iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

0
votes
0answers
5 views

tcp tunnel inside local network with iptables

I want to configure outside and inside forwarding rules to behave the same way, and simplified problem that i have with 'inside part' is like this: if i have compA - eth0 192.168.0.1 compB - eth0 ...
1
vote
0answers
33 views

How to do iptables nat loopback?

I have a linux server behind the ISP's cablemodem-router combo. With some hacking I was able to make the port forwarding work, and the DHCP exceptions in the udhcpd. But I wasn't able to do the NAT ...
3
votes
2answers
156 views

Why doesn't iptables receive the marked packet?

I was learning the ping command options. In that I found the -m option to set the mark for a packet. The below command sends the packet with marking of 10 to the 192.168.2.65. ping -m 10 ...
0
votes
1answer
17 views

How does this work in firewalld? iptables accept all [on hold]

On Ubuntu with plain iptables, filter table, INPUT chain: Chain INPUT (policy ACCEPT) num target prot opt source destination 1 ACCEPT all -- anywhere anywhere ctstate ...
0
votes
0answers
11 views

iptables traffic redirecting going wrong - UDP forwarding from proxy

good evening! I have a proxy running HAProxy and iptables in my network (and that proxy is behind another firewall and NAT). So far, I've been doing only TCP redirects to servers using HAProxy, and ...
1
vote
0answers
36 views

Is an SSH connection timeout expected when iptables is set to REJECT?

We’re setting up a firewall for a machine that should allow: incoming SSH connections from particular IP addresses; ICMP, except for redirect. We’ve opted to use REJECT over DROP, at least until ...
0
votes
1answer
27 views

iptables redirect via url to localhost vhost

I'm trying to set up a test environment for a mobile app. I have a machine acting as a gateway and providing dhcp on 192.168.10.0/24, and serving pages from apache. How would I set up iptables rules ...
0
votes
2answers
75 views

iptables forward traffic to vpn tunnel if open

I've used the following guide to set up my raspberry pi as an access point: Raspberry Pi 3 as wifi access point I'm forwarding wlan0 to eth0 and NATing all my traffic. Works great! sudo iptables -t ...
2
votes
2answers
28 views

Debian 8 - IPTables reverts to state on every packet

Problem: iptables cannot be changed. On my computer, I can run iptables -F. iptables -L shows it is flushed. When any packets come into or out of the machine, all rules are back! The same behaviour ...
0
votes
0answers
24 views

ubuntu 14.04 create route to multicast stream server and have access udp://239.255.0.169:5500

My server is ubuntu 14.04 server edition and I am trying to re stream existed multicast stream by my server : Multicast stream server is using udp://239.255.0.169:5500 destination ip. On my side I ...
2
votes
1answer
90 views

What is the meaning of UNCLEAN state in iptables

What is the meaning of UNCLEAN state in iptables? Example: iptables -A INPUT -m conntrack --ctstate UNCLEAN -j DROP This actually gives me an error, but there should exist an unclean state. ...
1
vote
0answers
16 views

NFTables NAT not caolled

I have tried to switch from IPTables to NFTables. Everything worked fine, except of NATting. This configuration does nothing when I try to run it, the NAT chains are not called: table ip vms { ...
0
votes
1answer
23 views

How to do Masquerading with NFTables

How would I implement a masquerading rule like this iptables one in NFTables: iptables -t nat -A POSTROUTING -s 10.5.6.0/24 -o eth0 -j MASQUERADE I've looked for it, but couldn't find out how to ...
5
votes
0answers
60 views

Simulate ethernet cable unplugged on a remote machine while staying connected

I am working from home on remote embedded Linux machine "X" via ssh. It has one physical network card. I need to simulate Ethernet cable unplugged condition on the same remote machine "X" , while ...
3
votes
0answers
28 views

No “unreachable” response for an outgoing TCP connection when using fwmark and policy routing

I would like to route locally-generated traffic: to a TCP port "A" of host "H" via the interface "A", to a TCP port "B" of host "H" via the interface "B". Interface "B" is sometimes unavailable. ...
0
votes
1answer
17 views

secure my servers with iptables

I have 2 vps servers (debian 7 & 8) with a public IP address and I would like to protect them. I would like to have access only to SSH (public/private keys), openVPN, services that are requested ...
1
vote
1answer
26 views

