Tag Info

Hot answers tagged

5

The order of rules in Netfilter tables are important. You should move PUB_IN and ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 rules after your DROP rules. The rule with state RELATED,ESTABLISHED should remain in place. If the rules are matching complementary traffic, you should order them with bigger prefixes on top (e.g. /4 should be on top /32 on ...


3

Both Fedora 22 and Centos 7 is shipped with firewalld as default firewall. I got a the same behavior when testing on a Centos7 when having firewalld and iptables enabled at the same time. Check to see if systemctl list-unit-files|grep firewalld is enabled if so disabled it with: # systemctl disable firewalld rm ...


2

You don't need to add or even have custom direct chains (though you can if you want to get really complicated. Just add to your existing chains directly. After IP version, table, chain and priority, you simply specify the relevant iptables options: firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 \ -m owner --uid-owner $UID -j ...


2

If you're writing your own NAT rules for your virtual machines, rather than allowing libvirt to manage them, then the virtual network to which the VMs are connected should be set up as a routed network, not a NAT network. You can fix this with virsh net-edit <network> and change: <forward mode='nat'/> to: <forward mode='route'/> ...


2

Yes, iptables will do the job. Set default policy for OUTPUT to accept: iptables -P OUTOUT ACCEPT. Allow all IPs by repeating same rule but changing source IP like: iptables -A INPUT -s ip1 -p tcp --dport 443 -j ACCEPT. Allow SSH port 22: iptables -A INPUT -s ip4 -p tcp --dport 22 -j ACCEPT. You need to deny other traffic for INPUT chain or set default ...


1

tl;dr: iptables is really literal, don't forget localhost rules. Okay! Got it. Michael Hampton gave me the idea to use a logging rule (this was my first time). So I did the following: Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- 10.0.0.0/8 anywhere ACCEPT all -- anywhere ...


1

Kernel handles TCP handshake by default Try to make a TCP connection $ telnet localhost 8877 Trying 127.0.0.1... telnet: Unable to connect to remote host: Connection refused Here connection is refused by kernel directly. To stop kernel handling TCP connections, you can add netfilter rules. Following command makes kernel ignore TCP packets coming to port ...


1

Container communicates with host using docker0 interface. To allow traffic from container add: -A INPUT -i docker0 -j ACCEPT


1

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -d 100.80.77.8 -j ACCEPT before the rule you show above (ie, handle the exception, then the rule). iptables doesn't do DNS (in any way that you want) so abandon any thoughts of layer-4 handling - it's strictly a layer 2/3 tool. If you find this doesn't work, we'll need to see all your rules to make ...



Only top voted, non community-wiki answers of a minimum length are eligible