iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

1
vote
1answer
30 views

iptables rule in /etc/rc.local are not loaded

/etc/iptables.conf contains a rule to dump my outgoing packets to 10.199 network as, *filter :INPUT ACCEPT [122:9273] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [73:8165] -A OUTPUT -d 10.199.48.0/24 -j ...
2
votes
1answer
23 views

traffic routing with DNS

I have 2 gateway machines. 1 debian (main - 192.168.1.1), 1 centos (backup 192.168.1.2). There are 2 networks, 1 LAN and 1 WAN, going through "main" and from there over ISP1 "backup" is on LAN and it ...
1
vote
0answers
14 views

How to drop packet if conntrack entry not present

Is there a way to check if conntrack exists before doing a particular action in iptable chains ? I would like to drop the packet in mangle-postrouting if conntrack entry is not present, dont want it ...
0
votes
1answer
9 views

CONFIG_NF_CONNTRACK is not set

I am trying to setup iptables on udoo quad but I hit a brick wall and cannot find a fix anywhere: root@udoo:/# uname -a Linux udoo 3.0.35 #10 SMP PREEMPT Wed Jul 30 18:16:10 CEST 2014 armv7l ...
0
votes
1answer
47 views

iptables do not work, very slow to process on Debian 8

I never had issues with Debian 7 using iptables. However, with Debian 8, I cannot get iptables to work at all. Simple script like this takes several minutes to load and can't access my portal page. ...
0
votes
0answers
8 views

PPTP IPs different than LAN ips

in /etv/pptpd.config I have: localip 1.0.0.1 remoteip 10.0.0.100-200 my server real IP is 192.168.1.40 (my LAN is 192.168.1.0) is it OK to do it? how I can route it so the clients with ...
2
votes
1answer
15 views

route some traffic in subnet to other gateway

I want to route traffic destined for 192.168.5.0/24 to a gateway of 10.1.10.24, but all other traffic to a gateway of 10.1.10.1. I tried: ip route add 192.168.5.0/24 via 10.1.10.24 but it seems to ...
1
vote
1answer
14 views

Using IPTables to Block Ports to Class A Subnets While Allowing Web Ports (80/443)

This is about a cPanel server which, like most servers, is under constant attack from lands afar. Considering that I only host to clients in the US and Canada, there is less of a reason to allow full ...
0
votes
1answer
23 views

How to find what custom config is used by iptables?

I need to open custom iptables config, and change old IP adrees to new. How i can find what custom config is used by iptables?
-1
votes
1answer
37 views

Centos 7 - firewalld - passthrough traffic with firewall-cmd

How can I allow traffic from some hosts network A (behind eth0 interface) through my centos 7 box to network B (some hosts behind eth1). network A: 1.1.1.0/24 network B: 2.2.2.0/24 Firewall ...
0
votes
0answers
34 views

CentOS 6.6 iptables hit count maximum value

I'm working on CentOS 6.6. I'm trying to change the default value of iptables 'hitcount'. But I'm not sure how to change it. I referred to this link for reference. Two problems I see here: I ...
2
votes
0answers
10 views

How to unwrap a tunneled packet in iptables/netfilter and process the tunneled packet

I have a specific question regarding the Linux netfilter/iptables interaction. Let's say I have an IP packet P1 inside of another IP packet P2 (that is, P1 is tunneled). Now, the question is as ...
1
vote
2answers
44 views

iptables -I FORWARD -j DROP does not cut existing connections

Have a router with openwrt. Want to temporarily cut all transit traffic without changing router's configuration. Do: iptables -I FORWARD -j DROP New connections cannot be established now, but ...
0
votes
0answers
35 views

enable/disable domain redirection

My router can be joined by clientes. enable // I'd like to redirect all trafic to an IP (13.37.42.1), I mean any IP and any domain. disable // Then I d like to be able to disable it. Then clients ...
0
votes
0answers
53 views

How to stop default iptables rules being added after reboot in fedora?

