iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

1
vote
2answers
110 views

Iptables blocking smtp

Iptables is blocking outgoing and incomming smtp on my server, although I specified it not to. My policies are DROP everything except what's specified. Changing policies to ACCEPT everything "solves" ...
0
votes
2answers
63 views

ip forwarding using iptables

I have two interface in my linux machine , one is configured for public ip 110.111.250.241 - eth0, another is for LAN 10.42.43.1. I have a client machine 10.42.43.174 with apache web server. I want ...
1
vote
2answers
67 views

How to best redirect customers to a login page? (ISP)

I'm trying to come up with the cleanest way to redirect a user to a logon/payment page from an ISP gateway router. We run a small ISP and would like to force users to have to log in prior to getting ...
0
votes
1answer
57 views

How to block/ban clients that try to access some paths / urls?

Some spambots hammer my server with nonexisting paths like /user/pass?=asdfdasfas How could I block any access to /user/pass?=* ? Is there a better tool than iptables or csf for catching such crap?
0
votes
2answers
356 views

Remove Iptables log from kern.log syslog messages

I'm having trouble with Iptables logs, i'm not able to get them out from kern.log, syslog and message files. I added two rules in rsyslog.conf which redirect my messages to an "iptables.log" file but ...
-1
votes
1answer
61 views

Trying to RDP to Windows machine using iptables

I am a newbie to iptables. Sorry for the basic question. I am trying to connect to a Windows Machine using Microsoft's "Remote Desktop Protocol" This service uses TCP Port 3389. My Linux server is my ...
1
vote
3answers
121 views

Changing iptables chain from port based to ip based

Im working to limit access to a new XenServer 6.2 installation. The default iptables rules on the boxes have a RH-Firewall-1-INPUT chain that exposes quite a bit to the outside world. Without going ...
-1
votes
2answers
49 views

How to detect and restrict frequent query from the same IP using iptables?

Here is the scenario: I intend to protect my server from being queried with high frequency from the same IP, say, the upperbound is 60 times per minute. I don't know how to do that via iptables, Is ...
2
votes
1answer
239 views

What is “state RELATED,ESTABLISHED” in iptables? [duplicate]

2064 871K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x00 0 0 DROP tcp -- * ...
-1
votes
2answers
70 views

Setting IPtables rules into a file

Currently I have a debian install with a shell script which has the following content (as an example): # Setup iptables IPT="/sbin/iptables" # Flush old rules, old custom tables $IPT --flush $IPT ...
0
votes
1answer
80 views

How to bind traffic of each NAT client to a external IP address?

I have a NAT router with 2 IP addresses, lets say 111.111.111.111 and 222.222.222.222 associated with the interfaces eth0 and eth0:1 respectively. I have two servers that connect to this NAT gateway ...
3
votes
1answer
124 views

Will using iptables DROP target result in socket CLOSE_WAIT that never completes?

I have some simple rules to block certain IP blocks used frequently by hackers/spammers, e.g.: iptables -A INPUT -s 173.208.250.0/24 -j DROP But, I noticed that apache hangs after a couple of days ...
0
votes
1answer
492 views

netfilter DNAT rule doesn't work for local traffic

I have a webserver hidden behind a firewall. A DNAT rule on my firewall makes it reachable for visitors from the internet. The rule works for traffic from the internet. Unfortunately it doesn't work ...
1
vote
1answer
94 views

Where does Webmin store its firewall configuration?

I want to copy the firewall configuration for iptables from one server to the other. Both servers run Debian Squeeze and have Webmin 1.660 installed, so I want to copy the configuration that Webmin ...
1
vote
1answer
109 views

Reach LXC container from a virtualbox guest on the same host

Context I develop websites on my Ubuntu laptop (Ubuntu 13.04 64b). Each site runs within a dedicated LXC container¹ on network 10.0.3.x I sometimes need to reach those sites from a virtualbox guest ...
0
votes
3answers
77 views

iptables + nat to internal web server

We run ubuntu on our gateway machine. We have a DNAT iptables rule sending traffic on 80 and 3306 to an internal ip address that runs a webserver. It doesn't work at all. eth1 is the wan interface, ...
0
votes
0answers
116 views

Using iptables to log traffic from port mirroring

I configured one port of my switch to do port mirroring of the other ports. I connected to this port mirroring a server where iptables has some rules. If some rules are matched, iptables sends to the ...
0
votes
2answers
452 views

