iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

4
votes
0answers
48 views

IPset Alternatives and Firewall Management

I have CentOS 7, Plesk 12, 8GB RAM VPS. I have around 1000 rules in my IPtables to block abusive users. But when reloading IPtables it takes 15 seconds to reload all 1000 rules. First of all, is it ...
4
votes
0answers
1k views

Fail2Ban Correctly Attempts to Ban IP but IP does not get banned - iptables chain exists but not working

Running on Ubuntu 14.04 Server. So I have fail2ban correctly configured to process /var/log/auth.log for SSH login attempts. Upon 3 failed attempts I see this in the fail2ban log: 2014-11-19 ...
4
votes
0answers
2k views

ip6tables port redirect with TPROXY on IPv6 only

Our server is IPv6 only connected and an applications listen to port 8080 at private network, but we need port 80 at public Internet. On purpose of testing, when opening the firewall for port 8080, ...
3
votes
0answers
83 views

Hacker bypassing iptables

(moved from SO) I have iptables protecting a sip server. It blocks all IPs except ones I specifically opened, and it seems to work for almost everyone. I have tested from lots of ip addresses that ...
3
votes
0answers
189 views

How to split traffic through two different network adapters based on TCP port in OS X

I have a scenario where we will be using a Mac to stream video content to an RTMP server. This RMTP service provides 2 ingest URLs so that you can upload the same video content twice and have ...
3
votes
0answers
316 views

How do iptables work with NFQ in terms of traffic shaping in snort?

I'm trying to understand how iptables and NFQ work together with snort. The reason that I ask this is because from what I understand snort can be set to IPS via NFQ but if you have iptables there ...
3
votes
0answers
278 views

Source IP rate limiting in iptables: hashlimit vs recent

I want to perform rate limiting per source IP in iptables. For example, limit the rate at which a host can establish new SSH connections to 5 per minute. To my knowledge there are two ways of doing ...
2
votes
0answers
31 views

Block incoming traffic in bonding mode when primary interface is down

My server running on latest kernel (4.4.6) has configured a bond device (bond0) with two enslaved interfaces eth0, wlan0 with primary interface eth0. cat /proc/net/bonding/bond0 Ethernet Channel ...
2
votes
0answers
35 views

Can't firewalld replace iptables?

I used Iptables on Centos 6.5 and tried to translate iptables rules into firewalld rules on centos 7. However, with firewalld, i have discovered i am unable to drop packets in invalid states create ...
2
votes
0answers
41 views

iptables configuations for stunnel+squid

I'm building a highly anonymous proxy server with squid and stunnel, and I'm facing a configurations problem on iptables. The server should act like this: browser <-> client stunnel <=> ...
2
votes
0answers
20 views

Policy-based routing on OpenVPN server

I'm trying to set up an OpenVPN server as reverse proxy for mobile/desktop devices, that can relay traffic based on certain policies: only requests to white-listed IP addresses are going to be ...
2
votes
0answers
31 views

Samba server disappears from the browser list after a period of time

I have a Ubuntu server running as a router. On the server I use iptables and DHCP 3.1.3, Samba 3.4.7 and OpenVPN 2.1.0 server. I have problem with Samba server disappears from the VPN client browser ...
2
votes
0answers
139 views

Understanding packets dropped by iptables from puppetmaster

I am seeing packets getting dropped during my puppet client runs on a semi regular basis. And I do not understand what is causing this. I should mention that Puppet is managing the firewall rules ...
2
votes
0answers
469 views

Why is the first of two post-up commands for routing in interfaces configuration not automatically processed

We managed to connect our servers to two distinct networks and everything works fine. We use routing rules that ensure that server responds to the right network. I followed the instructions under ...
2
votes
0answers
87 views

Change sender-IP for VM in libvirt behind NAT

I have a server with my own public /28 IPv4 Network. On this server I have some vServers, done with KVM/libvirt. These vServers are connected with a virtual network, NATed to the internet. Every ...
2
votes
0answers
367 views

firehol simple config doesn't work on Debian 7

I'm trying to set up a very simple firehol setup under a brand new Debian7 server. I only installed ssh and sudo before this Installed firehol with sudo apt-get install firehol Changed the config ...
2
votes
0answers
471 views

