iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

1
vote
0answers
50 views

Open ports for local samba server with iptables

I can't seem to connect from Windows 7 to my network share on Ubuntu (Samba). Why won't this work? Heres a bit of information, that would perhaps be useful. user1@computer:/etc$ sudo iptables -L ...
5
votes
1answer
75 views

forward outgoing traffic port using iptables

I am trying to forward all outgoing traffic from port 80 to port 8080 using iptables and I tried the following rule, though it did not work: iptables -t nat -A OUTPUT -p tcp --dport 80 -j REDIRECT ...
1
vote
1answer
65 views

forwarding not working in iptables from 8006 to 443

My dedicated server was bridged to vmbr0 and it has 2 Ethernet cards eth0 and eth1 its bridged. I have enabled forwarding with net.ipv4.ip_forward=1. I want to redirect the Port 8006 to 443. Now ...
0
votes
2answers
38 views

iptables and securing an smtp

I am trying to block all SMTP out of my network, that is not from my internal mail server address. So i would just like to know if there could be anything i am missing or perhaps anything i could ...
8
votes
6answers
167 views

iptables rule adviser script

There is a server without any iptables defense: ACCEPT all.. There could be custom applications on this server. If we should need to harden this server (so deny all, and only let what is needed by ...
-1
votes
2answers
148 views

My Centos Server cannot resolve the DNS host name [closed]

My Server OS: Centos 6.3 x64. The server iptables is: *filter :INPUT DROP [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT -A INPUT -p tcp -m tcp --dport ...
0
votes
1answer
41 views

Linux iptables DNAT 53306 to 127.0.0.1 3306

mysql real port is 3306。 I want public network using 53306 to visit mysql, and 3306 is not allowed access from public network. How to write the iptables rules DNAT 53306 to 127.0.0.1 3306?
0
votes
0answers
86 views

set rules for openvpn by iptables in firewall CentOS 6.2

Firewall (FW), three leg: eth0: 172.16.1.101 eth1: 192.168.99.99 (LAN) eth2: 10.0.0.1 (DMZ) I installed openvpn in FW by tunnel mode, already ok: tun0: 192.168.10.0/24. If I use shorewall and ...
1
vote
0answers
568 views

Error: iptables: No chain/target/match by that name

I am trying to configure proxy server on RHEL Server 6.5 using Squid and iptables. Below is the command I executed and the error message it displayed: vzlptest01 root [root] > iptables -A INPUT -i ...
1
vote
1answer
59 views

Bridged TAP interface to virtualbox

I need bridged TAP interface on client side of my VPN to virtual machine. I use VirtualBox 4.3.12. But in Adapter Network options in Attached to: Bridged adapter I do not see my TUN adapter. I have ...
2
votes
1answer
55 views

How do I enable IPv6 inbound traffic to get forwarded to my machine?

It seems that IPv6 traffic on my router is being dropped. How do I configure ip6tables appropriately, so that traffic is forwarded/accepted to my machine? Here's the syslog for my IPv6 traffic: Jun ...
1
vote
0answers
56 views

Packets sent through TUN interface not routed

I have a C program attached to a TUN interface. In my C program, I'm building packets and writing them to the TUN interface. Now to check if packets are really sent from my TUN interface I use ...
7
votes
3answers
469 views

Limit max connections per IP address and new connections per second with iptables

We have an Ubuntu 12.04 server with httpd on port 80 and we want to limit: the maximum connections per IP address to httpd to 10 the maximum new connections per second to httpd to 150 How can we ...
2
votes
1answer
32 views

My iptables works the opposite from what I wanted

I have this set of iptables rules ... $ sudo iptables -n -L Chain INPUT (policy ACCEPT) target prot opt source destination LOG all -- 0.0.0.0/0 0.0.0.0/0 ...
1
vote
1answer
74 views

Setting up a gateway between two subnets on the same physical network

I need to configure a DHCP-enabled network (192.168.2.) on a physical layer where resides an already existing network (192.168.1.) with static IPs. I have a Debian 7 server with two interfaces (server ...
2
votes
2answers
77 views

Temporary redirect ports

I need a temporary redirection of some ports to another machine. I've tried: iptables -t nat -A PREROUTING -p tcp --dport 4321 -j DNAT --to-destination 192.168.121.4:80 But shorewall blocks all ...
3
votes
0answers
42 views

Packets do not cross IP tables Postrouting when originating from an external IP

I'm trying to reflect traffic from the internet to an internal device that I only want to have local access. I have a host in my DMZ that I'm trying to DNAT traffic to this internal device, and SNAT ...
1
vote
0answers
60 views

How do I control ip routing in the new firewalld?

