iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

1
vote
0answers
25 views

Iptables multiple port redirects based on destination address

I have iptables setup for selective routing. In the current configuration it checks if the dst address is listed in a specific chain and if it is not it redirects the traffic to my proxy port which ...
0
votes
1answer
38 views

Block incoming port

I installed LabView on a Scientific Linux 6 machine and promptly got a message from our security officer, stating that the port 3580 is open and listening and that this is a security issue. ...
0
votes
3answers
40 views

iptables: block all inbound traffic over a certain port number

It is possible using iptables (on Debian) to block all inbound connections for all the ports with a port number over (as an example) 16000. Like this (using 16000 as reference): The port 15999 is ...
0
votes
0answers
15 views

Block incoming traffic in bonding mode when primary interface is down

My server running on latest kernel (4.4.6) has configured a bond device (bond0) with two enslaved interfaces eth0, wlan0 with primary interface eth0. cat /proc/net/bonding/bond0 Ethernet Channel ...
2
votes
1answer
51 views

Shorewall to protect interfaces that are not yet defined

I am planning to use Shorewall to filter traffic that originates from a virtual interface created by OpenVPN (lets call it tap0). If OpenVPN did not successfully create this interface before ...
1
vote
1answer
25 views

Route specific traffic to specific interface

I have two NICs. Basically, I want to use one of them for specific traffic (based on the destination IP or the domain) and the second one for the rest of the trafic. Is this possible? If it is, How ...
1
vote
0answers
23 views

OpenVPN block SMTP Access Server completely

I've tried almost all iptables rules to block smtp on openvpn server but still clients clients can access remote smtp servers on port 25. I'm using openvpn access server. It's creating two interfaces ...
1
vote
1answer
48 views

How do I amend these iptables rules so that they bind HTTP traffic to my VPN connection?

I have followed this guide to set up a VPN service to send the data to/from transmission-daemon from my device running Debian. #!/bin/sh # Print environment variables for transmission's benefit ...
2
votes
1answer
83 views

Don't allow docker internet access

I'm looking for a simple way to limit my docker containers so they only have local access and not internet access. I've tried using IPtables to do this and the following works: iptables -I FORWARD ...
0
votes
1answer
34 views

Dose iptables NAT overwrite user agent of HTTP headers?

If i use iptables to NAT all HTTP traffic behind another network, does it overwrite user agent of HTTP headers? The rules are as follows: /usr/sbin/iptables -t nat -A POSTROUTING -o eth0 -j ...
3
votes
1answer
87 views

PPTP VPN not working with Linux router

ORIGINAL: I've just switched from an old Linux install (Debian squeeze) to a new one (Linux Mint 17.3) for my router (I am using a full desktop PC with a Linux install as my router). The Linux PC ...
1
vote
1answer
32 views

Answer redirect IP to specific port

I want make a system that has a few subdomains. I set each subdomain to IP address using DNS. I used random IP addresses for the question 165.93.198.34 x.mydomain.com (Which is actually ...
2
votes
1answer
54 views

Blocking a specific external IP:Port connection in RedHat?

I know that in RedHat, in the IP tables I can block incoming connections to a local port. I can also block connections from a specific IP. But is it possible to block a connection from a specific IP ...
2
votes
0answers
58 views

How to debug what is stopping ping to respond on our server?

We used to have a sysadmin person months ago who had disabled ping response on one of our servers. But now we want to re-enable ping response. I tried to check if the ping was disabled from config. ...
0
votes
1answer
50 views

Redirect https request on local network

I'm trying to implement a local web server that handle all the http requests. Basically, when a user connect to the network and open an url, he is redirected to my local web server. I'm using dns ...
1
vote
1answer
35 views

lxc container <-> external internet, what I missed?

I have Ethernet on my machine (enp0s10) that connected to real network, and I have lxcbr0 Ethernet bridge which gather lxc containers. And I want to make available one of lxc containers. So I wrote: ...
1
vote
0answers
25 views

Why does a connection from my LAN to my public IP address fails?

