems: I have a CENTOS Linux VPS. I have the following in my IPTABLES script to run when my VPN restarts, but I get errors when I do a service ...
1
vote
1answer
102 views

IPTABLES command that end with ACCEPT or DROP fail on service firewall restart

I have a CENTOS Linux VPS. I have the following in my IPTABLES script to run when my VPN restarts, but I get errors when I do a service firewall restart I've ran each of the commands below manually ...
1
vote
0answers
72 views

xtable geoip filter unable to load into memroy

Ok, I have a odd problem. I just got done doing the bas configuring of my server. Adding in fail2ban, postfix, apache, mysql, ect ect. I then went in and started to add the xtable addons. I ...
0
votes
0answers
55 views

puppetlabs/firewall nat policy issue

I'm using puppetlabs/firewall. I need to create following iptable rules: iptables -A PREROUTING -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 8443 My manifests is firewall { '001 default ...
0
votes
1answer
91 views

OpenVPN with no internet access

I am using OpenVPN and am able to connect, but with no internet access anymore. Here is my ip table: sshadmin@mdpi1:/etc/openvpn/easy-rsa/keys$ netstat -nr Kernel IP routing table Destination ...
3
votes
2answers
642 views

iptables -F locks me out of the server until reboot, why?

I'm trying to apply some iptables rules and iptables -F is supposed to remove the current rules (from my understanding), but instead it appears to freeze my SSH connection and not let me re-establish ...
-2
votes
1answer
38 views

Iptables “if not” condition?

I am trying to create a rule for iptables which logically does the following: IF [destination != 192.168.0.1] forward port 80 requests to port 3128 else carry on like this never ...
0
votes
1answer
32 views

will renaming iptables mean I have no firewall after a reboot?

I'm having some issues accessing my VPS due to a combination of things. Serial console via my VPS control panel isn't accepting input either so my VPS host has offered to mount my file system on the ...
0
votes
1answer
32 views

Drop packets after NAT in iptables

I'm trying to rate limit traffic to a certain client behind the NAT (using hashlimit combined with DROP target) using iptables rule but due to my rudimentary knowledge of this area, I'm not sure which ...