iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

learn more… | top users | synonyms (1)

5
votes
0answers
86 views

IPset Alternatives and Firewall Management

I have CentOS 7, Plesk 12, 8GB RAM VPS. I have around 1000 rules in my IPtables to block abusive users. But when reloading IPtables it takes 15 seconds to reload all 1000 rules. First of all, is it ...
5
votes
0answers
2k views

Fail2Ban Correctly Attempts to Ban IP but IP does not get banned - iptables chain exists but not working

Running on Ubuntu 14.04 Server. So I have fail2ban correctly configured to process /var/log/auth.log for SSH login attempts. Upon 3 failed attempts I see this in the fail2ban log: 2014-11-19 15:...
4
votes
0answers
2k views

ip6tables port redirect with TPROXY on IPv6 only

Our server is IPv6 only connected and an applications listen to port 8080 at private network, but we need port 80 at public Internet. On purpose of testing, when opening the firewall for port 8080, ...
3
votes
0answers
152 views

Hacker bypassing iptables

(moved from SO) I have iptables protecting a sip server. It blocks all IPs except ones I specifically opened, and it seems to work for almost everyone. I have tested from lots of ip addresses that ...
3
votes
0answers
209 views

How to split traffic through two different network adapters based on TCP port in OS X

I have a scenario where we will be using a Mac to stream video content to an RTMP server. This RMTP service provides 2 ingest URLs so that you can upload the same video content twice and have ...
3
votes
0answers
317 views

Source IP rate limiting in iptables: hashlimit vs recent

I want to perform rate limiting per source IP in iptables. For example, limit the rate at which a host can establish new SSH connections to 5 per minute. To my knowledge there are two ways of doing ...
2
votes
0answers
16 views

Iptables don't load balance

I have consulted multiple tutorials to achieve load balancing over two internet connections. However, all traffic continues to get routed over the default route with the lowest metric, and I can't ...
2
votes
0answers
37 views

WhatsApp call blocking

I'm managing a small network and I'm requested to block WhatsApp calls without blocking its messaging features. As they provide their public IP addresses I thought it'd be straightforward to add some ...
2
votes
0answers
28 views

Iptables u32 matching nat

I'm currently setting up IPtables to redirect certain UDP payloads to my application. Here is an example of what I have working so far: iptables -t nat -I PREROUTING -p udp -d {IPDST} --dport 27055 -...
2
votes
0answers
46 views

IPTables DNAT Exemption

TL;DR - I'm looking for a way to send all my external traffic through a proxy server but not send all my internal traffic through a proxy server. How can I achieve this? My end goal is to forward ...
2
votes
0answers
44 views

Block incoming traffic in bonding mode when primary interface is down

My server running on latest kernel (4.4.6) has configured a bond device (bond0) with two enslaved interfaces eth0, wlan0 with primary interface eth0. cat /proc/net/bonding/bond0 Ethernet Channel ...
2
votes
0answers
52 views

Can't firewalld replace iptables?

I used Iptables on Centos 6.5 and tried to translate iptables rules into firewalld rules on centos 7. However, with firewalld, i have discovered i am unable to drop packets in invalid states create ...
2
votes
0answers
101 views

iptables configuations for stunnel+squid

I'm building a highly anonymous proxy server with squid and stunnel, and I'm facing a configurations problem on iptables. The server should act like this: browser <-> client stunnel <=> ...
2
votes
0answers
22 views

Policy-based routing on OpenVPN server

I'm trying to set up an OpenVPN server as reverse proxy for mobile/desktop devices, that can relay traffic based on certain policies: only requests to white-listed IP addresses are going to be ...
2
votes
0answers
31 views

Samba server disappears from the browser list after a period of time

I have a Ubuntu server running as a router. On the server I use iptables and DHCP 3.1.3, Samba 3.4.7 and OpenVPN 2.1.0 server. I have problem with Samba server disappears from the VPN client browser ...
2
votes
0answers
180 views

Understanding packets dropped by iptables from puppetmaster

I am seeing packets getting dropped during my puppet client runs on a semi regular basis. And I do not understand what is causing this. I should mention that Puppet is managing the firewall rules ...
2
votes
0answers
351 views

Linux ipv6 forwarding

Situation I know how to do ipv4 forwarding, and expected ipv6 forwarding to work pretty much the same way. So I configured a VirtualBox host with the network address configured from my ISP. Right now,...
2
votes
0answers
334 views

How to use iptables or IFB to mark incoming traffic by device?

