0
votes
1answer
18 views

How to use partial IP address in /etc/sysconfig/iptables for the “-s” flag?

in this example it is a full ip ip is: 1.1.1.1 -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -s 1.1.1.1 -j ACCEPT but suppose i want to allow any ip that simply starts with: 1.1. ...
-2
votes
0answers
14 views

real scenario about tc command and mangle table of iptables [closed]

I don't have any question, But i have a request: I want to learn mangle table of iptables and tc command But i need to a real scenario, Please define me a real scenario!
0
votes
0answers
27 views

IPtables Packet Balancing

I would like to see the below work as a result of seeing several posts online that have this working but not quite the same as my situation. Forgive me if it appears to be a stupid idea as I'm now ...
0
votes
1answer
30 views

What this Iptables rules does?

I think I can understand this iptable rule, but I want to make sure what it does, so can someone explain to me technically what this does? well this two rules combined. /sbin/iptables -t nat -A ...
0
votes
0answers
21 views

How can I use 0.0.0.0/0 in ipset hash:net,port?

Right now, if I do ipset a ansible_allowed 0.0.0.0/0,tcp:22 I get ipset v6.19: The value of the CIDR parameter of the IP address is invalid and instead I have to add 0.0.0.0/1,tcp:22 ...
1
vote
1answer
57 views

Curious about strange ICMP type 3 code 10 traffic to my IP address

My firewall (iptables) logs some strange ICMP type 3 code 10 traffic that I am curious to understand (specifically how or if this could be an exploit of some sort). Type 3 = Destination ...
5
votes
1answer
75 views

forward outgoing traffic port using iptables

I am trying to forward all outgoing traffic from port 80 to port 8080 using iptables and I tried the following rule, though it did not work: iptables -t nat -A OUTPUT -p tcp --dport 80 -j REDIRECT ...
8
votes
6answers
166 views

iptables rule adviser script

There is a server without any iptables defense: ACCEPT all.. There could be custom applications on this server. If we should need to harden this server (so deny all, and only let what is needed by ...
1
vote
0answers
535 views

Error: iptables: No chain/target/match by that name

I am trying to configure proxy server on RHEL Server 6.5 using Squid and iptables. Below is the command I executed and the error message it displayed: vzlptest01 root [root] > iptables -A INPUT -i ...
3
votes
1answer
170 views

What's the difference between ULOG and NFLog?

Various places suggest to use ULOG or NFLOG instead of LOG for getting dedicated netfilter logging (see for example here or here). From looking at man iptables those two look quite alike. Except that ...
1
vote
1answer
54 views

How do you route to secondary interface on the same physical port?

INTERNET<->(wan)BRIDGED_DEVICE(lan)<->ETH_ROUTER<->LAN Problem: Need to access web server on BRIDGED_DEVICE's LAN from INTERNET via ROUTER (BRIDGED_DEVICE web server cannot be accessed form ...
1
vote
0answers
195 views

Why does this iptables rule doesn't get configured after a reboot once in a while? [closed]

On my Android network device, iptables firewall rules service script is started by the init.rc scripts during boot time. One of the firewall INPUT chain rules doesn't get configured in the iptables ...
1
vote
1answer
54 views

iptables - masqueraded NAT has delayed first hop in traceroute

I'm just in the process of setting up my Linux (Debian-based) router with a PPPoE connection via an ADSL/PPPoA -> PPPoE bridge. The connection works perfectly on the router itself but a traceroute ...
1
vote
1answer
314 views

iptables based redirect captive portal style

What is a iptables set of rules that will force hosts connected to a access point, that try to access any website (port 80 of any ip or hostname) to be redirected to another device on the network ...
4
votes
2answers
83 views

Can iptables rules manipulate IP sets?

In iptables-extensions(8) the set module is described and it is discussed that it is possible to react to the presence or absence of an IP or more generally a match against an IP set. However, it ...
1
vote
0answers
33 views

How do I route traffic between eth0:0 and eth0 [duplicate]

I have been trying to convert my linux box which is running Mint into a router. eth0 has a public IP address of 71.xx.xx.xx. I created an eth0:0 and gave it an IP address of 10.0.0.100. I started a ...
2
votes
1answer
72 views

IPTables Port Redirection Should Have Broken Apache But Didn't

I have a Load Balance set up in Apache httpd: <VirtualHost *:80> DocumentRoot /var/www/html ServerName xxx.xxx.xxx.com ProxyRequests Off ...
2
votes
1answer
36 views

Do I have to swap IP sets, or can I add/remove on the fly?