I changed from the default firewall (firewalld) back to iptables in the latest release of fedora. This is because iptables is what I use in Debian and I have already learned how to use it, whereas i ...
2
votes
3answers
60 views

Is there a command to deny an IP

Looking at the access log I found excessive access from an IP address. I then edit either .htaccess or .conf files to deny access from that IP. I wonder if there is a command or a oneliner that can do ...
1
vote
1answer
33 views

Redirect outbound traffic on LAN going to port 443 to port 80 or 8080 instead

How would I achieve this, I've tried using iptables a bit but have had no success at all. Any help at all would be appreciated. I basically just want it so that whenever a user on my LAN attempts to ...
1
vote
0answers
25 views

iptables blocking incoming FTP traffic 2/3 minutes after being reset

On CentOS 6.6- At first, iptables was blocking access to my FTP server at all while it was on. After some research I added the lines to /etc/sysconfig/iptables that are suggested in the question ...
1
vote
0answers
13 views

What do the fields in /proc/net/ipt_hashlimit/FILE mean?

What do the fields in /proc/net/ipt_hashlimit/FILE mean? These files are created upon iptables -A CHAIN -m hashlimit--hashlimit-name FILE [...] [...] 9 198.51.100.23:0->0.0.0.0:0 80000 80000 160 ...
1
vote
0answers
38 views

Change timeout of an entry of ipset with iptables rule

I'm trying to create a set with ipset and using it in some iptables rules. ipset has timeout option to set a countdown timeout to an entry of a set to automatically remove it after a period of time. ...
5
votes
1answer
47 views

IPtables - new vs new, established, related

I'm «pretty» new to IPtables, or I have used IPtables a few years, but never with advanced features. I understand the concept of stateful IPtables rules, but recently I discovered that some people ...
0
votes
2answers
26 views

Using IPtables to block outgoing traffic to a TAP interface from a LAN IP address or subnet

How can I configure IPtables to block outgoing traffic to a TAP interface from an IP or subnet?
0
votes
0answers
31 views

Redirect external ip to localhost on ubuntu

I have an application running on an EC2 ubuntu instance. I have mongo db running on the same instance. I have ElasticMapReduce which gets data from MySQL and puts it in the mongo db on the application ...
1
vote
2answers
52 views

Iptables exception for specific port

I'm new to iptables but configured a simple natting today on my raspian: # Always accept loopback traffic /sbin/iptables -A INPUT -i lo -j ACCEPT # Allow established connections, and those not ...
0
votes
2answers
93 views

How to let the Firewall of RHEL7 the SNMP connection passing?

How to let the Firewall of RHEL7 the SNMP connection passing? When I did this command on the computer: systemctl stop firewalld All the SNMP packet are passing well. When I restarted firewalld ...
1
vote
0answers
20 views

How can I monitor iptables classification applied by OpenWRT QoS, preferably live?

I set up a bunch of quality of service rules in OpenWRT, which then are translated to iptables rules. For debugging purposes, I'd love to see how the different connections are binned into, which would ...
1
vote
0answers
45 views

Howto configure linux router to allow clients to use maximum bandwidth?

The problem is that I'm always limited on the final client machine to about 1/3 (one third,about 200/300kb) of the internet hotspot bandwidth when testing download speed with wget. I have configured ...
0
votes
1answer
58 views

Bridge and iptables postrouting

I have a Linux 3.14 PC with three NICs and a bridge between two of the NICs (eth1 and eth2). My Question Why is there no traffic passing through the POSTROUTING rule? FYI, traffic is passing ...
0
votes
1answer
42 views

Effect of limiting tcp connections through iptables to limit ssh sessions

I have limited no. of tcp connections through iptables to limit total number of ssh connections. Now when i am adding a rule with maximum limit of tcp connections lesser than currently opened ssh ...
0
votes
1answer
22 views

Docker: personal ip but another network

Recently i found this for give to docker a "personal" ip ip addr del 10.1.1.133/24 dev eth0 ip link add link eth0 dev eth0m type macvlan mode bridge ip link set eth0m up ip addr add 10.1.1.133/24 dev ...
2
votes
1answer
21 views

Use two SSH ports, but open only one?

My iptables.conf looks loosely like this: -A INPUT -p tcp --dport 65000 -j ACCEPT -A INPUT -j DROP My sshd_config looks like this: Port 22 Port 65000 #AddressFamily any #ListenAddress 0.0.0.0 ...
1
vote
0answers
57 views

GUI for NFTables, like fwbuilder

We have several clients where we use linux based (iptable) firewalls. To manage the rulesets we currently use fwbuilder to manage the firewalls and the relations between the different firewalls. So ...
2
votes
1answer
20 views

Routing problem from internal eth1 interface to an external ppp0 interface

I'm trying to connect two LANs using a ppp link. I had a basic network topology diagram but it didn't come out well. This can be seen here. Routing Problem ================ 172.20.0.0/16 ...
2
votes
0answers
36 views