Using ufw on OpenVZ-based VPSes

I'm facing with a problem to set up ufw on Ubuntu 12.04 running on an OpenVZ-based VPS. I know there is limitations for ufw. I googled a bunch of articles how to resolve the issue (like: ...
2
votes
0answers
103 views

Some packets are dropped in [wan-local], when DNAT rule exists

I am running EdgeOS (aka vyatta 6.3 aka debian) with 3.4.27. There are two DNAT port forwarding rules like this: rule 1 { destination { port 65432 } inbound-interface eth0 inside-address { ...
2
votes
0answers
702 views

iptables & tc limit both upload & download together

I have the following for iptables & tc but it limits the upload speed to 2Mbits once the quota of 1GB has been hit. iptables -t mangle -A POSTROUTING -o eth0 -p tcp -m owner --uid-owner aaron ...
2
votes
0answers
2k views

Forwarding udp ports iptables packets “lost”?

I have a Linux router (Debian 6.x) where i forward some ports to internal services. Some tcp ports (like 80, 22...) are OK. I have one Application listening on port 54277udp. No return is coming from ...
2
votes
0answers
645 views

A minmal iptables ruleset for a high volume Nginx reverse proxy (or: how to use NOTRACK for http and https)?

I'm looking for a minimal iptables ruleset for a rather high volume Nginx/Varnish reverse proxy. I'd like to close down the server, so that only ports 80 and 22 are open at all for connections from ...
2
votes
0answers
694 views

iptables: limiting bytes downloaded per IP per day?

On a public-facing web server, I'd like to limit the total bytes downloaded per IP address per day. For example, after a visitor downloaded 100MB, any additional requests would be dropped or rejected ...
2
votes
0answers
176 views

Virtual guest doesn't NAT when using the hosts IP

I am using lxc to host some services. I wish to expose one of these services to the outside world. I have setup three NAT rules on my host using iptables, one for the eth0, one for br0 (the bridge ...
2
votes
0answers
242 views

iptables ipt_recent recent module number of IP to remember

One of the parameters of ipt_recnet is ip_list_tot which dictates the number of IPs to remember. What happens if it reaches that limit? Is it going to stop recording new IPs?
2
votes
0answers
1k views

bypass ip destination squid tproxy bridge

I have configured a squid transparent tproxy. All works fine. Now I need all the traffic going to an external IP (internet) does not pass through the proxy. Do I need to modify iptables, ebetables ...
2
votes
0answers
2k views

Routing only some local IPs through VPN on dd-wrt

Much similar to this entry: http://serverfault.com/questions/94283/using-dd-wrt-to-connect-to-vpn-and-forward-all-traffic-of-certain-devices-through , I have set up my router with dd-wrt + OpenVPN to ...
1
vote
0answers
30 views

Drop fragmented packets in nftables

Using iptables is it possible to block fragmented packets with this rule: iptables -A INPUT -f -j DROP But there isn't a equivalent in nftables. There is any way to do it?
1
vote
0answers
12 views

Iptables multiple port redirects based on destination address

I have iptables setup for selective routing. In the current configuration it checks if the dst address is listed in a specific chain and if it is not it redirects the traffic to my proxy port which is ...
1
vote
0answers
16 views

Route all traffic from virtual interface to temporary tun0

I'm trying setting up at home an automated torrent client to download some big GIS databases I produce at work and release as .torrent files. My home server is a Raspberry PI with one Ethernet ...
1
vote
0answers
11 views

IPsec and pinging rightsubnets

I have been racking my brain about this. I have openswan running and I have been able to get tunnels up. Unfortunately, when I try to ping computers on my right subnet, I am not able to get any ...
1
vote
0answers
13 views

How do I use Client9's IPCat with IPTables

I'd like to block all ips of all datacenters in the world with this list: https://github.com/client9/ipcat But I don't know how to use that list, I'd like a bash script that checks if there's an ...
1
vote
0answers
25 views

How to use virtual interface as default interface

I've got a cloud SSD VPS @ OVH, and I'd like to change the default interface used for requests. I have two interfaces: eth0 (which is the default interface) and eth0:0 (which is the new virtual ...
1
vote
0answers
21 views

keep ossec iptables rules after restarting OSSEC

I have 6 OSSEC installations (5 agents + 1 server, all Debian 8) all configured to block repeated offenders using iptables from 10 minutes to 1 month. I have the need to restart one or more of the ...
1
vote
0answers
24 views

IPsec: hide private IP behind Gateway IP

I have an IPsec Gateway to a customer, and the VPN tunnel is up, the problem is that they don't allow me to use my private address because it used by another VPN they use. Our gateway is an EC2 ...
1
vote
0answers
34 views

iptables/nat/prerouting ignores UDP packets?