I was wondering about the semantics of ipset(8). Is it possible to add a rule matching a set to iptables and then manipulate the set, or can I only create a set and swap it for an older set in order ...
2
votes
0answers
34 views

iptables drop length and TTL condition doesn't work

With iptables utility on Linux host need to create mini firewall. I need to drop all incoming connections with package length greater than 722 AND TTL greater than 22. Need exactly AND. Drop only if ...
0
votes
1answer
219 views

Disable iptables service on CentOS

I don't want the service to start after reboot. my code does this: service iptables stop service iptables save chkconfig --level 123456 iptables off service iptables status iptables: Firewall is not ...
5
votes
1answer
157 views

Skip routing via `lo` interface for outgoing packets

Introduction I have following load balancing configuration: 10.0.1.31 - lb 10.0.1.35 - virtual IP 10.0.1.32 - node1 (tomcat + mysql) 10.0.1.33 - node2 (tomcat + mysql) I'm using keepalived which ...
3
votes
1answer
98 views

Configure iptables on remote server without locking me up

I have a little remote server that I can access only with SSH, and what I want to do, is block all the traffic except port 22 for SSH. The first time, what I did was : iptables -P INPUT DROP And ...
0
votes
4answers
75 views

Linux routing tables

I'm trying to learn Linux routing tables and ran into bit of snag. In the example below I'm not sure what is happening. My understanding is 0.0.0.0 means that for line 1 and 2 any packets outside of ...
1
vote
1answer
65 views

How to see content of dropped packages at OUTPUT chain in iptables

iptables is as below: # iptables -t filter -nvL Chain INPUT (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 ...
1
vote
1answer
91 views

iptables adding rules in OUTPUT chain

We can insert iptables rules based on IP/Network/Hostname: iptables -t filter -A OUTPUT -p tcp -d www.google.com -j ACCEPT -m comment --comment "www.google.com" It is not accepting: iptables ...
1
vote
1answer
80 views

FTP download problems with iptables — Port 21 connection is allowed but “Network is unreachable”

I'm trying to connect to an FTP site but with, e.g., wget: Logging in as anonymous ... Logged in! ==> SYST ... done. ==> PWD ... done. ==> TYPE I ... done. ==> CWD (1) /gcrypt/gnutls ...
0
votes
3answers
67 views

iptables rules - input and output

I'm new with Linux and iptables. I have a Ubuntu Server distro (12.04) on a PC which has 2 network interfaces (eth0 and eth1). I also have 2 laptops, one is plugged to eth0 and the other to eth1. ...
2
votes
1answer
43 views

Should IP tables rules affect a serial port on Linux

I'm trying to setup some iptables rules on my embedded Debian Linux system, using a serial console I entered this: root@ts7600-47aad3:~# iptables -F root@ts7600-47aad3:~# iptables -P INPUT DROP ...
0
votes
0answers
987 views

IPTables “iptables table `filter': Table does not exist (do you need to insmod?)”

I'm trying to get iptables working for my embedded Debian system, kernel version 2.6.35.3-571-gcca29a0. I've tried to enable iptables support in the kernel by selecting these options (this is a diff ...
1
vote
2answers
88 views

Run shell script based on IPTABLES port access attempt

Is there a way in Linux (RHEL 5-6) using IPTABLES, that if someone tried to access port 21, as an FTP user, to log what the user name they are trying to authenticate as and additionally run a shell ...
0
votes
1answer
581 views

how to forward from port 80 to 8080 using iptables without opening port 8080?

The following iptables configuration work for forwarding port 80 to 8080. #nat chains *nat :PREROUTING ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A PREROUTING -i bond1 -p tcp -m ...
2
votes
1answer
118 views

Randomizing the source port for new connections

Generally whenever source port is selected by a network application, it is selected in a sequential manner among the free ports like 32000, 32001 and so on. I want to randomize the source port ...
0
votes
0answers
25 views

Routing Application through different network interfaces [duplicate]

