iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

34
votes
4answers
85k views

How can I port forward with iptables?

I want connections coming in on ppp0 on port 8001 to route to 192.168.1.200 on eth0 on port 8080 I've got these two rules -A PREROUTING -p tcp -m tcp --dport 8001 -j DNAT --to-destination ...
18
votes
3answers
12k views

iptables port redirect not working for localhost

I want to redirect all traffic from port 443 to the internal port 8080. I'm using this config for iptables: iptables -t nat -I PREROUTING --source 0/0 --destination 0/0 -p tcp ...
26
votes
8answers
11k views

Why not block ICMP?

I think I almost have my iptables setup complete on my CentOS 5.3 system. Here is my script... # Establish a clean slate iptables -P INPUT ACCEPT iptables -P FORWARD ACCEPT iptables -P OUTPUT ACCEPT ...
30
votes
10answers
12k views

iptables Tips & Tricks

I'm sure Linux sysadmins are quite familiar with iptables, the userland interface to the netfilter packet-filtering framework. Now, this "Question" is meant to be a Community Wiki for collecting ...
27
votes
5answers
7k views

Debugger for Iptables

I'm looking for an easy way to follow a packet through the iptables rules. This is not so much about logging, because I don't want to log all traffic (and I only want to have LOG targets for very few ...
-1
votes
1answer
823 views

How do I open custom ports in my iptables firewall? [closed]

I need IPTables, like everyone else, but I don't use it enough to really keep my knowledge complete and fresh. The setup utility in CentOS is too basic. It doesn't seem to allow me to open up custom ...
4
votes
2answers
401 views

Don't understand [0:0] iptable syntax

I'm struggling with some iptables rules. I'm a newbie in iptables. I found some resources where I get the following command related to iptables. This is stored in a file that will be executed. [0:0] ...
15
votes
6answers
11k views

Force local IP traffic to an external interface

I have a machine with several interfaces that I can configure as I want, for instance: eth1: 192.168.1.1 eth2: 192.168.2.2 I would like to forward all the traffic sent to one of these local ...
3
votes
3answers
15k views

iptables - Target to route packet to specific interface?

My home server has two main interfaces, eth1 (a standard internet connection) and tun0 (an OpenVPN tunnel). I'd like to use iptables to force all packets generated by a local process owned by UID ...
72
votes
2answers
32k views

IPTABLES - Limit rate of a specific incoming IP

I do not wish to limit the rate of a specific service. My goals is to limit rate based solely on the incoming IP address. For example using a pseudo-rule: john.domain.local (192.168.1.100) can only ...
12
votes
3answers
26k views

Iptables: How to allow only one ip through specific port?

How can I on my ubuntu server, in Iptables only allow one IP adress on a specific port? Thanks
13
votes
2answers
25k views

Allowing FTP with IPTables

My current scenario involves allowing various rules, but I need ftp to be accessible from anywhere. The OS is Cent 5 and I am using VSFTPD. I can't seem to get the syntax correct. All other rules ...
41
votes
10answers
153k views

How to start/stop iptables on Ubuntu?

How can I start/stop the iptables service on Ubuntu? I have tried service iptables stop but it is giving "unrecognized service". Why is it doing so? Is there any other method?
14
votes
12answers
40k views

Using Linux IPTables, How to block torrents or any P2P protocols?

At our institution we had connected 300+ computers to different LAN's with Internet. Included here are Officies LAN, and Internet Laboratory for students. And we want to Control Torrents or any P2P ...
15
votes
2answers
6k views

Why is our firewall (Ubuntu 8.04) rejecting the final packet (FIN, ACK, PSH) with a RST

Background, for a long time we have had problems with our firewall that sometimes keep HTTP requests hanging partially loaded until TCP times out. After tracing the traffic on the firewall I noticed ...
23
votes
6answers
2k views

Hardware Firewall Vs. Software Firewall (IP Tables, RHEL)

TL;DR My hosting company says IP Tables is useless and doesn't provide any protection. Is this BS? I have two, co-located servers. Yesterday my DC company contacted me to tell me that because I'm ...
4
votes
1answer
1k views

How to Tee udp packets onto a different host

I would like to clone incoming UDP packets onto a different host, I found a way to do it Here but I could not build xtables-addons on centos 5.3 . Is there any other way to tee upd packets?
2
votes
2answers
2k views

