iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

0
votes
0answers
1k views

Transparent Proxy squid TCP_MISS/503 Error in all pages

I m trying to make a squid proxy server with to work as a transparent proxy server, and i m facing some issues that i m unable to figure out the reasons. The setup i m using is several VLAN's with ...
3
votes
2answers
50 views

Why is my iptables config not accepting connections from the specified source iP?

From machine 192.168.1.2, I have this iptables configuration: $ hostname -I 192.168.1.2 $ iptables -L -n -v Chain INPUT (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out ...
2
votes
1answer
103 views

ifcfg-eth0.200 is not responding to arp broadcasts

I have a Centos router doing a stupendous job in a setup similar to this: eth0 --> no IP eth0.200 --> 192.168.200.1 eth0.201 --> 192.168.201.1 ... so on up to eth0.213 --> 192.168.213.1 I have ...
0
votes
2answers
194 views

VSFTPd 2.3.5 through iptables on Debian 7.6

Configured and running vsftpd 2.3.5 on Debian 7.6 behind IPtables and fail2ban with ssl_enabled I can't upload files properly because after a few I receive the following errors: Timeout or OOPS: ...
1
vote
1answer
58 views

How to forward a port to multiple internal ips

I have a Centos 6 64 bit server with OpenVPN installed. I'm using this iptables rule to forward a port for an OpenVPN user: iptables -t nat -A PREROUTING -p tcp -m tcp --dport PORT -j DNAT ...
0
votes
0answers
31 views

IP TABLES port forwaring corrupts my packets?

Here's my scenario. I have a WORKING DAEMON receiving packets through a proprietary protocol (mounted on the port 5000) that has been working flawlessly for over a decade. I have a weird problem ...
2
votes
1answer
75 views

Iptables and conditional statements. Is it possible?

I tried a search but i was unsuccessful, in the case i'm sorry and i will appreciate the redirect. I had this problem in mind: a computer with mac address M is sending packets through an openwrt ...
3
votes
2answers
805 views

How to enable traceroute in linux machine

I'm working on something in the transport layer and after i ran our custom policies for securing the policies i'm not able to do traceroute from the linux machine. root@keystone-evm:~# iptables ...
-1
votes
1answer
55 views

Sometimes this script fails to update the iptables [closed]

It does not happen often, but sometimes after running the below script, checking the iptables with service iptables status shows that they weren't updated and the script doesn't output any error. The ...
0
votes
0answers
39 views

Conflicting ip routes with local table on attaching a virtual network interface

I have an EC2 instance with these ip rules: $ sudo ip rule show 0: from all lookup local 32766: from all lookup main 32767: from all lookup default I can attach an elastic network interface to ...
0
votes
2answers
39 views

Open Specific Linux Port

Im trying to open a Port(2012) on my VPS so i can access it over the internet. This is the output of sudo iptables -L produces Chain INPUT (policy ACCEPT) target prot opt source ...
0
votes
0answers
36 views

iptables: Packet not being matched by neither INPUT nor FORWARD

How can it be, that a packet that gets matched by a mangle PREROUTING does not get matched by neither filter INPUT nor filter FORWARD? From this diagram ...
1
vote
1answer
294 views

Linux iptables - reject tcp SYN with RST

I am doing an implementation on a linux machine to reject incoming telnet requests from wan side telnet port 8023. The functionality is achieved by using the below iptables rules. The first rule in ...
0
votes
1answer
184 views

iptable CLUSTERIP doesn't work

We have some requirements which explained here. We tried to satisfy them without any success as described. Here is the brief information: Here are requirements: High Availability Load Balancing ...
-5
votes
1answer
169 views

ports I open with iptables appear closed [closed]

I opened the following ports with iptables on Debian 7: iptables -X iptables -F iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT ACCEPT iptables -A INPUT -m state --state ...
0
votes
1answer
31 views

Iptables and counters

I'm trying to use iptables counters with munin to monitor traffic of hosts on my local subnet. For each host I set up a rule like this: iptables -I OUTPUT -d $ip This should count the packets going ...
0
votes
0answers
37 views

is iptables-save rule dump deterministic?

is the order of the parameters of iptables rule line deterministic in the iptables-save output? -A CHAIN1 -m mod1 -m mod2 -j CHAIN2 will be always the same, or I can expect it to be -A CHAIN1 -m mod2 ...
2
votes
1answer
129 views

What is the correct iptables rule when NATing multiple private subnets?