Searching for a solution to set up a reverse proxy for game servers

I run a game server on my dedicated box in country A, which runs Linux and communicates with its clients using UDP. The server has players from both inside and outside Country A. Players within ...
0
votes
0answers
11 views

VLAN sub-interfaces and Netfilter

Is it correct to think that from Netfilter point of view there are no separate packet flows for physical interface(for example eth0) and VLAN-interface associated with the physical NIC(for example ...
2
votes
1answer
55 views

How to add marks together in iptables (targets MARK and CONNMARK)

When you want to mark a packet in iptables, you would generally add the following line to your firewall script: iptables -t mangle -A POSTROUTING -p tcp -m multiport --dports 80,443 -j MARK ...
3
votes
0answers
40 views

TC (Traffic Control) to control bandwidth

I'm having an issue with a bandwidth script that I've been using for a while to limit the outgoing bandwidth on a port. It worked fine at the beginning until I wanted to change the outgoing port ...
0
votes
0answers
11 views

iptables for tomato to block all non-vpn traffic

I have been combing through a few forums of many VPNs that have iptables for the tomato router. Most don't work. The one from VPN.ac recommends adding under Administration > Scripts > Firewall ...
0
votes
1answer
13 views

Does 'multiport' make a difference in terms of efficiency?

Can any one can say definitively that using the --multiport extension with iptables rules: Is faster than creating a rule per port? Is slower than creating a rule per port? Makes no difference? If ...
1
vote
2answers
45 views

IP tables for home use

I've been trying to set up rules for a desktop I have in my home network and even though at first this configuration worked, I changed something somewhere and now it won't pass any kind of connection. ...
2
votes
1answer
24 views

Can you send a TCP packet with RST flag set using IPTABLES as a way to trick NMAP into thinking a port is closed?

I am learning Nmap and a thought occurred to me with regards to a SYN scan... A SYN scan sends an empty TCP packet with the SYN flag set to illicit a response from the target of either RST, ...
2
votes
1answer
78 views

How can I mark a flow with iptables?

I read this tutorial, however I am considering a method to load balancing for Internet connection by applying iptables rule on 2 interfaces. The following is my iptables rule. #!/bin/sh ...
0
votes
1answer
22 views

Understanding Iptables rules to prevent DDoS

Following IPTables rules exist on my system as some preventive measures against DDoS attacks -A INPUT -s 255.0.0.0/8 -j LOG --log-prefix "Spoofed source IP" -A INPUT -s 255.0.0.0/8 -j DROP -A INPUT ...
1
vote
2answers
61 views

How does NAT reflection (NAT loopback) work?

I use the auto generated rules that come from OpenWRT as an example of NAT reflection (NAT loopback). So let's pretend there's a network 192.168.1.0/24 with two hosts (+ router): 192.168.1.100 and ...
0
votes
1answer
19 views

iptables connection refused in VLAN network when iptables configured NAT and port forwarding

I have a static IP X.X.X.X. I configured a Linux server as a router by using iptables. The following figures as my network topology: ppp0 +-------------+ +----------+ ...
0
votes
1answer
24 views

iptables connection mark not balance

The following is my network topology: + + | | | | | | | ...
1
vote
3answers
52 views

log connection attempts from an IP blocked by iptables

I blocked an abusive IP from a CentOS server using iptables, dropping all connection attempts on all services / ports. As is the way of things, the server with this IP may have been part of a botnet, ...
0
votes
1answer
36 views

understand chains and tables in netfilter/iptables

As I understand, Linux kernel has five hook points for IPv4 packet flow defined in netfilter_ipv4.h file: /* IP Hooks */ /* After promisc drops, checksum checks. */ #define NF_IP_PRE_ROUTING 0 /* ...
1
vote
0answers
40 views

Why fail2ban doesn't put some IP address in jail

This is several days ago, I observed some IP addresses was't banned by fail2ban, and continued to brute force attack on different port of ssh. This an extract of my logwatch: undef: 22 times a ...
-1
votes
0answers
32 views

Getting iptables to pass wlan0 traffic

My network is as follows: wlan0->br0->eth0->router->internet wlan0 is there to allow wireless devices (smartphones, tablets etc.) to have wireless access to the internet. Everything goes eventually ...
4
votes
1answer
88 views

Identifying source of audit messages in kern.log

I recently installed the auditd package on my Debian machine. I did some testing with auditctl, creating a single rule to watch a directory, proved something, and then removed and purged auditd. ...
0
votes
1answer
39 views

How do I make sure the iptables is closed?

