iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

2
votes
2answers
46 views

Are there ways to break into a machine if iptables drops all traffic?

Say I install Linux on an blank computer (no other OS, disk is formatted for installation), and I configure this in iptables: iptables -F iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P ...
1
vote
0answers
23 views

How can I use iptables to block certain processes from accessing the network? [duplicate]

I can set the processes to run under special uid's and use the technique from this SF answer: -A OUTPUT -m owner --uid-owner 400 -j DROP ...But are there any other ways to blacklist based on the ...
4
votes
0answers
16 views

Debian Wheezy subnet configuration (proxy, MASQUARADing etc.)

I have a "server" with eth1 having a full IP address, DNS, gateway and proxy name connected to the university internet/intranet provider and eth0 IP 192.168.1.2 connected by a gigabit switch with two ...
2
votes
1answer
29 views

What -A INPUT -j REJECT --reject-with icmp-host-prohibited Iptables line does exactly?

What do the following lines do? I have been reading redhat iptables documentation but can't figure it out. ... -j REJECT --reject-with icmp-host-prohibited ... -j REJECT --reject-with ...
1
vote
1answer
19 views

rtorrent: 'Tracker Timeout' caused by IPtables

I'm trying to secure my rtorrent-running-homeserver with IPtables. With the aim to allow only incoming connections to the rtorrent port 6890 and 5292 for ftp (both are forwarded by the router), I ...
0
votes
1answer
71 views

Masquerade not working sometimes

I have an issue with private network traffic not being masqueraded in very specific circumstances. The network is a group of VMware guests using the 10.1.0.0/18 network. The problematic host is ...
0
votes
1answer
19 views

Simple iptables filter rule for 101/8 block not working

I run a webserver that caters to an entirely local crowd, so to keep hacking attempts to a minimum, I have inserted a bunch of international IP-blocking rules into my iptables, but my filters don't ...
3
votes
1answer
56 views

Configure iptables on remote server without locking me up

I have a little remote server that I can access only with SSH, and what I want to do, is block all the traffic except port 22 for SSH. The first time, what I did was : iptables -P INPUT DROP And ...
0
votes
1answer
27 views

Blanket blocking SMTP with whitelist

So using a VPS environment, whereby we need to block outbound SMTP by default (spammers), with the ability to unblock when needed. We have found some scripts eg: iptables -I FORWARD 1 -d $VPS_IP -p ...
0
votes
4answers
43 views

Linux routing tables

I'm trying to learn Linux routing tables and ran into bit of snag. In the example below I'm not sure what is happening. My understanding is 0.0.0.0 means that for line 1 and 2 any packets outside of ...
2
votes
2answers
115 views

iptables multiple -d flags not allowed

I am trying to log all my outbound connections to a file using iptables. This is my rule: -A OUTPUT ! -o lo ! --destination 127.0.0.1 -m state --state NEW -j LOG --log-prefix "new_connection " ...
2
votes
1answer
83 views

Bad argument `127.0.0.1' in iptables

-A OUTPUT --destination ! '127.0.0.1' -m state --state NEW -j LOG --log-prefix "new_connection " --log-level 7 gives me Bad argument `127.0.0.1' What am I doing wrong? I used this docs : ...
1
vote
1answer
11 views

tcp/ip - trigger action or event after period of no network activity on certain port(s)

Is it possible, perhaps using iptables or one of the wrappers/frontends to iptables, to trigger an action or run a script after a certain period of time has elapsed with no network activity on a ...
0
votes
1answer
35 views

Socket Connection Refused (raspbian) but ports are open for connections

I'd like to establish a connection between my client and raspbian. Within my network, I can connect to my service at any time without any problems. Now I want to connect to my service via the ...
1
vote
2answers
24 views

iptables ignores other rules after add last rule

I have written these rules in iptables: -A FORWARD -i eth1 -o eth0 -p icmp -m limit --limit 1/hour --limit-burst 5000 -j ACCEPT -A FORWARD -i eth1 -o eth0 -p udp -m limit --limit 1/hour --limit-burst ...
1
vote
1answer
26 views

How to see content of dropped packages at OUTPUT chain in iptables

iptables is as below: # iptables -t filter -nvL Chain INPUT (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 ...
1
vote
1answer
39 views

iptables adding rules in OUTPUT chain

We can insert iptables rules based on IP/Network/Hostname: iptables -t filter -A OUTPUT -p tcp -d www.google.com -j ACCEPT -m comment --comment "www.google.com" It is not accepting: iptables ...
1
vote
1answer
24 views

