iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

5
votes
0answers
2k views

connect Open vSwitch switch to real network : iptables masquerade

I'm using Open vSwitch to create a switched network between virtualBox guest machines, and i want that the host OS (Ubuntu 12.04) join this network and to configure it as the gateway of this virtual ...
3
votes
0answers
52 views

Filter mirrored port traffic using iptables

I receive traffic from a mirrored port and I would like to send it into an NFQUEUE for processing. Because of the mirrored port, the packets destination MAC addresses are not my host MAC address. ...
3
votes
0answers
520 views

Limiting bandwidth with hashlimit (e.g. kb/s — not connections!) doesn't work, though the man page says it should

According to the iptables-extensions man page hashlimit can do bandwidth limiting: "flows exceeding 512kbyte/s" => --hashlimit-mode srcip,dstip,srcport,dstport --hashlimit-above 512kb/s ...
3
votes
0answers
238 views

Monitoring Linux Kernel Space Processing

I'm running two "services" that are served in linux kernel-space: Linux Netfilter Firewall ("iptables") Linux Virtual Server Loadbalancer ("IPVS", "LVS") Now I want to (performance-)monitor my ...
3
votes
0answers
2k views

ufw deny all incoming and outgoing not working!

I'm sure I'm doing something wrong. I'm expecting my current rules of "denying all incoming/outgoing" to cripple anything network related, but it's not. First, I did: sudo ufw default deny incoming ...
2
votes
0answers
102 views

How to route traffic through different interfaces based on the port number?

iptables -A PREROUTING -i usb0 -t mangle -p tcp --dport 8080 -j MARK --set-mark 1 iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination Chain ...
2
votes
0answers
152 views

firehol simple config doesn't work on Debian 7

I'm trying to set up a very simple firehol setup under a brand new Debian7 server. I only installed ssh and sudo before this Installed firehol with sudo apt-get install firehol Changed the config ...
2
votes
0answers
295 views

Using ufw on OpenVZ-based VPSes

I'm facing with a problem to set up ufw on Ubuntu 12.04 running on an OpenVZ-based VPS. I know there is limitations for ufw. I googled a bunch of articles how to resolve the issue (like: ...
2
votes
0answers
82 views

Some packets are dropped in [wan-local], when DNAT rule exists

I am running EdgeOS (aka vyatta 6.3 aka debian) with 3.4.27. There are two DNAT port forwarding rules like this: rule 1 { destination { port 65432 } inbound-interface eth0 inside-address { ...
2
votes
0answers
2k views

ip6tables port redirect with TPROXY on IPv6 only

Our server is IPv6 only connected and an applications listen to port 8080 at private network, but we need port 80 at public Internet. On purpose of testing, when opening the firewall for port 8080, ...
2
votes
0answers
1k views

Forwarding udp ports iptables packets “lost”?

I have a Linux router (Debian 6.x) where i forward some ports to internal services. Some tcp ports (like 80, 22...) are OK. I have one Application listening on port 54277udp. No return is coming from ...
2
votes
0answers
444 views

A minmal iptables ruleset for a high volume Nginx reverse proxy (or: how to use NOTRACK for http and https)?

I'm looking for a minimal iptables ruleset for a rather high volume Nginx/Varnish reverse proxy. I'd like to close down the server, so that only ports 80 and 22 are open at all for connections from ...
2
votes
0answers
168 views

Virtual guest doesn't NAT when using the hosts IP

I am using lxc to host some services. I wish to expose one of these services to the outside world. I have setup three NAT rules on my host using iptables, one for the eth0, one for br0 (the bridge ...
2
votes
0answers
182 views

iptables ipt_recent recent module number of IP to remember

One of the parameters of ipt_recnet is ip_list_tot which dictates the number of IPs to remember. What happens if it reaches that limit? Is it going to stop recording new IPs?
2
votes
0answers
1k views

Routing only some local IPs through VPN on dd-wrt

Much similar to this entry: http://serverfault.com/questions/94283/using-dd-wrt-to-connect-to-vpn-and-forward-all-traffic-of-certain-devices-through , I have set up my router with dd-wrt + OpenVPN to ...
1
vote
0answers
37 views

Connect AWS and Azure via OpenVPN

I am trying to connect two networks (AWS and Azure) together via OpenVPN. I am aware of other implementations (OpenSwan+Azure GW etc.) but I need maximal portability as I will be expanding this to ...
1
vote
0answers
10 views

How to use iptables or IFB to mark incoming traffic by device?

