iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

3
votes
1answer
28 views

IP rule table look up does not seem to work

I have a sytem with three network interfaces. Below is the configuration that I'm trying to set up. wlan0 (its actually an WiFi AP interface) - other devices connects via this interface. net1 - ...
2
votes
1answer
19 views

psad: do not block access to HTTP

I want to block intruders via psad, but HTTP and HTTPS should not be blocked. For example, if someone is scanning my dedicated server via nmap, psad should block him for 2 hours, but he should still ...
0
votes
1answer
19 views

How to use partial IP address in /etc/sysconfig/iptables for the “-s” flag?

in this example it is a full ip ip is: 1.1.1.1 -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -s 1.1.1.1 -j ACCEPT but suppose i want to allow any ip that simply starts with: 1.1. ...
0
votes
1answer
24 views

iptables redirect traffic from VPN interface to next interface

Can you help me with this problem please? I need redirect all traffic from tun0 interface (OpenVPN tunnel) to eth1 interface. eth1 is internal network behind this system which works as special ...
-2
votes
0answers
14 views

real scenario about tc command and mangle table of iptables [closed]

I don't have any question, But i have a request: I want to learn mangle table of iptables and tc command But i need to a real scenario, Please define me a real scenario!
4
votes
2answers
36 views

Redirecting loopback traffic through a router

For some tests purposes, I am running multiple socket-based applications on one machine and want to simulate "real" network conditions between them. I thought the simplest would be to redirect all ...
0
votes
3answers
31 views

Redirect domains to different ports on same machine

I used the following command to redirect 80 to 3000. All the requests that come, from any domain, are redirected to 3000: sudo iptables -t nat -I PREROUTING -p tcp --dport 80 -j REDIRECT --to-port ...
-2
votes
2answers
90 views

Domain Name problems in CentOS hosted under VirtualBox

When I ping www.google.com I get: [root@ryanPC ~]# ping www.google.com ping: unknown host www.google.com Also, when I run ping -n 8.8.8.8, I get: connect: Network is unreachable So I have ran the ...
1
vote
1answer
28 views

iptables routing

I believe this question has been answered a 100 times before, but I'm almost sure that I'm searching into the wrong direction. My desired setup is the following: I have a virtual host using KVM and ...
2
votes
3answers
55 views

bash: iptables: command not found

How do I fix the iptables: command not found problem that happened to Debian 7.6? batman@gotham:~$ uname -a Linux gotham 3.14-0.bpo.2-amd64 #1 SMP Debian 3.14.13-2~bpo70+1 (2014-07-31) x86_64 ...
2
votes
2answers
94 views

How can I make iptables service start automatically after reboot on CenOS/RHEL7?

I am having a few issues with a newly installed home server I am preparing. I have installed CentOS7 on it and I found that port 80 and 443 are off by default. I therefore added them to the iptables ...
2
votes
2answers
32 views

Delay when iptables icmp rules take effect

I have setup my iptables to disable all incoming connection, i.e. :INPUT DROP [0:65535] When the iptables has been started, I run the following command to enable ping: /usr/sbin/iptables -A INPUT ...
3
votes
1answer
37 views

Proper way to handle FTP over SSL with restrictive firewall rules?

Without SSL, FTP works fine over a stateful Firewall, like netfilter (iptables) + the nf_conntrack_ftp kernel module like this: # modprobe nf_conntrack_ftp # iptables -A INPUT -m conntrack --ctstate ...
2
votes
1answer
31 views

How is whonix blocking UDP traffic (except udp-dns related traffic)?

I want to know how whonix manages to block unwanted UDP-Traffic i.e. all UDP-traffic but DNS related udp traffic. I looked at the iptable rules both in the Workstation and Gateway. There are no ...
2
votes
0answers
51 views

iptables rule to transfer UDP through a SSH tunnel

The problem I have two programs that runs on two distant computers and communicate through a specific protocol. All I know is that this protocol only communicates through UDP and uses the ports 1101 ...
0
votes
0answers
60 views

Upon bootup, all iptables are lost because the kernel module ip_set is not loaded

i can get iptables to whitelist / blacklist using ipset members, but after a reboot, the iptables are emptied out because the kernel module is not loaded. Have limped along in the past by customizing ...
0
votes
1answer
20 views

how to find out wich chain in iptables in listing

Suppose I have the following two entries line of iptables: iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE iptables -A INPUT -s 192.168.1.0/24 -j DROP So, I have POSTROUTING and INPUT chains. ...
2
votes
1answer
210 views

