iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

3
votes
0answers
50 views

Why “echo f” in the case of clearing conntrack table doesn't work on debian?

Many people don't clear the conntrack table when they want to reload their firewall rules. When you have some ESTABLISHED connections, all the sessions won't be affected when you add a rule that ...
0
votes
1answer
72 views

how to forward ntp traffic to default gateway instead of vpn tunnel

I have a small Raspberry Pi server connected to an openvpn provider, used as a VPN gateway. Almost everything works fine with the following iptables rules: iptables -t nat -A POSTROUTING -o tun0 -j ...
1
vote
1answer
17 views

Would packets being processed by iptables chain be affected when updating iptables rules?

Suppose there are always packets being processed in iptables chains all the time. When I update iptables rules vi command line, would those packets still in process be dropped or delayed? In other ...
0
votes
0answers
19 views

error nf_conntrack table full without iptables running

Why I am getting "nf_conntrack table full" error in syslog even when I am not running iptables? I believe if iptables not running then nf_conntrack shouldn't used, even it's loaded into the kernel.
0
votes
0answers
37 views

Very slow RMI+SSL requests after added SSL certificate

I added a SSL certificate to a RMI based application, and it's working normally on test server, so after deploy it at production servers, all requests are waiting for SSL handshake, even local ...
1
vote
2answers
29 views

why do we need to specify 1 in the command iptables -I INPUT 1

While I configure the Linux firewall there is a command iptables -I INPUT 1 -p tcp --dport 80 -j ACCEPT In this command why do we need to specify 1 after INPUT
1
vote
0answers
38 views

How to proxy all traffic except local traffic and ssh to another server?

I have an application that connects a local database on the loopback address. I would like to send all the traffic of this application to another server to hide it's IP. The first solution I tried is ...
-1
votes
2answers
41 views

SSL Strip Attack: Confusion with “echo 1 > /proc/sys/net/ipv4/ip_forward”

In the SSLStrip attack, one has to enable IP forwarding using the command : echo 1 > /proc/sys/net/ipv4/ip_forward I understand this command enables the host to work as a router forwarding ...
3
votes
1answer
43 views

Using iptables to stop brute force attacks on a Apache https site

I have a TLS site Apache which uses Basic Authentication to protect resources. I'm trying to setup an iptables rule to prevent brute force attacks on port 443, so I've added the following iptables ...
0
votes
0answers
19 views

Troubleshoot routing in rewrite/virtual host

I don't want a solution as much as a way to find the problem. I am learning networking mostly because it interests me and I set up something in my uncle's restaurant. It looks like this. A soft AP ...
2
votes
0answers
88 views

privoxy or any proxy server on Linux forward requests to multiple different proxy servers

I'm a stack exchange Virgin. Is it possible to forward data to the parent proxy based on the listen-address port in was recieved For example my firefox browser is set to use proxy 90.91.92.93:8118 ...
1
vote
1answer
37 views

tcp tunnel inside local network with iptables and bridge involved

I want to configure outside and inside forwarding rules to behave the same way, and simplified problem that i have with 'inside part' is like this: if i have compA - eth0 192.168.0.1 compB - br0 ...
1
vote
0answers
93 views

How to do iptables nat loopback?

I have a linux server behind the ISP's cablemodem-router combo. With some hacking I was able to make the port forwarding work, and the DHCP exceptions in the udhcpd. But I wasn't able to do the NAT ...
3
votes
2answers
197 views

Why doesn't iptables receive the marked packet?

I was learning the ping command options. In that I found the -m option to set the mark for a packet. The below command sends the packet with marking of 10 to the 192.168.2.65. ping -m 10 192.168.2....
0
votes
0answers
40 views

iptables traffic redirecting going wrong - UDP forwarding from proxy

good evening! I have a proxy running HAProxy and iptables in my network (and that proxy is behind another firewall and NAT). So far, I've been doing only TCP redirects to servers using HAProxy, and ...
2
votes
0answers
78 views

Is an SSH connection timeout expected when iptables is set to REJECT?

