iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

1
vote
1answer
1k views

/etc/init.d/iptables-persistent start returns fail but seems to work

I am trying to activate iptables-persistent on an Ubunutu server. Config files are located in /etc/iptables/rules.v4 /etc/iptables/rules.v6 I have installed the iptables-persistent package. ...
1
vote
1answer
41 views
+50

Route IP Traffic Based on Process to Different Default Routes / Interfaces

I'm trying to determine if it is possible to selectively route IP packets from a process or process group through a specific interface while all other packets are routed through another interface. ...
2
votes
0answers
19 views

How to split traffic through two different network adapters based on TCP port in OS X

I have a scenario where we will be using a Mac to stream video content to an RTMP server. This RMTP service provides 2 ingest URLs so that you can upload the same video content twice and have ...
-1
votes
1answer
13 views

How do I forward all traffic from eth0 on lan segment x.x.x.x to eth1 on a different lan segment, y.y.y.y?

On a RHEL 6 / CentOS 6 server with two NICs, how do I forward all traffic from eth0 on lan segment x.x.x.x to eth1 on a different lan segment, y.y.y.y? Example 1: (eth0) 192.168.1.1:443 -> (eth1) ...
0
votes
1answer
12k views

I can connect, but cannot ping/route to remote VPN computers

Setup: L2TP VPN Server on a Windows Server 2008 machine which is behind a router, which is behind a modem/router. Modem/Router (IP: 192.168.2.1, Subnet: 255.255.255.0, DHCP serves 192.168.2.2 to ...
1
vote
1answer
945 views

Is there any way to filter packets (eg. by iptables) after routing is complete?

I want to drop certain packet destined to an ip_address AFTER it has reached the POSTROUTING chain. However, for iptables, the "nat" table cannot be used for filtering so the following doesn't work: ...
0
votes
2answers
46 views

iptables: trying to block port 53 but not working

I'm messing around with IP tables and I'm trying to do the following: I have several hosts on the same network: 192.168.1.0/24. The DNS server is 192.168.1.1. I'm trying to prevent all the hosts ...
-3
votes
1answer
25 views

Postfix behind a firewall

I have two servers : the first one, a frontend / firewall (using iptables) the second one, containing Postfix I want to use the IP address of the firewall server to send emails. If I send an email ...
0
votes
0answers
19 views

Trouble figuring out a fail2ban log error message: “iptables -n -L INPUT | grep -q 'fail2ban-SSH[ \t]' returned 100”

Here is my jail.local rule for ssh: [ssh-iptables] enabled = true filter = sshd action = iptables[name=SSH, port=ssh, protocol=tcp] logpath = /var/log/messages maxretry = 5 Here is what my ...
0
votes
2answers
51 views

SSH works but tunneling or SFTP doesn't. Why?

since 2014 I've got a server from SoYouStart, with Centos 7. It worked perfectly, but now I had to install again the OS. Now I'm configuring all the services to work again. I need to connect to the ...
1
vote
1answer
913 views

Transparent proxy which preserves client mac address

I have a customer that wants to intercept SSL traffic as it leaves their network. My proposed solution is to setup a proxy that is transparent and both layer 2 and layer 3 so it can simply be dropped ...
2
votes
4answers
17k views

Need to open port 10000 for webmin and 21 for FTP in Centos?

How can I open these two ports in CentOS? I have used Ubuntu before, but I never had to manually open any port. When I enter iptables -L, I get output like this: Chain INPUT (policy ACCEPT) target ...
0
votes
1answer
9 views

Iptables redirect HTTP traffic to proxy

I have a local HTTP proxy running, if I configure my browser to go through it works perfectly but I would need to leave the browser configuration blank and only redirect the traffic to the proxy with ...
1
vote
2answers
33 views

ftp server in passive mode at private subnetwork

I have following configuration: FTP client (public_IP1) => internet => Firewall(Public_IP2) => FTP server (10.10.12.171) I have following iptables rules at Firewall: DNAT tcp -- 0.0.0.0/0 ...
3
votes
1answer
48 views

Firewall: allow all traffic from sources authenticated via. an open ssh connection

I'm looking for a way to avoid the editing of the firewall rules all the time on test and dev servers. I don't want to open up all ports. So I thought maybe there is a way to allow all traffic from ...
0
votes
1answer
2k views

