iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

0
votes
0answers
33 views

Can't connect to Tomcat

I an new to Tomcat and having some problems - I have installed Tomcat 7 and it is running and set to use port 8080 in server.xml. I have opened port 8080 in iptables (and saved iptables) but I cannot ...
1
vote
1answer
77 views

iptables + postfix cant send email

Recently my host provider sent me a letter about some sort of attack from my server. I'm not into security so i found some tutorial and closed all unused ports with iptables. Here is my iptables ...
-1
votes
1answer
84 views

Something is filtering 27017 port even then firewall is not working

Good day, i' trying to move mongodb database to separate VPS from application, but VPS was pre-configured not by me. I have instance with running mongodb on 27017 port: COMMAND PID USER FD ...
0
votes
1answer
108 views

ssh tunneling not working due to strict iptables

my iptables are set so that I can only allow ssh connections. I tried ssh tunneling and I can connect to my sever, but after when I try using my server as a proxy on firefox, pages try to load ...
0
votes
1answer
119 views

Iptables drop outgoing HTTPs GET request matches string in payload [closed]

I'm using CentOS 5.8(final), kernel 2.6.18-308.8.2, iptables v1.3.5 I want to block a HTTPs POST/GET request to outside which matches a string (defined as ABCxyz) in the POST/GET payload. I tried to ...
0
votes
1answer
42 views

QEMU guest can access HTTPS sites, but not HTTP

So I'm configuring a QEMU guest on my Debian Wheezy server, using virt-manager. As guest I've installed Ubuntu 14.04.1 server. The server contains the following iptables rule: iptables -t nat -A ...
0
votes
1answer
74 views

Data only seems to go one way on ethernet over usb connection [closed]

I have a router+modem combo connected via ethernet to a raspberry pi (this part works fine) The pi has a usb wifi device plugged in, and runs hostapd, does NAT and provides internet to a household. ...
0
votes
0answers
81 views

Why HLS streaming bypass connlimit iptables rule?

excuse me, i have this situation: I need to set limits to the simultaneous connections to a server to enable only X number of viewers of a stream at any time. To make the video streams we are using ...
0
votes
1answer
267 views

Fail2Ban - Iptables - Set does not exist

I have a very strange problem with fail2ban/iptables. Something is not working right, but I can't figoure out what. I have added this conf & and filter for fail2ban: [wordpress-register] enabled ...
1
vote
0answers
105 views

shorewall can'T start: UNTRACKED state requires Raw Table in your kernel and iptables

I'm trying setting up my firewall and installed and configured shorewall. Unfortunately I tried to directly configure iptables first, but this didn't work. When I start shorewall, I get this messages ...
-1
votes
1answer
27 views

Application protocol-based port forwarding/redirection [closed]

I need to split traffic on port 80 between HTTP and non-HTTP, and internally forward HTTP traffic to a port nginx will listen to, and non-HTTP traffic to port 22. Does anyone know of a piece of ...
0
votes
1answer
143 views

TCP packets not reaching app, iptables dropping?

We are occasionally, but not consistently, experiencing a weird network stack issue. Rebooting the server in question clears it up. It happens as follows (gleaned through tcpdump on the server): ...
0
votes
1answer
67 views

Can't open ports to ouside

I need to open my webserver to internet. I have no idea whats wrong with my config but no ports opened to internet, and server does not respond to ping. I have debian squeeze webserver with following ...
1
vote
2answers
85 views

Allow only IPSEC outgoing traffic to a port (using IPTABLE?)

Problem: I've a situation where IPSEC server and the target server (Say http server) happens to be the same machine and I need allow ONLY the traffic coming through IPSEC server to have access to a ...
0
votes
0answers
59 views

NAT Traffic via my instance in Microsoft Azure

I'm working in Azure IaaS Environment I have a private network 172.16.0.0/16 in which I have few linux instances running (172.16.0.1-5) My instances are accessing the public internet on port 80 (so my ...
0
votes
1answer
74 views

Forward traffic to VPN

I have several servers I want to put on a VPN. I've set the VPN up with OpenVPN and that's working fine, each machine can access the other servers on the VPN. My issue is I would like to somehow ...
2
votes
5answers
168 views

iptables, ICMP and RELATED

I am using the following simple iptables rule that accepts related packets: -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT I am letting ICMP echo-requests pass with this other rule: ...
1
vote
0answers
152 views

Shorewall: DNAT to IPSEC tunnel zone not routing correctly

I have a ipsec tunnel working that gives access to a 192.168.4.0/24 lan. It is working fine and I can access hosts on the other side without problem: # from fw and lan hosts: # ping 192.168.4.44 PING ...
0
votes
1answer
56 views

How can I tell what's happening to my packets?

