iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

0
votes
0answers
68 views

Traffic on eth0 despite denying it with iptables

Despite having an iptables ruleset which should not allow it - DHCP is working on eth0. Given the below information can anyone give me an idea of why? tap0 is not up (not that it should make any ...
0
votes
0answers
25 views

haproxy, iptables & iproute2 as a mean to select a different src vIP for same default GW

Got a HAproxy 2 node cluster/setup, each node has an external and internal NIC. External has a default gw: .249 service service pool A pool B srv1..srvN srv1..srvM ...
0
votes
0answers
30 views

firewalld multiple public ips to multiple private ips routing

I'm trying to use CentOS 7 server as a firewall/nat for some sensitive servers on the LAN. The CentOS server has multiple public IPs (one per box on the LAN) and I'm trying to associate each external ...
-1
votes
1answer
41 views

Multiple NodeJS apps forward to port 80

I have a server running CentOS. There are a few NodeJS apps running on it. For example: example.com:8000 > My first app example.com:8080 > A second app example.com:8888 > Another one The problem ...
3
votes
1answer
27 views

Will it detriment my security if I allow all connections from localhost through iptables?

Under my current configuration, iptables will block every inbound connection, even if coming from localhost. In some cases, I need localhost to connect to itself. If I create a rule that allows all ...
0
votes
1answer
111 views

CentOS port forward

I have the following situation: Internet ----- Server ------- virtual machine (kvm) public ip 192.168.122.12 x.x.x.x I need to make service on the port 3333 ...
2
votes
1answer
102 views

How do I set up the default route on a Linux router with dual ISP links?

So, here's the situation. I have dual ISP links currently active and working for routing traffic from my network, with a very similar iptables setup to the accepted answer at Load balancing & NAT-...
1
vote
0answers
30 views

How to use virtual interface as default interface

I've got a cloud SSD VPS @ OVH, and I'd like to change the default interface used for requests. I have two interfaces: eth0 (which is the default interface) and eth0:0 (which is the new virtual ...
1
vote
0answers
28 views

keep ossec iptables rules after restarting OSSEC

I have 6 OSSEC installations (5 agents + 1 server, all Debian 8) all configured to block repeated offenders using iptables from 10 minutes to 1 month. I have the need to restart one or more of the ...
0
votes
0answers
35 views

OpenVPN connect to OpenVPN client network

OpenVPN Server Ubuntu 14.04 In Digital Ocean (Public and Private interface) OpenVPN client Ubuntu 14.04 I can't SSH from Server to client via VPN connection. Ping works fine. Tunnel is up. Followed ...
0
votes
1answer
28 views

Identical DHCP leases, excessive dhcp traffic

Fresh install of CentOS 7, removed dnsmasq, installed dhcp server, iptables, webmin, apache. This is school and lot of switches and wifi (bridge mode) AP's connected to this router One network - 10....
0
votes
0answers
26 views

Redirection of ports does not work

I have a VPS, and by some reasons common ports (1 - 1000) are closed. I installed iRedMail, but did not find any ways to change smtp submission ports, so I decided to just forward connection. I have ...
1
vote
1answer
54 views

How do I block traffic between two interfaces using iptables?

I want to block all traffic between my two interfaces. I am using erpxe on the eth1 interface and it seems that when I boot into erpxe, it pulls an ip address from eth0. How can I accomplish this via ...
0
votes
0answers
32 views

Ldap server cannot accept Public IP

I have this LDAP server and 10 clients in the network. 2 clints can connect to server using server's private ip (10.10.10.10), but the other clients cannot ping private ip, so they use public ip ...
0
votes
1answer
52 views

AWS EC2 and OpenVPN

I've been trying for a few hours to get OpenVPN working with AWS EC2 without any luck. Its the same setup as anyone would think of: Openvpn running on a server to gain access to resources within the ...
-1
votes
1answer
39 views

How are IP packets routed from LAN to WAN? [closed]

I have OpenWRT set up on a router, with a wireless client connected on the LAN, and connected to another network on the WAN. wlan1 is bridged on the br-lan interface, and typically forwards to the LAN ...
-2
votes
1answer
138 views

How Temporarily block an IP address making too many hits on the Server with iptables?

this is my first question here. I made this follow script to protect my server against Slowloris and some DDOS. #!/bin/sh # It does not allow more than 10 connections per IP on ports 80 and 443. And ...
-1
votes
1answer
77 views

Clone http traffic to another port on same server transparently

I am experimenting with following setup. Clone/copy (but not redirect) all incoming HTTP requests from port 80 to another port say 8080 on same machine. I have a simple NGINX + Lua based WAF which is ...
3
votes
1answer
99 views

Reject all except for whitelist policy with firewalld

I've been reading on firewalld for about the whole morning, and I came up with the following public zone: <?xml version="1.0" encoding="utf-8"?> <zone> <short>Public</short> ...
-1
votes
1answer
66 views

How to route LAN traffic for OpenVPN?