I'm trying to use iptables to mark incoming packets based on the device where those packets arrived (rather than their originating IP address or port etc), but haven't found a way of getting this to ...
1
vote
0answers
36 views

OpenVZ : live migration fails

I can't launch live migration of OpenVZ container between two proxmox nodes... Feb 05 03:30:27 starting migration of CT 102 to node 'madrid' (xx.xx.xx.xx) Feb 05 03:30:27 container is running - using ...
1
vote
0answers
18 views

Clone and then route SNMP traps to new destination

We have 2 SNMP trap servers 10.0.0.1 and 10.0.0.2 which are the SNMP trap servers for close to 500 devices that we monitor.In all these 500 devices,10.0.0.1 and 10.0.0.2 are configured as the trap ...
1
vote
0answers
16 views

Redirect incoming WAN connection to other WAN host with iptables

I have router with Linux. I want to redirect incoming WAN connections with specified port to some other WAN host:port. I've tryed do this standard way: iptables -t nat -A PREROUTING -p tcp --dport ...
1
vote
0answers
40 views

IPTables on two interfaces - cannot see where I'm going wrong

Ubuntu 14.4 I have used iptables before without issue but am having a real struggle with them today. I have two cards eth0 and eth1. eth0 does have more than one ip so has eth0:0 and eth0:1 etc. If ...
1
vote
0answers
24 views

iptables traffic after forwarding

I have 2 servers Server A and Server B ServerA = 1.1.1.1 ServerB = 2.2.2.2 I am using ip-tables to send all traffic on port 80 to Server B on Server (A) 1.1.1.1 i have done iptables -t nat -A ...
1
vote
0answers
39 views

Strange entries in Squid3 access.log

My WiFi network for guests is transparently proxied by Squid3. There's now a girl from Indonesia with her Samsung GT-B5330 running Android 4.0.4, who gets blocked by "The requested URL could not be ...
1
vote
0answers
65 views

linux not replying to an arp request

I am running linux 3.14 on a system with 2 interfaces. on the first interface, i can access our local network. on the second interface, arp packets come in but linux doesn't send out reply. is it ...
1
vote
0answers
54 views

Dovecot/Postfix mail server replies to [SYN] with [RST, ACK] when user attempts to connect (POP3). Likely iptables?

Currently I am trying to trouble shoot an e-mail server that will allow users to send e-mail, but not log in to the server (POP3) or receive e-mail using their Outlook clients. Previously this was ...
1
vote
0answers
178 views

Forward single port between subnets on dd-wrt router

I have a DD-WRT router with two subnets, 192.168.0.0/24 and 192.168.8.0/24. The latter is used for a 'guest' WiFi network. Traffic between subnets is filtered using iptables. What I would like to ...
1
vote
0answers
47 views

NAT for IPSEC access?

Please help to understand if the following configuration can be created. I have IPSEC connection with my customer. It is site2site vpn between customer network and my network 10.102.103.0/28. This ...
1
vote
0answers
138 views

shorewall can'T start: UNTRACKED state requires Raw Table in your kernel and iptables

I'm trying setting up my firewall and installed and configured shorewall. Unfortunately I tried to directly configure iptables first, but this didn't work. When I start shorewall, I get this messages ...
1
vote
0answers
205 views

Shorewall: DNAT to IPSEC tunnel zone not routing correctly

I have a ipsec tunnel working that gives access to a 192.168.4.0/24 lan. It is working fine and I can access hosts on the other side without problem: # from fw and lan hosts: # ping 192.168.4.44 PING ...
1
vote
0answers
35 views

Why do some outgoing IP traffic not contain UID information?

I am doing egress logging on my server using IPTABLES with the following line which is supposed to provide UID information on all traffic that is logged: -A OUTPUT -j LOG --log-prefix "IPTABLES(O): " ...
1
vote
0answers
48 views

Automatically add rules to iptables when an user logs in or logs out with ssh?

I'm looking for a solution to automatically add couple of rules to iptables when an user logs in and remove those rules when it logs out. I'd like to get somehow get the ip address of the user from ...
1
vote
0answers
459 views

Client successfully connects to OpenVPN server but with no internet access over the VPN

I'm trying to setup OpenVPN with static key authentication(instead of TLS) on TCP port 443; but the client cannot access the internet over the VPN after connecting to the server. Here's my current ...
1
vote
0answers
726 views

TPROXY Not working with HAProxy, Ubuntu 14.04

I'm trying to use HAProxy as a fully transparent proxy using TPROXY in Ubuntu 14.04. HAProxy will be setup on the first server with eth0 111.111.250.250 and eth1 10.111.128.134. The single balanced ...
1
vote
0answers
65 views

Policy routing local user's traffic down a tunnel

I've got a Linux based Firewall/Router running iptables and SNAT for traffic passing through it to the Internet via a single uplink - This is working fine. There is also a small number of applications ...
1
vote
0answers
167 views

Command to set dscp / ToS value on outgoing packets for OS X Mavericks?

