iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

-1
votes
1answer
130 views

How to allow google-analytics via iptables when internet is blocked for other traffic [duplicate]

I am running the following script on a wifi gateway. The WAN side of the gateway has ppp0 interface while LAN side is on wlan0. No LAN user should be allowed to browser internet Some services on ...
1
vote
1answer
76 views

iptables forward ip to another ip

I've configured multiple IP Addresses on my Ubuntu ssh server. Now the server can be accessed by using any IP Address, from 192.168.0.51 to 192.168.0.99. Depending on which IP Address someone uses to ...
0
votes
0answers
41 views

How to do the port forwarding from one ip to another ip only for right incoming ip?

I'm have 2 vpn clients and 1 vpn server. One vpn client(work) has access to the server on amazon, but it seems for this server in the firewall block incoming requests from all ips except work ...
0
votes
1answer
32 views

Cannot understand this example fail2ban rule

I'm trying to secure my admin and user login page from brute force attacks. I have setup iptables and the closest thing I can find which looks useful is this: jail file: [nginx-login] enabled = true ...
0
votes
1answer
62 views

Iptables drop all connection except my domain(s)

I tried use this command to block a domain iptables -I INPUT -p tcp -m string --string "Host: domain.com" --algo bm -j REJECT and it worked but, i want to Reject all but accept from specified ...
0
votes
1answer
44 views

ip6tables snat don't work properly [closed]

I got three computers with these names: laptop, vds and home; vds is openvpn server; home is openvpn client. and, I got an ipv6 network 2a01:dead:beef::/64 vds has address 2a01:dead:beef::311 on ...
0
votes
0answers
94 views

iptables DNAT packets into an openswan IPSEC tunnel

I have the following network setup: +-----------------------------------+ | | ...
0
votes
0answers
39 views

Trying to create a NAT with virtual Ethernet using IPTables

I have a separate namespace running on my server and I want to create a NAT that will enable Internet connectivity in this namespace. I specifically want to do this so that certain inbound ports are ...
0
votes
1answer
143 views

iptables using, goto + jump: what is the RETURN behaviour?

I'm trying to work out what is the iptables behaviour when you have multiple custom chains and you sue a mix between -goto and -jump Example: INPUT iptables -A INPUT -i eth1 -j CUSTOM-A CUSTOM-A ...
0
votes
1answer
68 views

How to block every port except specific ones to a user with iptables? [closed]

I'd like to block every port except 80, 443, 1005 to a specific user (owner) with iptables. What command should I use?
0
votes
0answers
140 views

CentOS 6.6 ignores iptables nat rules

I try to use iptables nat to forward incoming TCP traffic to another computer. I use following rules within nat table: -A PREROUTING -i eth3 -p tcp -m tcp --dport 8888 -j DNAT --to-destination ...
0
votes
1answer
61 views

How to disable network access for a user on Linux?

Trying to disable the network access for the user: [root@notebook ~]# iptables -I OUTPUT -m owner --uid-owner tempuser -j DROP [root@notebook ~]# ip6tables -I OUTPUT -m owner --uid-owner tempuser -j ...
0
votes
3answers
111 views

“Bad argument 'NEW'” when configuring iptables

I am getting the following error when configuring iptables on a Debian 7.6 server to log new TCP connections: Bad argument `NEW' Error occurred at line: ## The line throwing the error is formatted ...
0
votes
1answer
129 views

Is there a way to run just save with firewalld in RHEL7?

I'm starting to use RHEL7 and learning a little about the changes that come with systemd. Is there a way to perform /sbin/service iptables save in firewalld? $ /sbin/service iptables save The ...
1
vote
0answers
92 views

How to block hping3 SYN ACK efficiently with iptables?