I'm trying to bring up a little box on my network. I just reflashed the firmware and it's supposed to come up as 192.168.1.1 by default. My router is a DSL modem at 192.168.0.1; it usually uses a ...
0
votes
2answers
112 views

My ubuntu server won't allow loopback wget

I have the following rules on my Ubuntu Server 14.04: #!/bin/sh # Flushing all rules iptables -F iptables -X # Setting default filter policy iptables -P INPUT DROP iptables -P OUTPUT DROP iptables ...
0
votes
3answers
53 views

Changed SSH port but iptables refuse

I just changed my SSH port from the default 22. Now, I cannot access it anymore, my thought would be the firewall. I already added the new port to the iptables then do sudo iptables-save. However it ...
1
vote
1answer
145 views

Duplicate iptable rules

I have this iptable rules: -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -N fail2ban-ssh -A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh -A INPUT -p tcp -m multiport --dports 22 -j ...
0
votes
0answers
137 views

Can't redirect DNS queries to TOR proxy

I've set up a TOR proxy but I can't access to the .onion sites. I do surf through the TOR net though. I set up a PPTP VPN (I know it's insecure but it's just a test) to create a quick IP address swap ...
0
votes
2answers
89 views

iptables to route/filter traffic by URL behind NAT

I have the following configuration: a DNS record of X.a.b.c pointing to an ip address I a DNS record of Y.a.b.c pointing to the same ip I. Internet---->(RT)--->(FW)--+-->(MN) ...
0
votes
1answer
116 views

OpenVPN Access Server connects and can browse all other ports than port HTTP and HTTPS

Hello dear Serverfault experts, I have a very frustrating issue with my recently installed OpenVPN Access Server ...
0
votes
0answers
40 views

Keepalived failover and broken pipe with NAT'd connection?

I have an active/active conntrackd setup with asymmetric routing. Which means some TCP flows can be split between 2 firewalls. i.e. outgoing packets flows out one firewall, and for the same ...
0
votes
1answer
322 views

Will this HAProxy “restart script” work as gracefully I think it will?

I put this script together from various places. What I am hoping is that it will do the following once run: Pause all "NEW" http traffic for ports 80 and 443 - just "pause" them, don't give any ...
1
vote
1answer
81 views

Why is conntrackd not replicating state?

I have a problem with an active/active firewall cluster where the connection tracking state in the firewall does not seem be be being replicated. It's active/active because I have two routers ...
0
votes
1answer
104 views

Iptables to UFW before.rules not working

I've got the follwing working iptables commands: iptables -t nat -i ppp0 -A PREROUTING -p tcp --dport 81 -j DNAT --to-destination 192.168.16.8:80 iptables -t nat -A POSTROUTING -p tcp --dport 80 -j ...
-1
votes
4answers
48 views

iptables - Unable to telnet out

I'm building a firewall rule that should drop all outgoing connection except telnet out. [ I know that I ultimately need to drop all input and allow some, but I need to filter output as well ( block ...
1
vote
0answers
32 views

Why do some outgoing IP traffic not contain UID information?

I am doing egress logging on my server using IPTABLES with the following line which is supposed to provide UID information on all traffic that is logged: -A OUTPUT -j LOG --log-prefix "IPTABLES(O): " ...
0
votes
1answer
75 views

apache rate limit best practice

I have the following business scenario: 1. apache http server load balances client request to application servers via ajp 2. all the resource intensive work is done on application servers for each ...
0
votes
2answers
58 views

use iptables to limit the number of concurrent http requests per ip

Currently my iptable is as follows to limit the number of concurrent connections per ip to 10 from any http client. However, I tried a simulated http test and I'm not getting dropped at all. what's ...
0
votes
2answers
783 views

Configuring port in iptables for websockets

I'm implementing Ratchet's push example in my server (websockets) on port 9090. These are current iptables policies: [root@myserver ~]# iptables -L -n -v Chain INPUT (policy ACCEPT 309 packets, 22420 ...
0
votes
1answer
439 views

