iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

3
votes
0answers
205 views

iptables/netfilter rules for samba/netbios access

Which iptables-rules do I have to set to allow clients to access a samba server with working netbios (i.e. being able to use \MyServer instead of \192.168.0.1 to access the server from Windows)? I've ...
3
votes
0answers
374 views

Limiting bandwidth with hashlimit (e.g. kb/s — not connections!) doesn't work, though the man page says it should

According to the iptables-extensions man page hashlimit can do bandwidth limiting: "flows exceeding 512kbyte/s" => --hashlimit-mode srcip,dstip,srcport,dstport --hashlimit-above 512kb/s ...
3
votes
0answers
1k views

connect Open vSwitch switch to real network : iptables masquerade

I'm using Open vSwitch to create a switched network between virtualBox guest machines, and i want that the host OS (Ubuntu 12.04) join this network and to configure it as the gateway of this virtual ...
2
votes
0answers
43 views

Understanding an OpenVPN bridge from iptable's point of view

In my scenario, there is a machine which acts as both an iptables-based firewall and an OpenVPN-server at the same time. It has two network interfaces - eth1 is connected to the internet whereas eth0 ...
2
votes
0answers
53 views

firehol simple config doesn't work on Debian 7

I'm trying to set up a very simple firehol setup under a brand new Debian7 server. I only installed ssh and sudo before this Installed firehol with sudo apt-get install firehol Changed the config ...
2
votes
0answers
65 views

Some packets are dropped in [wan-local], when DNAT rule exists

I am running EdgeOS (aka vyatta 6.3 aka debian) with 3.4.27. There are two DNAT port forwarding rules like this: rule 1 { destination { port 65432 } inbound-interface eth0 inside-address { ...
2
votes
0answers
1k views

ip6tables port redirect with TPROXY on IPv6 only

Our server is IPv6 only connected and an applications listen to port 8080 at private network, but we need port 80 at public Internet. On purpose of testing, when opening the firewall for port 8080, ...
2
votes
0answers
853 views

Forwarding udp ports iptables packets “lost”?

I have a Linux router (Debian 6.x) where i forward some ports to internal services. Some tcp ports (like 80, 22...) are OK. I have one Application listening on port 54277udp. No return is coming from ...
2
votes
0answers
363 views

A minmal iptables ruleset for a high volume Nginx reverse proxy (or: how to use NOTRACK for http and https)?

I'm looking for a minimal iptables ruleset for a rather high volume Nginx/Varnish reverse proxy. I'd like to close down the server, so that only ports 80 and 22 are open at all for connections from ...
2
votes
0answers
164 views

Virtual guest doesn't NAT when using the hosts IP

I am using lxc to host some services. I wish to expose one of these services to the outside world. I have setup three NAT rules on my host using iptables, one for the eth0, one for br0 (the bridge ...
2
votes
0answers
207 views

Monitoring Linux Kernel Space Processing

I'm running two "services" that are served in linux kernel-space: Linux Netfilter Firewall ("iptables") Linux Virtual Server Loadbalancer ("IPVS", "LVS") Now I want to (performance-)monitor my ...
2
votes
0answers
174 views

iptables ipt_recent recent module number of IP to remember

One of the parameters of ipt_recnet is ip_list_tot which dictates the number of IPs to remember. What happens if it reaches that limit? Is it going to stop recording new IPs?
1
vote
0answers
14 views

Policy routing local user's traffic down a tunnel

I've got a Linux based Firewall/Router running iptables and SNAT for traffic passing through it to the Internet via a single uplink - This is working fine. There is also a small number of applications ...
1
vote
0answers
16 views

xtable geoip filter unable to load into memroy

Ok, I have a odd problem. I just got done doing the bas configuring of my server. Adding in fail2ban, postfix, apache, mysql, ect ect. I then went in and started to add the xtable addons. I ...
1
vote
0answers
63 views

Command to set dscp / ToS value on outgoing packets for OS X Mavericks?

