iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

2
votes
1answer
118 views

Using iptables to block for specific services

I am using ipset in conjunction with iptables to create a list of IPs I want to block. I did this: ipset -N blocking iphash ipset -A blocking 124.205.11.230 // and repeated this line for all IPs I ...
2
votes
1answer
233 views

Linux nat/iptables configuration for a chain of peer-to-peer links

I have an experimental setup, of 4 Linux (CentOS) machines: All 4 machines are internally connected using different networks and can ping eachother directly connected interfaces. However only PC4 ...
3
votes
1answer
5k views

How to re-enable iptables on Fedora 18?

FirewallD is the default firewall in Fedora 18. I have been using iptables for quite some time and have a custom configuration which I need for logging of ip traffic. I am not used to the new ...
1
vote
2answers
3k views

iptables blocking from internet side on eth1?

How to use iptables to deal with two Ethernet ports? eth0 port for LAN use (192.168.1.50 Private IP). eth1 port is connected to the internet via cable modem (80.0.xxx.xxx public IP). ifconfig ...
1
vote
0answers
120 views

Deny/allow a user's access to a port dynamically

I have stumbled upon this little tech dilemma yesterday, and know that there is a solution to it (IRC BNC resellers have it implemented already). However, the exact details and implementation elude ...
0
votes
1answer
155 views

Fedora Firewall no option as of yet

I need a firewall because I was decade long user of internet security suites on windows. I am not a professional of networks or anything but a student who just needs to block unblock running ...
1
vote
0answers
255 views

Asterisk server problems with firewall settings [closed]

I replaced an IVR machine for incoming call after going down. It is running asterisk 1.4.23 on ubunutu 10.04 I decided to put the server behind iptables because my server was under brute force attack. ...
1
vote
1answer
2k views

Redirect Packets from ppp0 interface to ethernet interface in linux

My question is similar to this question, however with some change. I have a PPPoE connection on my Linux Machine (CentOS kernal 2.6.32) as a client, so that when I setup this connection, another ...
5
votes
2answers
11k views

Does iptables -F permanently delete all iptables rules?

In a RHEL training document, the author says: ...run the following command to disable the firewall on the current system: iptables -F He explicitly uses the word "disable" which to me suggests ...
4
votes
2answers
506 views

Why can I reach a different interface's IP address?

I'm wondering about this, and I can't seem to find an explanation on the internet. I have a linux gateway which has multiple interfaces: eth0: external ip eth1: 172.16.1.1/24 eth2: 172.16.2.1/24 ...
4
votes
2answers
8k views

incoming ACCEPT all iptables rule still appearing

I'm following this guide here: http://isalazyadmin.net/2009/07/02/configuring-a-basic-firewall-for-debian-linux/ And I have the iptables listed shown, but my server still appears to be accepting all ...
3
votes
2answers
555 views

iptables routing marked packets from router to PC and routing them back to router

I'm trying to do deep packet inspection on HTTP packets. The purpose of this is to collect HTTP payload data and then create some proxy/cache-independent reports. Following this, the idea is to ...
2
votes
1answer
530 views

Why is a echo-request ping packet 84 bytes in the log of iptables?

When I log the length of a echo-request packet, iptables -A OUTPUT -p icmp -m icmp --icmp-type 8 -j LOG I saw the length was LEN=84, but in wireshark, the captured packet size was 0x60, why does it ...
1
vote
1answer
517 views

Allow user to see how many iptables rules are loaded, but not actual contents?

I want to allow user to check how many rules are present in filter table, but not able to view actual rules, is that possible? literally I mean iptables -L | wc -l (I know it's faulty), but sudo ...
7
votes
1answer
552 views

iptables will match the following ICMP request packet as ESTABLISHED state after the first reply packet is sent

Test environment: CentOS 6.3 - kernel 2.6.32-279.el6.i686, iptables v1.4.7 Win7 <---> CentOS Windows is constantly replaying ICMP echo request in 10pkt/sec rate to CentOS. In iptables, I added the ...
2
votes
1answer
245 views

PPTP server with NIC aliases

I have set up a VPN on a VPS Server using PPTP. I have one NIC with two aliases. eth0 eth0:1 eth0:2 The 3 interfaces have public addresses. eth0 is a French IP, eth0:1 is UK, and eth0:2 is ...
9
votes
2answers
21k views

iptables --set-mark - Route diferent ports through different interfaces

Short story, 3 interfaces, eth0 (LAN), eth1(ADSL), eth2(4G). eth0 -> eth1: Works (ports 80, 443, 4070) eth0 -> eth2: Doesn't happen This is a graphical representation of the idea: Port 80 & ...
3
votes
3answers
889 views

Undo iptables modification

I ran the following iptables commands to create a blacklist rule but used the wrong port: iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH iptables -A INPUT -p tcp ...
5
votes
1answer
4k views

How to understand why the packet was considered INVALID by the `iptables`?