Azure Site-to-Site VPN with a Linux based router to bridge the VPN ports to a RRAS server while keeping NAT for other traffic

I am trying to get an Azure Site-to-Site VPN up and running using RRAS but require help configuring my router's iptables to bridge the VPN ports and protocols to the RRAS server without using NAT ...
1
vote
1answer
167 views

Redirect all incoming traffic from a secondary public IP to an internal IP address using iptables

I'm currently trying to figure out how I can forward traffic from a secondary public IP address of my dedicated server to an internal IP of my network using iptables in order to make e.g. webservers ...
0
votes
1answer
103 views

blocking ip on linux(CENTOS) [closed]

I m blocking an ip from my centos server using iptables: iptables -A INPUT -s $ip -j DROP service iptables save however my ip is still able to access the ip and even view websites hosted on this ...
0
votes
0answers
49 views

Connection limiting on Kernel 3.10.53

I have upgraded a server from the stock CentOS 5 kernel to Kernel 3.10.53, compiled from source. I also upgraded IPtables from 1.3.5 to 1.4.20, also compiled from source. Since the upgrades, it seems ...
0
votes
0answers
74 views

Multiple dynamic IP & port forwarding ( iptables )

I have multiple internal servers using port 443 and am using 6 dynamic IP's (same provider) to allow me to forward without having to use a non-standard port.I am not load balancing any traffic. Right ...
0
votes
1answer
61 views

Redirecting Iptables [closed]

I have set up a Personal hotspot using Hostapd. But this hotspot is not connected to the internet but I do have Apache installed on it. What I am trying to achieve is to redirect all the clients (that ...
-1
votes
1answer
236 views

Docker Host iptables

Using our stock iptables based on a default DROP policy, Dockerfiles based on Ubuntu or Debian are unable to resolve hosts on apt-get commands, making it impossible to build the files. If I change the ...
1
vote
2answers
4k views

Centos 7 save iptables settings

Problem: iptables resets to default settings after server reboot. I'm trying to set rule like this: iptables -I INPUT -p tcp --dport 3000 -j ACCEPT after that I do: service iptables save and it ...
1
vote
0answers
41 views

Automatically add rules to iptables when an user logs in or logs out with ssh?

I'm looking for a solution to automatically add couple of rules to iptables when an user logs in and remove those rules when it logs out. I'd like to get somehow get the ip address of the user from ...
0
votes
1answer
55 views

Port forwarding with 2 interfaces not working

I'm running debian and I've got the following network configuration: eth0 Link encap:Ethernet inet addr:192.168.16.6 Bcast:192.168.16.255 Mask:255.255.255.0 inet6 addr: ...
-4
votes
2answers
32 views

Restrict access to path vi IPTables

I want to restrict access to a path via iptables - I try this one and its work on the whole site iptables -I INPUT -p tcp --dport 443 -m string --algo bm --string 'example.com' -j DROP but I want ...
0
votes
0answers
23 views

How to limit rapid-fire connections to HTTP port with iptables?

I'd like to prevent malicious bots from hitting my Apache server too quickly. A couple issues/problems: I don't fully understand the relationship between --limit and --limit-burst and how they work, ...
1
vote
2answers
170 views

Ubuntu 1404, iptables, block everything except specific ips

I'm trying to block anything on my server except for some specific ip ranges. There should be neither access from web nor to ssh or anything else. I searched already through different topics and ...
1
vote
1answer
38 views

Invisible for traceroute with iptables rule?

Can someone explain me why when i set on my host iptables rule like this: iptables -I PREROUTING -t mangle -j TTL --ttl-inc 1 ... it will be invisible for traceroute from this moment?
0
votes
2answers
57 views

use iptables's nat to proxy mysql

I find this similar thread but don't work: http://stackoverflow.com/questions/10864854/forwarding-mysql-connection-with-iptables-and-differents-network-interfaces?rq=1 My environment as follows: ...
1
vote
0answers
289 views

Client successfully connects to OpenVPN server but with no internet access over the VPN

I'm trying to setup OpenVPN with static key authentication(instead of TLS) on TCP port 443; but the client cannot access the internet over the VPN after connecting to the server. Here's my current ...