iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

0
votes
1answer
173 views

How can I block all traffic to/from an bridged interface while allowing DHCP?

I have a PC (running Fedora 20) that is being used as a "software switch" to control the network connectivity of some external devices. There are eight such devices; the PC has two 4-port Ethernet ...
0
votes
1answer
52 views

Open port only on OpenVPN network with iptables

I'm running an OpenVPN network and one of the VPN clients in my network is a web server which provides access to some internal services used by my application. Normally, on a public facing web server ...
1
vote
1answer
233 views

How to forward ports to DMZ using iptables and separate modem

I have a network that looks like this: ADSL VLAN 2 VLAN 3 ------[Modem]----------[firewall]----------[intranet PC] | | ...
0
votes
1answer
64 views

redirecting iptables to privoxy does not work

I have set up a wireless access point on my Debian 8 laptop following this and this tutorial. When redirecting iptables to port 9040 it works but changing the port to 8118 which is the one privoxy ...
0
votes
0answers
85 views

Does netfilter reassemble IP fragments when packet is forwarded?

IP datagram should be reassemble in the termination of the path because the fragments may arrive from different paths. I think Netfilter need to reassemble a IP datagram to inspect the whole payload ...
0
votes
1answer
45 views

I can't open any UDP port(inbound)

I am setting up a little IPTable. This is my current config: # Accept everything on the loopback interface iptables -A INPUT -i lo -j ACCEPT # Accept ICMP iptables -A INPUT -p icmp --icmp-type any ...
0
votes
0answers
90 views

nftables, bridge, lxc. Can't call into container

My first post so bear with me. I am using nftables to start to replace old ones. I am loving it, but obviously, my approach is a bit iptables-like and also highly procedural, rather than using the ...
0
votes
2answers
50 views

is there a way from iptables/iproute to forward all traffic to my IDS and also keep the regular flow

The reason of this, is that to catch all packages into my IDS keeping my existing enviroment, so the IDS does not become a single point of failure. If route all my traffic into my IDS and from my IDS ...
0
votes
0answers
103 views

Return traffic through same interface as entered

I've created a GRE tunnel on my Linux server (VPS, OpenVZ). Server gets a public IP address from this tunnel and I need it be accessible from Internet through it. There is already a default gateway, ...
0
votes
2answers
89 views

iptables: static ephemeral port maps

I have a VPN on my Linux server which does IPv4 NAT, example: iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT iptables -t nat -A ...
1
vote
1answer
135 views

iptables only blocks OpenVPN on server startup

I'm currently in the process of setting up OpenVPN across multiple data centres on Linode. The OpenVPN set up is working great and I'm now focusing on getting my firewall set up so that my public and ...
0
votes
0answers
19 views

How can I proxy requests to a specific IP to a different IP on OS X?

On OS X how can I setup a route so that when I make a request to 10.0.0.1 it is redirected to localhost? Right now I can do curl localhost:3000 and get back a blob of HTML from my running node web ...
0
votes
1answer
79 views

Connection lost to VPS While using iptables by default policy as DROP for INPUT, OUTPUT, FORWARD

I'am using iptables in many server's but now stuck with this issue while using default Policy as DROP. Here is my rules which i have used in VPS, Tried many time's everything seems fine but VPS ...
0
votes
0answers
25 views

Why iptables state setting changes from 1.3.x to 1.4.x?

I intend to set iptables rules in the purpose of allowing to access outer website from current machine, but not allow any positive connection to this machine. Thus, my iptables is set as follows: ...
-1
votes
2answers
97 views

how to force linux to accept packet with loopback ip

i have an embedded system with an Ethernet interface that needs to accept external packets with IP of 127.x.x.xx. is there a way to force Linux to accept external packets with this loop back address ...
1
vote
1answer
86 views

How do iptables policies work?

I've added some basic rules: iptables -A INPUT -p tcp --dport 22 -j ACCEPT iptables -A INPUT -p tcp --dport 80 -j ACCEPT Then, command to close all other ports with: iptables -A INPUT -j DROP ...
2
votes
2answers
77 views

What is the difference between iptables -X and iptables -F?

