iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

54
votes
4answers
158k views

How can I port forward with iptables?

I want connections coming in on ppp0 on port 8001 to route to 192.168.1.200 on eth0 on port 8080 I've got these two rules -A PREROUTING -p tcp -m tcp --dport 8001 -j DNAT --to-destination ...
41
votes
15answers
18k views

iptables Tips & Tricks

I'm sure Linux sysadmins are quite familiar with iptables, the userland interface to the netfilter packet-filtering framework. Now, this "Question" is meant to be a Community Wiki for collecting ...
29
votes
5answers
10k views

Debugger for Iptables

I'm looking for an easy way to follow a packet through the iptables rules. This is not so much about logging, because I don't want to log all traffic (and I only want to have LOG targets for very few ...
35
votes
9answers
19k views

Why not block ICMP?

I think I almost have my iptables setup complete on my CentOS 5.3 system. Here is my script... # Establish a clean slate iptables -P INPUT ACCEPT iptables -P FORWARD ACCEPT iptables -P OUTPUT ACCEPT ...
11
votes
3answers
30k views

iptables - Target to route packet to specific interface?

My home server has two main interfaces, eth1 (a standard internet connection) and tun0 (an OpenVPN tunnel). I'd like to use iptables to force all packets generated by a local process owned by UID ...
0
votes
2answers
1k views

Can't resolve issue: iptables: No chain/target/match by that name

So I am trying to setup shorewall firewall on my linux vps. The vps is running ubuntu 12.10. When I type $ shorewall check I get this error. iptables: No chain/target/match by that name. ERROR: ...
17
votes
7answers
24k views

Force local IP traffic to an external interface

I have a machine with several interfaces that I can configure as I want, for instance: eth1: 192.168.1.1 eth2: 192.168.2.2 I would like to forward all the traffic sent to one of these local ...
29
votes
3answers
25k views

iptables port redirect not working for localhost

I want to redirect all traffic from port 443 to the internal port 8080. I'm using this config for iptables: iptables -t nat -I PREROUTING --source 0/0 --destination 0/0 -p tcp \ --dport 443 ...
-3
votes
1answer
2k views

How do I open custom ports in my iptables firewall? [closed]

I need IPTables, like everyone else, but I don't use it enough to really keep my knowledge complete and fresh. The setup utility in CentOS is too basic. It doesn't seem to allow me to open up custom ...
5
votes
2answers
21k views

How to do the port forwarding from one ip to another ip in same network?

I would like do some NAT in iptables. So that, all the packets coming to 192.168.12.87 and port 80 will be forwarded to 192.168.12.77 port 80. How to do this with iptables? Or Any other ways to ...
7
votes
2answers
1k views

Don't understand [0:0] iptable syntax

I'm struggling with some iptables rules. I'm a newbie in iptables. I found some resources where I get the following command related to iptables. This is stored in a file that will be executed. [0:0] ...
87
votes
2answers
39k views

IPTABLES - Limit rate of a specific incoming IP

I do not wish to limit the rate of a specific service. My goals is to limit rate based solely on the incoming IP address. For example using a pseudo-rule: john.domain.local (192.168.1.100) can only ...
23
votes
1answer
3k views

How can I block all traffic *except* Tor?

On a Linux system, is there a way to block all in and outbound traffic unless it passes through the Tor network. This includes any form of IP communication, not just TCP connections. For example I ...
13
votes
3answers
40k views

Iptables: How to allow only one ip through specific port?

How can I on my ubuntu server, in Iptables only allow one IP adress on a specific port? Thanks
32
votes
4answers
25k views

REJECT vs DROP when using iptables

Is there any reason why I would want to have iptables -A INPUT -j REJECT instead of iptables -A INPUT -j DROP
19
votes
2answers
46k views

Allowing FTP with IPTables

My current scenario involves allowing various rules, but I need ftp to be accessible from anywhere. The OS is Cent 5 and I am using VSFTPD. I can't seem to get the syntax correct. All other rules ...
8
votes
5answers
17k views

iptables rules to allow HTTP traffic to one domain only

I need to configure my machine as to allow HTTP traffic to/from serverfault.com only. All other websites, services ports are not accessible. I came up with these iptables rules: #drop everything ...
5
votes
3answers
3k views

