1
vote
0answers
68 views

iptables: unknown option “--dport”

When I try to run iptables -A control_in -p tcp --dport 22 -j ACCEPT I get the error message iptables v1.4.20: unknown option "--dport". Everything I've found on the internet and serverfault relating ...
0
votes
2answers
67 views

How to drop bogus tcp packets through iptables?

We are seeing the issue described here - http://archives.neohapsis.com/archives/bugtraq/2002-10/0266.html In brief, we need to drop bogus packets, such as with SYN+FIN flags set. I can drop this ...
1
vote
1answer
458 views

Dropped ACK FIN, ACK RST, RST packets on webserver with iptables

I run a webserver (Apache) on a Debian 7 machine, with iptables on the same machine. iptables rules are generated by the ConfigServer Firewall (CSF) script. The websites hosted there are fine on my ...
1
vote
0answers
321 views

How to stop NAT dropping idle connections?

I have a TCP connection that can be idle for many hours. The traffic is flowing from the server to the client only. One might say it's kind of push notification. My home router, however, tends to ...
0
votes
0answers
69 views

Can I use IPtables to access/mangle the contents of a TCP “optional header field”?

Can IPtables stuff data into and recover data from the TCP Optional Header Field area? I'd like to have one server add some "tags" to a packet, and another server see those tags and take action on ...
0
votes
2answers
486 views

How to globally limit total number of TCP connections with iptables?

I'm having quite a difficult time figuring out how to REJECT both inbound and outbound connections from a machine with iptables once the total number of TCP connections hits a global maximum without ...
7
votes
1answer
2k views

Unexpectedly shrunk window

I run a major media upload/download site and I noticed these: Is this serious or background noise due to the big file sizes and is there any tweaks I can add to /etc/sysctl.conf to improve and ...
1
vote
1answer
284 views

How to reset a tcp connection immediately on both ends on a certain condition using linux netfilter/iptables?

Dear Serverfault community, I have the following problem: I need to reset (disconnect) tcp connections on both network sides immediately if a certain string is encountered in the packet data. I don't ...
0
votes
1answer
99 views

TCP packet filter based on TCP sequence

I need to build a test environment with a very precise packet loss based on specific TCP sequence or, optionally, on payload content. I couldn't figure out how to do it with tc or iptables. What tool ...
1
vote
0answers
96 views

Strange dropped packets coming from port 8888 and with ACK or ACK+PSH set

Background During an incident on a small privative network (1 router/FW + 1 server) my server got accidentally exposed to the internet. Fortunately it was protected by it's own UFW to allow only 1 ...
1
vote
1answer
386 views

How to edit TCP window size from iptables?

There is TCPMSS target to edit MSS value of connections (including forwarded). How to edit window size (for example, cap to some maximum value) by iptables rule? Expecting something like iptables ...
0
votes
1answer
71 views

Route TCP responses (ACK) through another interface

For reasons I can't go into, I am working with a strange network configuration. I have a one-way higher speed wireless link, and a slower bi-directional wireless link. There is a network interface ...
-1
votes
1answer
171 views

iptables NAT Forward 443 Port DNAT,SNAT failing

I'm trying to setup a proxy server that handles http and forwards https to the webserver. Client > Proxy > httpd I added the rules: iptables -t nat -I PREROUTING -i eth1 -p tcp -m tcp --dport ...
3
votes
1answer
275 views

Enabling TCP md5 signature option in centOS?

I'm trying to enable md5 checksum/signature for tcp packets in centOS (the main use case to stop tcp RST attacks, etc). It seems like I may be able to do this for individual ports using netcat or via ...
2
votes
2answers
2k views

Reduce firewall rules by half - one iptables rule for tcp and udp

I have a number of iptables rules on my firewall that look like this: iptables -A zone_lan_forward -p tcp -d 1.2.3.0/24 -j ACCEPT iptables -A zone_lan_forward -p udp -d 1.2.3.0/24 -j ACCEPT Is ...
3
votes
1answer
120 views

TCP 443 Connection goes into server but never reaches Apache2 (Passenger)

