iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

1
vote
0answers
12 views

UFW before rules for VPN forwarding

I'm trying to setup an OpenVPN server on Debian 7, following this guide: How to install and set-up OpenVPN in Debian 7 (Wheezy) In step 15 I have to setup forwarding and IPtables rules. I prefer to ...
0
votes
0answers
23 views

IPTABLES comment: No chain/target/match by that name

Facid with error when adding new rule with 'comment': # iptables -I INPUT 1 --source 66.***.***.78 -j REJECT -m comment --comment "Some" iptables: No chain/target/match by that name. Without ...
0
votes
0answers
25 views

Routing incoming source IP traffic to a loopback IP issue

I'm wanting to accomplish the following: I have a BIND DNS server setup where it is listening on ANY address and also listening in a BIND config ACL on 127.0.1.1. If there is another way where you ...
0
votes
1answer
30 views

IPtables don't block IP

I'm running Postfix SMTP server. Some hosts trying to connect with wrong passwords. warning: s15393678.onlinehome-server.com[74.208.17.126]: SASL LOGIN authentication failed: I'm adding iptables ...
0
votes
0answers
7 views

iptables/netfilter behavior if DNAT changes mid-connection

I'm planning to leverage iptables to act as a 'poor-man's active/passive load balancer'. The plan is to have a pair of these rules: -t nat -A PREROUTING -d 10.1.2.3/32 -m condition --condition ...
3
votes
0answers
15 views

Which tool is used to create firewall rules on Fedora 20? [closed]

What is a recommended way to set up firewall rules on Fedora 20/Centos 7/RHEL 7 currently? I know about relatively new replacement of itpables service by firewalld service. Which command-line user ...
1
vote
1answer
18 views

How to measure iptables load?

I have added about 3500 IP addresses to iptables using ufw on a Debian 7 and I am wondering if this has any impact on the performance of my server. How can I measure that?
0
votes
1answer
50 views

CentOS 7 iptables problems and doubts?

I have a CentOS 7 image on VM VirtualBox (bridged Ethernet with static IP) I was trying to set iptables filter table but I have the following problems: Whatever I did to open Apache on port 80 ...
1
vote
1answer
64 views

Whitelist IP's in CentOS 7

I want to setup CentOS 7 firewall such that, all the incoming requests will be blocked except from the originating IP's that I whitelist. And for the Whitelist IP's all the ports should be accessible. ...
0
votes
0answers
27 views

How to bridge the eth0 (ethernet) and eth1 (WiFi_Ap)?

I am in the WiFi test embedded board. The ethernet port eth0 is connected to the Internet. The interface eth1 is caused due to the WiFi chip. The Access Point can be used as a WiFi eth1 is. We use the ...
0
votes
1answer
28 views

Allowing web server communication in Linux firewall

I have a unique situation. Let's say my webserver ( e.g. 10.0.0.2) is connected to eth0 of my firewall (gw 10.0.0.1). A local network (192.168.0.0/24) is also connected to eth1 (192.168.0.1/24) of my ...
1
vote
0answers
17 views

What is the point of the second route lookup after OUTPUT?

According to the packet path diagram, and its description: Table 6-2. Source local host (our own machine) [...] Routing decision, since the previous mangle and nat changes may have ...
0
votes
0answers
23 views

bridge or iptables or route?

iptables vs bridge-utils vs route I have two network cards in a Linux server and don't know how to make them communicate. After searching a lot I still don't know which method is the one that should ...
0
votes
0answers
16 views

Set source address for incoming packets on a server

I'm developing a UDP reverse proxy for a game server, and so far, everything has gone fine except for one thing - getting the backend server to submit requests to the master server list (run by a 3rd ...
1
vote
0answers
20 views

SNAT with firewall-cmd?

I have an interface with multiple IP Addresses (on CentOS 7), which is in zone "external" (with masquerade on). I want to specify that, if a connectiona attempt to a specific address goes out, to use ...
0
votes
1answer
15 views

How to set up a stateful firewall on an am335x Starter Kit board?