I have a Centos minimal 6.5 acting as a router. eth0 is connected to a Cisco switch trunk port, allowing VLANs 200-213. I have several VLAN interfaces just as this link suggests: ...
0
votes
1answer
143 views

BROUTING's target “redirect” in ebtables behaving in a strange way

Situation (host A)-------(bridge B)------(host C) where: A has MAC A on it's interface C has MAC C on it's interface B has MAC BA and MAC BC on it's two interfaces (depending on who it's facing) ...
0
votes
1answer
248 views

iptables and TPROXY support

I'm running iptables v1.4.21 on Ubuntu 14.04 and is trying to setup iptables to use TPROXY. How can I check whether my current build of iptables supports TPROXY? I can check TPROXY support for ...
1
vote
0answers
518 views

TPROXY Not working with HAProxy, Ubuntu 14.04

I'm trying to use HAProxy as a fully transparent proxy using TPROXY in Ubuntu 14.04. HAProxy will be setup on the first server with eth0 111.111.250.250 and eth1 10.111.128.134. The single balanced ...
0
votes
1answer
72 views

fail2ban block ports rules iptable

I just installed Ubuntu Server 14.04 and don't have much experience with IPtables. I am trying to get a basic setup going where I only accept SSH connections on port 22 and 2222. I actually have that ...
0
votes
1answer
236 views

Using 2 Transparent HAProxy for load balancing

We can configure HAProxy to be a transparent proxy by using the guide here, where one of the steps says ...to put the backend servers in a different subnet to the front end clients and make sure that ...
1
vote
0answers
57 views

Policy routing local user's traffic down a tunnel

I've got a Linux based Firewall/Router running iptables and SNAT for traffic passing through it to the Internet via a single uplink - This is working fine. There is also a small number of applications ...
1
vote
1answer
57 views

Need help translating rate limiting iptables rules to Puppet format

I use Puppet Iptables module to manage Iptables rules on my machine. I'd like to implement to rate limit failed SSH connections as described here: iptables -A INPUT -p tcp --dport 22 -m recent ...
0
votes
1answer
656 views

How can I reload IPTables without interrupting existing connections?

I will be adding and removing entries to the script below automatically (adding ports 80/443 with different IP addresses). If I run this script, I am "assuming" that connections will be uninterrupted, ...
0
votes
1answer
215 views

Ubuntu 14.04 UWF for iptables

Can I still use the init.d iptables stop? It seems that init.d is replaced by systemd. Is that correct? The iptables is part of the kernel right and not a service. On redhat based systems it is a ...
-1
votes
2answers
43 views

Allow connection only from 2 ips [closed]

I need to block all connection on port 30000. I alredy did that , with command like that iptables -I INPUT ! -s IP_HERE -p tcp --dport 30001 -j DROP but now i need 2 ips , how i could do that? ...
0
votes
0answers
72 views

rkhunter reports suspicious activity /bin/usr/wget and killall permissions changed

Sorry about the long post but please bear with me. I'm wondering if my system has been compromised. I've had issues in the past on this VM server with a Linux.BackDoor.Gates.5 Trojan that was DDoSing ...
2
votes
2answers
267 views

How to setup IPTables on KVM host - iptables-persistent is being ignored

I'm trying to setup some specific IPTables rules on an ubuntu 14.04.1 host that runs some KVM guests. The box has multiple NICs with multiple IP addresses and the guests use different addresses based ...
0
votes
0answers
45 views

Iptables and PREROUTING-Chain. Checking only the first (SYN-) packet of a connection?