We have some weird problems, when external servers try to connect to our Website on Port 443(TCP) which is an Apache2+Passenger and a Rails Application. The problem only happens rarely. I started to ...
3
votes
1answer
468 views

Rotating outgoing IPs using iptables

I am trying to rotate outgoing IPs using iptables. I want to rotate outgoing connections between three IPs, one by one. Here is what I'm doing with iptables: root@server:~# iptables -t nat -I ...
0
votes
2answers
88 views

limit connexions to my proxy

I have a slow internet bandwith (1024 KBITS/S) to share between 30 users. To control the traffic, I have setup a basic proxy server with iptables. Logs and Packets captured with tcpdump show that ...
0
votes
1answer
140 views

Routing config between internet load balancers and backend

Im facing a problem due my lack of experiencie on routing. I need to config the next things (all run on my computer virtualized, if works, i will pass it to hardware) [internet] ---- ...
1
vote
1answer
236 views

Iptables -gw parameter

I want to copy tcp traffic. i want to use these commands " iptables -A PREROUTING -t mangle -p tcp --dport 7 -j ROUTE --gw 1.2.3.4 --tee iptables -A POSTROUTING -t mangle -p tcp --sport 7 -j ROUTE ...
3
votes
3answers
427 views

How can private IPV4 addresses get past iptables NAT (tcp RST,FIN)

I've got a router performing simple NAT translation using iptables iptables -t nat -o -j MASQUERADE This works fine almost all of the time except for one particular case where some TCP RST and FIN ...
1
vote
0answers
51 views

Effective ways of mitigating Spoofed Syn Flood with iptables [duplicate]

Possible Duplicate: SYN Flood Advice Heyo, Been dealing alot with spoofed syn floods lately. Are there any tips or tricks we could do to better survive them? Syn Cookies are already ...
1
vote
1answer
309 views

iptables tcp proxy rules not working

I have several servers that need to connect to a remote service. These servers are ec2 instances under my control. The remote service is run on a server managed by my company, but not my department, ...
1
vote
1answer
259 views

iptables/haproxy limit packets per second

Is it possible to limit incoming tcp packets per second (or bytes per second) with iptables or haproxy? I have found many examples but none of them seem to work.
2
votes
1answer
939 views

Trying to make iptables stateless is causing unforeseen filtering

I'm trying to improve the performance of my server by tuning iptables to not keep track of TCP connection's state. I'm looking at this guide: ...
1
vote
1answer
189 views

centos iptables, restrict tcp port to specific ips

I would like to modify the iptables on my CentOS 5.8 server so that only specific ips can connect to the machine on a specific port. Currently, I have the following in my iptables file: -A ...
1
vote
1answer
255 views

iptables accept only three-way handshake

With iptables I want to accept three-way handshake of a TCP connection and then drop the connection. Is it possible, if so how?
1
vote
0answers
508 views

Disable kernel processing of TCP packets for raw socket

I'm working on a TCP/IP implementation, for an embedded device, that I want to test from a Linux user space process using raw sockets. raw(7) says that Raw sockets may tap all IP protocols in ...
1
vote
3answers
3k views

How to formulate IP forwarding rule using iptables

I have two Systems A and B. A is a TCP Client and sends a message to TCP Server on B. ------------------ -------------------------- System A System B ...
4
votes
1answer
334 views

What happens to tcp packets when they are unable to finish the 3 way handshake?

Firewall for a virtual dedicated server. I was looking into how to prevent a FIN scan and it got me thinking about the consequences. A lot of people are using this rule: -p tcp --tcp-flags ...
7
votes
2answers
1k views

tcp flags in iptables: What's the difference between RST SYN and RST and SYN RST ? When to use ALL?

