Tagged Questions
3
votes
1answer
38 views
IPTables - Port to another ip & port (from the inside)
I currently have a NAS box running under port 80. To access the NAS from the outside, I mapped the port 8080 to port 80 on the NAS as follow:
iptables -t nat -A PREROUTING -p tcp --dport 8080 -j DNAT ...
2
votes
1answer
47 views
Can iptables be used to convert a single-homed host into a NAT server?
Given: I have a machine (HostA) with only one NIC which has Internet connectivity. I have another machine (HostB) with one NIC on the same switch. HostB is not configured for Internet access yet. ...
1
vote
2answers
57 views
Where is iptables script stored on DD-WRT filesystem?
I have an ASUS RT-N16 router that I've flashed with the open-source DD-WRT firmware. According to my ssh login, I'm running:
DD-WRT v24-sp2 mega (c) 2010 NewMedia-NET GmbH
Release: 08/07/10 (SVN ...
1
vote
1answer
72 views
How do I route different users over different OpenVPN tunnels in Linux?
The setup:
I have multiple, static-key OpenVPN client/server configurations, labeled "client1", "client2", and "client3" with server/client IPs 10.10.1.1/10.10.1.2, 10.10.2.1/10.10.2.2, and ...
2
votes
1answer
58 views
Explanation of bandwidth management script calling tc
I have some scripts in Linux to manage internet bandwidth, but I do not understand what they do.
What is the meaning of the following scripts:
tc qdisc add dev $IF root handle 1: htb default 256
tc ...
3
votes
1answer
62 views
tc on bridge port
I have a 4 port bridge:
root@Linux-Switch:~# brctl show
bridge name bridge id STP enabled interfaces
br0 8000.000024cd2cb0 no eth0
eth1
...
1
vote
3answers
129 views
Block network access of a process?
Is it possible to block the (outgoing) network access of a single process?
0
votes
3answers
446 views
How can I redirect ports 80 and 443 to 8080 and 8443 with iptables?
I'm looking at the documentation for a Tomcat 6 webapp called DSpace, specifically in regardds to running Running DSpace on Standard Ports (80 for http:// and 443 for https://)
I am trying to use ...
2
votes
1answer
73 views
IPtables command shows libipt_random.so missing
When I run a command, it shows error. I searched on net, but no one give me the correct answer. Googling shows only wrong answers for this questions.
So please help me to overcome this problem.
...
1
vote
1answer
302 views
Help to understand Iptables Forward chain with DNAT
I have one server where iptables configured with all chains DROP in filter table
eth0 :- 10.0.0.2 [ Intranet assume as LAN ]
eth2 :- 172.16.0.2 [ External clients assume as WAN ]
Now What I am ...
2
votes
1answer
96 views
Linux nat/iptables configuration for a chain of peer-to-peer links
I have an experimental setup, of 4 Linux (CentOS) machines:
All 4 machines are internally connected using different networks and can ping eachother directly connected interfaces. However only PC4 ...
1
vote
2answers
339 views
iptables blocking from internet side on eth1?
How to use iptables to deal with two Ethernet ports?
eth0 port for LAN use (192.168.1.50 Private IP).
eth1 port is connected to the internet via cable modem (80.0.xxx.xxx public IP).
ifconfig ...
1
vote
1answer
514 views
Redirect Packets from ppp0 interface to ethernet interface in linux
My question is similar to this question, however with some change.
I have a PPPoE connection on my Linux Machine (CentOS kernal 2.6.32) as a client, so that when I setup this connection, another ...
6
votes
1answer
275 views
iptables will match the following ICMP request packet as ESTABLISHED state after the first reply packet is sent
Test environment: CentOS 6.3 - kernel 2.6.32-279.el6.i686, iptables v1.4.7
Win7 <---> CentOS
Windows is constantly replaying ICMP echo request in 10pkt/sec rate to CentOS.
In iptables, I added the ...
2
votes
3answers
118 views
Undo iptables modification
I ran the following iptables commands to create a blacklist rule but used the wrong port:
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH
iptables -A INPUT -p tcp ...
3
votes
1answer
250 views
How to understand why the packet was considered INVALID by the `iptables`?
I set up some iptables rules so it logs and drops the packets that are INVALID (--state INVALID). Reading the logs how can I understand why the packet was considered invalid? For example, the ...