I have an OpenVPN server on server. It is available from Internet via a two NATs: first the ISP box relays to 192.168.0.10, then 192.168.0.10 relays to 10.10.10.254 (relays = DNAT). I can connect ...
2
votes
1answer
87 views

Redirect secondary network interface traffic along with port forwarding to tun0 (OpenVPN) using iptables

I have a NAS server which I should do port forwarding for it in order to make its services accessible from internet. However my ISP is blocking ports, so I've managed to buy myself a cheap Ubuntu VPS ...
1
vote
1answer
17 views

What order of iptables rules to use for specific SRC IPs?

I would like to block traffic from a specific address during some hours. I use firehol to manage my rules. The following rule does block all traffic during my target hours ACCEPT all -- ...
0
votes
0answers
24 views

Firewall rules: banned localhost

I recently had an issue with a server that was refusing local connections. I was doing some wget domain.com/somePath. And while the resolution was correct and returned the right EXTERNAL_IP, the ...
0
votes
1answer
26 views

iptables REJECT icmp-admin-prohibited

The iptables man page says: Using icmp-admin-prohibited with kernels that do not support it will result in a plain DROP instead of REJECT I have been unsuccessful at finding out at which kernel ...
1
vote
0answers
14 views

OpenVPN maintain connection state during tunnel reconnect

Sometimes I want to do a short maintenance like restarting a tunnel, all connection running on top such as file transfer...etc will receive connection lost signal, is it possible to maintain those ...
0
votes
1answer
58 views

NAT for second interface on private network

I have the following configured for my two network interfaces. eth1 10.93.90.1 (Production Network) eth0 192.160.0.1 (Private Network/Labb Network) I want to configure eth0 with NAT so I can ...
0
votes
0answers
17 views

RHEL Jenkins email notifications failing

RHEL Server release 6.7 (Santiago) I know there have been multiple questions about this on SO (none of which have helped me solve my problem), but I think my problem pertains to Linux more so than it ...
1
vote
0answers
34 views

How to prevent responding to arp scan requests from outside (except the router) in ubuntu?

How do I prevent my computer from responding to arp scans in my network? A solution using iptables or something similar is very welcome. The network interface is wlan0. Some malicious users are ...
3
votes
0answers
16 views

Routing policy is not working

I have an Access Point with OpenWrt. On other host of the same LAN there is a squid (IP Address 192.168.80.148). I'd like to route packages with destination port 80 to 192.168.80.148. So I have ...
4
votes
1answer
67 views

How to redirect web traffic to specific host with iptables

I want to be able to redirect a host in my Lan to an specific ip address and port. I can achieve one thing which is that only my desired host can access the ip address, but I can't get the user to ...
3
votes
0answers
118 views

iptables and ip forwarding for failover

hi i have an ethernet nic interface with 4 additional virtual interfaces (failovers) all configured with public ip4 (IP-1 to IP-5) / netmask 255.255.255.255 / broadcast addr same as ip: eth0 ...
1
vote
0answers
40 views

Automatically manage whitelisting (e.g. in tinyproxy) of dynamic IPs?

I have a VPS that runs tinyproxy for private use, and another that runs nginx for development. Is there a protocol/daemon that I can use to automate whitelisting for my dynamic IP? So that tinyproxy ...
1
vote
1answer
94 views

How to block broadcast messages (Apple's mDNS traffic)

I am in a network and a user is sending broadcast messages on udp port 5353. Regardless of what that is and what their purpose is, I decided to block all the traffic, so I ran: sudo iptables -A INPUT ...
0
votes
1answer
98 views

What am I doing wrong when trying to open port 8080 on iptables using Ubuntu?

I'm trying to open port 8080 so I can use a web panel application (McMyAdmin) I have installed on my Ubuntu server. I'm rather new to Linux / SSH in general but I'm getting there thanks to various ...
1
vote
1answer
34 views

unmanaged vps centos6.4 need to open port 20/21

I brought an unmanaged vps which is running Centos 6.4 and the only port which was open was 22 and I need help opening port 20 and 21 so I can ftp, but every time I try to it wont save and let me ...
0
votes
2answers
36 views

Count Bytes by Ports

Using RHEL/CentOS 6.7 -- I want to be be able to know byte counts on IPv4 ports. We have thousands.. I would think counting via IP Tables for that would be a bit unweldy and slow the firewall a wee ...
1
vote
1answer
52 views

Iptables rules doesn't work as expected

I need to block access to my server from the outside of my private network. I need to allow pings from my server out only to my private network and answer pings initiated from my private network as ...
1
vote
0answers
37 views

How to not going through openvpn tunnel for a specific port

After long hours of digging and many tries I still cannot figure out how to not have a traffic on a given port going through the openvpn tunnel. Below my setup: (enp0s25)<ovpn server>(tun0) ...
1
vote
0answers
49 views

How to block access to “private” host-only network from VirtualBox nat interface (separate host-only networks)?

