-1
votes
4answers
214 views

Is there anyway to tell what user will receive data from inbound packet?

In linux, considering this use case: 1. User initiates http request for webpage to remote server 2. Remote server answers request and sends packets Is there any reference to the user who started ...
0
votes
1answer
17 views

squid3 with tcp_outgoing_address could not connect to anywhere

I have one server with 3 interfaces (3 physical lan card), which are connected to 3 different routers. Each router has a different subnet, i.e. the 3 interfaces of server belong to 3 different ...
1
vote
1answer
135 views

How to stabilish a VPN connection, only on port 8080

Infrastructure: Here's what I want, be able to connect to the website 10.10.100.32:8080 from my LAN on 'Router 1', and all the traffic outside the port 8080 should go to the default gateway 'Router ...
1
vote
3answers
182 views

How can I achieve OpenVPN client routing without NAT on Linode

I've set up an OpenVPN network, and it is working properly in the sense that I can access the inner/LAN machines from the remote client. However, my problem is that all traffic from the remote ...
2
votes
2answers
208 views

What is the correct way to open a range of ports in iptables

I have come across articles advising for the following: iptables -A INPUT -p tcp 1000:2000 -j ACCEPT And others stating that the above will not work and iptables only supports multiple port ...
0
votes
0answers
17 views

Redirection of nfstraffic to different host ip

I am setting up an environment with NFS. I have a setting where a SVR1 has two interfaces. I receive NFS-requests on one interface(192.168.122.2). I need to redirect these nfs request via the other ...
2
votes
1answer
51 views

iptables: does a scanner knows if you DROP packets?

I know how REJECT and DROP chain works. But, as I read here REJECT vs DROP when using iptables, user Dagelf said that the server still replies with TCP SYN/ACK. Does the scanner knows that a packet ...
0
votes
0answers
44 views

Couldn't load target `DNAT':No such file or directory

Trying to do some ipv6 nat and running into an error from ip6tables $ip6tables -t nat -N IPV6-BRIDGE $ip6tables -t nat -A PREROUTING -p all -d 2600:3c01::f03c:91ff:fe6e:2563 -j IPV6-BRIDGE $ip6tables ...
0
votes
0answers
37 views

Pinging to google.com from a particular interface

I am connected to the internet via wlan0(wifi) and also have an ethernet port(not connected to the internet). I am looking for some iptables rule / route addition, which will let me do a ping via eth1 ...
1
vote
0answers
27 views

Do I need a firewall if the service doesn't listen on all interfaces? [duplicate]

Short version: I have a CentOS 6.5 with two NICs, one connected to the internet and one connected to the internal network. The services that shouldn't be accessible to the internet don't listen on ...
0
votes
2answers
47 views

APF and iptables on router - disallow SSH on specific subnet host

I have a CentOS terminal working as a router with APF installed. Also 1 terminal with 3 NICs (3 IPs) is using that router as a Gateway to access the internet. What I want is APF to block SSH access, ...
1
vote
0answers
95 views

iptables - hashlimits, why it calculate all to seconds

I've tried to set 'synflood' limits with hashlimits, those are my snippet of rules: iptables -A SYNFLOOD_CHECK -p tcp --syn -m hashlimit --hashlimit-above 10/s --hashlimit-burst 6 \ ...
0
votes
1answer
61 views

IPTables: Firewall with just one Eth device? [closed]

Admittedly I am a novice in the area of firewalls. But I have read on the IPtables and Firewall theory and command options. There is a general diagram by Rusty Russell, the creator of IPtables: ...
0
votes
1answer
30 views

Forward a host network traffic to another host with the exception of the ssh service

I am trying to redirect all the network traffic received in a old host to a different new host. For that i created two new rules on iptables of the old host: echo 1 > /proc/sys/net/ipv4/ip_forward ...
0
votes
1answer
65 views

How can I configure iptables to forward and forget?