CentOS 6 and PostgreSQL - Can't Connect to Port

SOLUTION: it turns out the ORDER of iptables matters. The firth INPUT rule is REJECT all ... which precludes the ACCEPT rule. So I had to use iptables -I INPUT 5 ... to add the rule in the fifth ...
1
vote
1answer
59 views

copy ipv4 rules to ip6tables

I have a static IPv4 and a static IPv6 address. Right now, my iptables look like: *filter :INPUT DROP [28:2168] :FORWARD DROP [0:0] :OUTPUT ACCEPT [551:134808] -A INPUT -i lo -j ACCEPT -A INPUT -i ...
0
votes
0answers
109 views

Martian packet errors with physical adapter's IP address on GRE tunnel

I'm very new to the networking world (most of my time is spent as a developer), so I could very well be missing something simple. TL;DR version: I get 'martian packet' errors on response traffic when ...
0
votes
1answer
285 views

Iptables port forwarding on AWS EC2

I have AWS VPC with 1 public subnet and 1 private subnet. I have my web-server running on port 80 in private subnet. I want this webserver be accessible form public internet Yes, The VPC security ...
0
votes
2answers
162 views

MySQL / Firewall / Can't connect to MySQL server

I have a client running a mysql server with bind-address=0.0.0.0. Here is the iptables output root@host:/var/www# iptables -L Chain INPUT (policy ACCEPT) target prot opt source ...
2
votes
1answer
107 views

How to open a port below 1024 in Cent OS for socket.io?

I'm trying to open port 843 in my Cent OS 5.2, I added following line to etc\sysconfig\iptables : -A INPUT -p tcp --dport 843 -j ACCEPT and then updated my iptables service. I need to listen to ...
1
vote
1answer
81 views

Outbound HTTP traffic being blocked by APF - outbound filter is off

I'm using CentOS 6.4 inside an OpenVZ container. I'm trying to configure APF 9.7-2 to allow inbound SSH and HTTP traffic (only) and outbound HTTP and HTTPS traffic (don't care much if other outbound ...
0
votes
1answer
62 views

Limit HTTP method on ubuntu 12.04 server

For starters, this is not a web server. I would like to allow or deny HTTP methods on various ports on the server itself. Ideally could write rules like UFW only extended to include the HTTP method ...
2
votes
1answer
72 views

web sites know the “real” access user(IP) through a proxy?

I'm new to Squid and iptables, and am investigating whether they would be able to accomplish a task at hand. part of my squid.conf: acl wf myport 8010 acl vp myport 8020 acl ss myport 8030 ...
0
votes
1answer
888 views

Failed to retrieve directory listing in Filezilla connecting to vsftpd

newbie here. At first I was unable to connect to vsftpd but I added port 21 in iptables (i'm running on Centos 6) and managed to make it work. But now, I can't get past Command: LIST in Filezilla ...
0
votes
0answers
32 views

CONNMARK on rewritten packets

I have tried to ask this question on superuser, for it, being a custom setup, belongs there, but that got no answer even with a bounty. I have a host, on which I rewrite saddr and daddr of IP packets ...
0
votes
1answer
229 views

KVM: port forwarding to guest VM

I'm using KVM on Debian wheezy. I want to connect to the guest using ssh with the command ssh 1.2.3.4 -p 10122. What I do is: root@host$ iptables -t nat -A PREROUTING -p TCP --dport 10122 -j DNAT ...
3
votes
3answers
540 views

Almost working: How to set up iptables and iproute2 rules on dual WAN linux server?

I have a Raspberry Pi (running Raspbian) with three network interfaces (one ethernet and two USB wifi nics). What I want to achieve is this: I have two WAN connections to the internet (DSL + Cable), ...
2
votes
1answer
52 views

iptables port forwarding only for a certain range of IP

I'm using LXC containers. Each one of my containers have an ip address in 10.0.3.0/24. I want the packets that come into my host on a certain port to be redirected to a container so I use this rule: ...
0
votes
1answer
83 views

How to add another router on an existing subnet? [closed]

What I am trying to do is basically this. I am on a network who's routing table is something like this. Destination Gateway Genmask Flags Metric Ref Use Iface default ...
0
votes
1answer
124 views

Ban failed pure-ftpd login attempts using iptables [closed]

Just curious if there is a way to block IPs after 3 failed login attempts to pure-ftpd, but only for a couple of hours, strictly using iptables. I have heard using fail2ban works fine for this, but ...
0
votes
1answer
25 views

Redis: INFO doesn't report network/bandwidth metrics?