Configuring OpenVPN to use Firewalld instead of iptables on Centos 7

I need some help configuring OpenVPN on Centos 7 using firewalld. I used iptables on Centos 6.5 and only had to add the following lines to /etc/sysconfig/iptables: -A POSTROUTING -s "10.0.0.0/24" ...
0
votes
0answers
28 views

IPtables Packet Balancing

I would like to see the below work as a result of seeing several posts online that have this working but not quite the same as my situation. Forgive me if it appears to be a stupid idea as I'm now ...
1
vote
1answer
19 views

Confused by different output from iptables -L

I keep following this tutorial using a bash shell on ubuntu 12.04 as I open more and more ports on my server. I usually open up ports like this sudo iptables -A INPUT -p tcp --dport PortNumberToOpen ...
0
votes
1answer
30 views

What this Iptables rules does?

I think I can understand this iptable rule, but I want to make sure what it does, so can someone explain to me technically what this does? well this two rules combined. /sbin/iptables -t nat -A ...
2
votes
0answers
10 views

Extra overhead in MASQUERADE target

There's a part in iptables manual concerning SNAT and MASQUERADE targets. I know the key difference between the two, but I don't fully get the following sentence: It is still possible to use the ...
0
votes
0answers
22 views

How can I use 0.0.0.0/0 in ipset hash:net,port?

Right now, if I do ipset a ansible_allowed 0.0.0.0/0,tcp:22 I get ipset v6.19: The value of the CIDR parameter of the IP address is invalid and instead I have to add 0.0.0.0/1,tcp:22 ...
3
votes
1answer
30 views

IPTables rules for specific processes [duplicate]

I have a lot more experience with the Windows Firewall with advanced functionality than I do with IPTables. With the WFAF, I was able to lock down a program so that it could only connect over specific ...
3
votes
1answer
29 views

Which network services depend on the “accept related input” iptables rule?

Background I am setting up a firewall for a webserver and was wondering if it would be a good security meassure to even reject RELATED input traffic and only except established connections by ...
-1
votes
1answer
68 views

MYSQL : Connecting to mysql from : 127.0.0.1 + telling ip tables to allow only 127.0.0.1 for mysql port : Logic vs Common Sense

If i make 1 billion or 1 trillion queries to MYSQL database from 127.0.0.1 via port 3306. vs If i make same amount of queries to MYSQL database also from 127.0.0.1 via port 3306. but with ...
5
votes
2answers
31 views

Move iptables rule (w/o removing and adding)

Is there a way to move a rule in the iptables and change it position ? I'm aware i can use -I to insert a rule in a specific position, but i also like to keep the counters.
2
votes
0answers
38 views

How can I configure iptables for per application setup?

I am working on a project where we are building lots of micro-services. Each service is neatly packaged as an RPM. Ideally I'd like for us to have iptables enabled on all of our machines and it would ...
0
votes
0answers
12 views

Why SAMP is not listening to the port

I have forwarded 38474 port to internal port 7778. Then I launched San Andreas Multiplayer on my CentOS server. When I'm typing netstat -npl I see this: Proto: tcp Recv-Q: 0 Send-Q: 0 Local Address: ...
1
vote
1answer
57 views

Curious about strange ICMP type 3 code 10 traffic to my IP address

My firewall (iptables) logs some strange ICMP type 3 code 10 traffic that I am curious to understand (specifically how or if this could be an exploit of some sort). Type 3 = Destination ...
0
votes
0answers
94 views

Forward local port to remote port in a Vagrant machine

I have MySQL running on my local machine and I need to publish this port to a Vagrant box without any special SSH hackery. Is there a way for me to forward 10.0.2.2:3306 to 127.0.0.1:3306 on the ...
7
votes
2answers
635 views

How to ensure SSH port for example is only open to a specific IP address?

This is my /etc/sysconfig/iptables: it has two ports open 80 apache and 22 for ssh. # Firewall configuration written by system-config-firewall # Manual customization of this file is not recommended. ...
1
vote
0answers
36 views

Redirect shared internet to tor/privoxy [closed]

I have shared my internet and set my client gateway to my IP, every thing works. I need to client goes through tor. I configured privoxy to use tor and with this iptable command I defined a rule: ...
2
votes
1answer
88 views

Unable to access website hosted on virtual machine

I'm on a mac (osx 10.9.3) running CentOS7 in virtualbox. I would like to access the website hosted on the virtual machine. Browsing to the Guest IP returns webpage not available. I'm able to ping and ...
2
votes
0answers
47 views

iptables hangs at applying rules

I have a set of rules that are supposed to give me the most protection before things like fail2ban and other things are added to the mix. The issue is that although everything checks out in the test, ...
0
votes
1answer
29 views

how to get effect of IP rules script in RHEL 6?