I want to set a certain DSCP (or ToS) value on all packets sent over port 22. I have an iptables command to do so, but Mavericks only has the equivalent of pfctl and I can't figure out how to ...
1
vote
0answers
15 views

`ufw insert 1 deny to any` not working

ufw insert 1 deny to any ufw enable ufw status Status output: Status: active Logging: on (high) Default: deny (incoming), allow (outgoing), disabled (routed) New profiles: skip To ...
1
vote
0answers
29 views

EC2 instance won't allow pinging

Ive got an EC2 instance with an iptables config as follows: *filter :INPUT ACCEPT [121:8012] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [64:6240] -A INPUT -p icmp --icmp-type echo-request -j ACCEPT -A ...
1
vote
0answers
42 views

Iptables multiport and source ip

I have a rule which does not seem to allow traffic as expected -A INPUT -p tcp -m state --state NEW -m multiport -s x.x.x.x -d y.y.y.y --dports 38000:38100 -j ACCEPT If I remove the -s argument ...
1
vote
0answers
47 views

Change sender-IP for VM in libvirt behind NAT

I have a server with my own public /28 IPv4 Network. On this server I have some vServers, done with KVM/libvirt. These vServers are connected with a virtual network, NATed to the internet. Every ...
1
vote
0answers
22 views

How to test if packet has been tagged with classid

I'm trying to troubleshoot an issue I'm having related to IFB Mirroring which I'm attempting to deploy based on this question: Tc: ingress policing and ifb mirroring My theory is that since the ...
1
vote
0answers
38 views

Firewall rejecting UDP “connections”?

I have a server that is aggregating logs from various other servers. It mostly works great, however from time-to-time (right after a reboot, but not all reboots) it will decide that various UDP ...
1
vote
0answers
40 views

Is it possible to incorporate ndpi with iptables nfqueue?

I would like to know if it is possible to mark traffic with ndpi (ntop.org) classification engine with iptables nfqueue? Is there any example code out there? Thanks for helping.
1
vote
0answers
50 views

Can I use iptables to rate limit an ipset?

Is it possible to use iptable tables to rate limit an ipset ? I know you can use ipset to create a block list named blacklist i.e. ipset create blacklist hash:ip iptables -I INPUT -m set ...
1
vote
0answers
37 views

iptables failed to forward packages to NFQ

I have set the following rules in iptables: sudo iptables -I INPUT -i eth0 -p tcp -s 192.168.37.184 -j NFQUEUE sudo iptables -I OUTPUT -p tcp --dport 3306 -j NFQUEUE What I want to do is forward ...
1
vote
0answers
26 views

ospf hello not forwarded

I am trying to change the destination ip of ospf hello packet (224.0.0.5) to link local address using iptables rule (DNAT) . It does not seem to work. A similar rule for unicast packet (BGP control) ...
1
vote
0answers
49 views

Openstack instances, routing, packets not delivered for SPECIFIC services

I am taking over management of an existing openstack system at work and I have only a little prior experience with openstack. I have about 8 instances running and all of them appear to function ...
1
vote
0answers
67 views

Firewall and NAT settings in GSM modem for one server

I have a GSM Modem (PSI-MODEM-GSM/ETH) in field with one device behind, acting as a server. The situation is as follows: "PC" | \_________Dynamic IP: 10.103.153.122 | ...
1
vote
0answers
114 views

Routing LDAP traffic from Application server to Proxy to internet

I've included a drawing so you get an idea how it would work. (Red = LDAP connections , Blue = HTTP / AJP in the backend) Problem: We want to connect our customer application server to an LDAP of ...
1
vote
0answers
155 views

How to configure nDPI for iptables

I am new to nDPI, I have installed nDPI but when I add rules like; iptables -I OUTPUT -m ndpi --http -j REJECT it shows error iptables v1.4.7: Couldn't load match ...
1
vote
0answers
74 views

Confirm IPTables firewall settings for NFS v4 server?

This question has been asked here before but has conflicting and possibly outdated answers. It seems to depend on OS, version of OS, and version of NFS. On a CentOS 6.5 server, the default rules are ...
1
vote
0answers
40 views

LXC and proxying port 22 (ssh)

I have installed LXC on my Ubuntu 12.04 server and have created a couple of containers. I have only 1 external IP address, thus I am using nginx on my host machine to proxy HTTP requests from certain ...
1
vote
0answers
144 views

iptables - hashlimits, why it calculate all to seconds

I've tried to set 'synflood' limits with hashlimits, those are my snippet of rules: iptables -A SYNFLOOD_CHECK -p tcp --syn -m hashlimit --hashlimit-above 10/s --hashlimit-burst 6 \ ...
1
vote
0answers
53 views

strongswan packet get natted when ufw is enabled

I'm using strongswan 4.6.4 to connect road warriors to my server (ubuntu 13.10), which is natted behind a firewall. left=%defaultroute leftsubnet=10.10.1.0/24 right=%any ...
1
vote
0answers
71 views

iptables xt_recent change in kernel without modules

is it possible to change xt_recent module parameters when it is compiled into kernel ? most of the info on internet suggest setting it by modprobe but that is not the case in my setup as I have ...
1
vote
0answers
46 views

