Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [iptables]

iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

0
votes
0answers
10 views

Firewall Configuration fails for FTP Passive Mode in LXC Containers

The following scenario: 2 LXC/LXD containers are running on the vServer (Debian 9). Both have one ProFTPd server each (1st port: 21, 2nd port: 2121). I use a bridge for LXC (which was created by the ...
0
votes
0answers
10 views

Proxy setup between a private and public [duplicate]

I have two servers: Private Server with IP: 172.16.0.2 Public Server with 172.16.0.3 (private IP) and x.x.x.x (public IP) What I want to achieve is: Incoming communications to Public IP (x.x.x.x) ...
-1
votes
0answers
16 views

iptables: change source port of incoming udp packet [on hold]

I'm trying to get mDNS working on a network that blocks port 5353 (the standard mDNS port). My plan is to make packets that are typically output on UDP port 5353 redirect to 5358, and make udp ...
-1
votes
0answers
17 views

Redirect access to service using NAT with iptables [on hold]

I am new to iptables implementation and need some help to understanding how to create a specific rule for my server. The situation is this: I have local service which is using port 80 and want to NAT ...
1
vote
1answer
40 views

Forwarding traffic between two interface

I have a Linux box with two interfaces: ~#ip -4 addr show scope global 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 1000 inet 192.168.45.101/24 brd ...
-2
votes
0answers
11 views

How to allow client to use DNS server through gateway [on hold]

Lets say i have: gateway - 5.5.5.5 DNS server - 1.1.1.1 client - 9.9.9.9 how to allow client reach DNS server and make query? I know some kind of forwarding is required.
0
votes
1answer
14 views

Forwarding traffic from a host to a host's container

I have two hosts in a network 192.168.0.0/24: Host A 192.168.0.15 Host B 192.168.0.13 And there is a remote ssh tunnel from B to A: ssh -R 192.168.0.13:8080:192.168.0.15:8002 192.168.0.13 -N and ...
0
votes
1answer
45 views

IPTables forward traffic coming from port + subnet-mask to another port

I have a raspberry pi on which I'm planning to run 2 DNS-servers, both authoritative, one on port 53, and one on port 54. What I want is all except some traffic to go to the first one, and then all ...
0
votes
1answer
30 views

Proxy setup between a private and public

I have two servers: Private Server with IP: 172.16.0.2 Public Server with 172.16.0.3 (private IP) and x.x.x.x (public IP) What I want to achieve is: Incoming communications to Public IP (x.x.x.x) ...
0
votes
0answers
10 views

host + docker iptables rules confusion

I have an Ubuntu 16.04 running Docker and I am attempting to secure this server such that it only accepts: SSH connections HTTP connection HTTPS connection I know to add iptables policies before ...
0
votes
1answer
20 views

Another app is currently holding the xtables lock

I've been using a bash shell script to set complex iptables rules for years. However, on Debian Stretch when I tried to use a script, it became sluggish and left iptables in a bad state. When I ...
-1
votes
0answers
11 views

How to use IPTables and geoip to route outgoing traffic to vpn tun based on selected country?

I’m trying to set up an Linux router in our office in China, that also connects our overseas server thru VPN connection. I would like to route all overseas (outside China) bound traffic to VPN tunnel ...
1
vote
1answer
44 views

Preventing a server from accessing parts of the network

I did a preliminary search and was unable to find an exact / similar question. I'm configuring a server in our network, in order to give SSH access to a normal user from a third party. I'm trying to ...
-5
votes
1answer
78 views

Debian 9 dummy network adapter - works on Local but not Remote?

I'm trying to set up an IPSEC tunnel between my remote external server and a locally situated machine. My remote has a naked public IP4 in a data-centre. My nearby server has a local NAT hidden 192....
0
votes
0answers
19 views

Bypassing a Load Balancing Packet Marking setup for Rate Testing on Centos 7

Trying to Bypass a load Balancer Our system has directs network traffic into a three way load balancer across three cellular modems in normal operation. We use a program called speedtest_cli that ...
0
votes
1answer
24 views

Port forwad public ip port to internal server on different interface

Hello I am trying to port forward a public ip:port I have on a wan interface to a server on my lan my server has two interfaces ens19 [WAN] ens18 [LAN] I then have another server connected on the ...
0
votes
1answer
22 views

Is it possible to whitelist a domain and all subdomains in IPTABLES?