I have written one ip.sh file in that I have written one rule and then saved the iprules with the corresponding commands. Now when I opened /etc/sysconfig/iptables nothing is reflecting. I need the ...
1
vote
0answers
23 views

ISC DHCP Server - A Client's Uplink Is Not Working

Running a DHCP server, client(s) does not have up-link (0Mbps) and has a downlink (50Mbps.) I am setting up a gateway/router on a PC running Debian Wheezy with ISC-DHCP. I have 1 WAN (eth0) and 2 LAN ...
3
votes
0answers
91 views

iptables rule no actions on scapy packets

I wrote this rule to change all udp destination IP addresses to 8.8.8.8 when dport is 53: iptables -t nat -A OUTPUT -p udp -m udp --dport 53 -j DNAT --to-destination 8.8.8.8 The rule worked when ...
9
votes
2answers
630 views

( /etc/sysconfig/iptables ) “Manual customization of this file is not recommended.” Why?

Editing this file directly /etc/sysconfig/iptables can save me so much headaches so much time and so on... and yet on the very top of the file it says.. Manual customization of this file is not ...
0
votes
1answer
35 views

Is it OK to copy /etc/sysconfig/iptables to another machine?

This is my original server with very loose security given that it does not block all ports via iptables. /etc/sysconfig/iptables contents: # Generated by iptables-save v1.4.7 on Mon Jun 16 ...
-1
votes
1answer
65 views

/etc/sysconfig/iptables : how to block everything except for port 80 and 22?

My new centos 6.5 cloud server came with this /etc/sysconfig/iptables inside we have: # Generated by iptables-save v1.4.7 on Mon Jun 16 20:04:05 2014 *filter :INPUT ACCEPT [8:607] :FORWARD ACCEPT ...
0
votes
1answer
44 views

How to modify iptables rules via editing a file rather than interacting via command line?

In the history, i would simply edit a file and then reboot the whole server. i would clone the line that had port 22 open change it to 80 and then save the file.. and reboot the whole system so ...
2
votes
1answer
52 views

In iptables, what is the difference between targets DNAT and REDIRECT?

More specifically, is -A PREROUTING -i $INT -p $PROTO --dport $PORT -j REDIRECT --to-ports $NEWPORT equivalent to one or both of these? -A PREROUTING -i $INT -p $PROTO --dport $PORT -j DNAT ...
10
votes
3answers
429 views

Iptables to redirect DNS lookup IP and Port

I have discovered that my ISP (verizon) is intercepting all DNS traffic on port 53. Using iptables, I want to redirect all DNS lookup traffic to a specific IP and Port (5353). Any attempt for my ...
2
votes
2answers
36 views

Iptables not forward traffic

I need to redirect all traffic incoming on port 9750 (the port chat server) to another machine on the same subnet. Ports clients - dynamic. iptables -t nat -A PREROUTING -p tcp -d x.x.x.a --dport ...
1
vote
2answers
53 views

Reject ssh connections made from proxies

I was seeing this question which was concerned with blocking access to the users who do not belong to a particular region. I am sure that blocking is possible but I see there is a workaround to this. ...
1
vote
0answers
73 views

DROP all for port 22 if not geoip set of US for iptables and xtables

I want to simply block all ssh access from anywhere but with in the US. This is my whole iptables, and I have followed ...
0
votes
0answers
32 views

iptables blocking email from my wordpress site

I cant seem to send email from my Wordpress site. Here is what my iptables script looks like. Ports 25 and 110 are commented but even uncommented the send email does not work. #!/bin/bash # A Linux ...
2
votes
3answers
103 views

What iptables command do I need to allow web server traffic?

I have a hard time understanding iptables rules. I am running a centos 6.5 VM on my laptop (vmware hypervisor) and it looks like it comes with this setup for iptables: # iptables -L Chain INPUT ...
2
votes
0answers
41 views

Transparent Proxy

I am setting up attempting to set up a transparent proxy on CentOS using Squid. So far I have managed to filter the content and get it working perfectly. The only issue I am having is getting a form ...