OpenVPN running on Internet Gateway, so all private clients can access VPN with no config

Our LAN connects to our office gateway machine (192.168.1.1), which is connected to the Internet. I have setup NAT/Masquerading for this purpose with no issue. We also use OpenVPN to connect to our ...
1
vote
0answers
336 views

Ports blocked on ubuntu 13.10 vps

I have been searching all over for an answer, i got a cheap vps server running ubuntu 13.10 and installed webmin which should allow me to go to serverip:10000 But i can't connect to it and ...
1
vote
0answers
41 views

Can IPtables (possibly with libnetfilter_queue library) do everything that snort does?

I have just started getting into network security, firewall, etc. So, please excuse me for asking this basic question. I looked at IPtables and got a good hang of it (nowhere close to becoming an ...
1
vote
0answers
258 views

Firewall/iptables rules for GlusterFS

A great pleasure would be to know which exact iptables rules to use for securing GlusterFS 3.4.2 (with Debian Wheezy) in shared environment. I'm running some dedicated servers at ISP. There are two ...
1
vote
0answers
199 views

Using ufw on OpenVZ-based VPSes

I'm facing with a problem to set up ufw on Ubuntu 12.04 running on an OpenVZ-based VPS. I know there is limitations for ufw. I googled a bunch of articles how to resolve the issue (like: ...
1
vote
0answers
77 views

Port corruption using iptables NAT on Enterprise Linux 6

I am trying to setup a captive web portal redirect on CentOS using the following configuration: This configuration works for the first few packets, but then suddenly the destination port is corrupted ...
1
vote
0answers
43 views

Open ports for VPN users

I have been looking around for some time for answer to this, and have yet to find one. The issue that I am having is that users that are connected to the VPN cannot do the following, as examples: ...
1
vote
0answers
55 views

Iptables and system-config-firewall

I had a set of netfilter rules set with iptables, but someone else told me to use system-config-firewall to add a rule for sharing files with Windows. (Samba) This rewrote the iptables rules file and ...
1
vote
0answers
394 views

How to stop NAT dropping idle connections?

I have a TCP connection that can be idle for many hours. The traffic is flowing from the server to the client only. One might say it's kind of push notification. My home router, however, tends to ...
1
vote
0answers
310 views

iptables & tc limit both upload & download together

I have the following for iptables & tc but it limits the upload speed to 2Mbits once the quota of 1GB has been hit. iptables -t mangle -A POSTROUTING -o eth0 -p tcp -m owner --uid-owner aaron ...
1
vote
0answers
102 views

Strange dropped packets coming from port 8888 and with ACK or ACK+PSH set

Background During an incident on a small privative network (1 router/FW + 1 server) my server got accidentally exposed to the internet. Fortunately it was protected by it's own UFW to allow only 1 ...
1
vote
0answers
159 views

How to Exclude Log Using Fail2Ban logpath with Wildcard Settings

I'm using wildcard in the logpath value as shown below: [http-get-dos] enabled = true filter = http-get-dos logpath = /var/log/ispconfig/httpd/*/access.log maxretry = 250 findtime = 300 #ban for 10 ...
1
vote
0answers
227 views

racoon pure IPSEC VPN, best way to give vpn server an IP address on the VPN?

We are testing a VPN server for DR. We have a rackspace cloud instance, with a pure IPSEC VPN server running in racoon, serving "road warrior" clients. We have some NAT going on on the server to route ...
1
vote
0answers
116 views

ip routing of multiple virtual IPs on one ethernet card

I am working on a live network of multiple boxes and routes with a long history of changes. I am trying to consolidate them with the minimum disruption. I'd like to get rid of some old routers and ...
1
vote
0answers
132 views

Send traffic over a specific port through a specific interface, using Shorewall

I have an application that does not support binding to a different interface. It currently sends outgoing connections over eth0, but I would like to send it over eth0:1 which is a virtual interface. ...
1
vote
0answers
95 views

iptables filter tftp's caps failed

i want use iptables to filter tftp client's OUTPUT package, but failed, could you help me? My rules: iptables -A OUTPUT -m udp -p udp --dport 69 -j NFQUEUE iptables -A OUTPUT -m string --algo kmp ...