Questions tagged [iptables]
iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n
6,672
questions
2
votes
0
answers
282
views
Policy-based routing on OpenVPN server
I'm trying to set up an OpenVPN server as reverse proxy for mobile/desktop devices, that can relay traffic based on certain policies:
only requests to white-listed IP addresses are going to be ...
- 21
0
votes
0
answers
996
views
iptables requires POSTROUTING for port forwarding
I have a very basic router/firewall running Ubuntu. I want to forward tcp connections on a specific port (443) to one of the machines in the local network. It has one interface to the outside world (...
- 101
-1
votes
1
answer
410
views
ip tables, block all traffic to a specific ip, unless it comes from a specific ip
Here's the situation. I have multiple Apache vhosts listening on port 443 on different IPs, on the same network interface.
I would like to only allow a certain IP to access one of those vhosts.
In ...
- 279
3
votes
3
answers
7k
views
Unable to connect to Ubuntu on port 3306 (MySQL) on Rackspace instance
I'm trying to connect to port 3306 on an Ubuntu box and am unable to do so. When I do iptables -L -n | grep 3306 I see this:
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:3306
...
- 337
3
votes
1
answer
947
views
How to configure collecd aggregate plugin to aggregate output from IPTable::Plugin?
I have enabled the CollectD:IPTables plugin to track traffic to two different server groups:
LoadPlugin iptables
<Plugin iptables>
Chain "filter" "TRACK_TRAFFIC_SERVER_A" "...
- 327
1
vote
1
answer
8k
views
Create subzones in firewallD
In firewalld, I can assign a zone to an network interface. A zone contains some firewall rules.
Now I have a network interface with different levels of trust (172.16.1.1/32 should have special ...
-1
votes
2
answers
4k
views
Iptables NAT (PAT) A to B to C and back
I want to access via SSH a DB server from an outside network via a linux (CentOS) gateway with two interfaces in separate networks as it follow below:
Admin PC IP: 10.21.1.8
Linux GW IP eth1 ...
- 1
-3
votes
1
answer
3k
views
Difference between iptables rules and firewall rules?
I am renting a vps and the company I rent from has firewall settings where I am allowed 20 rules. Then I have the iptables on my server. I have just setup some rules on the iptables that I found from ...
1
vote
1
answer
1k
views
Why is iptables not blocking any ports?
I have iptables running and the most recent rules applied (i.e. I restarted the service and it says everything is "OK").
I have only used system-config-firewall to edit/define any rules, so I ...
- 419
-4
votes
2
answers
416
views
Where do the Chinese, Russian and etc. random attackers find their targets?
I recently started running a personal site on a dedicated server that i've had for some time, but have never actually used. I have never checked it's logs, but now when i do, auth.log is full with ...
- 155
1
vote
0
answers
171
views
Route 172.0.0.0 and 10.0.0.0 traffic through two NAT boxes
I have set up two NAT boxes in two separate AWS accounts and given the necessary security group permissions to allow both instances to talk to each other.
In account A I have a service that needs to ...
- 11
4
votes
1
answer
3k
views
Windows 10 strange OpenVPN behavior
I have an OpenVPN server running (93.xxx.xxx.xxx is the public IP) to which different android and windows clients can connect and have access to the internet, but
an OpenVPN client on my Windows 10 PC ...
- 41
9
votes
2
answers
1k
views
iptables is converting the IP into a domain
I'd like to block an entire set of IPs on the server:
iptables -A INPUT -s 77.0.0.0/8 -j DROP
Though when I run
iptables -L
on that record I get a strange domain instead of the IP
DROP tcp ...
-1
votes
2
answers
162
views
Can't open new port in iptables
Today I'm facing a strange problem.
Some days ago I configured Iptables. I opened port 80,1000 and some others port.
Today I need to open port 25 for mail system. I have added the rule in ...
- 9
5
votes
1
answer
6k
views
Whitelisting outgoing traffic from docker containers
I have a server running multiple docker containers in the following configuration:
One of the containers is a reverse proxy binding to the exposed ports of the other containers. This is the only ...
- 161
0
votes
1
answer
617
views
Iptables configuration in CentOS for GCM commands
I am planning to enable iptables for my CentOS VM. Have configured the below rules. But for GCM (Google Cloud Messaging) commands it fails to receive reply from GCM server. If i disable iptables it ...
google-cloud-platform
1
vote
1
answer
255
views
Best practice for managing a whitelist of ips across multiple servers with iptables?
I was wondering what the best practice for managing a whitelist of ip address across multiple servers? We want to allow our user base to add an ip address they want to whitelist through a web ...