In many examples, I see the following 2 consecutive commands: iptables -F iptables -X From the man page, I cannot figure out the difference between flushing and deleting. Is there a difference ...
0
votes
1answer
38 views

Measuring request response time by port

So, I'm currently working on a project in which I spin up a set docker image on a number of different machines and configurations. This image basically contains a web server that accepts a number of ...
0
votes
1answer
146 views

iptables fails to load nf_conntrack_ftp [duplicate]

I have recently had to rebuild my iptables configuration and when I run service iptables restart I now receive the following error line: iptables: Loading additional modules: nf_conntrack_ftp ...
0
votes
0answers
54 views

Best way to add multiple IP to single interface

My hosting provider routes an IP block to my eth0 interface. Until today I've been adding the block using IP alias via ifconfig, unknown to me that it was an old solution. I've now learnt that there ...
7
votes
2answers
1k views

CentOS port forwarding not working

I'm using CentOS 6.5 and I added the following commands to my iptables to forward all incoming traffic on port 8088 to 4569: iptables -A PREROUTING -t nat -p udp --dport 8088 -i eth0 -j DNAT ...
-2
votes
1answer
53 views

Opinions about firewall rules for vps [closed]

I just switched to a new vps, which I installed Linux and I wish to harden it a bit by applying firewall rules using iptables. I use Firewall Builder to create my rules and I would like some ...
2
votes
2answers
161 views

How to have ntpd serve only my local subnet

I have a few servers with public Internet IP addresses like A.B.C.x. One of my hosts (A.B.C.10) runs ntpd and I have it syncing it's time from europe.pool.ntp.org. Now I only want to allow hosts ...
1
vote
1answer
154 views

why port forwarding is not working in this setup?

I'm trying to setup a docker virtualization environment. This is a follow up of this question. I have a virtual eth0:0 interface, and I would like to forward it using iptables. The public, main IP ...
3
votes
2answers
86 views

source address with iptables port forwarding

I set up port forwarding for port 80 with iptables: iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 10080 Additionally, I have ip forwarding enabled to route connections ...
0
votes
1answer
88 views

Fail2ban detects attempts from permanently banned IPs

I have a VM with a custom firewall script and Fail2ban. I've identified some IP ranges that make permanent intrusion attempts so I blocked them directly in my firewall script. Here is a simplified ...
0
votes
1answer
89 views

Add custom NAT rule to Plesk managed firewall [closed]

I am running a vServer with Ubuntu 10.04 LTS and Plesk 12. I am using the Plesk firewall module which was ok for me so far. However, now I set up a OpenVPN server on the server. In order to be able to ...
2
votes
2answers
102 views

ACCEPT statements in policy DROP

I'm trying to set up some rules using IPtables under Debian (Wheezy) and have been running in to some problems i think. The policy of INPUT is set to DROP. Does this drop everything based on the ...
0
votes
3answers
130 views

aws ec2 security group and centos ip tables

I try to change the SSH port from 22 to another port (218). In AWS EC2, I shall add the rules in security group or in IP Tables? Is there any guideline/references recommended for EC2 Security ...
0
votes
1answer
79 views

pptp gateway with ssh access

I am desperately trying to setup a gateway-server that forwards all local traffic to a ppp0 connection but is still reachable via ssh on the local network. The point-to-point connection establishes ...
-2
votes
1answer
123 views

Iptables block connection from specific IP - to another IP [closed]

My server with dnsmasq will send Facebook.com (for example) to DNS 8.8.8.8. All other websites go trough another dns server. When i use:sudo iptables -A INPUT -p udp -s 8.8.8.8 --sport 53 -j DROP With ...
1
vote
2answers
1k views

Forward one IP to a docker container

As far as I understood, docker run containers with their own IPs, and fully open ports, on the bridge interface docker0. Let's say I launch a container, and it has its own IP: 172.17.0.11, and I have ...
3
votes
1answer
94 views

Filter mirrored port traffic using iptables

I receive traffic from a mirrored port and I would like to send it into an NFQUEUE for processing. Because of the mirrored port, the packets destination MAC addresses are not my host MAC address. ...
0
votes
1answer
67 views

Linux: iptables and marking confusion

Before I ask my question, let me first pose the situation: I have 2 network interfaces: eth0 and eth1 I bridge those 2 (using brctl) and form a new interface: br0 This bridge gets the ip address ...
1
vote
1answer
48 views

Influence of kernel code execution to Load average in top?