#!/bin/bash IPT="/sbin/iptables" Using a drop all policy for IPTABLES echo "Set default policy to 'DROP'" $IPT -P INPUT DROP $IPT -P FORWARD DROP $IPT -P OUTPUT DROP Trying to define specific ...
0
votes
0answers
29 views

Redirect web traffic in OpenVPN server

Long story short: I have a functioning OpenVPN server (odroid-XU4 running Ubuntu Mate) and can successfully connect to it from 3 different clients (gentoo, Kubuntu and android). I want to route all ...
0
votes
1answer
15 views

“ip rule to” works but “ip rule fwmark” fails - why?

I have a CentOS 6 (kernel 2.6.32) router with working OpenVPN client on it, and I want to redirect some traffic via VPN server. Client (192.168.60.159) sends request to router (192.168.60.6:1443), ...
1
vote
3answers
77 views

VPN client unable to access LAN

I have a server on the office lan with a public ip running open vpn. External vpn clients can connect to the vpn via the public ip. But once connected they are unable to connect to other servers on ...
0
votes
1answer
15 views

verbose output for ip xfrm command?

I have an up script for strongswan that adds policies like this: ip xfrm policy add dir in src $PLUTO_PEER_CLIENT dst 0.0.0.0/0 proto any varl src $PLUTO_PEER dst $PLUTO_ME proto esp mode tunnel ...
-2
votes
0answers
16 views

openvpn creative ways of opening access to internal web servers on common subnets

I have an openvpn routing setup that puts users on 10.8.0.0/24. It forwards traffic to 192.168.0.0/24. My problem is that 192.168 subnet is too common and some of my users can't reach internal web ...
0
votes
0answers
7 views

docker issues (mount folder and after restarting iptables)

I have issues when running docker for some SMTP services. Host server IP : public ip address Docker host: 192.168.1.1 docker container: 192.168.1.2 Host OS : Centos7 Docker image : Ubuntu 1) mount /...
0
votes
0answers
17 views

Netfilter: force IPv6 client to use another source address

I have a network with two IPv6 subnets: one is a native connectivity and one is a Hurricane Electric 6in4 tunnel. When clients initiate a connection towards the Internet, they usually choose a source ...
0
votes
0answers
18 views

iptables cgroup no chain/target/match by that name

im running raspbian on my pi and im trying to route some stuff around my vpn. im trying to run something like explained here: How to bypass OpenVPN per application but trying to use iptables -t ...
0
votes
1answer
18 views

How to open a port in Linux for other users in same network?

I have an application running that is listening on port 7896. I can access that using localhost and port 7896 but other users in the same network can't access that using my IP address and port 7896. I ...
0
votes
1answer
58 views

blok udp 53 traffic to Internet only from lan

i want to block all dns queries from lan to Internet so only server allowed to make dns requests so i need rule to dns requests from eth0 to Internet allowed, lan to eth1 allowed, but lan to Internet ...
0
votes
0answers
27 views

iptables block dns port 53 access to specific LAN IP

I need help to block traffic dns/http/https using iptables for a specific IP (ex 192.168.1.36). But I have to allow only one site (ex: globo.com) The DD-WRT router is the network gateway (192.168.1.0/...
0
votes
0answers
11 views

What ports do I need to use in iptables for ftps and vsftpd?

The answers in this question aren't working for me. Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere anywhere ...
1
vote
2answers
41 views

What is the downside of deleting an iptables rule as an attempt to check if it exists?

I want to add a rule using iptables, but only if it does not exist already. There's option -C which will allow us to check if a rule specification exists already. The option is described in this Q&...
0
votes
0answers
21 views

iptables - match address of interface

Can I configure iptables to only match packets that match (one of the addresses) of the host itself? Without hardcoding these in the configuration files? The goal is to have port forwarding on the ...
1
vote
1answer
31 views

iptables block outgoing on port, allow selected IP's [duplicate]

Debian 7 iptables v1.4.14 (there are no rules) Need to block all outgoing connections on ports 25,587,465 and allow only on specific IP's. What I've tried: iptables -A OUTPUT -p tcp --match ...
0
votes
0answers
34 views

Iptables rules depending on network connected to [migrated]

I've struggling around something I would like to put in place. I use my ubuntu 18.04 laptop at work and at home. I would like my iptables to drop all incoming connections (except established ones of ...
1
vote
1answer
37 views