I have the following scenario: Our fedora server is connected to the internet on eth0 and has a second nic, wlan0 acting as an access point. The purpose of the access point is to provide a connection ...
1
vote
1answer
54 views

Iptables not forwarding. Input instead

I have set up iptables on my ubuntu headless server: iptables -S -P INPUT ACCEPT -P FORWARD DROP -P OUTPUT ACCEPT -A INPUT -s 10.1.3.90/32 -i eth0 -j LOG --log-prefix "INPUT: " -A INPUT -i eth1 -j ...
3
votes
1answer
174 views

What's the difference between ULOG and NFLog?

Various places suggest to use ULOG or NFLOG instead of LOG for getting dedicated netfilter logging (see for example here or here). From looking at man iptables those two look quite alike. Except that ...
1
vote
1answer
49 views

CentOS Traffic Filter

I am trying to use Squid to filter the traffic flowing through the network. I am also trying to make this system transparent. My network setup is like so: Router -> CentOS Machine -> The rest ...
0
votes
2answers
38 views

Is there a need for repeating rule parameters in iptables?

Let's say we need some ssh rules in iptables. But we also want to specify another chain for all the rules. We could use something like this: iptables -t filter -N ssh iptables -t filter -N tcp ...
1
vote
1answer
87 views

IPTables DNAT rule to local web server doesn't work with localhost?

I have linux box functioning as Wireless Access Point. Wireless clients connect and then browse the web. I am only allowing port 80. There are certain sites I'd like to block, but not by dropping the ...
1
vote
1answer
49 views

Configure NAT filtring behavior with iptables

I'm using this rule to configure SNAT: iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to-source 193.49.142.107:4000 I want to specify a rule to filter out packets not destined to the internal ...
1
vote
1answer
75 views

Randomize external port when doing NAT with iptables

I want to configure a NAT behavior different from the default one implemented by iptables. In this example: iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to-source 193.49.142.107:2000-400 The ...
4
votes
1answer
122 views

Why does my firewall (iptables) interfere in my bridge (brctl)?

I set up a bridge br0 "attached" to two interfaces: eth0, my physical interface connected to the real LAN, vnet0, a KVM virtual interface (connected to a Windows VM). And I have this single ...
1
vote
0answers
52 views

Local Client/Server communication using TUN interfaces

I want to establish a local communication between a client and a server using TUN interfaces. The client program will be attached to interface TUN1 and we suppose that it has IP address @IP1. The ...
5
votes
2answers
382 views

Why are some ports reported by nmap filtered and not the others?

I'm scanning a server which should have a pretty simple firewall using iptables: by default everything is DROPped besides RELATED and ESTABLISHED packets. The only type of NEW packets allowed are TCP ...
2
votes
2answers
176 views

IPTables rule to allow incoming SSH connections

The aim of this script is to only allow traffic over the VPN, except for localhost<->localhost and incoming SSH traffic. But when I run the script over SSH I am disconnected and forced to restart ...
0
votes
0answers
94 views

Port forwarding only works for first packet sent

I'm trying to configure port forwarding (80 and 443) on my new router. The router is a Xiaomi Mi Wi-fi, that establishes a PPPOE session with a VDSL2 modem/router (BBox2). The Xiaomi router runs a ...
1
vote
1answer
54 views

How do you route to secondary interface on the same physical port?

INTERNET<->(wan)BRIDGED_DEVICE(lan)<->ETH_ROUTER<->LAN Problem: Need to access web server on BRIDGED_DEVICE's LAN from INTERNET via ROUTER (BRIDGED_DEVICE web server cannot be accessed form ...
2
votes
1answer
45 views

How to combine iptables rulesets

Say there are several iptables scripts (run at boot time), all of which run something like iptables -A ... to add rules. I'm thinking this could be improved, turning all those shell scripts into text ...
2
votes
1answer
76 views

iptables - add rule for interface before it comes up

Right now I'm using /etc/rc.local to add some iptables rules on my Linux router on boot however some of the rules aren't added. I assume this is because the interface hasn't come up yet. This is what ...
1
vote
0answers
199 views

Why does this iptables rule doesn't get configured after a reboot once in a while? [closed]

On my Android network device, iptables firewall rules service script is started by the init.rc scripts during boot time. One of the firewall INPUT chain rules doesn't get configured in the iptables ...
0
votes
0answers
38 views

DNAT in iptables

Help me set rules in IPTABLES! I used rules in firewall - shorewall as below: DNAT net dmz:10.10.10.200 tcp 21,80,3306 DNAT net local:192.168.1.99 tcp 502,8008 Where: IP firewall: ...
5
votes
1answer
70 views

Is there a way to match an inet and inet6 IP set in a single rule?