1
vote
1answer
182 views
Firewall/routing rule in Centos for this setup
I have two ethernet interfaces, namely eth0 and eth1.
I want to implement an advanced routing rule but I am totally new to firewall/routing rules in CentOS.
Here is what I am trying to do:
Both my ...
3
votes
1answer
140 views
Using source routing (LSRR) - any ideas?
What I want to do is conceptually very simple, but I can't find any information or help about how to go about doing this.
Basically, I want to configure my networking to use source routing (LSRR). ...
3
votes
2answers
233 views
Meaning of log entries from an iptables configuration
My router has Linux as its OS. The system log has a lot of rows about iptable and klogd that I don't understand, could someone explain them to me?
The iptables setup:
iptables -t nat -A PREROUTING ...
3
votes
3answers
270 views
Can't add large number of rules to iptables
I made a very simple bash script (echo at start, runs commands, echos at end) to add approx 7300 rules to iptables blocking much of China and Russia, however it gets through adding approximately 400 ...
4
votes
1answer
131 views
Creating a NAT from loopback to a remote server
My goal is to redirect connections from the local host to a remote server, and be able to change the remote address on the fly, without any client config changes. I can do this now using a nat on the ...
4
votes
2answers
2k views
Iptables: matching outgoing traffic with conntrack and owner. Works with strange drops
In my iptables script I have been experimenting with writing as finely grained rules as possible. I limit which users are allowed to use which services, partly for security and partly as a learning ...
3
votes
2answers
1k views
Why do iptables rules disappear when restarting my Debian system?
I add this rule:
sudo iptables -t nat -A OUTPUT -d a.b.c.d -p tcp \
--dport 1723 -j DNAT --to-destination a.b.c.d:10000
When restart computer rules are deleted. Why?
What I can do to make ...
1
vote
1answer
488 views
Redirect Output with Iptables
Is possible on Debian change the port of packets that going to a specific port, using iptables?
Example:
I want packets going out the direction a.b.c.d for port 1723 to be redirected to the address ...
3
votes
1answer
597 views
tc don't see marked with -j MARK packets
Server has 2 network interfaces:
eth1 with address 13.0.0.254/24
eth0 with address 172.20.203.4/24.
It's routing traffic between this two networks. Task is to limit bandwidth between this two ...
1
vote
1answer
1k views
iptables forwarding and routing
In fact, this question is about openwrt and CoovaAP, but I guess it's the same in other linux distributions.
I've two interfaces, a "wan" and a "wlan" interface.
Is there by default any filter, ...
4
votes
2answers
2k views
What prevents a machine from responding to pings?
I have a CentOS release 5.4 linux box on Amazon EC2 that I'm trying to set up to be monitored via Nagios. The machine is in the same security group as the nagios server, but it seems to be ...
1
vote
1answer
714 views
Redirect http using iptables for an ip range
I have a range of ip addresses (10.13.13.10-19) that I want to redirect all outgoing http traffic to an internal webserver. So if someone in that range tried to access any site, the html from my ...
3
votes
1answer
292 views
Routing through iptables
I have this vpn client that touches the routing table and then keeps watching it to exit if it gets touched.
It is the kind of setup needed for an endpoint, such as a laptop.
I want to use a small ...
0
votes
1answer
1k views
IPtables string match
I'm trying to write iptables string match rule To block http://domain.com:8888 and https://domain.com:8888 when it matches the supplied string in the rule. And another rule to redirect the ports also ...
0
votes
2answers
142 views
How To See Which Ports Are Open On A Particular Firewall
Using the terminal I was wondering if it would be possible to see a list of all the active firewalls on a particular system that I have shelled into. I want to be able to see which ports are active ...
4
votes
2answers
838 views
Having Linux port remap to itself
I have a scenario: I have 4 server and 3 web inbound requests that I have to allow through a modem/router. the ports are https(ssl)443 ssh22 and http80. All 4 servers want them.
I had set up the ...
1
vote
1answer
257 views
How do I shut down ports remotely without shutting myself out?
I have an Ubuntu 11.04 server in a remote location on another continent, so I have no physical access to it. I only interact with it by ssh (and scp), and intend to only ever interact with it that ...
1
vote
1answer
124 views
iptable rule to redirect only https handshake?