I have two interfaces on a server, let's call them eth0 and eth1. The underlying server is running CentOS 6.5 I would like to be able for some application to use eht0 while some others use eth1. ...
1
vote
0answers
67 views

setting up a local VoIP to use as a Wifi Headset

I had this idea of using Wi-fi in a vehicle to connect my cell to the car call handler.Just as it works with bluetooth nowadays. Just to demonstrate that such a thing is possible , i had three Linux ...
3
votes
1answer
193 views

listen to a conversation using port forwarding

I have been able to make a phone calls using the SIP client Pjsua from one Linux computer to another one. In case you have not heard of this user agent, explaining it's functionality is quite easy. It ...
0
votes
1answer
53 views

Configuring iptables by software

Is there a software, or a linux distro which has such a software built-in, which makes configuring the iptables easier? If not, I thought that some of the mostly used configuarations with a simple GUI ...
4
votes
1answer
4k views

How to Allow Outgoing SMTP on iptables Debian Linux

If I choose to allow all traffic on the OUTPUT chain (iptables -P OUTPUT ACCEPT) mail sends fine. As soon as I lock down my server with these rules, outgoing mail stops working. All else works though, ...
1
vote
1answer
182 views

Session limit for OpenSSH server on Ubuntu Desktop 7.10

I need restrict session limit on my OpenSSH server only for one session (one connection). I use Ubuntu Desktop 7.10. Of course Version is old, but I need it for experimental purposes. I tried modify ...
2
votes
0answers
214 views

iptables REDIRECT in combination with matching on interface vs. IP address

I've successfully set up Tor for transparent proxying using iptables (ie, all outgoing traffic is sent through Tor without the application's knowledge). In doing so, I discovered both an odd problem ...
2
votes
1answer
1k views

Linux Fedora 19 - iptables failed to start

I've been trying to start the iptables firewall service, but it keeps failing. What's going wrong? # systemctl status iptables.service iptables.service - IPv4 firewall with iptables Loaded: loaded ...
1
vote
1answer
197 views

How do I allow only certain IPSet set's to access a certain port with iptables?

I'm using IPSet to build IP ranges for different countries as follows : # Canada ipset -F ca.zone ipset -N ca.zone nethash for IP in $(wget -O - http://www.ipdeny.com/ipblocks/data/countries/ca.zone) ...
3
votes
1answer
1k views

What is the difference between OUTPUT and FORWARD chains in iptables?

CentOS 6.0 I'm studying iptables and am getting confused on the difference between FORWARD and OUTPUT chains. In my training documentation, it states: If you're appending to (-A) or deleting ...
4
votes
1answer
5k views

How can I configure syslog.conf file, to log iptables messages in a separate file?

How can I configure /etc/syslog.conf file in order to save log information about iptables in a specific file. I want to save these information separately, so I can extract what I want easily and ...
1
vote
0answers
25 views

Configure syslog.conf file [duplicate]

How can I configure /etc/syslog.conf file in order to save log information about iptables in a specific file. I want to save these information separately, so I can extract what I want easily and ...
0
votes
3answers
135 views

Search in iptables.log file takes a long time

I have used iptables to save information about connections by modifying the /etc/syslog.conf file to save information in /var/log/iptables.log. So, every X hours, I need to extract information from ...
4
votes
1answer
65 views

Is there any difference between these two configuration options?

Is there any actual difference between iptables -P FORWARD DROP and net.ipv4.ip_forward = 0 ? I know that one is a firewall command while the other one is a kernel option. But: I don't know ...
4
votes
2answers
509 views

iptables port forwarding

I have a CentOS server with Java/J2EE(Tomcat) installed on TCP port 8080. I have two interfaces, eth0 and lo. I need to forward all incoming connection on TCP port 80 to 8080. I tried doing the ...
0
votes
2answers
223 views

Isolate a hosts networking with iptables

I want to isolate a host on my home intranet using iptables on my linux router. So say for instance, I have a host that has the IP of 10.0.1.50 and I want it to be able to talk to the rest of the ...
2
votes
1answer
51 views

How would I go about making this IPTABLE rule for every ip and not just one?

iptables -I PREROUTING -t nat -p udp -s 192.168.0.62 --dport 53 -j DNAT --to-destination 23.21.182.24 Instead of 192.168.0.62 I'd like to set that as a global rule, EVERY ip that needs dns should ...
2
votes
0answers
206 views

SNAT problem in iptables

I am trying to reroute traffic from specific devices in my house over openvpn. For this, I've created an OpenVPN tunnel between my house wifi router and my server. Here is my setup: Wifi router's ...