Network Environment Setup Image Speedtest.net without OpenVPN - 300Mbps Speedtest.net with OpenVPN - 10Mbps Accessing \\192.168.0.223 through Windows Explorer with OpenVPN - 80-100MB/s Is accessing \...
3
votes
1answer
68 views

fallback route to drop packets if output interface that is NATed to goes down?

Background: I establish a connection to a 3rd party VPN and NAT packets marked as part of a particular cgroup (in order to selectively run processes through the VPN or not) to the 3rd party's VPN tun ...
2
votes
3answers
137 views

What does -P INPUT ACCEPT mean with regards to iptables?

I'm fairly new to iptables, and am trying to figure out if I've configured my ruleset appropriately. With regards to the -P INPUT ACCEPT part of my question, I am trying to determine if this is valid ...
-1
votes
1answer
68 views

Minimal requirements to firewall rules for running dhcpd server in linux container

I want to run isc dhcpd server in lxd (lxc) container. But it does not recive clients requests (DHCPDISCOVER, DHCPREQUEST) from clients without this rule: iptables -I FORWARD -m physdev --physdev-is-...
0
votes
1answer
67 views

Network configuration fault

I'm moving my router from Rpi with Rasbian to another pc device with ubuntu server 14. I have: - local network 10.0.0.0/16, with my router gateway 10.0.0.1 - lte usb device 192.168.8.1 in network 192....
0
votes
0answers
55 views

iptables: still all ports open even if access had been restricted

Server: Debian 8.0 iptables v1.4.21 Scenario: I restricted access for aliens to all ports except 80/433. But aliens still can see all ports as "Open" when they use port scanner. But they can't use ...
0
votes
0answers
91 views

Squid - Forward Port 80 to SquidServer:3128

I have a -squid ProxyServer (Hostname: SquidProxy - 10.160.54.1 SM /16) -and a Client (Client1 10.160.55.1 SM /16) At the Client i have configured the proxy in /etc/sysconfig/proxy with the ...
0
votes
1answer
73 views

iptables is marking packets with wrong number while copying file by scp

[Case1] When copying file from server (being on client) to client, packets are marked incorrect with 3 (root). [Case2] When copying file from server (being on server) to client, packets are marked ...
0
votes
0answers
40 views

CentO7 multiple TCP port forwarding entries, does not allow certain ports

I have CentOS7 KVM setup that is using TCP port forwarding to forward SSH sessions to three guests running behind a NAT virtual bridge. This is the setup i'm looking establish 2020 -> 192.168....
1
vote
0answers
28 views

IPsec: hide private IP behind Gateway IP

I have an IPsec Gateway to a customer, and the VPN tunnel is up, the problem is that they don't allow me to use my private address because it used by another VPN they use. Our gateway is an EC2 ...
2
votes
1answer
81 views

Iptables forward all traffic to a specified port, to another device

How can I modify this iptables rule, so that all traffic which coming for this computer will be forwarded to 192.168.42.10? iptables -t nat -A PREROUTING -s 192.168.46.0/24 -p tcp --dport 80 -j DNAT ...
0
votes
1answer
59 views

LVS/IP_VS LoadBalancing Gateway [closed]

I'm trying to setup my 2-gateway configuration with loadbalacing with IP_VS kernel module. I need to loadbalance forwarding traffic to 2 nodes. I do: Setup ip_vs fwmark service and add 2nodes. On ...
1
vote
1answer
75 views

Iptables : forwarding SSH traffic according destination IP

I have 2 servers : One that receives connections from outside my LAN and another (inside the LAN) that I aim to access from outside via ssh. There are prerequisites : I can't access to my SSH services ...
-2
votes
1answer
32 views

iptables and CONNMARK on ubuntu 14.04

How to enable connmark in netfilter in ubuntu 14. I see this post but I don't find the good module in Ubuntu 14.04. I use connmark for multiwan. My configuration run perfectly in debian 8. But no ...
0
votes
1answer
87 views

