iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

36
votes
4answers
96k views

How can I port forward with iptables?

I want connections coming in on ppp0 on port 8001 to route to 192.168.1.200 on eth0 on port 8080 I've got these two rules -A PREROUTING -p tcp -m tcp --dport 8001 -j DNAT --to-destination ...
30
votes
8answers
12k views

Why not block ICMP?

I think I almost have my iptables setup complete on my CentOS 5.3 system. Here is my script... # Establish a clean slate iptables -P INPUT ACCEPT iptables -P FORWARD ACCEPT iptables -P OUTPUT ACCEPT ...
27
votes
5answers
7k views

Debugger for Iptables

I'm looking for an easy way to follow a packet through the iptables rules. This is not so much about logging, because I don't want to log all traffic (and I only want to have LOG targets for very few ...
18
votes
3answers
14k views

iptables port redirect not working for localhost

I want to redirect all traffic from port 443 to the internal port 8080. I'm using this config for iptables: iptables -t nat -I PREROUTING --source 0/0 --destination 0/0 -p tcp ...
32
votes
10answers
13k views

iptables Tips & Tricks

I'm sure Linux sysadmins are quite familiar with iptables, the userland interface to the netfilter packet-filtering framework. Now, this "Question" is meant to be a Community Wiki for collecting ...
-1
votes
1answer
991 views

How do I open custom ports in my iptables firewall? [closed]

I need IPTables, like everyone else, but I don't use it enough to really keep my knowledge complete and fresh. The setup utility in CentOS is too basic. It doesn't seem to allow me to open up custom ...
4
votes
2answers
487 views

Don't understand [0:0] iptable syntax

I'm struggling with some iptables rules. I'm a newbie in iptables. I found some resources where I get the following command related to iptables. This is stored in a file that will be executed. [0:0] ...
15
votes
6answers
12k views

Force local IP traffic to an external interface

I have a machine with several interfaces that I can configure as I want, for instance: eth1: 192.168.1.1 eth2: 192.168.2.2 I would like to forward all the traffic sent to one of these local ...
4
votes
3answers
17k views

iptables - Target to route packet to specific interface?

My home server has two main interfaces, eth1 (a standard internet connection) and tun0 (an OpenVPN tunnel). I'd like to use iptables to force all packets generated by a local process owned by UID ...
73
votes
2answers
33k views

IPTABLES - Limit rate of a specific incoming IP

I do not wish to limit the rate of a specific service. My goals is to limit rate based solely on the incoming IP address. For example using a pseudo-rule: john.domain.local (192.168.1.100) can only ...
11
votes
3answers
29k views

Iptables: How to allow only one ip through specific port?

How can I on my ubuntu server, in Iptables only allow one IP adress on a specific port? Thanks
15
votes
2answers
29k views

Allowing FTP with IPTables

My current scenario involves allowing various rules, but I need ftp to be accessible from anywhere. The OS is Cent 5 and I am using VSFTPD. I can't seem to get the syntax correct. All other rules ...
21
votes
4answers
9k views

REJECT vs DROP when using iptables

Is there any reason why I would want to have iptables -A INPUT -j REJECT instead of iptables -A INPUT -j DROP
-1
votes
2answers
388 views

Can't resolve issue: iptables: No chain/target/match by that name

So I am trying to setup shorewall firewall on my linux vps. The vps is running ubuntu 12.10. When I type $ shorewall check I get this error. iptables: No chain/target/match by that name. ERROR: ...
43
votes
10answers
167k views

How to start/stop iptables on Ubuntu?

How can I start/stop the iptables service on Ubuntu? I have tried service iptables stop but it is giving "unrecognized service". Why is it doing so? Is there any other method?
14
votes
12answers
43k views

Using Linux IPTables, How to block torrents or any P2P protocols?