We’re setting up a firewall for a machine that should allow: incoming SSH connections from particular IP addresses; ICMP, except for redirect. We’ve opted to use REJECT over DROP, at least until ...
0
votes
1answer
71 views

iptables redirect via url to localhost vhost

I'm trying to set up a test environment for a mobile app. I have a machine acting as a gateway and providing dhcp on 192.168.10.0/24, and serving pages from apache. How would I set up iptables rules ...
0
votes
2answers
155 views

iptables forward traffic to vpn tunnel if open

I've used the following guide to set up my raspberry pi as an access point: Raspberry Pi 3 as wifi access point I'm forwarding wlan0 to eth0 and NATing all my traffic. Works great! sudo iptables -t ...
2
votes
2answers
33 views

Debian 8 - IPTables reverts to state on every packet

Problem: iptables cannot be changed. On my computer, I can run iptables -F. iptables -L shows it is flushed. When any packets come into or out of the machine, all rules are back! The same behaviour ...
0
votes
0answers
49 views

ubuntu 14.04 create route to multicast stream server and have access udp://239.255.0.169:5500

My server is ubuntu 14.04 server edition and I am trying to re stream existed multicast stream by my server : Multicast stream server is using udp://239.255.0.169:5500 destination ip. On my side I ...
2
votes
1answer
101 views

What is the meaning of UNCLEAN state in iptables

What is the meaning of UNCLEAN state in iptables? Example: iptables -A INPUT -m conntrack --ctstate UNCLEAN -j DROP This actually gives me an error, but there should exist an unclean state. ...
1
vote
0answers
31 views

NFTables NAT not caolled

I have tried to switch from IPTables to NFTables. Everything worked fine, except of NATting. This configuration does nothing when I try to run it, the NAT chains are not called: table ip vms { ...
0
votes
1answer
36 views

How to do Masquerading with NFTables

How would I implement a masquerading rule like this iptables one in NFTables: iptables -t nat -A POSTROUTING -s 10.5.6.0/24 -o eth0 -j MASQUERADE I've looked for it, but couldn't find out how to ...
5
votes
1answer
114 views

Simulate ethernet cable unplugged on a remote machine while staying connected

I am working from home on remote embedded Linux machine "X" via ssh. It has one physical network card. I need to simulate Ethernet cable unplugged condition on the same remote machine "X" , while ...
3
votes
0answers
33 views

No “unreachable” response for an outgoing TCP connection when using fwmark and policy routing

I would like to route locally-generated traffic: to a TCP port "A" of host "H" via the interface "A", to a TCP port "B" of host "H" via the interface "B". Interface "B" is sometimes unavailable. ...
0
votes
1answer
23 views

secure my servers with iptables

I have 2 vps servers (debian 7 & 8) with a public IP address and I would like to protect them. I would like to have access only to SSH (public/private keys), openVPN, services that are requested ...
1
vote
1answer
43 views

Searching for a solution to set up a reverse proxy for game servers

I run a game server on my dedicated box in country A, which runs Linux and communicates with its clients using UDP. The server has players from both inside and outside Country A. Players within ...
0
votes
0answers
20 views

VLAN sub-interfaces and Netfilter

Is it correct to think that from Netfilter point of view there are no separate packet flows for physical interface(for example eth0) and VLAN-interface associated with the physical NIC(for example ...
2
votes
1answer
123 views

How to add marks together in iptables (targets MARK and CONNMARK)

When you want to mark a packet in iptables, you would generally add the following line to your firewall script: iptables -t mangle -A POSTROUTING -p tcp -m multiport --dports 80,443 -j MARK --set-...
4
votes
0answers
115 views

TC (Traffic Control) to control bandwidth

I'm having an issue with a bandwidth script that I've been using for a while to limit the outgoing bandwidth on a port. It worked fine at the beginning until I wanted to change the outgoing port ...
0
votes
0answers
59 views

iptables for tomato to block all non-vpn traffic

I have been combing through a few forums of many VPNs that have iptables for the tomato router. Most don't work. The one from VPN.ac recommends adding under Administration > Scripts > Firewall ...
0
votes
1answer
19 views

Does 'multiport' make a difference in terms of efficiency?

Can any one can say definitively that using the --multiport extension with iptables rules: Is faster than creating a rule per port? Is slower than creating a rule per port? Makes no difference? If ...
1
vote
2answers
51 views

IP tables for home use

I've been trying to set up rules for a desktop I have in my home network and even though at first this configuration worked, I changed something somewhere and now it won't pass any kind of connection. ...
2
votes
1answer
38 views

Can you send a TCP packet with RST flag set using IPTABLES as a way to trick NMAP into thinking a port is closed?