I was reading this interesting article today: http://www.moserware.com/2009/06/first-few-milliseconds-of-https.html
A crazy thought came to mind...Is it possible to write an iptable rule that only ...
8
votes
4answers
472 views
iptables on tor exit node
I want to run an open Tor router.
My exit policy will be similar to ReducedExitPolicy.
But I also want to make it hard for the tor network to abuse my resources.
Cases I want to prevent clients ...
1
vote
1answer
381 views
Allow Windows file share through a Linux Firewall
I'm struggling to enable NTFS share between two Windows (XP and 7) hosts through a Linux firewall.
Here's my setup:
[XPMachine-LAN1]---------->[LINUX FIREWALL]---------->[Win7-LAN2]
What I ...
1
vote
2answers
714 views
Checking the type of NAT
I have read that there are many types of NATs available like symmetric NAT, full-cone NAT, etc. If I am behind a NAT, is there any way to find out the type of NAT behind which I am currently working ...
7
votes
1answer
4k views
Why are incoming packets on a TAP interface seen with tcpdump but not with iptables?
A program injects packets on a Linux TAP interface (these packets are coming from a virtual machine). Specifically, these are DHCP requests (so they're UDP). I can see the packets with tcpdump but not ...
5
votes
2answers
991 views
How to restrict internet access for a particular user on the lan using iptables in Linux
Let's say there are two users on the LAN, A and B. How do I restrict user A from internet access using iptables rules and saving the rules so that after reboot, they are still effective. And suppose I ...
6
votes
2answers
5k views
Output traffic on different interfaces based on destination port
My question is basically the same as Only allow certain outbound traffic on certain interfaces.
I have two interfaces eth1 (10.0.0.2) and wlan0 (192.168.0.2).
My default route is for eth1.
Let's say ...
-1
votes
1answer
2k views
What is sport and dport?
I want to stop internet on my system using iptables so what should I do?
iptables -A INPUT -p tcp --sport 80 -j DROP
or
iptables -A INPUT -p tcp --dport 80 -j DROP ?
2
votes
0answers
310 views
Why are packets not moving forward? [closed]
I have a server with forwarding turned on. I placed an iptables LOG target in the PREROUTING, INPUT, and FORWARD chains of the mangle table. I can see the LOG messages from PREROUTING, but not INPUT ...
3
votes
4answers
1k views
How to share the internet connection?
An ordinally network topology in picture:
In words:
- "server" (e.g.: an Ubuntu 10.04 LTS) is connected to the "internet" through pppoe connection
- "server" is using it's wireless card in AP ...
4
votes
1answer
2k views
iptables port-mirroring
I need to be able to get a copy of packets received on port 8001 to port 8002. I have tried the following but I get an error that --tee is undefined.
sudo iptables -t nat -A PREROUTING -p TCP -s ...
1
vote
2answers
482 views
How to Optimize an IPTABLES script?
If I could list that which iptables rule has how many matched packets, then I could create a better/faster iptables script that's faster. That rule would be at top/first that has the more packets ...
1
vote
3answers
5k views
iptables drop all incoming ICMP requests except from one IP
Currently, I have something like:
iptables -A INPUT -p ICMP --icmp-type 8 -j DROP
iptables -A INPUT -s x.x.x.x -p ICMP --icmp-type 8 -j ACCEPT
However, when I run the second command, it ...
5
votes
1answer
6k views
How to reset all iptables settings?
Are there any simpler commands to these? (e.g.: a oneliner? can one command reset iptables/netfilter settings to this?)
IPTABLES="$(which iptables)"
# RESET DEFAULT POLICIES
$IPTABLES -P INPUT ...
0
votes
3answers
690 views
IP Tables / netfilters and modules
I am trying to understand how firewall works in linux...
I have read documentation but i am not sure about some things....
Netfilters is included in the modern kernels which allows you using hooks ...
2
votes
2answers
3k views
iptables: allow certain ips and block all other connection
How do I allow certain ips and block all other connection in iptables?
3
votes
1answer
159 views
Linux App that monitors log and add rules to iptables
I used to use a linux software that monitors logs like http, ssh, etc and if it detects that someone is trying to use brute force, it blocks that ip by adding a rule to iptables. I forgot what that ...
