iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

5
votes
2answers
332 views

Does Fedora's firewall use iptables?

Fedora has a Firewall Configuration interface: Does this use iptables underneath to enforce the rules?
4
votes
2answers
206 views

Why were tables built into ipchains?

Why are tables built into ipchains? What was the benefit of adding tables to ipchains? Is there a simple scenario that would illustrate how tables are used to increase performance or offer some other ...
1
vote
1answer
510 views

How can I move firewall settings from one Debian Squeeze web server to another?

I configured a Debian Squeeze virtual machine in VMWare on my laptop. I configured it with a very restrictive set of firewall rules using Firestarter. I then uploaded a copy of its disk image to use ...
1
vote
3answers
1k views

Iptables GEOIP not working under Debian Squeeze

I've just installed xtables-*, compiled the geoip database, but when I try to use an iptables command it always gives back the following error: Command: iptables -I INPUT -p tcp --dport 80 -m geoip ...
2
votes
1answer
531 views

iptables rule for limiting bandwidth in given time

Under Linux/iptables how can I limit the bandwidth in given time? ex.: don't limit the connection speed from 22h to 06h, but limit it from 06h to 22h, ex.: the max speed would be only 1Mbit/second! ...
7
votes
1answer
3k views

Why doesn't my iptables rule work?

I have two interfaces on my VPS: eth0 and eth0:0. I want to block incoming packets on port 80 on eth0:0 using iptables. I tried this, but it doesn't work: iptables -A INPUT -i "eth0:0" -p tcp ...
1
vote
1answer
631 views

Allow Windows file share through a Linux Firewall

I'm struggling to enable NTFS share between two Windows (XP and 7) hosts through a Linux firewall. Here's my setup: [XPMachine-LAN1]---------->[LINUX FIREWALL]---------->[Win7-LAN2] What I ...
3
votes
0answers
666 views

tunneling FON traffic via Tor

I would like to tunnel the traffic of my FON router through Tor. For that I added a second network card to a local server and connected the FON router to it. Then I set up a DHCP server and configured ...
2
votes
1answer
1k views

What does this iptables entry mean?

iptables-save output: *filter :INPUT DROP [2929:172650] :FORWARD DROP [0:0] :OUTPUT ACCEPT [74596344:6265371965] These are the opening lines of the iptables-save command. What do the numbers in the ...
1
vote
2answers
1k views

Checking the type of NAT

I have read that there are many types of NATs available like symmetric NAT, full-cone NAT, etc. If I am behind a NAT, is there any way to find out the type of NAT behind which I am currently working ...
7
votes
1answer
6k views

Why are incoming packets on a TAP interface seen with tcpdump but not with iptables?

A program injects packets on a Linux TAP interface (these packets are coming from a virtual machine). Specifically, these are DHCP requests (so they're UDP). I can see the packets with tcpdump but not ...
4
votes
1answer
813 views

Force VPN using IPtables?

I want to force the use of VPN using iptables, therefore while VPN is disabled no outgoing traffic shall be allowed (except maybe some DHCP stuff...). Now i guess I could just block everything not ...
9
votes
1answer
6k views

Difference between SNAT and Masquerade

I am confused what's the actual difference between SNAT and Masquerade? If I want to share my internet connection on local network than whether should I select SNAT or Masquerade? Give me some ...
7
votes
2answers
2k views

How to restrict internet access for a particular user on the lan using iptables in Linux

Let's say there are two users on the LAN, A and B. How do I restrict user A from internet access using iptables rules and saving the rules so that after reboot, they are still effective. And suppose I ...
4
votes
3answers
2k views

IPTables and transparent proxies

I have set up a local, transparent TCP proxy on localhost. I want to redirect ALL TCP traffic to this proxy, so it can handle it and nothing "leaks out," circumventing the proxy. I need to use ...
9
votes
3answers
15k views

Output traffic on different interfaces based on destination port

My question is basically the same as Only allow certain outbound traffic on certain interfaces. I have two interfaces eth1 (10.0.0.2) and wlan0 (192.168.0.2). My default route is for eth1. Let's say ...
4
votes
1answer
625 views

Why should the ECN on your machine be disabled?