At our institution we had connected 300+ computers to different LAN's with Internet. Included here are Officies LAN, and Internet Laboratory for students. And we want to Control Torrents or any P2P ...
16
votes
2answers
7k views

Why is our firewall (Ubuntu 8.04) rejecting the final packet (FIN, ACK, PSH) with a RST

Background, for a long time we have had problems with our firewall that sometimes keep HTTP requests hanging partially loaded until TCP times out. After tracing the traffic on the firewall I noticed ...
23
votes
6answers
3k views

Hardware Firewall Vs. Software Firewall (IP Tables, RHEL)

TL;DR My hosting company says IP Tables is useless and doesn't provide any protection. Is this BS? I have two, co-located servers. Yesterday my DC company contacted me to tell me that because I'm ...
5
votes
2answers
1k views

Policy based routing

I found very good article on load balancing at http://www.diegolima.org/wordpress/?p=36.. I could not implement it though as my requirement is slightly different from pure load balancing. We have two ...
4
votes
1answer
1k views

How to Tee udp packets onto a different host

I would like to clone incoming UDP packets onto a different host, I found a way to do it Here but I could not build xtables-addons on centos 5.3 . Is there any other way to tee upd packets?
2
votes
2answers
2k views

Basic iptables NAT port forwarding

I have three machines: A local PC (public IP 1.2.3.4), an Ubuntu 10 Server box in a datacentre (eth0 on 5.6.7.8 public IP), and a third-party server hosting a website outside of my network (let's say ...
3
votes
2answers
1k views

Debian 'ignores' /etc/network/if-pre-up.d/iptables

I want my iptables rules to automatically be loaded on startup. According to the wiki on Debian this can be done by placing a script with the name iptables in /etc/network/if-pre-up.d/ So I did, this ...
3
votes
2answers
2k views

Iptables port forwarding on OpenVZ CEntOS container

I am trying to setup a simple port forwarding on an OpenVZ container that is running CentOS 5.5. When I run a command I get errors. iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT ...
1
vote
1answer
607 views

Fedora Core 13 and VSFTPD issues

I am running Fedora Core 13 and I have vsftpd (vsftpd-2.2.2-7.fc13.x86_64) up and running, and I can login, but it keeps hanging: $ ftp xxx.local Connected to xxx.local. 220 (vsFTPd 2.2.2) Name ...
12
votes
3answers
1k views

Can you recommend a good intro to iptables?

I have to setup a firewall on a Linux server (all my previous experience is with Windows). My rules are meant to be pretty simple - forbid all, allow some ports with all, allow some ports for specific ...
4
votes
2answers
6k views

Stop DoS attacks with an IP tables rule?

I was wondering if I could prevent small (D)DoS attacks with a simple IP tables rule? By small I mean that they are flooding my web server with about 400+ requests from one or two IP addresses. I ...
9
votes
2answers
9k views

How can I block all but three ports in Ubuntu?

How can I block all ports except for 1962, 999, 12020? One port for SSH and two others for a kind of script. So, it's necessary to allow outgoing on these ports, right? My iptables: # Generated by ...
8
votes
5answers
10k views

iptables rules to allow HTTP traffic to one domain only

I need to configure my machine as to allow HTTP traffic to/from serverfault.com only. All other websites, services ports are not accessible. I came up with these iptables rules: #drop everything ...
11
votes
1answer
7k views

iptables: difference between NEW, ESTABLISHED and RELATED packets

Part of a firewall on a server : iptables -A INPUT -p tcp --dport 22 -m state NEW --state -m recent --set iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 100 ...
9
votes
2answers
833 views

linux command to prevent dos attack by using netstat and iptables

I want to DROP more than 200 requests per ip to prevent ddos attack. this is command that i used to detect requests count per ip : netstat -alpn | grep :80 | awk '{print $5}' |awk -F: '{print ...
9
votes
3answers
5k views

Cannot Set UID on Shell Scripts

Can anyone help me find out what is going on here? I have some rules set up tracking packet counts. When I run the following script as root: #!/bin/bash iptables -t mangle -xnvL I get the output ...
5
votes
2answers
7k views

Bridging LXC containers to host eth0 so they can have a public IP

UPDATE: I found the solution there: http://www.linuxfoundation.org/collaborate/workgroups/networking/bridge#No_traffic_gets_trough_.28except_ARP_and_STP.29 # cd /proc/sys/net/bridge # ls ...
5
votes
2answers
8k views

iptables: forward port 80 to port 8080

How can I port-forward port 80 internally to port 8080? My goal is to have a web app server (Glassfish) running on port 8080, but for the outside world to access it normally on port 80. This is ...
3
votes
3answers
2k views

Advanced routing problem

I have 2 internet links using 2 ADSL routers and I need to give access to the Internet for the 192.168.0.0/24 network. I have to route outgoing traffic based on port number, protocol, … using ...
6
votes
2answers
16k views

How to allow a range of IP's with IPTABLES?