Basic iptables NAT port forwarding

I have three machines: A local PC (public IP 1.2.3.4), an Ubuntu 10 Server box in a datacentre (eth0 on 5.6.7.8 public IP), and a third-party server hosting a website outside of my network (let's say ...
3
votes
2answers
956 views

Debian 'ignores' /etc/network/if-pre-up.d/iptables

I want my iptables rules to automatically be loaded on startup. According to the wiki on Debian this can be done by placing a script with the name iptables in /etc/network/if-pre-up.d/ So I did, this ...
3
votes
2answers
2k views

Iptables port forwarding on OpenVZ CEntOS container

I am trying to setup a simple port forwarding on an OpenVZ container that is running CentOS 5.5. When I run a command I get errors. iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT ...
1
vote
1answer
586 views

Fedora Core 13 and VSFTPD issues

I am running Fedora Core 13 and I have vsftpd (vsftpd-2.2.2-7.fc13.x86_64) up and running, and I can login, but it keeps hanging: $ ftp xxx.local Connected to xxx.local. 220 (vsFTPd 2.2.2) Name ...
12
votes
3answers
1k views

Can you recommend a good intro to iptables?

I have to setup a firewall on a Linux server (all my previous experience is with Windows). My rules are meant to be pretty simple - forbid all, allow some ports with all, allow some ports for specific ...
4
votes
2answers
5k views

Stop DoS attacks with an IP tables rule?

I was wondering if I could prevent small (D)DoS attacks with a simple IP tables rule? By small I mean that they are flooding my web server with about 400+ requests from one or two IP addresses. I ...
8
votes
2answers
8k views

How can I block all but three ports in Ubuntu?

How can I block all ports except for 1962, 999, 12020? One port for SSH and two others for a kind of script. So, it's necessary to allow outgoing on these ports, right? My iptables: # Generated by ...
19
votes
4answers
7k views

REJECT vs DROP when using iptables

Is there any reason why I would want to have iptables -A INPUT -j REJECT instead of iptables -A INPUT -j DROP
5
votes
2answers
5k views

Bridging LXC containers to host eth0 so they can have a public IP

UPDATE: I found the solution there: http://www.linuxfoundation.org/collaborate/workgroups/networking/bridge#No_traffic_gets_trough_.28except_ARP_and_STP.29 # cd /proc/sys/net/bridge # ls ...
5
votes
2answers
7k views

iptables: forward port 80 to port 8080

How can I port-forward port 80 internally to port 8080? My goal is to have a web app server (Glassfish) running on port 8080, but for the outside world to access it normally on port 80. This is ...
3
votes
3answers
2k views

Advanced routing problem

I have 2 internet links using 2 ADSL routers and I need to give access to the Internet for the 192.168.0.0/24 network. I have to route outgoing traffic based on port number, protocol, … using ...
9
votes
1answer
5k views

iptables: difference between NEW, ESTABLISHED and RELATED packets

Part of a firewall on a server : iptables -A INPUT -p tcp --dport 22 -m state NEW --state -m recent --set iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 100 ...
9
votes
3answers
5k views

Cannot Set UID on Shell Scripts

Can anyone help me find out what is going on here? I have some rules set up tracking packet counts. When I run the following script as root: #!/bin/bash iptables -t mangle -xnvL I get the output ...
3
votes
3answers
1k views

Service can't connect to self using public IP, NAT problem

I have a dedicated server from serverloft.eu, but due to some network security I cannot use bridge networking on my server. So I have setup all my IPs to the main eth0, and used NAT to forward trafic ...
1
vote
3answers
287 views

Server Firewall preventing sending of email

The firewall on my VPS appears to be preventing my site from sending email. It was working fine until the end of last month. My hosting provider (Webfusion) has been next to useless. I am able to ...
0
votes
2answers
1k views

How To Set iptables log rules for PSAD with UFW?

For PSAD to work, I need to add the following iptables rules and enable packet logging : iptables -A INPUT -j LOG iptables -A FORWARD -j LOG ip6tables -A INPUT -j LOG ip6tables -A FORWARD -j LOG I ...
6
votes
3answers
3k views

Firewall questions about state and policy?

I finally managed to install my VM host and now I am messing with iptables to create, test and learn. Does it matter if i put the below rules at the begin or at the end of my rules ? $IPT -P INPUT ...
5
votes
3answers
2k views

iptables — OK, **now** am I doing it right?