Iptable l7-filter installation guide and block p2p

I would install l7-filter to block P2P torrent, First of all , I have a linux debian. I installed by the below command apt-get install l7-filter-userspace And then run command iptables -I FORWARD ...
2
votes
2answers
2k views

mod_evasive DOSSystemCommand not working

I'm trying to get mod_evasive to fire off a script to add an iptables rule to deny the offending host. I've tried the suggestions from both answers here but I still can't get it working. Apart from ...
5
votes
4answers
3k views

Openvpn, forward packets very slowly

I rebooted my server, and an odd issue just came out. I am running on ArchLinux, the clients are Ubuntu, Android and Mac. The problem is that accessing the internet via the clients is slow, about ...
-1
votes
1answer
25 views

Iptables DNAT working in my own network, but not through VPN

For some reasons I need to switch a server ip to another ip, in order to be seen by another computer elsewhere through vpn. So I'm using iptables (didn't know any of that until yesterday) and testing ...
0
votes
2answers
1k views

How to delete all ufw rules for a certain port?

I am using ansible to configure ufw on my DB servers to only let accept connections from certain servers connection to a specific port (lets say 1234). When a server that used to have access is taken ...
1
vote
1answer
430 views

Iptables: how to easily group rules in chain?

I have some netfilter rules like this: iptables -I INPUT -j NFQUEUE -p udp --dport 4444 iptables -t mangle -I INPUT -j MARK --set-mark 100 -p udp --dport 4444 iptables -I OUTPUT -j NFQUEUE -p udp ...
4
votes
4answers
1k views

Automatically ban IP address if it accesses a certain URL

I'm getting bored by all those muieblackcat's and similar scripts ran on web sites. Can I block an IP address (for example with iptables) automatically, like for a hour or so, as soon as it accesses ...
6
votes
3answers
2k views

Limiting interface bandwidth with tc under Linux

I have a linux router which has a 10GBe interface on the outside and bonded Gigabit ethernet interfaces on the inside. We have currently budget for 2GBit/s. If we exceed that rate by more than 5% ...
0
votes
1answer
10 views

what version of iptables implemented -j CT?

I'm setting a firewall config for different distros/versions and I need to setup NOTRACK for DNS traffic. On CentOS 7 (iptables v.1.4.21), I need to write like this: -A PREROUTING -p udp -m udp ...
1
vote
0answers
24 views

Investigating connectivity issue

I'm trying to set a up a new service on a server that is running apache, however it seems like incoming traffic on that specific port is blocked, although I do not understand why. On the first server, ...
0
votes
1answer
39 views

Cannot open port 1337

I am struggling with iptables firewall to open port 1337 externally. My iptables file looks like this: *nat :PREROUTING ACCEPT [0:0] :INPUT ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] ...
2
votes
1answer
15 views

Restore rules from output of `iptables -S`

I have a bunch of rules dumped with iptables -S: -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A INPUT -p ...
1
vote
2answers
777 views

Allow curlftpfs though iptables firewall, how?

I'v allowed FTP ports 21 and 20 which then allows me to connect to my FTP server via "ftp" command, but I still can't get curlftpfs to work. What ports does curlftpfs all use? Or is their something ...
2
votes
3answers
1k views

NAT with iptables to Xen DomU

I am trying to forward packets arriving on the host machine to a virtual machine. Current aim is to forward xxx.xxx.xxx.xxx:3022 to the vm 192.168.10.2:22. I tried adding the following rules through ...
1
vote
3answers
204 views

Redirect incoming packets to loopback

I'm trying to use iptables to redirect an incoming packet on eth0 to a service listening on the loopback interface. Based on this link I'm attempting to craft the following rule: iptables -t nat -A ...
0
votes
0answers
17 views

PHP FTP Pasv mode on CentOS 7

I need help with connecting to a FTP server and using the passive mode. They told me I need to open ports 20, 21 and 5000-5100 range. I've got a virtual machine running CentOS 7 on a dedicated server ...
0
votes
0answers
4 views

Connection interruptions on Debian router, possibly due to excessive duplicate ACKs? [migrated]

I have a Debian server as a house router, which for a year has been working flawlessly. However, I recently moved and switched service providers from FiOS to Comcast, and possibly as a result am ...
-1
votes
0answers
6 views

How do I set up my iptables to allow web traffic to my Spring Boot application?