The same effect on many servers with various kernel versions. There are multiple Iptables DNAT rules: iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 12345 -j DNAT --to-destination ...
1
vote
0answers
40 views

CentOS + IPTables

I am trying to setup a CentOS 7 server with Squid as a proxy server. The proxy server is strictly private and doesn't need to be available to anyone other than myself and other 2 servers, therefore I ...
1
vote
0answers
24 views

iptables match output rule for supplementary groups

The iptables utility allows for rules to match based on the process's uid or gid with the following: sudo iptables -A OUTPUT -m owner --uid-owner root -j ACCEPT I also want to add a rule to allow ...
1
vote
0answers
28 views

What would be the cause of openvpn network fault?

We have openvpn network for aproximately 1200 client connections. Basically everything is running fine but there exists 0-4 collapses per day (which occurs randomly), when we looses majority/all of ...
1
vote
0answers
51 views

Route 172.0.0.0 and 10.0.0.0 traffic through two NAT boxes

I have set up two NAT boxes in two separate AWS accounts and given the necessary security group permissions to allow both instances to talk to each other. In account A I have a service that needs to ...
1
vote
0answers
10 views

Anomalous iptables entry with fail2ban (is it misconfigured to block outward traffic?)

Overall we are very satisfied with fail2ban as it has accumulated several dozen neverdowell IP addresses in our iptables rules. However I notice the following rule has also appeared: Chain ...
1
vote
0answers
94 views

Drop first packet for every IP with iptables

My servers are getting UDP-flooded with spoofed source IP addresses. They flood with real user packets so I cannot rate limit or block these packets. Is there a way to drop the first packet received ...
1
vote
0answers
43 views

Can iptables log all type of tcp connection?

Can iptables log tcp Split-Handshake and Simultaneous-Open connections as well as tcp Three Way Handshake? Here is these two kind of tcp connection descriptions. Here I find how to log new tcp ...
1
vote
0answers
35 views

VoIP Phones not working inside LAN

I have tried to read many documents on running a VoIP system behind a NAT'd router, going out to the Internet, then back through a dedicated connection for the VoIP server. I am not getting anywhere ...
1
vote
0answers
81 views

Migration of ebtables arp rule to nftables

I'd like to move to nftables (Ubuntu trusty, kernel 3.19). However I wonder how to migrate ebtables rules for ARP packets: -p ARP --arp-op Request --arp-ip-src 192.168.178.237 --arp-mac-src ...
1
vote
0answers
17 views

Output traffic on different interfaces based on origin subnet

This a diagram of my current network, http://s1.postimg.org/5689b415b/actual_diagram.png Objective Route 172.16.0.x/18 subnet web traffic to ADSL connection What do you think of this approach, will ...
1
vote
0answers
31 views

IPtables on DD-WRT - Bridge communication

I have a Broadcom based Linksys WRT160n router running DD-WRT build 14896. The LAN and wireless clients get a 192.168.1.xxx IP address. They are on br0. I have a guest network in the 192.168.2.xxx ...
1
vote
0answers
77 views

How to prevent conntrack overflow on host with many qemu guests

Is there any way to make iptables conntrack use separate data structures for each network interface? Would network namespaces help here (put each guest together with its tap device in its own netns ...
1
vote
0answers
40 views

IP Tables forwarding tun0 over gre1 (OpenVPN)

I haven't found a very descriptive thread (and sorry if there is one in existence - in my several hours of searching I've found nothing to my specific situation). My main issue here is getting my ...
1
vote
0answers
65 views

Cannot install iptables-service

I cannot install iptable-service on fedora 22. When i type the command dnf install iptables-service , it throws the error mentioned below. Error: Failed to synchronize cache for repo 'updates' ...
1
vote
0answers
58 views

How to drop only DHCP packets between two bridges?

I have a broadband ADSL modem-router SagemCom F@st 2704 which has a lot of embeded options such as create different networks per interface ( 4 Ethnet ports and 5 Wireless SSID, and many over ...