iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

1
vote
1answer
411 views

Some packets are flagged as INVALID by iptables

I configured a proxypass rule in order to redirect requests from the port 443 to a JBoss server running on port 8080. All works fine except some 503 errors in the Apache log, around 10 per day: In ...
1
vote
0answers
2k views

IPTables “iptables table `filter': Table does not exist (do you need to insmod?)”

I'm trying to get iptables working for my embedded Debian system, kernel version 2.6.35.3-571-gcca29a0. I've tried to enable iptables support in the kernel by selecting these options (this is a diff ...
1
vote
1answer
638 views

iptables forwarding between subnets

I want to forward traffic between two subnets, I'm not very familiar with iptables. The forwarding works except when iptables is enabled. There must be something wrong with the rules, though ...
1
vote
2answers
233 views

Run shell script based on IPTABLES port access attempt

Is there a way in Linux (RHEL 5-6) using IPTABLES, that if someone tried to access port 21, as an FTP user, to log what the user name they are trying to authenticate as and additionally run a shell ...
0
votes
1answer
2k views

how to forward from port 80 to 8080 using iptables without opening port 8080?

The following iptables configuration work for forwarding port 80 to 8080. #nat chains *nat :PREROUTING ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A PREROUTING -i bond1 -p tcp -m ...
1
vote
1answer
429 views

Configure port 1935 in iptables for media

On CentOs 6.4 I cannot connect to the media server from port 1935 only 5080. I have read you can edit the iptables files with following. Open flle /etc/sysconfig/iptables: $ sudo vi ...
3
votes
1answer
1k views

iptables: redirect local request with NAT

I'd like to redirect local requests to port which is translated with NAT. I have following rules: iptables -t nat -A PREROUTING -p tcp --dport 9020 -j DNAT --to 10.0.3.11:80 however request coming ...
2
votes
1answer
185 views

Randomizing the source port for new connections

Generally whenever source port is selected by a network application, it is selected in a sequential manner among the free ports like 32000, 32001 and so on. I want to randomize the source port ...
1
vote
1answer
797 views

Route HTTP traffic thorugh different interface

I have my normal eth0 interface and an setup ppp0 interface, the problem I have is that I want to exclusively route all HTTP/HTTPS traffic through the ppp0 interface and everything else through the ...
1
vote
1answer
120 views

How to measure the time a packet spends on the system(router)?

I have a streaming system and one if its components is a router/firewall. I'm using iptables for setting the required behaviour on the router. I'm having performance issues in forms of a constant ...
7
votes
3answers
13k views

iptables redirect outside requests to 127.0.0.1

I have a service running on 127.0.0.1 with port 2222. I need to forward all requests to 192.168.2.2:2222 (outside IP) only from subnet 192.168.1.0/24 to 127.0.0.1:2222. I'm trying to use this, but ...
1
vote
2answers
660 views

Saving an iptables configuration permanently

How can I save this configuration permanently? sudo iptables -t nat -A POSTROUTING -s 10.10.0.0/16 -o eth0 -j MASQUERADE
1
vote
0answers
637 views

iptables and physdev match confusion

I'd like to be able to prevent a network bridge from generating certain types of traffic from some of its interfaces. If I understand iptables correctly, packets generate by a device appear on the ...
0
votes
1answer
2k views

Fedora 20, startup script with network settings work correctly but without real effect

First, I love Fedora 20. :) I'm newcomers from Debian/Ubuntu/Suse, but I real like this clean distro. But I found some problems, and can't move forward with this little things. I have 2 PC in home ...
0
votes
0answers
27 views

Routing Application through different network interfaces [duplicate]

I have two interfaces on a server, let's call them eth0 and eth1. The underlying server is running CentOS 6.5 I would like to be able for some application to use eht0 while some others use eth1. ...
0
votes
0answers
93 views

Is it possible to move established connections on one port, to another without dropping data?

this problem has been bugging me for a couple of days now. I can't figure out a good enough solution using iptables without having dropped packets. So here is the back story. Say I have a client ...
0
votes
1answer
167 views

iptables - the meaning of “ERROR: No valid subcommand given”?