Scenario: 1 VirtualBox host with many vms. Different host-only networks are configured for different vm categories: Some vms are "private", others are "standard" vms. Most of these vms, including some ...
2
votes
1answer
38 views

How do you block a port on your loopback?

I am doing some testing and want to be able to test situations where my database goes down. Its running on the same box as my tests, and it appears that things like the following are not doing the ...
0
votes
1answer
39 views

ip tables by route command and iptables's table by iptables command, is the same?

There are two command : route, and iptables. Both of it have a/many tables: route tables and iptables's table. Does those two kind of tables describe the diffrent thing, or iptables can also be ...
0
votes
1answer
31 views

iptables - How to allow all connections to the local lan?

What's the simplest way to express "allow all connections to the local lan" for iptables output? Including connections to 192.*, 172.*, 10.*, etc. Can all of this compressed within a single rule?
0
votes
0answers
24 views

Setting up VPN on Linux

I have problems setting up networking on my laptop over VPN. I need to connect from my home to VPN which has the same IP address space as my home network. My network: 192.168.0.0/24 Other side of ...
0
votes
1answer
23 views

Can't access webmin due to iptables missconfiguration

I installed webmin, but I cant access it because iptables blocks the connection. I have added the chain that webmin suggests right here: http://www.webmin.com/firewall.html This is the result of ...
0
votes
0answers
13 views

Adding IP Blocklists to OSSEC

I've been reading through some documentations for OSSEC trying to learn some new tricks and such to make it more effective, and what I got really interested was looking into was seeing if it's ...
1
vote
1answer
97 views

IP forwarding through ssh tunnel

The situation involves 3 machines: A. Some laptop connected somewhere to the internet via any mean B. A server connected to the internet through a standard ISP (static IP provided by dyndns: ...
1
vote
1answer
39 views

Is it possible to save iptable rules that have a name for destination instead of IP?

For instance, I have the rule #iptables -A OUTPUT -d www.google.com -j ACCEPT When I type this rule in a terminal it resolves to the appropriate IPs, and that is what is stored in rules.v4 when I ...
3
votes
1answer
138 views

Debian-Jessie: How do you check iptables status?

In old sysvinit I would just do service iptables status and see if it was running or not. But in newer Debian-Jessie I grep for iptables in the list of services and don't see iptables listed ...
3
votes
1answer
54 views

Unable to get NAT working via iptables PREROUTING chain

So, not concerning ourselves with the WHY, and more so with the HOW, I'd like to see if anyone knows where I'm going wrong here. Basically, I'd like to forward all packets headed for port 80 on an IP ...
0
votes
2answers
43 views

Block IP if it connects to port 22

How can I effectively (so do it fast when talking about firewall level and can do it with many-many IP's) block an IP address for a given time, ex.: a month if it tried to contact port 22 TCP in any ...
0
votes
1answer
95 views

redirect to localhost using iptables

I'd like to redirect the outgoing traffic (whether coming from localhost or elsewhere, as the machine is a gateway) going from 192.168.0.2:80 to localhost:80. I've tried setting this rule in the nat ...
1
vote
0answers
30 views

Redirect the traffic of one port to one chain with iptable?

I am very sorry for that I can't describe the title more concretely. I would appreciate if someone can give a better title than mine. On the raspberry Pi, I install the privoxy and a socks proxy ...
1
vote
3answers
80 views

preventing dos attack in apache webserver

This is the version of apache we're using - httpd-2.2.15-39.el6.centos.x86_64 We recently had our website down due to DoS attack and hence started exploring iptables, and how to use it to prevent DoS ...