How to Tee udp packets onto a different host

I would like to clone incoming UDP packets onto a different host, I found a way to do it Here but I could not build xtables-addons on centos 5.3 . Is there any other way to tee upd packets?
4
votes
4answers
3k views

Debian ip6tables rules setup for IPv6

I am setting up a firewall for ipv6 on Debian Squeeze. It is a webserver, so I think the only port that need to be open to the world for ipv6 is 80. This is what I have: *filter :INPUT DROP [0:0] ...
3
votes
2answers
2k views

Iptables port forwarding on OpenVZ CEntOS container

I am trying to setup a simple port forwarding on an OpenVZ container that is running CentOS 5.5. When I run a command I get errors. iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT ...
51
votes
11answers
226k views

How to start/stop iptables on Ubuntu?

How can I start/stop the iptables service on Ubuntu? I have tried service iptables stop but it is giving "unrecognized service". Why is it doing so? Is there any other method?
24
votes
6answers
48k views

iptables equivalent for mac os x

I want to forward requests from 192.168.99.100:80 to 127.0.0.1:8000. This is how I'd do it in linux using iptables: iptables -t nat -A OUTPUT -p tcp --dport 80 -d 192.168.99.100 -j DNAT ...
16
votes
11answers
55k views

Using Linux IPTables, How to block torrents or any P2P protocols?

At our institution we had connected 300+ computers to different LAN's with Internet. Included here are Officies LAN, and Internet Laboratory for students. And we want to Control Torrents or any P2P ...
17
votes
2answers
10k views

Why is our firewall (Ubuntu 8.04) rejecting the final packet (FIN, ACK, PSH) with a RST

Background, for a long time we have had problems with our firewall that sometimes keep HTTP requests hanging partially loaded until TCP times out. After tracing the traffic on the firewall I noticed ...
10
votes
2answers
16k views

How can I block all but three ports in Ubuntu?

How can I block all ports except for 1962, 999, 12020? One port for SSH and two others for a kind of script. So, it's necessary to allow outgoing on these ports, right? My iptables: # Generated by ...
27
votes
2answers
11k views

Iptables, what's the difference between -m state and -m conntrack?

What's the practical difference between: iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT and iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT Which one is ...
28
votes
6answers
5k views

Hardware Firewall Vs. Software Firewall (IP Tables, RHEL)

TL;DR My hosting company says IP Tables is useless and doesn't provide any protection. Is this BS? I have two, co-located servers. Yesterday my DC company contacted me to tell me that because I'm ...
7
votes
2answers
13k views

Bridging LXC containers to host eth0 so they can have a public IP

UPDATE: I found the solution there: http://www.linuxfoundation.org/collaborate/workgroups/networking/bridge#No_traffic_gets_trough_.28except_ARP_and_STP.29 # cd /proc/sys/net/bridge # ls ...
5
votes
2answers
12k views

Node.js is not accessible from external IPs on Ubuntu

Hey everyone, I'm sure this is very noobish, so forgive me. I'm trying to run a node.js server on port 8080 of my ubuntu 10.04. Here's the result of iptables -L on the server: Chain INPUT (policy ...
14
votes
2answers
29k views

How to enable iptables (instead of firewalld) services on RHEL 7 and Fedora 18?

The newest fedora has firewalld as new firewall aplication. I liked old iptables services. I want them back but have no idea how to do that. I have tried : systemctl disable firewalld.service ...
10
votes
2answers
3k views

linux command to prevent dos attack by using netstat and iptables

I want to DROP more than 200 requests per ip to prevent ddos attack. this is command that i used to detect requests count per ip : netstat -alpn | grep :80 | awk '{print $5}' |awk -F: '{print ...
10
votes
2answers
245 views

How can I write automated tests for iptables?