I'm trying to create a front controller where users can connect to a specific port and have their connection redirected to a different IP/port. The reason I'd like to be able to do this is for ...
0
votes
1answer
71 views

Tunnel interface inside Virtualbox IP forwarding

I am working on a solution to expose a development stack that resides inside a Virtualbox guest up to the Internet through OpenVPN tunnels. OpenVPN client fires up inside the guest VM and connects ...
0
votes
1answer
37 views

Unable to nmap open port. IPTables has it listed as open

I have an IPtables firewall set up on a single system. I'm trying to nmap it with the following command: sudo nmap -Pn -A (IP addr) I expect everything incoming to be filtered except for ports 22 ...
0
votes
2answers
33 views

Forwarding all connections to different address

I have a script that tries to connect to rabbitmq using default url and port (localhost:5672). Is it possible to make linux redirect all connections to this url and port to different server? I am ...
0
votes
0answers
32 views

Forward connecting IP address to KVM guests

I'm running kvm with iptables configured to use DNAT and masquerading. However the guest machines are logging the host bridge ip not the connecting client IP address. Is there a way to configure ...
-2
votes
2answers
119 views

Iptables MASQUERADE: What is the advantage/disadvantage between these two commands? [closed]

What is the advantage/disadvantage between below 2 commands: iptables -t nat -A POSTROUTING -o eth0 -s 10.0.0.0/16 -j MASQUERADE AND iptables -t nat -A POSTROUTING -j MASQUERADE Some Background ...
0
votes
2answers
652 views

AWS VPC + IPtables + NAT: Port Forwarding is not working

Yesterday, I posted a question here but I think was not clear enough in my words. BTW, This question is not a duplicate. I have AWS VPC Setup as below. GOAL/PROBLEM: SSH to Server A from internet. ...
0
votes
2answers
61 views

IPtables: Forward port to another host is not working

I am trying out something so this is my test setup: Setup: I have AWS VPC with a public and private subnet. I have a host in public subnet with a public IP address (say Host A) I have a host in ...
1
vote
0answers
57 views

Port corruption using iptables NAT on Enterprise Linux 6

I am trying to setup a captive web portal redirect on CentOS using the following configuration: This configuration works for the first few packets, but then suddenly the destination port is corrupted ...
2
votes
2answers
77 views

IPtables NAT puzzler: Why is traffic from the firewall host being NATed even though it's not coming from one of the prescribed source addresses?

I run a small network where a linux web/mail server also provides NAT for a collection of windows boxes. One of these windows machines is apparently misbehaving (ZeroAccess botnet even though I can't ...
1
vote
2answers
89 views

How to best redirect customers to a login page? (ISP)

I'm trying to come up with the cleanest way to redirect a user to a logon/payment page from an ISP gateway router. We run a small ISP and would like to force users to have to log in prior to getting ...
1
vote
2answers
1k views

How to block internet access to certain programs on Linux

Recently, I have encountered a problem of limiting Internet Access to specific programs. Could anybody recommend a good way of doing that, without using any particular software?
-3
votes
1answer
50 views

iptables allow A -> B:22 , B -> everywhere:22

I want iptables rules that let a server allow incoming ssh from a specific host and at the same time this server can connect ssh on any destination, then block any other in/out traffic Thanks in ...
0
votes
0answers
335 views

Transparently redirecting http traffic to local proxy in bridge mode

Router - LinuxBridge - Backbone -- 10.0.0.0/8 , 10.20.0.0/16 test net | | |(eth1) --------> Management Interface 10.101.101.10 # brctl ...
0
votes
1answer
90 views

Linux Firewall & sharing files between computers in different subnets connected to single switch

EDIT : I've edited the question & the title to bring more clarity hoping that someone will be able to point me in the right direction. ************************* * Internet ...
2
votes
1answer
260 views

iptables: why only OUTPUT rules are needed for samba clients?

I tried the following iptables rules for samba client and they worked. Please note that policy for INPUT, OUTPUT and FORWARD were all set to DROP iptables -A OUTPUT -m state --state NEW,ESTABLISHED ...
2
votes
0answers
340 views

Limiting bandwidth with hashlimit (e.g. kb/s — not connections!) doesn't work, though the man page says it should

According to the iptables-extensions man page hashlimit can do bandwidth limiting: "flows exceeding 512kbyte/s" => --hashlimit-mode srcip,dstip,srcport,dstport --hashlimit-above 512kb/s ...
-1
votes
2answers
184 views

Does this iptables output mean all traffic is allowed?