- 11
4
votes
2
answers
9k
views
iproute rt_table and mark not working on linux
I have this configuration which comes from official and unofficial guides and questions readings here and a lot of failed tests.
CentOS 7 and Ubuntu server 15 (LAMP and only eth0).
/etc/iproute2/...
- 151
-4
votes
3
answers
4k
views
If no service is listening on a port can a system still be accessed using that port? [closed]
If I have a linux server with a FW rule (iptables) to allow inbound to a particular port does a service have to be running and listening to accept that connection or is there another way to access the ...
- 649
3
votes
1
answer
5k
views
Iptables max number of ports you can specify with --dport that is not continous?
How many ports can be specified in a single rule using the --dport argument?. Ex -
iptables -A INPUT -p tcp --dport {0,5,10,15,20,25, etc,,??} -j ACCEPT
- 649
1
vote
2
answers
169
views
IPV4 linux networking configuration
I am having problems figuring out what I configured wrong. I can't get packets back from the velodyne onto a Fedora server with 2 eth interfaces em1 and em2. I have velodyne connected to em1 host to ...
- 111
0
votes
1
answer
248
views
Ways to reduce packets per second (Bundle VPN Packets?) [closed]
I have an ISP that blocks me when I do more than 10 pps on any port. Only exception: ports 80 and 443 where I am allowed 100 pps.
To avoid being blocked I can use a VPN on port 80 or 443 which then ...
- 111
1
vote
0
answers
30
views
Anomalous iptables entry with fail2ban (is it misconfigured to block outward traffic?)
Overall we are very satisfied with fail2ban as it has accumulated several dozen neverdowell IP addresses in our iptables rules.
However I notice the following rule has also appeared:
Chain fail2ban-...
- 492
1
vote
1
answer
963
views
iptables route PPTP VPN through polipo http proxy
I want to route http traffic of my local pptp server to use Polipo http_proxy.
So i found this QA : IPTABLES: routing VPN users through transparent Squid
but i test on my system & change iptables ...
- 63
-3
votes
1
answer
475
views
Restrict a range of ports to one IP except one
Is there a way I can allow a range of ports to only be used by one IP address but one? Thanks.
Precisely, I want to restrict range 6011-6099 excluding 6012. The rule to restrict the range 6011-6099 ...
- 13
2
votes
1
answer
82
views
Problems Configuring IPTABLE for Samba Share
I am trying to configure Samba on my CentOS 6 server such that only 3 IP addresses have access to the Samba Share. For some reason my iptable configuration is wrong. I have checked lines 11-15 and ...
- 209
-1
votes
1
answer
1k
views
Centos iptables: No chain/target/match by that name [duplicate]
I had a CentOS6.7 with OpenVZ. Now, I just uninstalled OpenVZ and start using Plain CentOS6.7. Due to some difficulties for using cPanel in OpenVZ.
I noticed one problem when install csf in my plain ...
- 281
0
votes
1
answer
156
views
SNAT& iptables in Centos
i have a remote server where I have added a new FAILOVER IP in a new interface, ETH0:0. Everything works perfectly; IP is setup. I want the traffic that is coming from ETH0:0 to use the ETH0:0 as the ...
- 1
0
votes
0
answers
49
views
Linux forwarding packets to remote destinations (not localy)
Network case:
Source--Routers ... eth0=LINUX=eth1 ---- some routers.. -- Destination
2.2.2.2 10.0.0.1 192.168.0.1 1.1.1.1
and 1.1.1.0/24 via 192.168.0....
1
vote
1
answer
5k
views
iptables error with No such file or directory
I have CentOS 6 x86_64 vps server. I just created the following iptables. But it gives an error message. What am I doing wrong here?
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ...
- 333
1
vote
1
answer
284
views
nat and xen, nat only to external ip
I've setup xen that way that all my vm's have a public ip and a private ip (192.168.0.x).
However, those vms which don't have a puplic ip should also get internet access so I did setup nat.
iptables ...
- 205
0
votes
1
answer
365
views
FTP EPSV command and iptables
Troubleshooting an issue with an FTP connection going through an iptables firewall and seeing some strange issues with passive mode.
We are trying to connect to an FTP server and get the directory ...
- 951
0
votes
2
answers
1k
views
How can I use NAT or haproxy to reroute a certain host name?
I have an infrastructure where all requests made by internal subnets have to pass through a server in the "open to the world" subnet, where my NAT instance is (I'm using AWS).
I want to create a host ...
- 3
-2
votes
1
answer
145
views
Redirect all websites to a single webpage using iptables
I have a router which runs busybox, it has iptables so i wanted to redirect all webpages clients request to a single webpage. I cant use hosts file because the /etc folder is mounted as read-only. Is ...