I am configuring a Linux router with iptables. I want to write acceptance tests for the configuration that assert things like: traffic from some guy on the internet is not forwarded, and TCP to port ...
5
votes
2answers
13k views

iptables: forward port 80 to port 8080

How can I port-forward port 80 internally to port 8080? My goal is to have a web app server (Glassfish) running on port 8080, but for the outside world to access it normally on port 80. This is ...
5
votes
2answers
2k views

Policy based routing

I found very good article on load balancing at http://www.diegolima.org/wordpress/?p=36.. I could not implement it though as my requirement is slightly different from pure load balancing. We have two ...
3
votes
2answers
7k views

Basic iptables NAT port forwarding

I have three machines: A local PC (public IP 1.2.3.4), an Ubuntu 10 Server box in a datacentre (eth0 on 5.6.7.8 public IP), and a third-party server hosting a website outside of my network (let's say ...
6
votes
2answers
3k views

Debian 'ignores' /etc/network/if-pre-up.d/iptables

I want my iptables rules to automatically be loaded on startup. According to the wiki on Debian this can be done by placing a script with the name iptables in /etc/network/if-pre-up.d/ So I did, this ...
5
votes
5answers
8k views

iptables port forwarding on debian

I'm trying to setup a simple port forwarding firewall and I can't make the basic non-firewall configuration to work. I have setup the iptables script as follows #!/bin/sh # interfaces LAN="eth1" ...
3
votes
1answer
1k views

iptables preroute localhost

I would like to forward all incoming traffic from a certain port to another one using iptables. The problem is that prerouting doesn't work for traffic from localhost. This topic suggests a solution: ...
2
votes
2answers
5k views

AWS VPC + IPtables + NAT: Port Forwarding is not working

Yesterday, I posted a question here but I think was not clear enough in my words. BTW, This question is not a duplicate. I have AWS VPC Setup as below. GOAL/PROBLEM: SSH to Server A from internet. ...
2
votes
1answer
14k views

iptables forwarding between two interface [closed]

So I have a linux box with two wireless interfaces, one is a station and the other an AP. wlan0 (station) - Connected to the internet connection wlan1 (AP) - Other clients connect to it. I would ...
2
votes
3answers
2k views

Iptables massive 1:1 NAT

I have to connect two LANs: LAN1: 10.10.0.0/16 and LAN2: 192.168.0.0/16. I can't do simple routing, because 192.168.0.0/16 net is prohibited in LAN1, so I am thinking of using Full cone nat (1:1) to ...
1
vote
1answer
667 views

Fedora Core 13 and VSFTPD issues

I am running Fedora Core 13 and I have vsftpd (vsftpd-2.2.2-7.fc13.x86_64) up and running, and I can login, but it keeps hanging: $ ftp xxx.local Connected to xxx.local. 220 (vsFTPd 2.2.2) Name ...
12
votes
3answers
2k views

Can you recommend a good intro to iptables? [closed]

I have to setup a firewall on a Linux server (all my previous experience is with Windows). My rules are meant to be pretty simple - forbid all, allow some ports with all, allow some ports for specific ...
11
votes
4answers
16k views

Good iptables starting rules for a webserver?

I am installing a new centos 5.4 server and I would like to have a set of clean rules for mu iptables to startup. What would be the good rules to start with? Is this a good starting point : # ...
18
votes
5answers
7k views

Use IPtables or null route for blacklisting about 1 million IP addresses?

I've come across a situation where a client needs to blacklist a set of just under 1 million individual IP addresses (no subnets), and network performance is a concern. While I would conjecture that ...
12
votes
1answer
17k views

iptables: difference between NEW, ESTABLISHED and RELATED packets

Part of a firewall on a server : iptables -A INPUT -p tcp --dport 22 -m state NEW --state -m recent --set iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 100 ...
8
votes
3answers
15k views

Throttle bandwidth via iptables

I have a need to throttle the bandwidth usage, similar to how some ISPs do it, so that after a couple of seconds, it throttles down the speed.
4
votes
2answers
10k views

Stop DoS attacks with an IP tables rule?

I was wondering if I could prevent small (D)DoS attacks with a simple IP tables rule? By small I mean that they are flooding my web server with about 400+ requests from one or two IP addresses. I ...
54
votes
5answers
7k views

I accidentaly forbid SSH connection to a remote server… What's next?

Let's say it again, we all make mistakes, and I have just made one. A brief history: I was doing some stuff on a VPS (Debian) I'm renting, when I noticed some strange behaviour. Using the netstat ...
12
votes
3answers
25k views

Debugging rules in Iptables [duplicate]

Possible Duplicate: Debugger for Iptables Hi, How can I know how many packets were dropped by my iptables rules ?? Is there any debugging mechanism to see which rule is Dropping my packet ...