FTP download problems with iptables — Port 21 connection is allowed but “Network is unreachable”

I'm trying to connect to an FTP site but with, e.g., wget: Logging in as anonymous ... Logged in! ==> SYST ... done. ==> PWD ... done. ==> TYPE I ... done. ==> CWD (1) /gcrypt/gnutls ...
0
votes
3answers
42 views

iptables rules - input and output

I'm new with Linux and iptables. I have a Ubuntu Server distro (12.04) on a PC which has 2 network interfaces (eth0 and eth1). I also have 2 laptops, one is plugged to eth0 and the other to eth1. ...
2
votes
1answer
54 views

Bad built-in chain name with iptables-restore

I saved my iptable settings on a Ubuntu 11.4 system using iptables-save >filename I then replaced the Ubuntu system with CentOS 6.5 and tried to restore iptables using iptables-restore ...
1
vote
2answers
29 views

What network protocols do database servers use?

I have a postgres 9.1 server running on the default port 5432 on an ubuntu 12.04 cloud server. I want to open up the port so I can make remote queries -- but I have to open the port on IP tables, ...
0
votes
1answer
32 views

SSH E-mail login alert if SSH port is as NAT

Can you help me with this problem please? How can I set e-mail alerting after SSH login when port 22 is NATed? I use Linux Debian 7. I have used these iptables rules: eth0 - external network, eth1 - ...
1
vote
1answer
54 views

Why aren't my iptables rules appearing in the relevant list after reboot?

I am trying to write two persistent NAT rules, which I save via iptables-save > /etc/iptables.ipv4.nat, and restore upon reboot via pre-up iptables-restore < /etc/iptables.ipv4.nat in my ...
1
vote
0answers
64 views

How to redirect tun SSL VPN through HTTP CONNECT proxy, using iptables?

I use a VPN under SSL solution (Firepass) on Android. VPN opens an SSL connection on port 443 of remote VPN server. My mobile carrier doesn't allow direct connections on port 443 but allow SSL ...
1
vote
1answer
72 views

Is this what it looks like in the terminal on the client side when you are blocked out via fail2ban?

I am a new server admin. I just setup fail2ban on an ubuntu 12.04 VPS. I used this tutorial. Then I tried to login to the system via ssh from a friend's machine. It is showing "operation timed out." ...
1
vote
1answer
165 views

High performance routing with high churn ruleset. What approach is most likely to scale to C10K and beyond?

I've been asked to create a high throughput router using PC / server hardware. I'm modestly familiar with pf, iptables, and tc, but I've never had such high churn and so many rules. I hope you can ...
0
votes
0answers
55 views

iptables: how to redirect outgoing, public ip traffic to localhost:6666, not touching private ips

I want all outgoing to traffic that is directed to a private IP (10.0.0.0 - 10.255.255.255, 172.16.0.0 - 172.31.255.255, 192.168.0.0 - 192.168.255.255) to be untouched. I want all other traffic ...
0
votes
1answer
35 views

iptables correctness verification

I have so many questions around iptables and how it works. But we're using a modified kernel, and hence whatever experiment I try and fail, I can't be sure if it happens with Linux in common or just ...
0
votes
1answer
56 views

Iptables rule to allow only one port and block others

We have two apps running (on top of linux) and both communicates through port 42605. I wanted to quickly verify if this is the only port that's been used for communication between them. I tried below ...
3
votes
1answer
41 views

Did this tutorial block pings to my server?

I am a programmer teaching myself linux admin stuff. I followed this tutorial to setup a firewall on a VPS. As a part of that tutorial, I block all traffic except for web traffic and SSH traffic. I ...
1
vote
1answer
21 views

Will this open up a non-standard port to ssh?

I am following tutorials on iptable and want to allow ssh traffic on my non-standard SSH port = YYY. I think this is how you do it, but want to double check so I don't lock myself out of my server. ...
0
votes
1answer
31 views

What does the last column in this IP table mean?

From a tutorial, I run $sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT $ sudo iptables -L and get target prot opt source destination ACCEPT ...
0
votes
2answers
31 views

What is the default action for incoming packets that don't match explicit iptables rules?