I want to set a certain DSCP (or ToS) value on all packets sent over port 22. I have an iptables command to do so, but Mavericks only has the equivalent of pfctl and I can't figure out how to ...
1
vote
0answers
82 views

`ufw insert 1 deny to any` not working

ufw insert 1 deny to any ufw enable ufw status Status output: Status: active Logging: on (high) Default: deny (incoming), allow (outgoing), disabled (routed) New profiles: skip To ...
1
vote
0answers
41 views

EC2 instance won't allow pinging

Ive got an EC2 instance with an iptables config as follows: *filter :INPUT ACCEPT [121:8012] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [64:6240] -A INPUT -p icmp --icmp-type echo-request -j ACCEPT -A ...
1
vote
0answers
140 views

Iptables multiport and source ip

I have a rule which does not seem to allow traffic as expected -A INPUT -p tcp -m state --state NEW -m multiport -s x.x.x.x -d y.y.y.y --dports 38000:38100 -j ACCEPT If I remove the -s argument ...
1
vote
0answers
71 views

Change sender-IP for VM in libvirt behind NAT

I have a server with my own public /28 IPv4 Network. On this server I have some vServers, done with KVM/libvirt. These vServers are connected with a virtual network, NATed to the internet. Every ...
1
vote
0answers
37 views

How to test if packet has been tagged with classid

I'm trying to troubleshoot an issue I'm having related to IFB Mirroring which I'm attempting to deploy based on this question: Tc: ingress policing and ifb mirroring My theory is that since the ...
1
vote
0answers
155 views

Firewall rejecting UDP “connections”?

I have a server that is aggregating logs from various other servers. It mostly works great, however from time-to-time (right after a reboot, but not all reboots) it will decide that various UDP ...
1
vote
0answers
81 views

Is it possible to incorporate ndpi with iptables nfqueue?

I would like to know if it is possible to mark traffic with ndpi (ntop.org) classification engine with iptables nfqueue? Is there any example code out there? Thanks for helping.
1
vote
0answers
80 views

Can I use iptables to rate limit an ipset?

Is it possible to use iptable tables to rate limit an ipset ? I know you can use ipset to create a block list named blacklist i.e. ipset create blacklist hash:ip iptables -I INPUT -m set ...
1
vote
0answers
62 views

iptables failed to forward packages to NFQ

I have set the following rules in iptables: sudo iptables -I INPUT -i eth0 -p tcp -s 192.168.37.184 -j NFQUEUE sudo iptables -I OUTPUT -p tcp --dport 3306 -j NFQUEUE What I want to do is forward ...
1
vote
0answers
37 views

ospf hello not forwarded

I am trying to change the destination ip of ospf hello packet (224.0.0.5) to link local address using iptables rule (DNAT) . It does not seem to work. A similar rule for unicast packet (BGP control) ...
1
vote
0answers
80 views

Openstack instances, routing, packets not delivered for SPECIFIC services

I am taking over management of an existing openstack system at work and I have only a little prior experience with openstack. I have about 8 instances running and all of them appear to function ...
1
vote
0answers
140 views

Firewall and NAT settings in GSM modem for one server

I have a GSM Modem (PSI-MODEM-GSM/ETH) in field with one device behind, acting as a server. The situation is as follows: "PC" | \_________Dynamic IP: 10.103.153.122 | ...
1
vote
0answers
177 views

Routing LDAP traffic from Application server to Proxy to internet

I've included a drawing so you get an idea how it would work. (Red = LDAP connections , Blue = HTTP / AJP in the backend) Problem: We want to connect our customer application server to an LDAP of ...
1
vote
0answers
281 views

How to configure nDPI for iptables

I am new to nDPI, I have installed nDPI but when I add rules like; iptables -I OUTPUT -m ndpi --http -j REJECT it shows error iptables v1.4.7: Couldn't load match ...
1
vote
0answers
279 views

Confirm IPTables firewall settings for NFS v4 server?

This question has been asked here before but has conflicting and possibly outdated answers. It seems to depend on OS, version of OS, and version of NFS. On a CentOS 6.5 server, the default rules are ...