Assume for simplicity that there is only this one rule described below. Is it possible that the PREROUTING Chain of ip-tables checks only the first packet of connection A and then allows all ...
4
votes
2answers
2k views

Iptables management with ansible in huge environment

What is the best way to manage iptables from one point and have the ability to edit something on local server. We need to add some rules centralized on all servers, but we have specific servers with ...
0
votes
1answer
71 views

iptables DROP statement causing issues

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -p tcp --dport ssh -j ACCEPT iptables -A INPUT -p tcp --dport 80 -j ACCEPT iptables -A INPUT -j DROP I have the ...
1
vote
1answer
74 views

Unknown arg `--hashlimit-upto'

I'm trying to prevent loic attackes by using this command iptables -A INPUT -p tcp --dport 80 -m hashlimit --hashlimit-upto 50/min \ --hashlimit-burst 500 --hashlimit-mode srcip --hashlimit-name http ...
-2
votes
1answer
48 views

Multiport negation in iptables

Consider I want to make a rule that if destination port of the incomming packet is any of the ports 80,120,130 for established or related states the system should drop it but other ports should be ...
-1
votes
1answer
14 views

How to redirect ip to address iptables

I would like to know if is there a way to redirect the internal ip to another ip, but the second ip is Dynamically so i need to put an address, is there a way? Example: iptables -t nat -I OUTPUT ...
-1
votes
1answer
40 views

command not foundbles-config error on service firewall restart

This is a follow-up question after I fixed my initial problems: I have a CENTOS Linux VPS. I have the following in my IPTABLES script to run when my VPN restarts, but I get errors when I do a service ...
1
vote
1answer
137 views

IPTABLES command that end with ACCEPT or DROP fail on service firewall restart

I have a CENTOS Linux VPS. I have the following in my IPTABLES script to run when my VPN restarts, but I get errors when I do a service firewall restart I've ran each of the commands below manually ...
1
vote
0answers
79 views

xtable geoip filter unable to load into memroy

Ok, I have a odd problem. I just got done doing the bas configuring of my server. Adding in fail2ban, postfix, apache, mysql, ect ect. I then went in and started to add the xtable addons. I ...
0
votes
0answers
75 views

puppetlabs/firewall nat policy issue

I'm using puppetlabs/firewall. I need to create following iptable rules: iptables -A PREROUTING -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 8443 My manifests is firewall { '001 default ...
0
votes
1answer
105 views

OpenVPN with no internet access

I am using OpenVPN and am able to connect, but with no internet access anymore. Here is my ip table: sshadmin@mdpi1:/etc/openvpn/easy-rsa/keys$ netstat -nr Kernel IP routing table Destination ...
3
votes
2answers
684 views

iptables -F locks me out of the server until reboot, why?

I'm trying to apply some iptables rules and iptables -F is supposed to remove the current rules (from my understanding), but instead it appears to freeze my SSH connection and not let me re-establish ...
-2
votes
1answer
39 views

Iptables “if not” condition?

I am trying to create a rule for iptables which logically does the following: IF [destination != 192.168.0.1] forward port 80 requests to port 3128 else carry on like this never ...
0
votes
1answer
32 views

will renaming iptables mean I have no firewall after a reboot?

I'm having some issues accessing my VPS due to a combination of things. Serial console via my VPS control panel isn't accepting input either so my VPS host has offered to mount my file system on the ...
0
votes
1answer
34 views

Drop packets after NAT in iptables

I'm trying to rate limit traffic to a certain client behind the NAT (using hashlimit combined with DROP target) using iptables rule but due to my rudimentary knowledge of this area, I'm not sure which ...
-1
votes
1answer
42 views

Why does this IPTables command create 4 entries?

When I executed this IPTables command: iptables -A INPUT -p tcp -m tcp --dport 9080 -s localhost -d localhost -j ACCEPT iptables -L shows: ACCEPT tcp -- localhost localhost ...
0
votes
0answers
106 views

nginx images, css not loading from outside LAN

On my LAN, all the websites hosted on the nginx machine load fine. When outside of the LAN, they usually don't load at all, and if they do it takes several clicks of the refresh button and several ...
0
votes
0answers
82 views

Site to Site VPN - Openswan and CISCO A2A

Below is the diagram that the VPN connection between Openswan server and CISCO A2A. http://i.stack.imgur.com/yQBSw.jpg client A and B are remote hosts with static ips. client X and Y are behind the ...
0
votes
1answer
486 views

lots of UDP_IN Blocked errors

Since I have reinstalled my OS, I'm getting lots of UDP_IN Blocked errors in my messages log. Can anyone kindly explain what the error say exactly and what I can do to get rid of this error. Aug 8 ...
0
votes
2answers
101 views

How to block a VM from accessing other machines on network - XenServer

This might be a little far fetched and might not be possible. I have a virtual machine that will have files on that I don't want people to be able to transfer off - they are allowed access, I just ...