Actually I'm trying to execute a SYN TCP flood on my Debian web server with nginx and, by executing tcpdump "tcp[tcpflags] & (tcp-syn) != 0" while flooding, I see all packets coming. I already ...
1
vote
0answers
212 views

Squid intercept proxy stuck with forwarding loop

I'm trying to set up a debugging proxy using Squid, mainly to test our own client communications library for various proxy types (one possibility with our client, is to connect to an external ...
0
votes
0answers
37 views

Port forwarding to VPN

| |WAN /-------\ ...
0
votes
1answer
47 views

iptables-save return with errno 1 - operation not permited

When I run the command iptables-save it returns with errno 1 - opearation not permitted If I do: iptables -L and then: iptables-save then iptables-save succeeds This error happens only ...
1
vote
0answers
17 views

Troubles with subnets and redirections

What I want to create is 2 subnets that communicate each other through a gateway. Here is my gateway: wlan0 Link encap:Ethernet IndirizzoHW c4:46:19:69:b7:a5 indirizzo ...
0
votes
1answer
31 views

ssh port is different from what is connected

Ok, so here's the deal. I setup an Iptables rule as follows: IPTABLES -A INPUT -p tcp --dport 51722 -j ACCEPT and if I do systemctl status sshd.service, I get the following: Server listening on ...
0
votes
1answer
204 views

drop ip blacklist with firewalld centos 7 [closed]

Question 1 I have I very long list 1500+ ips in a file lets say /etc/blocklist.ips each ip in a line of the file. How can I DROP for every ip in the file with firewalld from centos 7 ? also I been ...
0
votes
2answers
208 views

IPTables port redirect with Docker

I have a web service running on port 8080, which is made available on port 80 through IPTables like so: iptables -t nat -A OUTPUT -p tcp -d 127.0.0.0/8 --dport 80 -j REDIRECT --to-port 8080 This ...
0
votes
0answers
44 views

ebtables captive portal bridge vlan

http://s16.postimg.org/e5nu6g1md/bridgevlancaptive.png Attached link image is based on my project about captive portal. As you can see on the image i have diagram on LEFT side which is WORKING ...
0
votes
0answers
414 views

firewalld service is running, but firewall-cmd doesn't work

I am new to Centos 7/Server management. I am trying to figure out how to work with firewalld. my kernel release is: 2.6.32-042stab084.20(OpenVZ) And: #firewall-cmd --version #0.3.9 The problem is ...
1
vote
2answers
114 views

TCP traffic on port 1433 blocked by NAT rules

We have a SQL server that is hosted on AWS, the SQL server it not directly accessible on the internet, it relies on a NAT box to route traffic to it. We are trying to set up a Linked SQL server from ...
1
vote
0answers
913 views

squid transparent proxy for https / ssl trafic

I am trying to configure squid as transparent proxy , I followed below steps to configure Downloaded squid3.5 from the website, As squid3.1 will not support for ssl bump ./configure ...
0
votes
1answer
43 views

PSAD IPTables logging error

I installed PSAD on my Ubuntu server and then set the IPTables accordingly. But I still get this error by email: You may just need to add a default logging rule to the /sbin/iptables 'filter' ...
0
votes
0answers
47 views

Combining IPTables Accounting and Transparent Proxy Rules

I'm trying to combine IPTables traffic accounting rules with those required for transparent proxying and still maintain the accounting. I have one system that is handling both accounting and the ...
-4
votes
2answers
459 views

iptables: open port 25 CentOS 7 [closed]

I have problems opening port 25 for sendmail on my CentOS 7 machine. Here's my iptables configuration: *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A INPUT -m state ...
5
votes
2answers
133 views

Default policy for OUTPUT

Are there any security risks of having policy for OUTPUT set to ACCEPT? Machine in question is VPS hosting few websites, git repositories, jabber server and mail.
-1
votes
2answers
64 views

How can I enable protocol traffic with firewalld?

I need to allow Protocol 50 (esp) traffic for ipsec. I can do: iptables -A INPUT -p esp iptables -A OUTPUT -p esp How could I do this with firewalld instead? Same question closed on StackOverflow ...
1
vote
0answers
61 views

iptables keeps using old nat rules

I use iptables snat on my gateway to change local source ip addresses to external. The trouble is that after I change the rules (or even if I flush iptables nat table) gateway keeps using the old rule ...
1
vote
1answer
146 views

Why some iptables DNAT rules don't work until reboot?

My iptables DNAT rules don't work until reboot. If I reboot my server, all of the rules work. Desciption of the architecture : Tens of hosts (senders) send some UDP packets (one-way on a specific ...
0
votes
1answer
48 views

iptables: when to use input or output with LAN connections?