I was going through this article on iptables and there the author said that: It's important to turn off ECN (explicit congestion notification) so that Internet communications will work ...
-1
votes
1answer
8k views

What is sport and dport?

I want to stop internet on my system using iptables so what should I do? iptables -A INPUT -p tcp --sport 80 -j DROP or iptables -A INPUT -p tcp --dport 80 -j DROP ?
2
votes
1answer
2k views

iptables rule to allow access to internet

I made default policy of my machine- iptables -A INPUT -j REJECT #DROP ALL PACKETS TO INPUT CHANNEL INPUT channel has been blocked. Now I want to allow only some specific services like I should be ...
5
votes
4answers
1k views

How can I send spoofed packets in Linux

In order to test a firewall, I want to send malformed packets to its interface, regardless of my routing table. Is there a way to ask linux "send this exact tcp package, to this MAC address, ...
2
votes
0answers
419 views

Why are packets not moving forward? [closed]

I have a server with forwarding turned on. I placed an iptables LOG target in the PREROUTING, INPUT, and FORWARD chains of the mangle table. I can see the LOG messages from PREROUTING, but not INPUT ...
5
votes
4answers
9k views

Set some firewall ports to only accept local network connections?

Basic firewall question: How do I set up the firewall on a system in a LAN so that some ports are only open to connections from the local area network, and not from the outside world? For instance, ...
2
votes
1answer
3k views

Why does iptables still block my samba?

I'm currently fighting with iptables and samba. I read that samba needs ports 137-139 and 445 open on both tcp and udp. Here is the relevant part of my iptables config ... # forward valid incoming ...
2
votes
2answers
742 views

use iptables to allow incoming connections to some computer on port XYZ?

This is what I have: iptables -i em1 -A INPUT -j ACCEPT -p tcp --dport 9001 -v. If I want to accept incoming connections on port 9001 at this (127.0.0.1, or on the network 192.168.1.143) address, ...
5
votes
4answers
2k views

How to share the internet connection?

An ordinally network topology in picture: In words: - "server" (e.g.: an Ubuntu 10.04 LTS) is connected to the "internet" through pppoe connection - "server" is using it's wireless card in AP ...
5
votes
2answers
3k views

How to redirect kernel messages having the unique id substring into separate log file (using `rsyslog`)?

I am using iptables's logging feature to debug my network activity. I use certain prefix with --log-prefix parameter to uniquely identify messages in kernel log belonging to iptables output, for ...
6
votes
2answers
2k views

Is it possible to redirect a logging output of the iptables' LOG chain into a separate log file?

I don't want to mix iptables's log output with other system logs. How could I specify a dedicated log file for iptables LOG chains output?
5
votes
1answer
4k views

iptables port-mirroring

I need to be able to get a copy of packets received on port 8001 to port 8002. I have tried the following but I get an error that --tee is undefined. sudo iptables -t nat -A PREROUTING -p TCP -s ...
1
vote
2answers
683 views

How to Optimize an IPTABLES script?

If I could list that which iptables rule has how many matched packets, then I could create a better/faster iptables script that's faster. That rule would be at top/first that has the more packets ...
1
vote
1answer
964 views

Why am I getting a “Listing remote folder failed” error when I try to connect with SFTP?

I set up SFTP, but I have a problem regarding iptables. Here are my rules: A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT A RH-Firewall-1-INPUT -m state --state NEW -m ...
2
votes
1answer
2k views

Limit the max connections per IP using OpenWRT?

Would the following iptables command on an OpenWRT router assure that no one client has more than 50 active connections? $ iptables -I FORWARD -m connlimit --connlimit-above 50 -j REJECT ...
3
votes
1answer
205 views

iptables infographic

Is there an infographic somewhere that describes the logical flow of iptables? Specifically, I'm looking for something that diagrams which point in the process ip_conntrack applies.
1
vote
4answers
10k views

iptables drop all incoming ICMP requests except from one IP

Currently, I have something like: iptables -A INPUT -p ICMP --icmp-type 8 -j DROP iptables -A INPUT -s x.x.x.x -p ICMP --icmp-type 8 -j ACCEPT However, when I run the second command, it ...
6
votes
4answers
6k views