I set up some iptables rules so it logs and drops the packets that are INVALID (--state INVALID). Reading the logs how can I understand why the packet was considered invalid? For example, the ...
4
votes
2answers
1k views

Port fowarding and load balancer in ubuntu server 12.04

I am looking to create a load balancing server. Essentially here is what I want to do: I have a public IP address, lets say 1.1.1.1 I have a second public IP address, lets say 2.2.2.2. I have a ...
2
votes
1answer
340 views

iptables doesn't forward from WAN to virtual machines

I have a machine working like gateway and have two network interfaces: eth0 LAN : 192.168.1.0/24 eth1 WAN : XXX.XXX.XXX.XXX (my public ip) This machine has 3 VM guest over virtualbox. All have ...
0
votes
3answers
2k views

How to make sense of an iptables chain configuration

This is about how to make sense of the chains found in the iptables default configuration on a typical home router running OpenWrt (a stripped down Linux for router devices), but which ultimately may ...
2
votes
1answer
954 views

Allow IP packet forwarding from LAN to modem via router

In short: I'd like to be able to telnet to my modem from my PC via my router. There is a simple home router on 192.168.33.1. It is running OpenWrt. It has the following interfaces defined: br-lan ...
1
vote
1answer
337 views

Firewall/routing rule in Centos for this setup

I have two ethernet interfaces, namely eth0 and eth1. I want to implement an advanced routing rule but I am totally new to firewall/routing rules in CentOS. Here is what I am trying to do: Both my ...
5
votes
1answer
5k views

Have someone ever audited the default OpenWrt firewall rules?

I have an Openwrt 10.03.1 installed from: openwrt-ar71xx-wrt160nl-squashfs-factory.bin (firewall only customized with this: sed 's/REJECT/DROP/g' /etc/config/firewall) - so besides this, IT'S A ...
4
votes
2answers
9k views

Port forward to VPN Client?

I've run into a bit of a puzzle and haven't had much luck finding a solution. Right now I am (sadly) connected to the net via Verizon 3G. They filter all incoming traffic so it is impossible for me to ...
1
vote
1answer
153 views

darkstat shown blocked traffic

I've installed Darkstat on a Qemu VM which is connected to a bridge interface on top of main server's interface ( eth0 ) In Darkstat report I can see many hosts in the same IP range of specified VMs ...
0
votes
1answer
710 views

Allow incoming connections from Google Translate only

I have a small web server running on port 80, and I'd like to allow only Google Translate to have access to it. First I tried running dig translate.google.com and dig translate.googleusercontent.com ...
5
votes
1answer
375 views

Using source routing (LSRR) - any ideas?

What I want to do is conceptually very simple, but I can't find any information or help about how to go about doing this. Basically, I want to configure my networking to use source routing (LSRR). ...
3
votes
2answers
576 views

Policy routing with load balanced ppp connections

This my setup using Debian 6.0. 6. It's role is a proxy server and a load balancer using eight 3G modems. Whenever a ppp connection dials it takes over the default gateway which is ok but it also ...
3
votes
2answers
525 views

Meaning of log entries from an iptables configuration

My router has Linux as its OS. The system log has a lot of rows about iptable and klogd that I don't understand, could someone explain them to me? The iptables setup: iptables -t nat -A PREROUTING ...
3
votes
3answers
980 views

Can't add large number of rules to iptables

I made a very simple bash script (echo at start, runs commands, echos at end) to add approx 7300 rules to iptables blocking much of China and Russia, however it gets through adding approximately 400 ...
5
votes
1answer
495 views

Creating a NAT from loopback to a remote server

My goal is to redirect connections from the local host to a remote server, and be able to change the remote address on the fly, without any client config changes. I can do this now using a nat on the ...
3
votes
0answers
179 views

iCloud stuff stops working while connected to OpenVPN

I have a fairly simple OpenVPN setup on an OpenVZ VPS with Ubuntu 11.10. Client is the Viscosity client on Mac OS X 10.8.2, and after some testing, we can rule out the client as being part of the ...
6
votes
2answers
4k views

Iptables: matching outgoing traffic with conntrack and owner. Works with strange drops

In my iptables script I have been experimenting with writing as finely grained rules as possible. I limit which users are allowed to use which services, partly for security and partly as a learning ...
6
votes
2answers
8k views

Why do iptables rules disappear when restarting my Debian system?