I've installed iptables on a embedded device with linux. I believe the installation was successful because all the other apps are working fine (busybox etc.). I try to run them but i get the ...
2
votes
1answer
496 views

iptables Port Forwarding — no service with the port

I have setup a network as in the image below: Firewall (FW) running CentOS 6 has two physical interfaces with subinterfaces: eth0:2 — 10.100.1.78/25 eth0:3 — 10.100.1.79/25 eth3 — 192.168.0.21/24 ...
4
votes
1answer
4k views

How to Block SSH Brute Force via Iptables and How does it work?

I'm planning to add the following rules to iptables to stop ssh brute force attack which are common these days. -A INPUT -i eth0.103 -p tcp -m tcp --dport 4522 -m state --state NEW -m recent --set ...
0
votes
1answer
278 views

PPTP: Allow remote clients to communicate with each other

I have a PPTP server. Clients log in to the server, but can not ping each other. The clients are at different locations. The problem is with my IPTABLES forward chain .... here is my iptables: ...
0
votes
1answer
127 views

why debian repository does not contain lokkit?

I was using lokkit in redhat, and I want to use it in debian, but it seems that debian doesn't contain it...
2
votes
2answers
4k views

FTP and iptables. Connection fails but ports are open

I installed proftp on my machine. With iptables disabled I can connect to the machine, using ftp-client or telnet. With iptables connection fails - telnet says "Connection failed" # works telnet ...
14
votes
1answer
6k views

Is it better to set -j REJECT or -j DROP in iptables?

There's an example of iptables rules on archlinux wiki: # Generated by iptables-save v1.4.18 on Sun Mar 17 14:21:12 2013 *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [0:0] :TCP - ...
2
votes
1answer
144 views

Internet sharing with iptables: choosing which connection to share

I have a computer with two network devices (eth0 and wlan0), both connected to the internet (two different connections/isp). I'm trying to share the connection of wlan0 to another computer connected ...
1
vote
1answer
982 views

Understanding the iptables rules created by FirewallD [closed]

I am having a hard time trying to figure out what the iptables rules generated by FirewallD say. Focusing on the "public" input zone, I have the following rules: *filter :INPUT ACCEPT [0:0] :FORWARD ...
8
votes
1answer
184 views

What is the difference between -j DROP and -j STEAL?

I often see that people set STEAL target in iptables rules. It's possible to get this target by installing (on debian) xtables-addons-common and xtables-addons-dkms. I was curious why people prefer ...
14
votes
2answers
6k views

What do numbers in INPUT,FORWARD,OUTPUT chains mean in iptables config file?

I came across the following config file: # Generated by iptables-save v1.3.1 on Sun Apr 23 06:19:53 2006 *filter :INPUT ACCEPT [368:102354] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [92952:20764374] -A ...
14
votes
1answer
11k views

What is the difference between -m conntrack --ctstate and -m state --state

I'm reading this howto, and there's something like this: We can allow established sessions to receive traffic: $ sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT ...
1
vote
0answers
51 views

How to send packets coming from a second router on a particular port back to the router, using iptables not a route

I have a Linux server which runs a particular service listening on a single TCP port. The Linux server connects to the internet using a PPP connection and also acts as router for a local network using ...
5
votes
3answers
8k views

Is it better to set rules in ip6tables or disable ipv6?

I have the following network configuration: # ifconfig -a eth0 Link encap:Ethernet HWaddr 00:e0:1c:73:02:09 inet addr:10.1.4.41 Bcast:10.1.255.255 Mask:255.255.0.0 inet6 ...
1
vote
0answers
116 views

setting up a local VoIP to use as a Wifi Headset

I had this idea of using Wi-fi in a vehicle to connect my cell to the car call handler.Just as it works with bluetooth nowadays. Just to demonstrate that such a thing is possible , i had three Linux ...
0
votes
0answers
837 views

Use iptable do redirect all the HTTP traffic to localhost

I use a Linux machine as WLAN Router with the help of hostapd and udhcpd. There's also an Apache web server installed on the same machine. Now I want to redirect all the traffic which comes through ...
3
votes
1answer
352 views

listen to a conversation using port forwarding

I have been able to make a phone calls using the SIP client Pjsua from one Linux computer to another one. In case you have not heard of this user agent, explaining it's functionality is quite easy. It ...
3
votes
1answer
294 views

How to deny access to specific port when destination is NOT a specific host?