I'm trying to use iptables to mark incoming packets based on the device where those packets arrived (rather than their originating IP address or port etc), but haven't found a way of getting this to ...
2
votes
0answers
542 views

Why is the first of two post-up commands for routing in interfaces configuration not automatically processed

We managed to connect our servers to two distinct networks and everything works fine. We use routing rules that ensure that server responds to the right network. I followed the instructions under ...
2
votes
0answers
88 views

Change sender-IP for VM in libvirt behind NAT

I have a server with my own public /28 IPv4 Network. On this server I have some vServers, done with KVM/libvirt. These vServers are connected with a virtual network, NATed to the internet. Every ...
2
votes
0answers
394 views

firehol simple config doesn't work on Debian 7

I'm trying to set up a very simple firehol setup under a brand new Debian7 server. I only installed ssh and sudo before this Installed firehol with sudo apt-get install firehol Changed the config ...
2
votes
0answers
495 views

Using ufw on OpenVZ-based VPSes

I'm facing with a problem to set up ufw on Ubuntu 12.04 running on an OpenVZ-based VPS. I know there is limitations for ufw. I googled a bunch of articles how to resolve the issue (like: http://blog....
2
votes
0answers
103 views

Some packets are dropped in [wan-local], when DNAT rule exists

I am running EdgeOS (aka vyatta 6.3 aka debian) with 3.4.27. There are two DNAT port forwarding rules like this: rule 1 { destination { port 65432 } inbound-interface eth0 inside-address { ...
2
votes
0answers
733 views

iptables & tc limit both upload & download together

I have the following for iptables & tc but it limits the upload speed to 2Mbits once the quota of 1GB has been hit. iptables -t mangle -A POSTROUTING -o eth0 -p tcp -m owner --uid-owner aaron -...
2
votes
0answers
2k views

Forwarding udp ports iptables packets “lost”?

I have a Linux router (Debian 6.x) where i forward some ports to internal services. Some tcp ports (like 80, 22...) are OK. I have one Application listening on port 54277udp. No return is coming from ...
2
votes
0answers
699 views

A minmal iptables ruleset for a high volume Nginx reverse proxy (or: how to use NOTRACK for http and https)?

I'm looking for a minimal iptables ruleset for a rather high volume Nginx/Varnish reverse proxy. I'd like to close down the server, so that only ports 80 and 22 are open at all for connections from ...
2
votes
0answers
713 views

iptables: limiting bytes downloaded per IP per day?

On a public-facing web server, I'd like to limit the total bytes downloaded per IP address per day. For example, after a visitor downloaded 100MB, any additional requests would be dropped or rejected ...
2
votes
0answers
177 views

Virtual guest doesn't NAT when using the hosts IP

I am using lxc to host some services. I wish to expose one of these services to the outside world. I have setup three NAT rules on my host using iptables, one for the eth0, one for br0 (the bridge ...
2
votes
0answers
244 views

iptables ipt_recent recent module number of IP to remember

One of the parameters of ipt_recnet is ip_list_tot which dictates the number of IPs to remember. What happens if it reaches that limit? Is it going to stop recording new IPs?
2
votes
0answers
1k views

bypass ip destination squid tproxy bridge

I have configured a squid transparent tproxy. All works fine. Now I need all the traffic going to an external IP (internet) does not pass through the proxy. Do I need to modify iptables, ebetables ...
2
votes
0answers
2k views

Routing only some local IPs through VPN on dd-wrt

Much similar to this entry: http://serverfault.com/questions/94283/using-dd-wrt-to-connect-to-vpn-and-forward-all-traffic-of-certain-devices-through , I have set up my router with dd-wrt + OpenVPN to ...
1
vote
0answers
24 views

iptables - POSTROUTING / SNAT doesn't change source IP (two routing tables)

I have a problem with iptables POSTROUTING rule, it seems that SNAT rule doesn't change source IP address. I would like set up the following system to route all traffic from LAN 2 through a VPN tunnel....
1
vote
0answers
23 views

How to redirect a URL from hostapd without internet access?

