Questions tagged [iptables]

iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

Filter by
Sorted by
Tagged with
2 votes
4 answers
17k views

CentOS not allowing remote MySQL connections

When assigning a user from a remote IP to connect to a database it is saying that it's failing to connect. It is also failing to connect with root so something is wrong. Bind IP is off and I have also ...
0 votes
0 answers
77 views

iptables improvement: log DROPped connections to unknown ports/destinations for banning with fail2ban

I'm testing the following iptables rules (ipv4) with support for logging of dropped packets. I log the drops to /var/log/iptables.log and then ban retrying/hammering IPs with fail2ban. I'm no expert ...
1 vote
1 answer
779 views

limit multicast to wanted outout interfaces using iptables (or other lartc commands)

I have the unifi server running for all my access points on a network. The controller host sits on a few networks, but only one of them should be used by unifi. Of course, the server has no options ...
1 vote
3 answers
2k views

Configuring Iptables On CentOS 6 Locks Me Out

I'm running the following bash script as root to configure iptables (I'm logged in via SSH): #!/bin/bash # Delete all existing rules iptables --flush # Set default chain policies iptables -P INPUT ...
-1 votes
2 answers
95 views

Is there a way to block ALL inbound/outbound traffic going outside of a LAN with iptables?

As the title says, I'm just looking for a way to disallow any traffic on ANY port unless it's going to a local IP address (192.168.1.*).
2 votes
1 answer
331 views

What is the state of subsequent http requests in iptables terms?

When a user requests a web page, e.g. www.example.com/about-us/history.html. The server will send them an HTML file, the HTML file will contain elements that subsequently generate many more HTTP ...
0 votes
2 answers
8k views

Load balancing IPTABLES POSTROUTING rules

I have an interface with 5 IP addresses assigned to it (as virtual adapters) let's call them x1,x2,x3,x4 and x5. Currently I have SNAT POSTROUTING forwarding rules from local source range to specific ...
0 votes
1 answer
2k views

Iptables block layer 7 DDoS attacks

Recently I've been experiencing lots of layer 7 ddos attacks to my website. Specifically an HTTP GET request flood on the index page. (~20k r/s), my server is at OVH, so it's not overloading the pipe, ...
0 votes
1 answer
2k views

How to allow google-analytics via iptables when internet is blocked for other traffic [duplicate]

I am running the following script on a wifi gateway. The WAN side of the gateway has ppp0 interface while LAN side is on wlan0. No LAN user should be allowed to browser internet Some services on ...
1 vote
1 answer
3k views

iptables forward ip to another ip

I've configured multiple IP Addresses on my Ubuntu ssh server. Now the server can be accessed by using any IP Address, from 192.168.0.51 to 192.168.0.99. Depending on which IP Address someone uses to ...
1 vote
2 answers
452 views

In iptables, does state ESTABLISHED require a later state NEW to make an ESTABLISHED connection?

When using the following rule: iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT ...do you need to add specific rules including the NEW states to allow for an ESTABLISHED connection? ...
0 votes
1 answer
213 views

Cannot understand this example fail2ban rule

I'm trying to secure my admin and user login page from brute force attacks. I have setup iptables and the closest thing I can find which looks useful is this: jail file: [nginx-login] enabled = true ...
0 votes
1 answer
1k views

Iptables drop all connection except my domain(s)

I tried use this command to block a domain iptables -I INPUT -p tcp -m string --string "Host: domain.com" --algo bm -j REJECT and it worked but, i want to Reject all but accept from specified ...
0 votes
1 answer
753 views

ip6tables snat don't work properly [closed]

I got three computers with these names: laptop, vds and home; vds is openvpn server; home is openvpn client. and, I got an ipv6 network 2a01:dead:beef::/64 vds has address 2a01:dead:beef::311 on ...
0 votes
0 answers
1k views

iptables DNAT packets into an openswan IPSEC tunnel

I have the following network setup: +-----------------------------------+ | | +-------...
1 vote
3 answers
6k views

By passing squid for few hosts using iptables

We have a squid proxy setup which listens on default port(3128): on eht0 (192.x.x.x). It has another interface eth1 (10.x.x.x) used to connect to external world. It is doing good quality content ...
1 vote
0 answers
494 views

Trying to create a NAT with virtual Ethernet using IPTables

I have a separate namespace running on my server and I want to create a NAT that will enable Internet connectivity in this namespace. I specifically want to do this so that certain inbound ports are ...
5 votes
2 answers
6k views

What is this in my syslog and should I be concerned?

