iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

0
votes
1answer
28 views

Cent OS - OpenVPN client connects but can't access internet

I set up openVPN 2.3 on a centOS 6.5 system I could connect with my windows client to the server. client gets IP address and DNS entries but when I like to access the internet with my client it does ...
2
votes
1answer
87 views

What are these iptables rules?

I'm trying to figure out what these iptables rules actually do, but I am not very experienced. These are the two rules: iptables -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 20 ...
1
vote
1answer
65 views

Is it possible to truncate packets using iptables?

The first thing on my mind when setting up a new Linux server (dedicated or VPS) is how you can increase security. I was wondering if it is possible using iptables to truncate icmp packets. If you ...
0
votes
0answers
41 views

NATted host cannot talk to itself unless virbr0 is in promiscuous mode

We have the following situation: A hypervisor using KVM-Qemu/libvirt with a single VM. The VM has the internal IP 192.168.122.151 on the default network pool using virbr0 on the hypervisor. We've ...
0
votes
1answer
12 views

Forwarding custom page rule for known ip adresses

I want to add some ip adresses to a blacklist, and i want to show these ip addresses in blacklist a custom web page that includes a "you are in blacklist" message on body. How can i do this? I have ...
1
vote
3answers
105 views

Forward all traffic when connected to a hub

I have a Ubuntu with two NICs. eth0 is connected to a hub and eth1 is connected to Internet. eth1 is used to do a point to point VPN using openVPN. So I have a tun0 interface. the VPN tunnel endpoints ...
0
votes
0answers
25 views

IPTables SNAT and DNAT - How to choose correct IP Address?

I have a physical host on which I run some virtual machines. IPTables is fully open and unconfigured but I add the following rule so the VMs can access the internet: iptables -t nat -A POSTROUTING -s ...
0
votes
0answers
29 views

conntrackd not syncing with external cache off

I have two firewall gateways that I want to work in active/active mode with conntrackd connection state syncing. Well, when I am using conntrackd with external cache on, connection created in one ...
1
vote
2answers
43 views

Route traffic in a public network

I have 3 stand alone CentOS servers on same hosting provider. The hosting company can't offer me a firewall for this devices, only iptables. So I want to buy another server and make this server a ...
0
votes
0answers
55 views

NAT for LXC Containers Debian 8 - no connection

I have a Debian 8 server running on a physical host machine. To seperate some services, I have created a lxc container (also debian 8). I am currently trying to set up a working NAT so my lxc ...
0
votes
0answers
37 views

iptables to do source nat for response packets

I am trying to do source NAT for all outgoing packets (packet initiating connection from my machine as well as responses to other connection). I put in following rule: iptables -t nat -A POSTROUTING ...
0
votes
0answers
67 views

Make redsocks redirect all tcp traffic for all users

Is it possible for redsocks (or any proxy in the same machine) to capture traffic within the private network (same LAN). I need to proxy ALL the outgoing tcp traffic from a client (which is a Linux ...
3
votes
1answer
111 views

Should i use Firewalld or Iptables for Fail2ban in Centos 7?

I'm setting up Fail2ban to protect ssh, and I use firewalld, I saw a lot of people recommending to use anaction = iptables-multiport and other solutions using iptables instead of firewalld claiming ...
1
vote
0answers
40 views

iptables/nat/prerouting ignores UDP packets?

The same effect on many servers with various kernel versions. There are multiple Iptables DNAT rules: iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 12345 -j DNAT --to-destination ...
3
votes
3answers
95 views

How to use iptables or tc to limit packets per client.

I have some problem network clients which send data too fast. I want to slow them down, using iptables, or possibly tc. I've seen iptables solutions like: sudo iptables -A INPUT -m state --state ...
-1
votes
1answer
33 views

Make Apache work on a custom port using iptables only

My Apache/2.2.14 (Ubuntu) is running on port 80. I'm trying to make it listen on port 999 as well, but without making any changes to the apache config, only using iptables. I've added this to the ...
0
votes
0answers
60 views

VPN Internet Access on a Zyxel SBG3300

I have Zyxel SBG3300 VDSL router that connects to ISP using VDSL and L2TP. The configuration was provided by my ISP - when I checked it seems like the VDSL modem first establishes a connection and the ...
0
votes
0answers
42 views

convert iptables u32 module to mikrotik

We experience some kind of DDos attack. here is attack log: http://paste.ubuntu.com/14476372/ in all of lines the expression "win 512, length 0" is the same, with this iptables rule we can drop ...
0
votes
1answer
28 views

DNS requests from a local server to another local server

I have two servers running in one network. External IP of main server: 1.2.3.4 (domain.com) External IP of secondary server: should not be available directly from outside Main server (dns, mx, ...
0
votes
2answers
41 views

How safe is IPtables whitelisting?