I have configured my server with iptables rules in order to forward all traffic to a specific domain. Those are NAT rules and the redirection works fine as long as I have internet access. But when ...
1
vote
0answers
24 views

How to forward port through VPN on Linux

I'm setting up a small CTF (hacker competition) and have a machine that hosts VMs. One of these VMs will be the target. The host machine cannot be reached through the internet, so I have set up a ...
1
vote
0answers
33 views

NO routing in VPN to client side

I try to configure the following network structure in one dev VMWare environment. W.XP------| |-----W10 192.168.5.100 | | 192.168.4.100 ...
1
vote
0answers
43 views

policy routing for local outcoming connections

I have a multihomed setup with two upstream providers. And I want to confine some connections to use only one provider — local outgoing connections that is. So, I've made a custom routing table, which ...
1
vote
0answers
8 views

3 server point to point bridge loop

I have a setup with 3 servers (A, B and C) running debian jessie which are all directly connected to the other two servers, so it is a ring-like layout. I'd like them to only have ohne IP each like if ...
1
vote
0answers
51 views

Iptables firewall causing instability

I've made a script to set an iptables firewall,but it's Causing instability on the local network aplication . The firewall is droping the connection between the clients and the server for a while ...
1
vote
0answers
31 views

TC not classifying packets correctly based on iptables MARK

I have machineA that is connected to the internet via eth0. MachineB on the other hand is connected to machineA through a mesh and is connected to the internet via machineA. I am trying to give lower ...
1
vote
0answers
18 views

iptable connetion to VPN Server (VPN + DNS)

i want to create iptable rules that allow no traffic to the outside world with the exception to my VPN - Server (xx.xx.xx.xx) and local Network 192.168.0.0/24 The rules i defined: iptables -F ...
1
vote
0answers
20 views

How do I remove ufw blocked protocol 59 log noise?

The logfile on one of my private servers running Ubuntu 14.04 is being filled with messages of the following form: [UFW BLOCK] IN=eth0 OUT= MAC=[macaddr] SRC=[srcipv6addr] DST=[destipv6addr] LEN=40 ...
1
vote
0answers
35 views

MySQL on Ubuntu. 10061 error on 3306

A fresh install of Ubuntu inside of a Virtualbox with LAMP option selected. I am unable to connect to the server via telnet on this port or via ODBC from my host machine. I can ping and SSH both ...
1
vote
0answers
58 views

Drop fragmented packets in nftables

Using iptables is it possible to block fragmented packets with this rule: iptables -A INPUT -f -j DROP But there isn't a equivalent in nftables. There is any way to do it?
1
vote
0answers
18 views

Iptables multiple port redirects based on destination address

I have iptables setup for selective routing. In the current configuration it checks if the dst address is listed in a specific chain and if it is not it redirects the traffic to my proxy port which is ...
1
vote
0answers
46 views

Route all traffic from virtual interface to temporary tun0

I'm trying setting up at home an automated torrent client to download some big GIS databases I produce at work and release as .torrent files. My home server is a Raspberry PI with one Ethernet ...
1
vote
0answers
16 views

IPsec and pinging rightsubnets

I have been racking my brain about this. I have openswan running and I have been able to get tunnels up. Unfortunately, when I try to ping computers on my right subnet, I am not able to get any ...
1
vote
0answers
18 views

How do I use Client9's IPCat with IPTables

I'd like to block all ips of all datacenters in the world with this list: https://github.com/client9/ipcat But I don't know how to use that list, I'd like a bash script that checks if there's an ...
1
vote
0answers
30 views

How to use virtual interface as default interface

I've got a cloud SSD VPS @ OVH, and I'd like to change the default interface used for requests. I have two interfaces: eth0 (which is the default interface) and eth0:0 (which is the new virtual ...
1
vote
0answers
27 views

keep ossec iptables rules after restarting OSSEC

I have 6 OSSEC installations (5 agents + 1 server, all Debian 8) all configured to block repeated offenders using iptables from 10 minutes to 1 month. I have the need to restart one or more of the ...
1
vote
0answers
28 views

IPsec: hide private IP behind Gateway IP

I have an IPsec Gateway to a customer, and the VPN tunnel is up, the problem is that they don't allow me to use my private address because it used by another VPN they use. Our gateway is an EC2 ...