Here is my iptables, how can I make it so that I can allow a range of ip's on ETH1 (10.51.x.x) # Generated by iptables-save v1.4.4 on Thu Jul 8 13:00:14 2010 *filter :INPUT ACCEPT [0:0] :FORWARD ...
5
votes
3answers
16k views

Debugging rules in Iptables [duplicate]

Possible Duplicate: Debugger for Iptables Hi, How can I know how many packets were dropped by my iptables rules ?? Is there any debugging mechanism to see which rule is Dropping my packet ...
3
votes
3answers
1k views

Service can't connect to self using public IP, NAT problem

I have a dedicated server from serverloft.eu, but due to some network security I cannot use bridge networking on my server. So I have setup all my IPs to the main eth0, and used NAT to forward trafic ...
1
vote
3answers
331 views

Server Firewall preventing sending of email

The firewall on my VPS appears to be preventing my site from sending email. It was working fine until the end of last month. My hosting provider (Webfusion) has been next to useless. I am able to ...
0
votes
2answers
1k views

How To Set iptables log rules for PSAD with UFW?

For PSAD to work, I need to add the following iptables rules and enable packet logging : iptables -A INPUT -j LOG iptables -A FORWARD -j LOG ip6tables -A INPUT -j LOG ip6tables -A FORWARD -j LOG I ...
6
votes
3answers
3k views

Firewall questions about state and policy?

I finally managed to install my VM host and now I am messing with iptables to create, test and learn. Does it matter if i put the below rules at the begin or at the end of my rules ? $IPT -P INPUT ...
5
votes
3answers
2k views

iptables — OK, **now** am I doing it right?

This is a follow up to a previous question where I asked whether my iptables config is correct. CentOS 5.3 system. Intended result: block everything except ping, ssh, Apache, and SSL. Based on ...
4
votes
1answer
3k views

PPTP VPN iptables firewall issues csf

I am having a problem with iptables and a PPTP VPN, I have read related topics both on hear and online but still can't get it to work! I am trying to set up PPTP on an ubuntu server on our local ...
4
votes
5answers
7k views

iptables port forwarding on debian

I'm trying to setup a simple port forwarding firewall and I can't make the basic non-firewall configuration to work. I have setup the iptables script as follows #!/bin/sh # interfaces LAN="eth1" ...
1
vote
3answers
2k views

fail2ban Error Gentoo

I've recently setup a new VPS running Gentoo (My first time using the distro so please forgive me is this is a really easy one) and as I've done with other servers installed fail2ban. Setting it up to ...
0
votes
2answers
1k views

iptables redirected port 80 to 8080 - How to disallow direct access to port 8080?

I've routed all requests from port 80 to port 8080 for my Tomcat server using iptables. iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080 Now http://mydomain.com/ ...
5
votes
3answers
1k views

Firewall still blocking port 53 despite listing otherwise?

I have 3 nodes with virtually the same iptables rules loaded from a bash script, but one particular node is blocking traffic on port 53 despite listing it's accepting it: $ iptables --list -v Chain ...
4
votes
3answers
3k views

How do you test iptables rules to prevent remote lockout and check matches?

As I'm learning about iptables I've made a couple of mistakes and locked myself out. What method(s) do you use to test rules without locking yourself out? I'm using ubuntu server 12.04 LTS
3
votes
1answer
776 views

IPTables: No chain/target/match by that name

I am trying to execute the following command in iptables (it's the first command I have issued to IPTables since I setup my new VPS, but when I execute the command below: iptables -A INPUT ...
3
votes
1answer
1k views

Linux IPv6 Transparent Proxy (but Linux doesn't support NAT on IPv6!?)

On Linux I can make a transparent proxy simply by adding a iptables -j REDIRECT command. To my surprise, I am needing to support IPv6. Simple enough right? iptables6 -j REDIRECT command not ...
3
votes
2answers
7k views

iptables redirect local connections to remote system / port

I am trying to use SSH to port forward windows machines local port 3389 to a redhat server on some arbitrary port (in the unprivileged region) I have protected behind a firewall, then forward the ...