I am deploying some VPS and of course, security is a big concern. I read that IPtables whitelisting is the best way to safeguard your machine. So I set up the follwing : echo "Flushing rules" ...
0
votes
1answer
30 views

source nat for return traffic (Hair pinning )

Is there any way to source nat traffic received ? iptables -t nat -A POSTROUTING -o eth18 --src 123.123.123.123/32 --jump SNAT --to-source 66.66.66.66 Return traffic still uses 123.123.123.123 as ...
0
votes
1answer
43 views

port forwarding by iptables failed

I hope to forward from 192.168.1.230:9090 to 192.168.1.231:8080. I execute the following command: iptables -t nat -A PREROUTING -d 192.168.1.230 -p tcp --dport 9090 -j DNAT --to 192.168.1.231:8080 ...
0
votes
3answers
76 views

iptables rules for port 53 not taking effect

My ubuntu 14.04 LTS server is receiving lots of incoming traffic on port 53 from different ip addresses. I am not hosting any DNS service. So I decided to block port 53: iptables -A INPUT -p tcp ...
0
votes
0answers
13 views

iptable script to block Post request to a specific file [duplicate]

I get these attacks daily across multiple servers (Apache): 135.120.5.180 - - [31/Jan/2016:14:21:08 +0000] "POST /xmlrpc.php HTTP/1.0" 200 598 "-" "Mozilla/4.0 (compatible: MSIE 7.0; Windows NT 6.0)" ...
1
vote
1answer
11 views

:: gem list -remote :: iptables configuration

Once I locked down my VPS server with iptables meaning I only have a few selected ports opened for input access, my Gem command stopped working and I'm not sure what I'm doing wrong. This is a two ...
0
votes
0answers
14 views

Setup router iptables like VPN for single pc

I'm currently far away from my office for a family visit. One of the applications got frozen and needs a restart. The config files are set up to only accept logins from local ips. Only device I ...
0
votes
2answers
93 views

IPTables: How to log and set a specific log file

Is it possible log all dropped connections by IPTables and set a iptables.log file for logging in /var/log/?
0
votes
2answers
59 views

IPTables: apt-get and wget not working

When resetting IPTables, the apt-get and wget command functions correctly and also downloads what I want. But once I activate this firewall, it isn't functional. Pings still work. I want to allow all ...
0
votes
0answers
169 views

iptables using ipset with SNAT

I have a bunch of iptables SNAT rules that map networks to ougoing public ips, like this: iptables -t nat -A POSTROUTING -o eth0 --src 10.1.1.0/26 --jump SNAT --to-source 123.123.123.12 iptables -t ...
-1
votes
1answer
31 views

Unable to connect to a port from a remote machine in Centos?

I am not able to connect to 9423 port of a machine from another machine though the local telnet localhost 9423 works. Here is my netstat -putna. Is there anything suspicious? 10000 works just fine ...
0
votes
0answers
38 views

Iptables and rate limit http URL

I need limit requests to xmlrpc.php in Centos 6.x. I have this rules added, but nothing do it. Thanks for help. iptables -I INPUT 1 -p tcp -m state --state NEW -m recent --rcheck --seconds 600 ...
-1
votes
1answer
37 views

IPTables: Does blocking spoofing, affect any services? [closed]

Do these rules affect any services/applications? Will apt-get and others still work? - iptables -A INPUT -s 10.0.0.0/8 -j DROP - iptables -A INPUT -s 169.254.0.0/16 -j DROP - iptables -A INPUT -s ...
2
votes
0answers
58 views

iptables configuations for stunnel+squid

I'm building a highly anonymous proxy server with squid and stunnel, and I'm facing a configurations problem on iptables. The server should act like this: browser <-> client stunnel <=> ...
0
votes
0answers
8 views

Http request blocked on port 80 [duplicate]

I currently have Centos 7 installed on EC2 with the following: Apache Php Mysql Iptables Firewalld Apache running Redirecting to /bin/systemctl status httpd.service ● httpd.service - The ...
0
votes
0answers
25 views

Proftpd: no way to get port 21 as user?