In the past, I have used the following script to set up a stateful firewall (on a normal x64 Ubuntu machine) without issue: iptables -P INPUT DROP iptables -P FORWARD DROP iptables -N TCP iptables -N ...
2
votes
1answer
83 views

Forwarding packets from loopback interface with policy-based routing

I have the following iptables rule: iptables -t mangle -A PREROUTING -p udp -m udp --dport 10000 -j MARK --set-xmark 0x4/0xffffffff which sets fwmark 4 on all udp packets with destination port ...
1
vote
2answers
74 views

ping: unknown host with iptables enabled

I can't ping www.google.com. However I can ping the IP address: ping 74.125.237.142 At first, I thought it is a problem with my DNS settings. But I checked my resolv.conf, hosts, and hostname ...
1
vote
0answers
38 views

Iptables and --tcp-flags

If I have the following rule in the nat-table in the prerouting chain: 0 0 REDIRECT tcp -- eth5 any anywhere anywhere tcp flags:FIN,SYN,RST,ACK/SYN redir ports ...
2
votes
2answers
124 views

Tunnel yum traffic through another server via ssh

I am running a Fedora desktop behind a corporate proxy that is blocking yum traffic (specifically *.gz and *.bz2). I have access to a separate RedHat machine via ssh which can download anything it ...
1
vote
0answers
56 views

Forward multicast between two LAN segments (Chromecast)

I've found some rules but most are inconclusive. Chromecast uses DIAL and discovers via multicast from what I've understood.. I have an Ethernet-connected computer which I would like to route via my ...
1
vote
0answers
21 views

Is iptables -p proto -m proto redundant?

I keep seeing "-p tcp -m tcp" all over the place, but it looks redundant. Why the '-m' if the '-p' already matches the protocol?
-1
votes
0answers
19 views

iptables forward too many interface

Can I build a FORWARD rule which gives both an in/out and SRC/DST IP host? I need to create a rule that does the following: PC -> switch (non-mgmt) -> Linux Router (VLAN) -> world: block ICMP $ ...
0
votes
1answer
35 views

How to map IP by iptables ?

I create a network namespace In this namespace, I open a nginx So for now, I can visit web server by 172.17.0.2 What I want to do is mapping this IP to 127.0.0.1 Lets say if I visit 127.0.0.1, I ...
0
votes
0answers
50 views

Iptables and Ip6tables redirect traffic

I want to deny all the network traffic and just allow a few ports and redirect them through tor or the socket I have set in /etc/tor/torrc, where tor binds to. And I am currently setting up these ...
1
vote
0answers
32 views

How do I write the rule that has an edge server forward a clients request to an internal network server and back?

I have a network situation as follows: -server1:1.1.1.1 -server2:2.2.2.2 -tunnel 10.8.0.0/24 -client: 3.3.3.3 I'm trying to have client IP 3.3.3.3 do an HTTP request from the 1.1.1.1 server. ...
2
votes
1answer
37 views

iptables routing incoming IP to another destination IP question

I have a test setup: server1:1.1.1.1 server2:2.2.2.2 client: 3.3.3.3 I'm trying to have client IP 3.3.3.3 do a HTTP request from the 1.1.1.1 server. However I want the 1.1.1.1 server to pass this ...
1
vote
1answer
23 views

Does -o and -i make sense when the target host is already connected to the interface specified?

iptables -A FORWARD -s 192.168.20.7 -d 10.10.48.3 -p tcp --dport 25 -o eth1 -j ACCEPT iptables -A FORWARD -s 10.10.48.3 -d 192.168.20.7 -p tcp --sport 25 -i eth1 -j ACCEPT Tuning the firewall of my ...
4
votes
0answers
32 views

Setting traffic class on return packets

I have a network topology: Server <-> router1 <-> router2 <-> router3 <-> edgeRouter <-> "internet" All routers are linux based, and support iptables. The server sets ...
0
votes
0answers
23 views

Sabayon: UFW blocking all incoming connections, although default policies are set to “Allow”

I have the following problem with ufw/iptables: When I start/reboot my computer, ufw fails to load: # ufw status Status: inactive I did enable it: # systemctl enable ufw Still I do have many ...
0
votes
1answer
65 views

Route OpenVPN clients to another different OpenVPN server

I have this scenario.. Server(Primary) with a multiple OpenVPN connections (so server is connected as a client to multiple OpenVPN servers.. lets say secondary servers) This server runs OpenVPN ...
1
vote
2answers
104 views

Drop TCP packets and prevent TCP retransmission

I have an application that sends TCP data to a server. My server is made to intentionally drop the packets sent by the application, and as a result the client retransmits the packets. I need to ...
0
votes
0answers
42 views

How to disable domain service at port 53 on WAN side in OpenWRT?

nmap on the WAN IP shows PORT STATE SERVICE 53/tcp open domain after basic configuration on a fresh OpenWRT (version Chaos Calmer) system. But the service should not be visible from WAN, but ...
3
votes
2answers
46 views

How can I determine what program or user connected to a particular port after the fact?