CentOS 5.x I'd like to understand what is specifically happening to incoming packets that don't explicitly match rules in my iptables chains. Is the default action to reject them? Or drop them? ...
0
votes
1answer
54 views

The Iptables don´t allow update the system [closed]

These rules don´t allow update the system (Debian wheezy on raspberry pi). Don´t allow ping: ping: sendmsg: Operation not permitted. I am trying to install a home web server and this rules don´t work ...
0
votes
2answers
56 views

what process is listening on a given port

I have several problems: some process is attempting to send data and the firewall is rejecting it at the rate it is sending it out firewall logs flood the system (may need to rate-limit the logging) ...
2
votes
1answer
36 views

Forward a host's network traffic to another host with the exception of SSH traffic

I am trying to redirect all the network traffic received in a old host to a different host. For that I created two new rules with iptables on the old host: echo 1 > /proc/sys/net/ipv4/ip_forward ...
0
votes
0answers
13 views

Apply iptable to ongoing communication

I have 3 hosts running, all in the same network. Host A and C are continuously communicating and host B poisoned both host A and C ARP caches so the traffic goes through it. However, if I apply this ...
1
vote
0answers
31 views

Corosync & Pacemaker IPTables Rules

When using Corosync with two rings via multi-cast addresses 226.94.1.1 (Port 5405) & 226.94.1.2 (Port 5406) what iptables rules are required to allow two nodes to communicate optimally without ...
1
vote
0answers
21 views

Prerouting issue

I have three hosts: A, B and C. Let's say host A is continuously communicating with host C (e.g. poll - response). Now, I spoof both ARP tables of host and A and C with host B and want to block ...
1
vote
1answer
53 views

Webserver establishing new outgoing connections from port 443

I've been trying to configure the firewall on a webserver running Apache using iptables commands. I took the approach of blocking all outgoing connections, except for those that are required. ...
2
votes
1answer
24 views

Should IP tables rules affect a serial port on Linux

I'm trying to setup some iptables rules on my embedded Debian Linux system, using a serial console I entered this: root@ts7600-47aad3:~# iptables -F root@ts7600-47aad3:~# iptables -P INPUT DROP ...
2
votes
0answers
55 views

IPtables rule to double NAT [closed]

Let me rephrase it.. I just need an IPtable rule to do double NAT-ting.. Host A - Host B - Host C - Host D Host B should do both source NAT and destination NAT, so that my request from Host A ...
0
votes
1answer
32 views

APF firewall & IPset

Due to too many hack attempts from spam countries, today got the server configured with IPset for iptables. I loaded thousands of ip range in IPset & then added it to iptables with this command ...
3
votes
1answer
44 views

How does iptables recognize packet state?

Consider these two sets of rules: Set A -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT -A INPUT -j REJECT -A OUTPUT -j ACCEPT Set B -A INPUT -m conntrack --ctstate ...
0
votes
1answer
64 views

Some packets are flagged as INVALID by iptables

I configured a proxypass rule in order to redirect requests from the port 443 to a JBoss server running on port 8080. All works fine except some 503 errors in the Apache log, around 10 per day: In ...
0
votes
0answers
176 views

IPTables “iptables table `filter': Table does not exist (do you need to insmod?)”

I'm trying to get iptables working for my embedded Debian system, kernel version 2.6.35.3-571-gcca29a0. I've tried to enable iptables support in the kernel by selecting these options (this is a diff ...
1
vote
1answer
92 views

iptables forwarding between subnets

I want to forward traffic between two subnets, I'm not very familiar with iptables. The forwarding works except when iptables is enabled. There must be something wrong with the rules, though ...
1
vote
2answers
40 views

Run shell script based on IPTABLES port access attempt

Is there a way in Linux (RHEL 5-6) using IPTABLES, that if someone tried to access port 21, as an FTP user, to log what the user name they are trying to authenticate as and additionally run a shell ...
0
votes
0answers
21 views

Proper way for setting general policy and firewall rules with libvirtd

I'm just struggling with the firewall configuration of our new KVM Host. I think by now I understand how libvirtd implements networking, but I'm missing a way to set some decent firewall rules. To ...
0
votes
1answer
102 views

how to forward from port 80 to 8080 using iptables without opening port 8080?

The following iptables configuration work for forwarding port 80 to 8080. #nat chains *nat :PREROUTING ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A PREROUTING -i bond1 -p tcp -m ...