I want to disable iptables completely. I followed the instruction like /etc/init.d/iptables close it said there No such file or directory [root@dataapp02 tmp]# service iptables stop Redirecting ...
1
vote
1answer
12 views

Linux + iptables fallback

I want to enable the routing VIA tcp from port 770 to port 7714 iptables -t nat -A PREROUTING -p tcp --dport 770 -j REDIRECT --to-ports 7714 . so I get the following: iptables --table nat --list ...
1
vote
1answer
51 views

Changing IPTables to Allow FTP over TLS Using Passive Ports

I am using Arch Linux. I followed a tutorial to change /etc/iptables/iptables.rules to allow only the basic ports for my web server. I also used /etc/modules-load.d/nf_conntrack_ftp.conf to enable ...
3
votes
1answer
26 views

How to make iptables logs to identify protocols by name and not by number?

In my iptables log files (Ubuntu 16-04), all messages from my LAN router and from other hosts in the LAN, related to IGMP have "PROTO=2". Is there a way to change this and get "PROTO=IGMP"?
3
votes
3answers
134 views

Why does SNAT happen in POSTROUTING chain and DNAT in PREROUTING chain?

Why does SNAT(modifies source IP and/or ports) happen in nat table POSTROUTING chain, i.e after routing? And why does DNAT(modifies destination IP ant/or ports) happen in PREROUTING chain? I guess ...
1
vote
2answers
47 views

Is firewalld the same as iptables?

I tried to close iptables on RHEL 7.2 using chkconfig iptables off error reading information on service iptables: No such file or directory tried /etc/init.d/iptables stop too, got ...
1
vote
3answers
24 views

How to access a URL filtered only for my public IP from outside my network

There is this URL which I can access from inside my network, because they allowed my public IP to access it. All other IPs are denied. how can I configure my iptables so that I can access this ...
3
votes
3answers
58 views

IPtables installation question

I am new to installing iptables and have an excellent book called "Linux Firewalls: Attack Detection and Response" by Michael Rash. I have a few questions before I begin. I want to make an ...
1
vote
1answer
46 views

iptables DNAT: 'No chain/target/match by that name'

I am trying to use DNAT on a new custom Linux target, but I get an error with the following basic command: #iptables -t nat -A PREROUTING -d 10.110.0.250 -p tcp --dport 9090 -j DNAT --to ...
1
vote
2answers
25 views

how to remove iptables port mirroring rule

I don't have much knowledge on iptables. I googled the port mirrioring with iptables iptables -t mangle -I PREROUTING -j TEE --gateway 10.20.0.129 iptables -t mangle -I POSTROUTING -j TEE --gateway ...
0
votes
1answer
58 views

Iptable rules for squid on centos 7

I have two interfaces in my proxy server eth0 and eth1. where eth0 connects to local (private) network wile eth1 connects to internet.My squid version is 3.3.8 and centos 7 is my OS. I have to ...
0
votes
0answers
18 views

IPTables/IPRoute + Avoiding VPN

I have a debian jessie headless server running an OpenVPN connection. However there is certain traffic I don't want passing through the VPN, and would rather pass through my local gateway. I have ...
0
votes
0answers
25 views

Unable to access http server when ufw is running, on Raspbian?

I have a Raspberry Pi running Raspbian, with Apache2 for the web server. Some recent change seems to have broken my ability to access my web server, when ufw is running. The server simply doesn't ...
0
votes
0answers
28 views

iptables forward all traffic to 2 different interfaces

I'm currently using dnsmasq to create a small Debian box as a DHCP and DNS cache server. Until today, I had just 2 interfaces (eth0, eth1). One connected to my WAN (eth0) and one connected to my LAN ...
0
votes
2answers
47 views

Packet flow in a virtual bridge with two interfaces, centos 7

I am struggling to create a bridge firewall with iptables since I cannot find/catch packets flowing through a bridge with two interfaces in centos7. No ip addresses are configured on interfaces or the ...
0
votes
0answers
15 views

SQUID proxy not allowing to access internet

I am using centos 7 and I have followed this tutorial to install transparent proxy on my system. Every step has been done successfully but when I try to access internet from any client. Nothing is ...