Two ISP and redirecting traffic

I have a gateway with two ISP connected to eth0 and eth2. There is also a eth1 with local network. I'm trying to group some services in one interface and some in the second: incoming traffic 1 ...
2
votes
1answer
45 views

iptables to block all websites

I have Debian 7, and I want to block all websites in my computer, unless my email, using IPTABLES or others firewall. How can I block all website, include http and https too. How can I do this?
0
votes
0answers
25 views

Delaying packets with libnetfilter_queue

From my Raspberry Pi configured as an access point, I set the following rules: sudo iptables -I FORWARD -p tcp --sport 25 -j NFQUEUE --queue-num 0 sudo iptables -I FORWARD -p tcp --sport 80 -j ...
1
vote
0answers
22 views

Why does a broken mount point break netfilter-persistent using systemd?

I have a relatively clean Debian Jessie install. I'm running into two related problems: 1) I have a cifs mount that shows me an error on boot. The error says to run systemctl status ...
0
votes
1answer
24 views

Forwarding traffics come from SSH tunnel to VPN tunnel on a Linux device

I want to route network traffic that comes from one end of ssh tunnel (constructed by ssh dynamic port-forwarding) into one end of VPN tunnel. Given four linux devices A, B, C and D, for example, I ...
3
votes
1answer
167 views

Which ports should I open for apt-get to work?

I installed Webmin, and then set up the firewall like this: INPUT SSH port ALLOWED Webmin port ALLOWED HTTP port (80) ALLOWED DROP EVERYTHING ELSE FORWARDING no rules OUTPUT no rules If I remove ...
1
vote
2answers
102 views

Error when redirecting ports with iptables: No chain/target/match by that name

I am trying to redirect all incoming TCP connections, originally to port 80, to port 8090, because I am running Confluence in 8090 and I want to avoid it running as root, which is a requirement to ...
1
vote
1answer
39 views

How check a port forwarded from localhost to localhost on.. localhost?

I'm learning about iptables, firewalling, routing and so on. I'm on Linux, Centos7, and I've set up a local port forwarding to localhost with: firewall-cmd ...
0
votes
0answers
17 views

How to block connections to specific file path

I have a server with cPanel/WHM installed. Now I want to block a specific path (example: /gate.php) to all users and prevent access from the Internet, so what is a good way to do it using iptables or ...
0
votes
1answer
59 views

How to get RX and TX bytes querying iptables?

My intention is to monitor traffic from/to wan. To achieve that, i want to calculate outgoing and ingoing bytes/second, with iptables counters as data source. Unluckily, I'm not able to understand ...
1
vote
1answer
23 views

Packets not forwarded due to second routing table

I've just spent about an hour trying to understand why my docker containers couldn't connect to the internet, in particular couldn't resolve any DNS names. By now I've found a workaround, but I still ...
2
votes
2answers
47 views

how to check if iptable rule is working

I am new to iptables and networking in general, so I am experimenting with it. I am learning how to close ports; in particular I am trying to close a specific port on the host machine, so another ...
0
votes
1answer
57 views

Forward all traffic from Android to Ubuntu server running privoxy (iptables)

My university has installed a non-transparent restrictive proxy which allows only traffic through 80 and 443 ports. Currently, I have my android phone (Nexus running CM12.1) pointing to my Ubuntu ...
0
votes
1answer
130 views

Redirect proxy traffic through another IPv4 address

I have a CentOS 6 box running Squid and Privoxy to create a custom proxy setup. The server has several public IPv4 addresses configured on virtual eth0 interfaces. My Goal: I want to send all proxy ...
0
votes
1answer
23 views

Allow INPUT only on one specific port?

I want to be able to be able to connect to 1.1.1.1 through port 110 to send email. I currently have the following set iptables -A OUTPUT -d 1.1.1.1 -j ACCEPT But it replies with the error 01:37:39 ...
1
vote
2answers
36 views

iptables block all inbound and outbound traffic except for my IPs

Previously I asked how to block all traffic except for specific IPs however that wasn't enough. I need to block all outbound/inbound except for my IPs. I don't want to be able to ping/connect to any ...
0
votes
2answers
220 views

Debian 8 - Update Iptables on boot

I am in the process of porting my "configure openvpn server" from ubuntu 14 to debian 8. So far it works well except for this section: # Set up iptables to forward packets for vpn and do this upon ...