Allow UPnP and NAT-PMP request in iptables

I have an OpenVPN gateway setup with forwarding which works great. My other machine connects through it and reaches the internet. Done an external port scan and no ports are visible on the external ...
0
votes
1answer
52 views

iptables counters in NAT table and state NOT NEW

I read everywhere that it is dangerous to do traffic filtering in the nat table because the nat table is only consulted for connections whose state is "NEW" (later packets bypass the table). Does it ...
0
votes
0answers
50 views

iptables (nth) load balance, connect failed: Connection refused when many request

I try to use iptables as load-balancer using round robin scheduling. Block Diagram My itables configuration on 172.18.3.190 like this : *nat :PREROUTING ACCEPT [42:7044] :INPUT ACCEPT [26:4290] :...
0
votes
0answers
41 views

What rules do i need to allow ipsec in iptables firewall?

I have a server sitting on a private subnet behind a iptables firewall. On that server I am planning to create site to site VPN to Amazon VPN. I am not sure what rules do I need to put in my iptables ...
0
votes
0answers
69 views

StrongSwan IPsec and NAT

I have an IPSec tunnel to the network of our customer running on a Linux box with StrongSwan. On there I have to do source NAT to translate our network addresses to the subnet they assigned us. This ...
1
vote
1answer
55 views

How to manage a Docker container with port mapping?

I installed the ELK Docker container. I run it with these parameters: sudo docker run -p 5601:5601 -p 9200:9200 -p 5044:5044 -p 5000:5000 -it --name elk sebp/elk Check check: sudo docker ps ...
1
vote
1answer
23 views

How to perform NAT with inside interface as bridge

(dublicate question from AskUbuntu) I have a following network diagram: network diagram 192.168.0.0/24 network with 4 web servers (.1,.2,.3,.4). There are 2 Ubuntu 14.04 (VM1 and VM2) in it. They ...
-1
votes
1answer
37 views

Iptables DNS Input on localhost [closed]

Currently my IPtables Input chain settings on the server are: Chain INPUT (policy DROP 6 packets, 588 bytes) pkts bytes target prot opt in out source destination 202 ...
0
votes
0answers
46 views

ISP provides 400MB connection but behind iptables firewall I only get about 150MB

I have COX communications as my ISP and I have a 400 MB connection at work. I have had for years an iptables firewall I setup that runs great. CPU Info Intel® Core™ i5-2400 Processor (6M Cache, 3.10 ...
1
vote
1answer
91 views

Correct iptables rules to allow linking of docker containers

I have two Docker containers on a Debian 8.3 node. One is the official postgres image, one is a basic phoenix / elixir app. I'm linking both with a docker stack file. But phoenix is not able to ...
1
vote
1answer
46 views

Slow OpenVPN tunnel

I have a tunnel set up between two AWS regions. Using iperf, I saw that if I connect two machines directly (through the internet), I get about 100mb/s. If I use the tunnel, I get 10mb/s. Is there a ...
0
votes
0answers
23 views

DNS using GRE work 50%

l'm in a big issue here to make it work I'm already at least about 60% done, but it is difficult and I would like to count on the help guys here who may have already done this type of configuration. ...
8
votes
2answers
1k views

How to configure iptables so an unwanted port is not reported as filtered

I'd like to stop others from seeing my ports as filtered in the nmap standard scan (unprivileged). Let's say that I have the following ports open: 22, 3306, 995 and a firewall configured like this: -...
0
votes
0answers
66 views

Run node server on port 8080, use iptables to redirect traffic

I saw in several venues that in order to run node as a user, and yet get it to listen to port 80, you can do a simple IPTables trick: sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j ...
-1
votes
2answers
95 views

Multiple NIC same subnet [closed]

I have a setup as shown in the image. I know it is insane but i have to work on this configuration only. It is basically an ubuntu server acting as a router with 4 interfaces. 3 of them (eth0, eth1 ...
1
vote
1answer
66 views

Iptables: Difference between RELATED and ESTABLISHED state?

I've tried reading many articles on the internet but none of them are quite clear. I also know similar question has been posted here before but none of them explain my situation. Earlier I ended up ...
0
votes
1answer
170 views

Route outgoing connections from a docker container through a specific IP

I have a docker host machine with a single physical network interface (eth0) and multiple IP addresses assigned to it using IP aliasing (eth0:1, eth0:2, eth0:3). I would like to run several docker ...