I run a proftpd server. Is on chroot and running as user(ftp),ftp user cannot bind port 21 because is privileged and need root. So i redirect all connect to 21 on 2121. The problem is,if I start a ...
0
votes
0answers
31 views

Sending duplicate packets to the wan ip address

I'm in need to send duplicated packets to the remote host (wan ip address). I'm aware that -j TEE would do just that on the LAN, but what about WAN? iptables -I POSTROUTING -t mangle -d x.x.x.x -j ...
0
votes
0answers
16 views

Another get pfctl equivalent of iptables, use ipfw or pfctl?

I'm trying to get the OS X equivalent of this iptables usage: sudo iptables -t nat -A OUTPUT -p tcp -m owner ! --uid-owner mitm_account --dport 80 -j REDIRECT --to-port 9001 But having a really ...
0
votes
1answer
22 views

Port forwarding work on virtual machines but not on host

I use this iptables config It simply redirect to port 21 the connection of 2121(used to run ftp as user instead of root) *nat :PREROUTING ACCEPT [200:39210] :INPUT ACCEPT [6:360] ...
0
votes
1answer
33 views

can access virtualhost locally on the same server but cannot access on remote machine

A pretty wired problem occured when configure a virtualhost at port 81. When I use command curl 123.123.123.123:81 or curl localhost:81 in the same server, it got response. While when I access it ...
1
vote
2answers
61 views

IPTABLES: Route outgoing http requests to eth1

I am trying to route all outgoing HTTP requests LEAVING my server to go through a proxy (tinyproxy) on another server. I want the transmission to the proxy to use our LAN which is on eth1. No matter ...
0
votes
2answers
28 views

Ubuntu server - packets from different networks not coming through (flushed iptables)

I have set up a brand new Ubuntu server, and I'm encountering a very strange network related issue - the processes running on the server cannot 'see' packets originating from external networks, but ...
-1
votes
1answer
216 views

port 80 is open by iptables but Connection timed out

I have nginx on my server, I run the script below to add rules to iptables: #!/bin/bash ip=/sbin/iptables services='22 25 53 80 443 5432 8000 8080' $ip -F; $ip -t nat -F; echo -e "Opening port 22 ...
0
votes
1answer
85 views

Telnet: Unable to connect to remote host

Related Threads: SMTP server works, but telnet to port 25 does not Can't connect to SMTP server The problem I have a server running Debian 3.2.65-1 and i am having some problems to connect other ...
0
votes
1answer
70 views

Add latency and random packet drops excluding SSH packets

I want to add some random delay/drop to all packets excluding SSH packets. I can do that to all packets this way: tc qdisc change dev $NIC root netem delay 100ms 10ms 25% tc qdisc change dev $NIC ...
-1
votes
1answer
22 views

OpenVPN cannot route traffic

Scenario OpenVPN server running on Gentoo eno1: (server public ip) has static ip... NO dhcp eno2: vlan (down for now) tun0: openvpn tunnel interface server.conf local <external ip> port ...
2
votes
9answers
359 views

IP forwarding on Linux - anything important to make sure to do or know?

In moving a website with a dedicated IP from one server to another, to minimize downtime due to DNS propagation delays, there's the approach of using IP forwarding so that all traffic to the original ...
0
votes
0answers
25 views

Iptables Port redirection don't take effect

Im tying to setup a mitm proxy to sniff my Android smartphone. I found this helpful tutorial. At the point where I need to teach Ubuntu to redirect everything from port 8080 to 443 and 80 I'm running ...
0
votes
0answers
36 views

NFS on Ubuntu Server 14 LTS with iptables

I have a virtual server with Ubuntu Server 14 LTS. The provider has offered me NFS storage which I wanted to mount on the virtual server: mount -t nfs 192.0.2.4:/space /mnt/nfs However, I cannot ...
0
votes
0answers
32 views

openvpn pass ip to client like hidemyass does

I have a debian server with 64 external ips (ip blocks) and no internal IP. They go like eth0:1 eth0:2 (virtual interfaces) I have successfully setup an openvpn server on it so that I can connect from ...
0
votes
1answer
99 views

why fail2ban does not ban? (ubuntu, ssh)

I installed a fresh Ubuntu machine. Then I changed the ssh port which is no more 22 but 22111: Then I have installed fail2ban: apt-get install fail2ban -y cp /etc/fail2ban/jail.conf ...