I'm working on a firewall for a virtual dedicated server and one of the things I'm looking into is port scanners. TCP flags are used for protection. I have 2 questions. The rule: -p tcp ...
2
votes
1answer
1k views

Block all incoming DNS requests EXCEPT from IPs x,y,

I want to block all incoming requests on my two DNS servers APART FROM certain IP addresses e.g. IP of 1.2.3.4 will be allowed to make requests but NOBODY else will. How do you do this with iptables? ...
0
votes
1answer
622 views

Using iptables to redirect according to pattern-matching (--string)

what I want to do is to redirect web traffic in this way: Every request to port 80 that HTTP GETs a given address should be redirected to a particular port (4444). Every other request goes to port ...
1
vote
1answer
223 views

Server behind DMZ firewall won't respond

I have a DMZ server set up to forward specific ports to a couple of machines. The intended behavior is for me to send a request to the DMZ on a specific port, and have the machine that's inaccessible ...
4
votes
1answer
364 views

droping packet on iptables = wasting bandwidth?

recently I do this on my iptables : -A INPUT -p tcp --dst 192.168.0.0/16 -m hashlimit --hashlimit-above 32/sec --hashlimit-mode dstip --hashlimit-name hosts -j DROP it seems that if my client ...
4
votes
1answer
899 views

IPtables rate-limit, What are the differences between modules? Recent, Limit

I am doing some rate-limiting with IPtables, and i'm not sure if I should use "Recent" or "Limit" What are the differences between the two? If they both achieve the same result, which one has ...
1
vote
1answer
49 views

nat with iptables, re-connecting fail within about 3 minutes

i constructed a nat with iptables, as following: echo 1 > /proc/sys/net/ipv4/ip_forward iptables -t nat -I PREROUTING -p tcp --dport 9000 -j DNAT --to xx.xx.xx.xx iptables -t nat -I POSTROUTING -p ...
2
votes
4answers
1k views

(Linux) Can multiple processes bind to the same TCP port on a per-use basis?

As part of a pilot project, I am attempting to set-up a thin client environment for a team of developers using NoMachine. Each developer will login to the same Linux box and do development via an X ...
3
votes
3answers
2k views

Easy way to “edit” the traffic coming from a tcp host (linux)

I need to make some small modification to incoming traffic from a known tcp host:port before the process handling the connection get the stream. For example, let 192.168.1.88 be a remote host which ...
5
votes
2answers
2k views

Duplicate incoming TCP traffic on Debian Squeeze

I have to test a homebrew server that accepts a lot of incoming TCP traffic on a single port. The protocol is homebrew as well. For testing purposes, I'd like to send this traffic both : - to the ...
4
votes
3answers
312 views

iptables redirect IP address

I have an application (mirth) on a server (10.2.2.200) that on port 6661 is receiving an HL7 feed from an egate server from 10.0.1.234 port 56789. For each message it receives/processes, its ...
2
votes
2answers
882 views

SSH disconnection issue - TCP RST packets

I have a SSH disconnection problem, disconnection occurs randomly. Sometimes, it works fine and other times I am frequently disconnected. After the disconnection I can again re-connect and continue to ...
1
vote
1answer
2k views

TCP: Treason uncloaked! shrinks window Repaired

I have this error. The server works fine but sendmail doesn't. I can't reach it for download emails but it sends them. I have this when I type dmesg: TCP: Treason uncloaked! Peer ...
0
votes
2answers
551 views

Simulate a bad TCP connection with iptables?

I want to forward TCP connections on a certain port of the machine A to another port on the machine B (which is actually the same that originated the connection to machine A) and simulate random or ...
3
votes
1answer
643 views

tcpdump output with iptables REJECT policy enabled

Quick question. I have a firewall with these simple rules: iptables -A INPUT -p tcp -s 127.0.0.1/32 --dport 6000 -j ACCEPT iptables -A INPUT -p tcp -s 192.168.16.20/32 --dport 6000 -j ACCEPT ...
3
votes
2answers
761 views

Linux: Invalid TCP Flags

It is often recommended in tutorials and books to filter invalid TCP flags with iptables. I wonder if those aren't already filtered by the kernel itself or the iptables state module. Does anyone have ...
3
votes
2answers
963 views

Why is iptables not dropping packets?

I have the following rule in our iptables config file /etc/sysconfig/iptables -A INPUT -s 84.23.99.97 -j DROP And when I do iptables --list I get the following Chain INPUT (policy ACCEPT) target ...