Is it possible to have one IPv4 and one IPv6 IP set (ipset(8)) within the same rule? I have several rules that depend on one set of IPv4 addresses and another set of IPv6 addresses respectively, but ...
1
vote
0answers
10 views

List of netfilter modules for which I can leave out the -m option and other implied information

Rules in iptables/ip6tables can sometimes become a bit verbose to read. I am looking for a list of information that I can skip from iptables/ip6tables that I write. Examples: if you say -s 1.2.3.4 ...
1
vote
1answer
56 views

iptables - masqueraded NAT has delayed first hop in traceroute

I'm just in the process of setting up my Linux (Debian-based) router with a PPPoE connection via an ADSL/PPPoA -> PPPoE bridge. The connection works perfectly on the router itself but a traceroute ...
0
votes
1answer
68 views

iptables applied in local machine, Can't access remote ssh

I want to SSH to 192.168.1.15 server from my machine, my ip was 192.168.1.99. Source destination was UP, with IP 192.168.1.15. This is a LAN, there are 30 machines connected to the network and ...
2
votes
0answers
33 views

Defining IPv6 chains in ip6tables-restore/iptables-restore files, is it possible?

The format for the files generated by iptables-save/ip6tables-save and loadable through iptables-restore/ip6tables-restore stipulates that one can prepend -4 or -6 respectively so as to maintain the ...
2
votes
1answer
78 views

Remove an IPTable Rule

I'm having troubles removing this ipables rule in Ubuntu: $ iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 3128 I've tried using the -D attribute but with no success. How can ...
1
vote
1answer
35 views

Creating a virtual interface to always access a DHCPed interface with the same ip

I have an interface that on connect always gets a new IP. So I want to create a virtual interface with a static IP that "relays" everything over the physical interface. This would be useful to bind ...
1
vote
0answers
65 views

CPU usage by kernel modules, routing and forwarding rules

I have a system with a loopback kernel module installed. Through a bunch of routing and iptable rules, packets coming out of the loopback interface are sent over an ipsec tunnel. I am seeing that ...
1
vote
1answer
44 views

Routing packets between networks with iptables

I'm trying to create a proxy of sorts using just iptables. The linux computer (my proxy) has two ports: p2p1 is connected to the Internet. em1 is connected to a local network. There are two ...
0
votes
2answers
80 views

IPtables reset on reboot, how do I tell what is causing this

Using RHEL, and I have had some "Cyber Security" people work on my server. I'm now using this server in a completely closed environment with no outward network connection, and would like my iptables ...
1
vote
1answer
321 views

iptables based redirect captive portal style

What is a iptables set of rules that will force hosts connected to a access point, that try to access any website (port 80 of any ip or hostname) to be redirected to another device on the network ...
3
votes
1answer
57 views

iptables: refuse immediately when blocking particular domain from visiting by browser

I need to block particular domain "megafonpro.ru" and all subdomains from visiting by browser. Here's rule that I wrote: sudo iptables -I OUTPUT -p tcp --dport 80 -m string --string "megafonpro.ru" ...
2
votes
2answers
118 views

Bonding two broadband connections to serve LAN as a gateway

I need to increase the connectivity and speed of the Internet to my LAN users. These are the things I have in my hand to do so. PC with 3 NICs 1 for LAN and 2 for routers 2 broadband connections ...
4
votes
2answers
85 views

Can iptables rules manipulate IP sets?

In iptables-extensions(8) the set module is described and it is discussed that it is possible to react to the presence or absence of an IP or more generally a match against an IP set. However, it ...
1
vote
0answers
80 views

IPTables 1.4.7 dropped allowed packet

When looking in the /var/log/messages file I found this line: May 23 10:56:02 localhost kernel: IP4T Invalid TCP flags IN=eth0 OUT= MAC=70:5a:b6:ec:95:6b:00:23:48:ad:b0:a4:08:00 SRC=A.B.C.D ...