Replacing IP address of connections from AWS towards SIP

We have installed a PBX on AWS and connected it to our on-prem Router via VPN. My on-prem router is connected to the SIP provider via a physical connection with another on-prem MUX device (device ...
0
votes
1answer
20 views

Routing and OpenVPN not running on the default gateway

I'm having difficult time setting the correct iptable in order to route OpenVPN traffic to my internal OpenVPN client. My network is similar to this +-------------------------+ ...
0
votes
1answer
48 views

iptables: Questions regarding the raw table

I can read all over the internet that the iptables raw table is only there to specify if connection tracking should not be applied. However, when a rules destination in the raw table is -j DROP for ...
1
vote
1answer
37 views

Host blocking all but icmp

I'm having a strange issue on a Centos 7 VM host (qemu-kvm). I have two VMs which, up until a week ago, were working perfectly fine with bridged networking. Now they can no longer access anything on ...
2
votes
1answer
41 views

How to split outbound traffic by destination IPs on aws with static IP?

Conditions are below. Use static IP for all outbound traffic. Send traffic through VPN Connection if it has the specific destination IPs. Send traffic through the Internet if it has NOT the specific ...
5
votes
3answers
120 views

How can I duplicate incoming DNS packets and send them to a different nameserver with iptables?

EDIT: the tldr: I want to use TEE and NAT to clone UDP traffic. I'm not worried about handling responses. I ideally don't want to install new software. I am using TEE to send to local segment (127.0.0....
0
votes
1answer
41 views

Port-forwarding traffic to remote server using iptables

I'm struggling to set up an infrastructure where MySQL replication traffic from an Amazon RDS instance is forwarded over an OpenVPN link to a second server. There is an Ubuntu EC2 instance running ...
0
votes
0answers
18 views

Switch this setup to use charon instead of pluto?

I using this wiki but using a newer version of strongswan: https://docs.openvpn.net/configuration/extending-vpn-connectivity-to-amazon-aws-vpc-using-aws-vpc-vpn-gateway-service/ My version uses ...
0
votes
0answers
5 views

Netty application gets reset flag from client

I have a Netty application, that is running inside a private network. When I access the netty application from inside the network, it works fine. Now we have to access it from outside the network. We ...
0
votes
1answer
55 views

Putting Tomcat on Port 80 on Amazon Linux 2 (iptables?)

I'm configuring a new EC2 instance, which will be running Tomcat, and I want it accessible on Port 80. Within Amazon Linux 1, the primary strategy I saw people using was to use iptables to do port ...
1
vote
1answer
35 views

iptables: Rate too fast Error

I want to set hard limit for incoming UDP packets on my Linux machine which is inside 10 Gigabit LAN. Following command works fine /sbin/iptables -A UDP-LIMIT -m limit --limit 10000/s --limit-burst ...
1
vote
0answers
22 views

iptables Rerouting by owner, first connection always fails

I am trying to reroute all connections of a user to go only via openvpn tunnel. the tunnel uses net30. This is my upscript (after many battles): #!/bin/bash rt_table="mtunnel" # make sure that rt ...
-1
votes
0answers
17 views

squid transparent proxy fail to connect to parent proxy

im tryn to configure a squid transparent proxy on Ubuntu 18.04, i obtain internet thanks to a parent proxy. I have 3 Ip declare on my iptables config file 172.16.1.8 is an administration ip , 172.16.1....
0
votes
0answers
17 views

3proxy: Redirect traffic to local transparent proxy

I am trying to setup a transparent HTTP proxy on a Linux host machine that directs all traffic to an external parent proxy. I am using 3proxy for this. After reading the documentation at https://...
-1
votes
0answers
24 views

How do I route all requests from one linux server to another?

I want to route all requests from server A to server B (like a proxy) (i want to hide the ip from server B because Server A have a good ddos protection and server B not) I tryed this but this ...
0
votes
0answers
17 views

Server with multiple networks, interconnected

So I have a server with multiple networks (network cards) Specifically: Internet (eth0) Bal (eth1) Admin (eth2) Wp (eth3) Tool (eth4) The network Bal contains load balancer (for ease let's say there ...
1
vote
1answer
147 views

Destination unreachable (Host administratively prohibited)

I'm using a host-only network in virtualbox. The host (Windows): 192.168.56.1/24 The guest (CentOS): 192.168.56.101/24 There's a simple http server which listens on 0.0.0.0:8080 running in the ...