I add this rule: sudo iptables -t nat -A OUTPUT -d a.b.c.d -p tcp \ --dport 1723 -j DNAT --to-destination a.b.c.d:10000 When restart computer rules are deleted. Why? What I can do to make ...
2
votes
1answer
662 views

How to config iptables for pppoe?

When I create the only rule disabling all input, iptables -P INPUT DROP I can not connect anything. So it looks like I should allow some incoming activity to get PPPoE working correctly. What rules ...
6
votes
1answer
711 views

Why are packages being rejected even through there's a rule that accepts them all before hand?

I'm just reading up on iptables, finally. I'm a little confused because the input chain from the filter table (as installed, fedora 17), looks like this: target prot opt source ...
1
vote
1answer
3k views

Redirect Output with Iptables

Is possible on Debian to change the port of packets that are going to a specific port, using iptables? Example: I want packets going in the outbound direction to a.b.c.d for port 1723 to be ...
3
votes
1answer
2k views

tc don't see marked with -j MARK packets

Server has 2 network interfaces: eth1 with address 13.0.0.254/24 eth0 with address 172.20.203.4/24. It's routing traffic between this two networks. Task is to limit bandwidth between this two ...
1
vote
0answers
806 views

iptables not starting up

I have inherited a custom built Linux kernel 2.6.30.9 and am just upgrading the underlying OS from RHEL 5.4 to 5.8 (kernels 2.6.18.164 and 2.6.18.308 respectively). When booting, the following is ...
5
votes
1answer
3k views

Enable RTSP in iptables

I'd like to receive a RTSP stream via VLC, but when I try to run sudo -u non_root_user cvlc -vvv -I dummy rtsp://ip:port/x.sdp I get: Unable to determine our source address: This computer has an ...
1
vote
1answer
2k views

iptables forwarding and routing

In fact, this question is about openwrt and CoovaAP, but I guess it's the same in other linux distributions. I've two interfaces, a "wan" and a "wlan" interface. Is there by default any filter, ...
1
vote
0answers
137 views

What other rules should I use to allow PPTP outbound connection?

I already allowed outbound connection to TCP/UDP port number 1723, but PPTP connection still fail to establish, If I allow all outbound connection, the tunnel will just go fine.
3
votes
1answer
784 views

Changing firewall settings after installation of CentOS via kickstart

I was trying to install CentOS 6.3 via Windows Deployment Server. And to automate the installation process I used kickstart file in which i provided various details required during installation.Then i ...
1
vote
1answer
563 views

How to provide a “guest LAN” on one ethernet device

I have an always-on machine running Debian/Squeeze with a couple of ethernet ports (it's doing various serverish jobs, including DHCP) and a LAN on each. eth0 is on 192.168.7.* and has access to the ...
5
votes
3answers
4k views

Why can't I use the REJECT policy on my iptables OUTPUT chain?

I currently have my OUTPUT chain set to DROP. I'd like to change it to REJECT, so that I have a clue that it's my firewall stopping me from getting somewhere rather than a problem with whatever ...
2
votes
1answer
2k views

system wide SOCKS5 Proxy

I connect to my Server on the internet using ssh -D 3128 user@rootserver.com. If I am right I thereby open a SOCKS v5 Proxy to my Server. Using firefox and FoxyProxy I can now add this to my proxys ...
6
votes
3answers
9k views

What prevents a machine from responding to pings?

I have a CentOS release 5.4 linux box on Amazon EC2 that I'm trying to set up to be monitored via Nagios. The machine is in the same security group as the nagios server, but it seems to be ...
1
vote
1answer
1k views

Losing wifi connection to access point after a few minutes (hostapd, dnsmasq, iptables)

I'm using a laptop as a wifi access point. Since this laptop has the proper hardware, I was able to use hostapd. I wanted to use DHCP and iptables/NAT forwarding instead of a bridge to have more ...