I'm seeing a lot of the following line in /var/log/syslog: Jun 21 14:36:15 my-server kernel: [416219.080061] iptables denied: IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:the-mac-address:08:00 SRC=0.0.0.0 DST=...
0 votes
1 answer
2k views

How to block every port except specific ones to a user with iptables? [closed]

I'd like to block every port except 80, 443, 1005 to a specific user (owner) with iptables. What command should I use?
0 votes
2 answers
15k views

Can not open port 3306 on Ubuntu using iptables

I am trying to open port 3306 (for remote mysql connections) on my ubuntu 12.04 server machine but for the life of me can't get the damned thing to work! Here is what I did: 1) list current firewall ...
0 votes
0 answers
287 views

CentOS 6.6 ignores iptables nat rules

I try to use iptables nat to forward incoming TCP traffic to another computer. I use following rules within nat table: -A PREROUTING -i eth3 -p tcp -m tcp --dport 8888 -j DNAT --to-destination 192....
2 votes
1 answer
971 views

ipt_CLUSTERIP: unknown protocol 1

I am trying to create a web cluster with two load balancers and a single public ip address The command I use is the following: iptables -I INPUT -d $CLUSTERIP -i $WAN_IF -j CLUSTERIP --new --...
0 votes
1 answer
655 views

How to disable network access for a user on Linux?

Trying to disable the network access for the user: [root@notebook ~]# iptables -I OUTPUT -m owner --uid-owner tempuser -j DROP [root@notebook ~]# ip6tables -I OUTPUT -m owner --uid-owner tempuser -j ...
0 votes
3 answers
5k views

"Bad argument 'NEW'" when configuring iptables

I am getting the following error when configuring iptables on a Debian 7.6 server to log new TCP connections: Bad argument `NEW' Error occurred at line: ## The line throwing the error is formatted ...
0 votes
1 answer
209 views

iptables-save return with errno 1 - operation not permited

When I run the command iptables-save it returns with errno 1 - opearation not permitted If I do: iptables -L and then: iptables-save then iptables-save succeeds This error happens only once. ...
2 votes
0 answers
3k views

Squid intercept proxy stuck with forwarding loop

I'm trying to set up a debugging proxy using Squid, mainly to test our own client communications library for various proxy types (one possibility with our client, is to connect to an external ...
0 votes
0 answers
77 views

Port forwarding to VPN

| |WAN /-------\ .------------------------------------------| switch| | ...
1 vote
2 answers
5k views

should iptables be this long? many chains?

Ok, this is a brand new install of CentOs 7 (minimal). This is the iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT)...
3 votes
1 answer
79 views

Need advices on iptables

Helly guys ! :-) . I need a (several?) advice(s) from you about my iptables setup. I'm pretty new to iptables, and this is the first time I configure a server with iptables ONLY as a firewall (we don'...
4 votes
1 answer
8k views

Why some iptables DNAT rules don't work until reboot?

My iptables DNAT rules don't work until reboot. If I reboot my server, all of the rules work. Desciption of the architecture : Tens of hosts (senders) send some UDP packets (one-way on a specific ...
-1 votes
1 answer
273 views

What is the recommended method for securing a Crate.io installation

I have installed an instance of Crate.io via docker on a CentOS 6.6 machine. By default Crate.io runs on port 4200 and is open to the world. I would like to secure this, so only the localhost can ...
1 vote
0 answers
22 views

Troubles with subnets and redirections

What I want to create is 2 subnets that communicate each other through a gateway. Here is my gateway: wlan0 Link encap:Ethernet IndirizzoHW c4:46:19:69:b7:a5 indirizzo inet:192.168....
0 votes
1 answer
102 views

ssh port is different from what is connected

Ok, so here's the deal. I setup an Iptables rule as follows: IPTABLES -A INPUT -p tcp --dport 51722 -j ACCEPT and if I do systemctl status sshd.service, I get the following: Server listening on 0....
1 vote
2 answers
2k views

TCP traffic on port 1433 blocked by NAT rules

We have a SQL server that is hosted on AWS, the SQL server it not directly accessible on the internet, it relies on a NAT box to route traffic to it. We are trying to set up a Linked SQL server from ...
5 votes
2 answers
2k views