I am having problems running a program from a client to my RHEL box that uses a non-standard port and I am trying to track down where the communication problem is occurring. I'm starting at the ...
-1
votes
1answer
314 views

I can't access my computer through specific port

On Fedora 18 I tried to access port 1521, so I opened the following port on my firewall: $ sudo iptables -I INPUT -i eth0 -p tcp -m tcp --dport 1521 -j ACCEPT $ sudo service iptables save and $ ...
2
votes
2answers
203 views

Redundant Iptables Routers - secondary router logging martian packet errors

We have a network mostly set up with a redundant pair of Linux Iptables firewalls/routers, but we're missing a crucial piece of the puzzle. Any local traffic destined to the secondary router succeeds ...
0
votes
1answer
58 views

Blocking traffic from specific TCP ports to other specific TCP ports using iptables

I have a Linux system where I have multiple processes communicating with a master process via TCP ports. I need to create a scenario where I block all traffic from all ports of one particular process ...
0
votes
1answer
120 views

KVM firewall to disallow internet access for group of guests

I've got a KVM server inside a local network (192.168.10.0/24). This server has three interfaces, which are all publicly bridged [1]. Atm I'm only using two of the three interfaces, so the virtual ...
1
vote
1answer
105 views

Is it insecure to use the following iptable rule for NAT?

I want to setup a VPN server for personal use, so I follow the blog article [1], and it work like a charm. The only thing I am wondering is if the iptable's rule secure, e.g. iptables -t nat -A ...
0
votes
1answer
97 views

Interface ip address discrepancy

This is very strange. Output of ip route show: default via 192.168.1.1 dev eth0 metric 100 192.168.1.0/24 dev eth1 proto kernel scope link src 192.168.1.10 192.168.1.0/24 dev eth2 proto kernel scope ...
-1
votes
2answers
253 views

iptables TCP handshake on Centos 6.0

Here's my iptables script: #!/bin/sh service iptables stop iptables -F iptables -P INPUT DROP iptables -P OUTPUT ACCEPT iptables -P FORWARD DROP iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -p ...
0
votes
0answers
134 views

Iptables - limiting connections to port range

I want to limit connections to my server to one connection per second on every port in range 10000:65535 I started using this rule: iptables -A INPUT -p tcp --syn --dport 10000:65535 \ -m ...
0
votes
2answers
682 views

How do I configure dd-wrt to forward IP Protocol ID 50 & 51 traffic to an internal machine?

Please note, I'm not talking about TCP or UDP traffic. Rather IP traffic with the protocol ids of 50 and 51. The point of this being that I can then pass IPsec traffic thru to the internal machine ...
1
vote
1answer
85 views

Understanding origin of some ICMP error packets

On my firewall/router Linux box I quite often see ICMP host/port unreachable errors like: Jan 10 10:11:56 localhost kernel: [80413.542607] firewall-invl: IN=wan OUT= ...
1
vote
2answers
52 views

Is it necessary to specify server ip in the destination option of the iptables rule?

I use iptables to log all incoming connections. While going through the log in var/log/messages, I notice that there are some incoming connections from another computer to an unassigned LAN ip ...
1
vote
1answer
248 views

Meaning of number inside iptable rules' brackets? [duplicate]

Possible Duplicate: Don’t understand [0:0] iptable syntax E.g. The command iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080, lead to the configs *nat :PREROUTING ...
1
vote
3answers
405 views

iptables blank after reboot

We've started encountering an issue with iptables on our RHEL 6.3 systems in that after a reboot, when the service starts, the rules are not loaded. We get the empty ruleset: [msnyder@matt-test ~]$ ...
1
vote
0answers
56 views

Multiple Internet connections, multiple networks and split access in Linux [duplicate]

Possible Duplicate: load balancing multiple gateway using route and iptables I am having trouble setting up multiple internet connections for split access in Linux. We have 3 internet ...
2
votes
2answers
2k views

Keep source IP after NAT [closed]

Until today I used a cheapy router so I can share my internet connection and keep a webserver online too, while using NAT. Users IP ($_SERVER['REMOTE_ADDR']) was fine, I was seeing class A IPs of ...
2
votes
1answer
102 views

iptables to drop for a while IPs with recently failed connections

I want to decrease the likelihood of a successful ssh attack on a linux system. The only port that is open is 22 (I use port forwarding for everything else), and of course I made sure that ssh accepts ...
0
votes
1answer
213 views

monitoring rx/tx stats of current connections on Linux

In a Linux netfilter router, connections table only includes information on end of connections. Where I reach real time rx/tx information for each connection? (In freebsd, session table already ...
1
vote
1answer
77 views

NAT ports - how do they work?

I have the following network schema: Computer A: three nics: NIC 1 (eth0): dhcp, public internet NIC 2 (eth1): static 192.168.1.1, gateway for Computer B NIC 3 (eth2): static 192.168.2.1, gateway ...