In a SSH server/firewall (192.168.2.3) that has a LAN behind it, say 192.168.2.1/30, will the connection attempts made by the internal machines of the 192.168.2.1/30 network be interpreted by the ...
0
votes
1answer
80 views

How do I get boto to work with port 443 being prerouted to another port?

My title may be poorly worded, but I'll try to get the backstory straight: I have Ubuntu instances with clusters of Docker containers all hosting web servers In order to appease firewalls we want to ...
0
votes
1answer
46 views

iptables ipset misconfiguration?

I'm looking for a solid method to block unwanted TCP/IP traffic. On my linux machine iptables and ipset seem to offer a nice way to do so. Until now I've done this: ipset create ipsok hash:net ...
0
votes
0answers
43 views

Given: iptables entry in place; my.cnf properly set up; MySQL user & permissions properly set - but still cannot access MySQL remotely: Suggestions?

I would like to access MySQL remotely on an Amazon EC2 CentOS instance (I assume it is CentOS because I use yum to update installed applications and libraries). I believe that iptables is set ...
-3
votes
1answer
89 views

iptables rules for blocking specific packets [closed]

Im using the following iptables rule: iptables -A INPUT -p tcp -m tcp --tcp-flags PSH,ACK PSH,ACK -m length --length 52 -m state --state ESTABLISHED -j DROP It does it's job for blocking the ...
0
votes
2answers
391 views

unexpected RCODE REFUSED - eating up log files

I have a website which I host myself, and I use bind9 as my DNS server (host my own nameservers etc.). I am having a problem with traffic bandwidth, and my syslog is full of the following type of ...
-2
votes
1answer
31 views

How can I apply a firewall rule to a specific local IP? [closed]

I host gameservers and as a result have a few IPs. On the main server IP I have the game panel, other IPs are reserved for use by the gameservers I host for my customers. As a result I would like ...
0
votes
0answers
102 views

How to config iptables to forward connection from/to internal VM

I have an host with proxmox and some virtual machine installed, the first machine is a proxy with haproxy that forward the request to other VM and in proxmox host i have this iptables script: ...
3
votes
1answer
55 views

Need advices on iptables

Helly guys ! :-) . I need a (several?) advice(s) from you about my iptables setup. I'm pretty new to iptables, and this is the first time I configure a server with iptables ONLY as a firewall (we ...
1
vote
1answer
114 views

Linux - show dropped packets form firewall

I am trying to set up a sip trunk and so far everything has gone well. The only issue I face is that the call does is not received when the iptables service is running. By stopping the service ...
0
votes
0answers
203 views

Docker open ports in iptables (rabbitmq)

I'm having a docker image based on rabbitmq. Nothing in my Dockerfile specifies anything about ports. I bind the usual rabbitmq ports (5671, 5672 and 15672) to my custom ports by running my instance ...
0
votes
0answers
61 views

iptables logging public server

I would like to create iptables for a public webserver, since I would like some stats on how-many times this server is being tried for open ports/ssh logins/ ... To do this I wanted to filter out all ...
0
votes
0answers
81 views

Routing between eth0 <-> tun0 doesnt work

I am configuring a linux vm as a openvpn client to act as router to route to another machines connected to the central vpn hub Data. Lan: 192.168.10.0/24 Remote vpn subnet: 192.168.40.0/24 openvpn ...
1
vote
1answer
145 views

What exactly happens to packets written to a TUN/TAP device?

I'm trying to send packets to an application listening on eth0 from machine's user-space as if they were coming from a remote machine. What I can't seem to find good documentation for is the exact ...
0
votes
1answer
52 views

IPTables from public ip and port to lan ip

I own 3 public IPs for my server and I have multiple VMs that have their own 'job'. The server has 1 NIC. Public IPs: XX.XX.9.247 (MAIN) XX.XX.21.141 (additional) XX.XX.21.142 (additional) LAN ...
0
votes
1answer
51 views

How to duplicate multicast packets on several interfaces?

I would like to send a stream from a Linux server to several Linux clients via a multicast address. The clients are directly connected to the server but on different interfaces: bnep0 and bnep1. ...
0
votes
0answers
47 views

L2TP daemon server multiple IP

I have VPS with 3 public IP - Debian 7. I would like to have 3 L2TP damemons (one ip each) NATing traffic to each ip. Something like this l2tp_multiple_public_ip_diagram. I have set up l2tp daemon for ...