Is there a way to get network/bandwidth metrics from a given Redis process? Something I missed in the output of the INFO command? Some patch or compile time configuration option? Or would I need to ...
1
vote
0answers
47 views

Iptables and system-config-firewall

I had a set of netfilter rules set with iptables, but someone else told me to use system-config-firewall to add a rule for sharing files with Windows. (Samba) This rewrote the iptables rules file and ...
0
votes
2answers
109 views

options to log Netfilter/iptables - anything better than ulogd?

My requirements are to do extensive logging of various iptables rules that must be logged into a file other than Syslog or the Journal. For some time have been using ulogd that enables setting up ...
1
vote
1answer
76 views

puppet service not stopping service

notice ("This should be echoed") service { "iptables": ensure => "stopped", } This does not stop iptables, I am not sure why. service iptables stop works fine. Puppet 2.6.17 on CentOS 6.3. ...
0
votes
1answer
168 views

Centos IPTables - Allow Traffic for Multiple IP Addresses [closed]

I know that: 211.95.79.186/24, it would allow 211.95.79.0 all the way up to 211.95.79.255. and 211.95.0.0/16, it would allow 211.95.0.0 all the way up to 211.95.255.255. and 192.168.1.30-50, it ...
2
votes
1answer
158 views

LXC networking with public IP

I have installed LXC in ubuntu server 12.04 using this link. It was installed successfully and i am able login using ubutu/ubuntu as username and password. Then I tried to setup network for LXC ...
0
votes
2answers
142 views

restrict ssh, sftp access on ubuntu 12.04 through iptables or /etc/hosts.allow

I´ve tried to get into restricting access to a ubuntu server but i´m still unsure which way to go. the situation: We want to restrict access for ssh, and sftp to 4 clients with no static ip on a ...
0
votes
1answer
91 views

getting “packet counter not numeric” when setting iptables dnslimit

I get this exact error: iptables -A INPUT -p udp --dport 53 --set --name dnslimit iptables v1.3.5: -c packet counter not numeric What am I doing wrong?
0
votes
0answers
52 views

iptables 1.4.12 invert and --u32

This line in a script: iptables -A jk2_ddos -m u32 ! --u32 "0x1c=0xffffffff" -j ACCEPT will result in this error: iptables v1.4.12: u32: option "--u32" cannot be inverted. This seems not to ...
0
votes
1answer
63 views

ip6tables only allow packages to a certain ip-range

I am trying to configure ip6tables to only allow ssh connections to a specific range. In iptables the command would be: iptables -A OUTPUT -p tcp --dport 22 -m iprange --dst-range ...
0
votes
1answer
95 views

DNAT from localhost (127.0.0.1)

I'd like to set up a TCP DNAT from 127.0.0.1, port 4242 to 11.22.33.44, port 5353 on Linux 3.x (currently 3.2.52, but I can upgrade if needed). It looks like the simple DNAT rule setup doesn't work, ...
0
votes
0answers
59 views

Nested VM Guest Access from Host - KVM

I have nested VM setup. I have a host with a single network interface card with a public facing IP. I have bridged this interface so that eth0 does not have a IP and br0 is having the IP instead. I ...
0
votes
0answers
65 views

Why is an ack response being sent to the wrong gateway?

I was trying to determine why a packet forwarded by iptables to my internal lan is returned on the wrong gateway. Having investigated this further, I determined that, at least in the case of one of ...
1
vote
1answer
167 views

iptables to block VPN-traffic if not through tun0

I have a dedicated Webserver running Debian 6 and some Apache, Tomcat, Asterisk and Mail-stuff. Now we needed to add VPN support for a special program. We installed OpenVPN and registered with a VPN ...
1
vote
2answers
49 views

Redirect incoming packets to loopback

I'm trying to use iptables to redirect an incoming packet on eth0 to a service listening on the loopback interface. Based on this link I'm attempting to craft the following rule: iptables -t nat -A ...
0
votes
2answers
40 views

Is it possible to force IP source depeding on source ports?

I have a question about routing. I've searched the internets, found some hints but couldn't make it work. I have a server with 2 public IP and the same gateway. Let's say 1.1.1.1 (on eth0) and ...
0
votes
1answer
135 views

NAT rules betweek 2 network interfaces (with iptables)

this is the current network that I have: UBUNTU: eth0: ip: 212.83.10.10 bcast: 212.83.10.10 netmask 255.255.255.255 gateway 62.x.x.x eth1: ip: 192.168.1.1 bcast: ...