This is a follow up to a previous question where I asked whether my iptables config is correct. CentOS 5.3 system. Intended result: block everything except ping, ssh, Apache, and SSL. Based on ...
4
votes
2answers
13k views

How to allow a range of IP's with IPTABLES?

Here is my iptables, how can I make it so that I can allow a range of ip's on ETH1 (10.51.x.x) # Generated by iptables-save v1.4.4 on Thu Jul 8 13:00:14 2010 *filter :INPUT ACCEPT [0:0] :FORWARD ...
4
votes
5answers
7k views

iptables port forwarding on debian

I'm trying to setup a simple port forwarding firewall and I can't make the basic non-firewall configuration to work. I have setup the iptables script as follows #!/bin/sh # interfaces LAN="eth1" ...
1
vote
3answers
2k views

fail2ban Error Gentoo

I've recently setup a new VPS running Gentoo (My first time using the distro so please forgive me is this is a really easy one) and as I've done with other servers installed fail2ban. Setting it up to ...
0
votes
2answers
1k views

iptables redirected port 80 to 8080 - How to disallow direct access to port 8080?

I've routed all requests from port 80 to port 8080 for my Tomcat server using iptables. iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080 Now http://mydomain.com/ ...
5
votes
3answers
1k views

Firewall still blocking port 53 despite listing otherwise?

I have 3 nodes with virtually the same iptables rules loaded from a bash script, but one particular node is blocking traffic on port 53 despite listing it's accepting it: $ iptables --list -v Chain ...
3
votes
1answer
643 views

IPTables: No chain/target/match by that name

I am trying to execute the following command in iptables (it's the first command I have issued to IPTables since I setup my new VPS, but when I execute the command below: iptables -A INPUT ...
3
votes
1answer
991 views

Linux IPv6 Transparent Proxy (but Linux doesn't support NAT on IPv6!?)

On Linux I can make a transparent proxy simply by adding a iptables -j REDIRECT command. To my surprise, I am needing to support IPv6. Simple enough right? iptables6 -j REDIRECT command not ...
3
votes
2answers
7k views

iptables redirect local connections to remote system / port

I am trying to use SSH to port forward windows machines local port 3389 to a redhat server on some arbitrary port (in the unprivileged region) I have protected behind a firewall, then forward the ...
3
votes
3answers
1k views

Open mysql only to localhost and a particular address

My config: ubuntu server 9 and msyql 5 my.cnf = bind-address = 0.0.0.0 my iptables script = iptables -A INPUT -i eth0 -s 99.88.77.66 -p tcp --destination-port 3306 -j ACCEPT I can connect from ...
2
votes
1answer
1k views

How do I redirect one port to another on a local computer using iptables?

All of the port forwarding examples I can find are for NAT, which is not what I want. We have an HTTP server application that only binds to 1 port at a time. However, we need to bind to an additional ...
2
votes
3answers
1k views

Iptables massive 1:1 NAT

I have to connect two LANs: LAN1: 10.10.0.0/16 and LAN2: 192.168.0.0/16. I can't do simple routing, because 192.168.0.0/16 net is prohibited in LAN1, so I am thinking of using Full cone nat (1:1) to ...
1
vote
1answer
319 views

redirection made by iptables take effect even after i removed the rule from the chain

for example i added the following rule to the PREROUTING chain: iptables -t nat -A PREROUTING -d 210.210.210.210 -j DNAT --to-destination 200.200.200.200 (lets say that both of the ip addresses are ...
1
vote
1answer
436 views

Why did my new iptables rules screw up outbound traffic?

I recently set up Tomcat on Port 80 using instructions provided by Werner Puschitz. In essence, I had to execute these two iptables commands: iptables -t nat -I PREROUTING -p tcp --dport 80 -j ...
0
votes
1answer
338 views

find common string to block IPs

Currently I have all these IPs coming in. Is there a way to find a common string in the content of the packets and then block the attack via IPTables? Oct 24 16:28:52 host kernel: [ 823.255566] ...
0
votes
4answers
6k views

iptables: IP alias and port forwarding

I can't figure out iptables and I don't know very much about networking and I'm really hoping that someone out there can help me. I have a server with two ip addresses associated with it: 1.1.1.1 and ...