I'm trying to DENY access to port 1000 when it is being accessed through any host or IP that is NOT a specific host. I.e. If I try to access the service on sub.domain.com:1000 I should get in. If I ...
4
votes
1answer
3k views

IPTABLES is slow after adding '-A INPUT -j DROP' to rule list

I am just getting started with iptables and stumbled across something I don't really understand. FYI, I followed the instructions of Ubuntu wiki's IptablesHowTo. The nat and mangle tables are empty, ...
1
vote
3answers
5k views

iptables-restore just says “FAILED”

I am not sure what's wrong with my rule in the Iptables. I am actually trying to build a SSH server and following a cyberciti tutorial. My Iptables configuration looks like this: # Firewall ...
0
votes
1answer
57 views

Configuring iptables by software

Is there a software, or a linux distro which has such a software built-in, which makes configuring the iptables easier? If not, I thought that some of the mostly used configuarations with a simple GUI ...
2
votes
2answers
346 views

RELATED,ESTABLISHED state in iptables

What do the words 'RELATED' and 'ESTABLISHED' individually signify in RELATED,ESTABLISHED state in iptables?
6
votes
1answer
13k views

How to Allow Outgoing SMTP on iptables Debian Linux

If I choose to allow all traffic on the OUTPUT chain (iptables -P OUTPUT ACCEPT) mail sends fine. As soon as I lock down my server with these rules, outgoing mail stops working. All else works though, ...
4
votes
2answers
382 views

How can I prevent iptables from counting bytes and packets on empty chains?

Background I occasionally have firewall rules that I need to use for maintenance windows, but don't want active (and therefore consuming CPU cycles or slowing the network interface) the rest of the ...
1
vote
2answers
5k views

Block specific application with iptables [duplicate]

I have to harden a Linux desktop as an assignment in my college. But I got stuck at a specific problem: I have to control the outgoing traffic with iptables. It should be possible to prevent a ...
2
votes
1answer
459 views

pptpd dead but subsys locked? on cent os

i install point to point tunnel (PPTP) in my VPS. (Cent OS 6 64 Bit) everything fine after reboot the PPTP not worked client side. the pptpd status shows " pptpd dead but subsys locked ". how to ...
2
votes
1answer
358 views

No internet even with iptables ACCEPT all

I was trying to setup the firewall settings, and probably did something wrong. I don't have internet now unless I stop iptables service I tried flushing,and accepting everything sudo iptables -F ...
4
votes
3answers
3k views

iptables: The “script” way or the “*filter, rules, COMMIT” way?

I'm trying to figure out how NAT and iptables work. While I'm in the trial-and-error phase of learning about it, I found two somewhat conflicting howtos. One howto uses a script to call iptables ...
1
vote
2answers
319 views

How is the loopback device traffic allowed?

How can I allow the traffic to be sent on the loopback device (lo)? What is the iptables command for it?
0
votes
1answer
926 views

iptables couldn't load target allow

I am using the command below to allow all traffic from hosts on my internal network but it says "iptables v1.4.18: Couldn't load target `ALLOW':No such file or directory". What is the problem here? ...
1
vote
1answer
522 views

Archlinux not configured with iptables

I have been trying to set up iptables on my archlinux server, however when I run iptables -nvL I receive the error iptables v1.4.20: can't initialize iptables table 'filter': Table does not exist ...
2
votes
0answers
577 views

Route all HTTP traffic through polipo

I've set up polipo on my machine to listen to the default port 8123. To test it, I set the in-memory cache to a ridiculously high 2 GB and downloaded a 50 MB file using wget utilizing the proxy. ...
0
votes
2answers
961 views

Route wlan0 to openVPN tunnel and rest to eth0

I'm having problems to create route/iptables rules for following configuration: I have an openVPN server (tun type) running on my raspberry machine at home At work i have company pc (behind proxy) ...
4
votes
1answer
218 views

How do you do NAT port redirection with PF?

In Linux, you can do NAT port redirection with a command like this: iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8000 What is the equivalent with BSD's PF?