Fail2ban block with IPtables doesn't work on Debian Lenny. [moved ssh port]

I've recently decided to do some security maintenance. I saw my logs, and there were some tries against my SSH server. At first, I moved away the SSH port from the default 22. After it, I read ...
1
vote
2answers
8k views

Problems setting up TigerVNC and firewall

I have a box running a fresh install of Fedora 15. I've installed TigerVNC server on it and client on my Windows machine. I've added -A INPUT -m state --state NET -m tcp -p tcp --dport 5900 -j ACCEPT ...
1
vote
1answer
438 views

List iptables rules as append command

A while back I was watching over the shoulder of a Linux guru and he issued a command that listed all the iptables rules in the format of the append commands you would need to issue in order to build ...
2
votes
1answer
2k views

Unable to make outbound SNMP connections when IPTables is enabled

I have a bunch of windows servers configured with the windows SNMP agent. Each server has four IP addresses and SNMP listens on all of them. There is something very odd with my monitoring server ...
5
votes
1answer
10k views

How to reset all iptables settings?

Are there any simpler commands to these? (e.g.: a oneliner? can one command reset iptables/netfilter settings to this?) IPTABLES="$(which iptables)" # RESET DEFAULT POLICIES $IPTABLES -P INPUT ...
2
votes
1answer
2k views

iptables/pf rule to only allow XY application/user?

I think there is no iptables/pf solution to only allow an XY application on e.g.: outbound tcp port 80, eth0. So if I have a userid: "500" then how could I block any other communications then the ...
0
votes
3answers
1k views

IP Tables / netfilters and modules

I am trying to understand how firewall works in linux... I have read documentation but i am not sure about some things.... Netfilters is included in the modern kernels which allows you using hooks ...
9
votes
3answers
8k views

Only allow certain outbound traffic on certain interfaces

I have rather an odd issue. I have a server with two network interfaces eth0 and eth1. Each are connected to a different network. Each network has a internet gateway. The server has various outbound ...
7
votes
2answers
12k views

iptables: allow certain ips and block all other connection

How do I allow certain ips and block all other connection in iptables?
4
votes
2answers
1k views

Screen session running as root? (it shouldn't be) node.js

cd /serv screen -R node {in the screen} node test.js C^a d initially, ls -l /dev/pts total 0 crw--w---- 1 tick-tock tty 136, 0 2011-04-19 16:41 0 crw--w---- 1 tick-tock tty 136, ...
3
votes
1answer
173 views

Linux App that monitors log and add rules to iptables

I used to use a linux software that monitors logs like http, ssh, etc and if it detects that someone is trying to use brute force, it blocks that ip by adding a rule to iptables. I forgot what that ...
2
votes
1answer
519 views

tun0+ iptables rule

I'm trying to figure out what that + sign means in a rule such as this: -A FORWARD -i tun0+ -j ACCEPT I'm pretty positive it relates to vpn. I noticed a /dev/net/tun interface and a tun0 in ...
2
votes
4answers
518 views

What does this iptables command do?

Does iptables -I INPUT -j ACCEPT open all ports?
10
votes
3answers
3k views

Is there a way to find which iptables rule was responsible for dropping a packet?

I have a system that came with a firewall already in place. The firewall consists of over 1000 iptables rules. One of these rule is dropping packets I don't want dropped. (I know this because I did ...
3
votes
1answer
381 views

1000 iptables entries on CentOS?

I just got a new dedicated server with CentOS and I'm trying to debug some network problems. In doing so, I found over one thousand iptables entries. Is this the default on a CentOS system? Is there ...
1
vote
2answers
876 views

iptables rule for local network with free internet blocking unrequested connection from internet to server?

I have a home server (with slackware 13) with a eth0 for the local network and a eth1 for the internet (cable modem with dynamic ip). While I do want to learn more about iptables I am still on the ...
2
votes
2answers
4k views

iptables log file

I have ubuntu and I want to know where can I find the log file of iptables? I find out /var/log/messages, but I am not sure this is a correct log file or not. And I also want to know when this log ...