I am learning Nmap and a thought occurred to me with regards to a SYN scan... A SYN scan sends an empty TCP packet with the SYN flag set to illicit a response from the target of either RST, ...
2
votes
1answer
127 views

How can I mark a flow with iptables?

I read this tutorial, however I am considering a method to load balancing for Internet connection by applying iptables rule on 2 interfaces. The following is my iptables rule. #!/bin/sh IPT="/sbin/...
0
votes
1answer
31 views

Understanding Iptables rules to prevent DDoS

Following IPTables rules exist on my system as some preventive measures against DDoS attacks -A INPUT -s 255.0.0.0/8 -j LOG --log-prefix "Spoofed source IP" -A INPUT -s 255.0.0.0/8 -j DROP -A INPUT -...
1
vote
2answers
202 views

How does NAT reflection (NAT loopback) work?

I use the auto generated rules that come from OpenWRT as an example of NAT reflection (NAT loopback). So let's pretend there's a network 192.168.1.0/24 with two hosts (+ router): 192.168.1.100 and ...
0
votes
1answer
27 views

iptables connection refused in VLAN network when iptables configured NAT and port forwarding

I have a static IP X.X.X.X. I configured a Linux server as a router by using iptables. The following figures as my network topology: ppp0 +-------------+ +----------+ |...
0
votes
1answer
30 views

iptables connection mark not balance

The following is my network topology: + + | | | | | | | +-----------...
1
vote
3answers
111 views

log connection attempts from an IP blocked by iptables

I blocked an abusive IP from a CentOS server using iptables, dropping all connection attempts on all services / ports. As is the way of things, the server with this IP may have been part of a botnet, ...
0
votes
1answer
41 views

understand chains and tables in netfilter/iptables

As I understand, Linux kernel has five hook points for IPv4 packet flow defined in netfilter_ipv4.h file: /* IP Hooks */ /* After promisc drops, checksum checks. */ #define NF_IP_PRE_ROUTING 0 /* ...
1
vote
0answers
53 views

Why fail2ban doesn't put some IP address in jail

This is several days ago, I observed some IP addresses was't banned by fail2ban, and continued to brute force attack on different port of ssh. This an extract of my logwatch: undef: 22 times a [...
4
votes
1answer
100 views

Identifying source of audit messages in kern.log

I recently installed the auditd package on my Debian machine. I did some testing with auditctl, creating a single rule to watch a directory, proved something, and then removed and purged auditd. ...
0
votes
1answer
77 views

How do I make sure the iptables is closed?

I want to disable iptables completely. I followed the instruction like /etc/init.d/iptables close it said there No such file or directory [root@dataapp02 tmp]# service iptables stop Redirecting ...
1
vote
1answer
24 views

Linux + iptables fallback

I want to enable the routing VIA tcp from port 770 to port 7714 iptables -t nat -A PREROUTING -p tcp --dport 770 -j REDIRECT --to-ports 7714 . so I get the following: iptables --table nat --list ...
1
vote
1answer
111 views

Changing IPTables to Allow FTP over TLS Using Passive Ports

I am using Arch Linux. I followed a tutorial to change /etc/iptables/iptables.rules to allow only the basic ports for my web server. I also used /etc/modules-load.d/nf_conntrack_ftp.conf to enable ...
3
votes
1answer
42 views

How to make iptables logs to identify protocols by name and not by number?

In my iptables log files (Ubuntu 16-04), all messages from my LAN router and from other hosts in the LAN, related to IGMP have "PROTO=2". Is there a way to change this and get "PROTO=IGMP"?
3
votes
3answers
286 views

Why does SNAT happen in POSTROUTING chain and DNAT in PREROUTING chain?

Why does SNAT(modifies source IP and/or ports) happen in nat table POSTROUTING chain, i.e after routing? And why does DNAT(modifies destination IP ant/or ports) happen in PREROUTING chain? I guess ...
1
vote
2answers
124 views

Is firewalld the same as iptables?

I tried to close iptables on RHEL 7.2 using chkconfig iptables off error reading information on service iptables: No such file or directory tried /etc/init.d/iptables stop too, got -...
1
vote
3answers
30 views

How to access a URL filtered only for my public IP from outside my network

There is this URL which I can access from inside my network, because they allowed my public IP to access it. All other IPs are denied. how can I configure my iptables so that I can access this ...