I'm trying to tests the amount of CPU that iptables use for NAT. Perhaps it will be more accurate to say "the amount of CPU that the netfilter kernel module" uses. The approach i took was to try and ...
0
votes
1answer
90 views

Can multiple firewalld zones be active at any given time?

I've been struggling through some weird (to me) firewalld errors but am now seeing the firewall behavior I'd like. But, baffling to me, what works seems to be a mix of both the drop zone and the ...
0
votes
1answer
32 views

iptables dnat mapping to specific ip

I constructed a private net with two machine, both of them have two network interfaces this is the networking information: machine1: eth0 10.0.0.11 (private net) eth1 10.82.80.208 (Campus Network ...
1
vote
1answer
1k views

Why does my Firewalld configuration on CentOS 7 fail to start and show iptables errors?

I'd like to: Drop all incoming connections from the external Web except 80 and 443 Allow internal machines on 192.168.0.0/16 to connect to :9000 :8080 Here's what I did to setup my drop zone via ...
2
votes
1answer
90 views

iptables unknown option `--connlimit-upto'

I have been getting hit pretty hard every day from thousands of requests all from the same few class's of ip addresses. Recently it's taking up all of my MYSQL connections and not allowing any new ...
1
vote
2answers
108 views

Rotating outgoing IP's [closed]

I want to rotate IP addresses for web-scraping, and here is my setup: I have configured multiple IP addresses as below in my /etc/network/interfaces file: # The loopback network interface auto lo ...
-1
votes
1answer
229 views

Debian iptables: Block all Incoming except special IPs or Ports

I play around with the rules for my web server, but it doesn´t work as i want. The ports seems to be reachable, but a connection won´t happen, here´s the script: #!/bin/bash # Drop all Incoming ...
3
votes
1answer
406 views

How do I automatically ban udp short packet with fail2ban?

This logfile /var/log/kern.log contains some IP addresses, which I would like the system to automatically ban/block. Basicaly, a packet is from the UDP protocol, and is a short packet, then I would ...
2
votes
1answer
39 views

Block traffic to certain servers

In my organization, I'd like to make sure all servers are only accessible from the inside. The only exceptions are the mail and webservers. What's the best way to do this? My own suggestion was ...
2
votes
1answer
323 views

UDP Traffic from outside to docker container is dropped after container restart

following situation: i have a hardware box with Ubuntu 14.04LTS as host for docker 1.4 I'm running an ELK stack in several containers. Curenntly the logstash container is exposing only port 514 to ...
0
votes
0answers
83 views

Docker containers connecting to a host daemon

I would like to run a daemon on the host and get the containers connect to it. I was thinking I will bind the daemon on the host to 127.0.0.1 and then have something (delegate? or is iptables enough?) ...
0
votes
0answers
192 views

OpenVPN server cannot ping client (routing/iptables issue?)

I am not sure exactly where the issue is here. I'm fairly sure that this is some NAT or iptables issue on the OpenVPN server but am lacking the networking know-how to fix the issue. The crux of the ...
0
votes
1answer
64 views

Configuring IPTables without connection tracking module

Usually connection tracking is required for outbound connections to allow established connections back in, for instance: iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT I don't ...
1
vote
0answers
45 views

Strange entries in Squid3 access.log

My WiFi network for guests is transparently proxied by Squid3. There's now a girl from Indonesia with her Samsung GT-B5330 running Android 4.0.4, who gets blocked by "The requested URL could not be ...
1
vote
1answer
100 views

iptables starts dropping packets; temporarily fixed by doing restart; only from home

I am running a small apache2/iRedMail server but I am having an issue with iptables. After a while of working correctly (hours) my server is unreachable edit: from my home internet connection on some ...
1
vote
0answers
84 views

linux not replying to an arp request

I am running linux 3.14 on a system with 2 interfaces. on the first interface, i can access our local network. on the second interface, arp packets come in but linux doesn't send out reply. is it ...