1
vote
0
answers
325
views
Drop first packet for every IP with iptables
My servers are getting UDP-flooded with spoofed source IP addresses. They flood with real user packets so I cannot rate limit or block these packets.
Is there a way to drop the first packet received ...
6
votes
2
answers
2k
views
iptables is occasionally logging MAC addresses. Why?
I have logging enabled on specific iptables packet drops. The rules I'm using are IP/port related only and this is what I can easily see in the logs, however occasionally I do get MAC address ...
- 105
1
vote
1
answer
4k
views
iptables - Filter by MAC on FORWARD chain
I need to setup a firewall between a server, and the clients on the intranet that filters access by MAC on the FORWARD chain.
The server has one NIC (on subnet 10.0.0.0/29), the firewall two NICs (...
- 11
-1
votes
1
answer
971
views
Redirecting all outgoing HTTP traffic from one computer to another on a DD-WRT router
I am trying to debug some HTTP traffic from one computer (let's call it A) on my network. I would like to redirect all of that traffic to another computer (let's call it B) without changing any ...
- 101
2
votes
1
answer
5k
views
Where are iptables rules stored on Digital Ocean Ubuntu 14.04
I have a basic standard Ubuntu 14.04 droplet on digital ocean. I used ufw to set some firewall rules but forgot to open port 22 for SSH. I rebooted my server and could no longer log in so DO support ...
- 149
3
votes
1
answer
977
views
multiple tuntap VPN traffic selection
I have a php / bash application on top of a linux machine (centos or debian but assume redhat just in case the reply need different dialect) connecting to port 80.
Actually I'm perfectly able to open ...
- 151
0
votes
1
answer
938
views
Why do I have an "any any" rule in iptables at the top and one at the bottom?
Hoping someone can clear this up for me. I'm on RHEL7.1 and I noticed that in iptables I have a rule that allows anything incoming. I ran this command to get the line numbers and interfaces just to ...
- 649
1
vote
1
answer
942
views
Executing php as sudo inside crontab [duplicate]
I've wrote a PHP-Script, and the execution requires sudo permission, because it executes some other system related stuff. So i've added this into the crontab -e but i can't see, that my script is ...
- 125
3
votes
1
answer
3k
views
IP based Whitelist for one Port on Ubuntu Server
Currently i'm trying to create a Whitelist IP based for one special Port. The application behind is just a simple TeamSpeak3 Server.
The IP Whitelist get the Visitor-IP by a HTTP Script. So the IP is ...
- 125
1
vote
1
answer
5k
views
Cannot connect to the MySQL remote server. Debian 8
I have issue that I cannot reach the 3306 port (mysql) even if I set it in iptables.
How can I resolve this issue?
root@vps191532:# iptables-save
# Generated by iptables-save v1.4.21 on Thu Oct 22 20:...
- 13
1
vote
1
answer
57
views
Why doesn't iptables drop 10. addresses?
I'm seeing brute force web login attempts from 10.19.0.222
My iptables contains:
DROP all -- anywhere anywhere match-set manual src
ipset test manual 10.19.0.222 confirms the address is in the set,...
- 233
1
vote
1
answer
409
views
What are the differences between Fail2Ban and BFD (Brute Force Detection)
I have used both Fail2Ban and BFD, typically I go with Fail2Ban on servers running IPTables, and BFD when servers are running APF.
Are there any major differences between these 2 services? What are ...
- 8,006
4
votes
2
answers
4k
views
fail2ban.action ERROR iptables -w -N f2b-<jail-name>
I've been using fail2ban for a while without any issues.
The other day, I decided to stop fail2ban to remove one rule from my default iptables. When I started fail2ban, it started ok (according to ...
- 231
0
votes
1
answer
344
views
How can I open a port on just one server IP?
I am setting up a dedicated server for gameserver hosting, which will also host a couple of other server applications (such as a web server).
The dedicated server has a total of four IP addresses, let'...
- 53
0
votes
1
answer
250
views
NAT in Amazon AWS
I am trying to configure NAT in Amazon AWS.
So I have two EC2 with private IPs: 10.0.0.49 and 10.0.0.48. (10.0.0.0/24 network)
Nodes in one VPC. I can ping 10.0.0.49 from 10.0.0.48.
Elastic IP 52.88....
- 321
0
votes
0
answers
317
views
Xen bridge - block traffic from port range - iptables / ebtables
I use Xen with bridge interface :
- eth0
- viifbr0
- Name of VM interface : vifv10XX.0
Do you know if it is possible to block output traffic from source port range for a domU please ?
If yes, can ...
- 1