TomatoUSB multiple IPs not forwarding

I am trying to use this Guide to enable multiple IPs on TomatoUSB. Our Firewall rules need to NAT and allow a 1to1 to two servers. /usr/sbin/ip addr add 208.x.x.133/30 dev vlan1 /usr/sbin/ip addr ...
0 votes
1 answer
225 views

PSAD IPTables logging error

I installed PSAD on my Ubuntu server and then set the IPTables accordingly. But I still get this error by email: You may just need to add a default logging rule to the /sbin/iptables 'filter' '...
-4 votes
2 answers
20k views

iptables: open port 25 CentOS 7 [closed]

I have problems opening port 25 for sendmail on my CentOS 7 machine. Here's my iptables configuration: *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A INPUT -m state --...
5 votes
2 answers
217 views

Default policy for OUTPUT

Are there any security risks of having policy for OUTPUT set to ACCEPT? Machine in question is VPS hosting few websites, git repositories, jabber server and mail.
0 votes
1 answer
947 views

Nodejs remote debugging ports closed

I have a problem with nodejs remote debugging. I'm using centos on remote server and phpstorm on my PC. When I open putty: I type in command: node --debug-brk=5858 main_server.js, and the output is: ...
2 votes
0 answers
254 views

iptables keeps using old nat rules

I use iptables snat on my gateway to change local source ip addresses to external. The trouble is that after I change the rules (or even if I flush iptables nat table) gateway keeps using the old rule ...
1 vote
1 answer
2k views

How to duplicate multicast packets on several interfaces?

I would like to send a stream from a Linux server to several Linux clients via a multicast address. The clients are directly connected to the server but on different interfaces: bnep0 and bnep1. ...
0 votes
1 answer
450 views

iptables: when to use input or output with LAN connections?

In a SSH server/firewall (192.168.2.3) that has a LAN behind it, say 192.168.2.1/30, will the connection attempts made by the internal machines of the 192.168.2.1/30 network be interpreted by the ...
-3 votes
1 answer
4k views

iptables rules for blocking specific packets [closed]

Im using the following iptables rule: iptables -A INPUT -p tcp -m tcp --tcp-flags PSH,ACK PSH,ACK -m length --length 52 -m state --state ESTABLISHED -j DROP It does it's job for blocking the ...
0 votes
1 answer
419 views

How do I get boto to work with port 443 being prerouted to another port?

My title may be poorly worded, but I'll try to get the backstory straight: I have Ubuntu instances with clusters of Docker containers all hosting web servers In order to appease firewalls we want to ...
4 votes
1 answer
2k views

Filter mirrored port traffic using iptables

I receive traffic from a mirrored port and I would like to send it into an NFQUEUE for processing. Because of the mirrored port, the packets destination MAC addresses are not my host MAC address. ...
5 votes
2 answers
28k views

unexpected RCODE REFUSED - eating up log files

I have a website which I host myself, and I use bind9 as my DNS server (host my own nameservers etc.). I am having a problem with traffic bandwidth, and my syslog is full of the following type of ...
0 votes
0 answers
113 views

Given: iptables entry in place; my.cnf properly set up; MySQL user & permissions properly set - but still cannot access MySQL remotely: Suggestions?

I would like to access MySQL remotely on an Amazon EC2 CentOS instance (I assume it is CentOS because I use yum to update installed applications and libraries). I believe that iptables is set ...
-2 votes
1 answer
64 views

How can I apply a firewall rule to a specific local IP? [closed]

I host gameservers and as a result have a few IPs. On the main server IP I have the game panel, other IPs are reserved for use by the gameservers I host for my customers. As a result I would like ...
1 vote
3 answers
996 views

Server Firewall preventing sending of email [closed]

The firewall on my VPS appears to be preventing my site from sending email. It was working fine until the end of last month. My hosting provider (Webfusion) has been next to useless. I am able to ...
0 votes
1 answer
175 views

IPTables from public ip and port to lan ip

I own 3 public IPs for my server and I have multiple VMs that have their own 'job'. The server has 1 NIC. Public IPs: XX.XX.9.247 (MAIN) XX.XX.21.141 (additional) XX.XX.21.142 (additional) LAN IPs: ...

1
80 81
82
83 84
134