I am examining the egress IPTABLES log of my computer for yesterday and notice the following: IN= OUT=eth0 SRC=192.168.1.1 DST=69.46.36.10 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=12345 DF PROTO=TCP ...
0
votes
0answers
138 views

iptables to allow teamviewer

I'm having some trouble to allow TeamViewer in a restrictive iptables configuration. I'm running Fedora 20. After some research I found out TeamViewer uses ports 80, 443 and I have created this ...
1
vote
0answers
82 views

How do I route bittorrent through a second interface?

I've managed to configure openvpn on my DD-WRT router such that the tunnel is up and working, but that it doesn't mess with routes at all (the default configuration wants all traffic to go through ...
3
votes
1answer
54 views

IP rule table look up does not seem to work

I have a sytem with three network interfaces. Below is the configuration that I'm trying to set up. wlan0 (its actually an WiFi AP interface) - other devices connects via this interface. net1 - ...
2
votes
1answer
34 views

psad: do not block access to HTTP

I want to block intruders via psad, but HTTP and HTTPS should not be blocked. For example, if someone is scanning my dedicated server via nmap, psad should block him for 2 hours, but he should still ...
-1
votes
1answer
39 views

How to use partial IP address in /etc/sysconfig/iptables for the “-s” flag?

in this example it is a full ip ip is: 1.1.1.1 -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -s 1.1.1.1 -j ACCEPT but suppose i want to allow any ip that simply starts with: 1.1. ...
0
votes
1answer
202 views

iptables redirect traffic from VPN interface to next interface

Can you help me with this problem please? I need redirect all traffic from tun0 interface (OpenVPN tunnel) to eth1 interface. eth1 is internal network behind this system which works as special ...
4
votes
2answers
67 views

Redirecting loopback traffic through a router

For some tests purposes, I am running multiple socket-based applications on one machine and want to simulate "real" network conditions between them. I thought the simplest would be to redirect all ...
0
votes
3answers
118 views

Redirect domains to different ports on same machine

I used the following command to redirect 80 to 3000. All the requests that come, from any domain, are redirected to 3000: sudo iptables -t nat -I PREROUTING -p tcp --dport 80 -j REDIRECT --to-port ...
-2
votes
2answers
161 views

Domain Name problems in CentOS hosted under VirtualBox

When I ping www.google.com I get: [root@ryanPC ~]# ping www.google.com ping: unknown host www.google.com Also, when I run ping -n 8.8.8.8, I get: connect: Network is unreachable So I have ran the ...
1
vote
1answer
47 views

iptables routing

I believe this question has been answered a 100 times before, but I'm almost sure that I'm searching into the wrong direction. My desired setup is the following: I have a virtual host using KVM and ...
2
votes
3answers
400 views

bash: iptables: command not found

How do I fix the iptables: command not found problem that happened to Debian 7.6? batman@gotham:~$ uname -a Linux gotham 3.14-0.bpo.2-amd64 #1 SMP Debian 3.14.13-2~bpo70+1 (2014-07-31) x86_64 ...
2
votes
2answers
634 views

How can I make iptables service start automatically after reboot on CenOS/RHEL7?

I am having a few issues with a newly installed home server I am preparing. I have installed CentOS7 on it and I found that port 80 and 443 are off by default. I therefore added them to the iptables ...
2
votes
2answers
73 views

Delay when iptables icmp rules take effect

I have setup my iptables to disable all incoming connection, i.e. :INPUT DROP [0:65535] When the iptables has been started, I run the following command to enable ping: /usr/sbin/iptables -A INPUT ...
3
votes
1answer
58 views

Proper way to handle FTP over SSL with restrictive firewall rules?

Without SSL, FTP works fine over a stateful Firewall, like netfilter (iptables) + the nf_conntrack_ftp kernel module like this: # modprobe nf_conntrack_ftp # iptables -A INPUT -m conntrack --ctstate ...
2
votes
1answer
73 views

How is whonix blocking UDP traffic (except udp-dns related traffic)?

I want to know how whonix manages to block unwanted UDP-Traffic i.e. all UDP-traffic but DNS related udp traffic. I looked at the iptable rules both in the Workstation and Gateway. There are no ...
2
votes
0answers
144 views

iptables rule to transfer UDP through a SSH tunnel

The problem I have two programs that runs on two distant computers and communicate through a specific protocol. All I know is that this protocol only communicates through UDP and uses the ports 1101 ...