I am trying to host my Spring Boot application on Arvixe's VPS Lite. No CPanel, just command line. When I spin up my Spring Boot app and navigate to the server's IP address, I see the ...
0
votes
3answers
2k views

Forward traffic to local LAN IP while keeping the originator IP

I am trying to forward traffic from one server to another, while keeping the origin requestor IP. Therefor I cannot use SNAT or MASQUERADE. SERVER A: Public IP: 111.111.111.111 Private IP: 10.0.0.1 ...
0
votes
1answer
1k views

Gre Tunnel Cisco Linux traffic forwarding

I setup a gre tunnel a cisco router and a Linux machine, the tunnel interface in the Linux box named pic. Well i have to forward traffic coming from cisco through the Linux box. the rules i've set in ...
2
votes
5answers
3k views

How to configure traffic from a specific IP hardcoded to an IP to forward to another IP:PORT using iptables?

Unfortunately we have a client who has hardcoded a device to point at a specific IP and port. We'd like to redirect traffic from their IP to our load balancer which will send the HTTP POSTs to a pool ...
0
votes
2answers
132 views

How to configure port-forwarding to enable internal service accessed by another machine?

I have an existing service which is listening on 127.0.0.1:2009, and I want to access that service from another machine, so I tried to configure port-forwarding to do it: sudo /sbin/iptables -t nat ...
1
vote
3answers
2k views

DNAT to 127.0.0.1 with iptables / Destination access control for transparent SOCKS proxy

I have a server running on my local network that acts as a router for the computers in my network. I want to achieve now that outgoing TCP requests to certain IP addresses are tunnelled through an SSH ...
-1
votes
0answers
19 views

iptables, redirecting all ingoing connexion

I have this iptables conf on my linux mint... What does it mean ? Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- 13.37.42.0/24 ...
-1
votes
0answers
28 views

iptables : redirect all ingoing traffic to www [closed]

I have a Wifi hotspot, made with a linux machine. I d like to redirect any ingoing trafic to my index.php localsite. My public interface is wan0. Is iptables the best solution ? How can I do that ?
-1
votes
0answers
17 views

Iptabels Port Forewarding Issue

I am trying to forward requests on eth0 (192.168.1.110 port 9600 tcp) to the same port on 192.168.250.2 (reachable through eth1 (192.168.250.150)). This is so that I can leve a preconfigured Raspberry ...
16
votes
11answers
54k views

Using Linux IPTables, How to block torrents or any P2P protocols?

At our institution we had connected 300+ computers to different LAN's with Internet. Included here are Officies LAN, and Internet Laboratory for students. And we want to Control Torrents or any P2P ...
1
vote
2answers
2k views

Iptables - Allowing only a single dhcp (relay) client

I am trying to create a firewall rule on an Ubuntu 10.04 server running isc-dhcpd. I only want dhcp to be accessible by a single relay host (172.1.1.1). I have iptables set up like so: # iptables ...
0
votes
0answers
8 views

PSAD / removed iptables block

I'm pretty new to PSAD but eagerly getting into it to have a safer installation. But some understanding is missing I've had yesterday the following notification : [psad-status] removed iptables ...
0
votes
1answer
27 views

Multiple TAP devices on OpenVPN Server

So we have a number of clients that have their own VPS instances which we host via Proxmox. The clients servers are all behind a NAT firewall and we forward ports per client request to our various ...
0
votes
1answer
914 views

Outgoing IP Packet Capture and Logging with iptables

My goal is to use ipset lists in iptables to log outbound traffic to certain IP addresses. I intend to monitor an entire network passively. I have port mirroring enabled and the port mirrored ...
-1
votes
0answers
16 views

iptables, multiple vpn with selective routing, unable to forward incoming ports

First of all, forgive my incompetence! I have a Linksys EA6900 with Tomato by Shibby v.129. I have set up 2 OpenVPN clients and successfully configured iptables so all traffic by default is routed ...
-1
votes
0answers
13 views

IPTables route only specific IP and ports over VPN

I have a DD-WRT router that is a OpenVPN client. I am trying to get my network to use the regular ISP based connection and only use the VPN connection for a couple specific IPs on specific ports ...
0
votes
1answer
979 views

Masquerade traffic from certain source IP to VPN connection

Network Setup: 10.0.0.1 Router: to internet 10.0.0.70 Server: Ubuntu based server,default gateway is 10.0.0.1 10.0.0.51 PC I created a PPTP connection(interface: ppp0) on Server to a machine ...
-4
votes
2answers
36 views

Using same port for http/ ssh on two ip's [closed]

How could use two diferent services using the same port on two diferent IP addresses? Example: IP 1 : 192.168.10.10: Service: Http Server Ports: 443 IP 2 : 192.168.10.11: Service: SSH Server ...