iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

0
votes
0answers
19 views

libvirtd fails with iptables on Linux 4.3.2 (Debian)

When I start libvirtd on a selfbuild kernel (make olddefconfig), it fails setting up bridge virbr0 with: internal error: Failed to apply firewall rules /sbin/iptables --table nat --insert POSTROUTING ...
2
votes
0answers
39 views

Need for IPTables expert, possibly with knowledge of u32 module

A customer is sending queries against DNS root-servers on my recursive DNS server. I need to block it with iptables. I tried 3 examples but it is not working. 0 0 DROP udp -- * * ...
1
vote
1answer
30 views

Mutt hangs sometimes when connection is limited to imap.gmail.com

I wanted to restrict email clients to connect to only 1 IMAP server - imap.gmail.com. And wrote this iptables rule: iptables -A OUTPUT -d imap.gmail.com -p tcp --dport imaps -j ACCEPT I have an ...
0
votes
1answer
22 views

What does this command do in Linux iptables

What does this command do and how to revert this command. in linux. iptables -I INPUT -i eth1 -p tcp -m tcp --dport 80 -j ACCEPT Will It cause any problem?
0
votes
0answers
43 views

Block IP Fragmentation attack using iptables

I am trying to stop all MF flag packet which has more fragment big set. because i have seen many IP Frag attack taking advantage of it. I know its not a good idea to do but, I have test my application ...
1
vote
1answer
14 views

ip_conntrack_max test not working

I am trying to do some ip_conntrack_max kernel parameter testing, but somehow its not working. -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT I have set following value to see its filling ...
1
vote
1answer
16 views

shorewall / iptables - restrict outbound ports by user

I have filtering working for some users and groups; however, it is not working for SSH. For SSH, I am specifying members of the ssh group can have outbound SSH traffic. I am using the same syntax ...
2
votes
0answers
32 views

How to properly port forwarding between different machines using UFW / iptables and DD-Wrt?

This is my network I want to see my ip_camera (192.168.3.4:80) from outside my house. It is on dd-wrt router (192.168.3.1) without internet. The router 192.168.1.1 has internet. However, i have a ...
1
vote
0answers
12 views

Access NATed network service behind dynamic public IP from the local network

I have a dynamic public IPv4 address configured on my router. There is a TCP based service running somewhere behind that router at 192.168.1.11:8448. With a dynamic DNS I can access this service using ...
0
votes
1answer
45 views

ufw: how to forward single port to another port on different interface

I have two interfaces eth0 (192.168.1.2) and eth1 (192.168.3.2). I receive data from 8080 at eth0. I want to forward it to eth1 port 80. I'm using UFW, because i don't understand iptables and how to ...
3
votes
1answer
44 views

How can Wireshark see packets dropped by iptables?

I recently installed my hard drive in a new computer and after some fiddling around I noticed my iptables rules were dropping DNS responses for some reason, turns out they were configured to allow ...
0
votes
0answers
8 views

how to safely increate ip_conntrack value

How do i calculate how much memory my single ip_conntrack connection will eat? I am planning to increate ip_conntrack on system but i want to be careful to not overcommit number. Is that any basic ...
0
votes
1answer
11 views

iptables and OpenVPN configuration

I have following iptables rules: -A INPUT -i eth0 -p udp -m udp --dport 1194 -m state --state NEW -j ACCEPT -A INPUT -i tun+ -j ACCEPT -A INPUT -j DROP -A FORWARD -i tun+ -j ACCEPT -A FORWARD -i tun+ ...
1
vote
0answers
7 views

don't jump to same user-defined chain twice

In my /etc/pam.d/sshd I have a line: session optional pam_exec.so /usr/local/bin/pam_exec_sshd It calls my script whenever I do ssh login or logout. Script contents: #!/bin/bash ...
0
votes
1answer
17 views

Whiptail radiolist

I am trying to build a iptables configure with whiptail. And I am stuck at the moment. I have got code below and I am trying to develop radio list where user choose between INPUT or OUPUT. ...
0
votes
0answers
48 views

IPv6 router advertisement seems to break OpenVPN setup

I have an OpenVPN setup on Debian Jessie, or Raspbian to be precise, that provides an IPv4 and IPv6 subnet for the clients. The server configuration of OpenVPN contains: dev tun server-ipv6 ...
0
votes
1answer
83 views

iptables bad argument '80'

I am running KALI-linux, and i am trying to execute this command: iptables -t nat -A PREROUTING -p tcp –destination-port 80 -j REDIRECT –to-ports 10000 i get this as response: "Bad argument `80'" ...
2
votes
2answers
104 views

iptables: No chain/target/match by that name - adding SSH ATTACK rule

I have a problem with adding rule against brute-force SSH attacks. I try to do it in the following way: iptables -F iptables -L iptables -N SSHATTACK iptables -A SSHATTACK -j LOG --log-prefix ...
0
votes
0answers
32 views

change destination IP address with iptables for infoming traffic

If I run tcpdump on eth0 interface, then I see following ingress packets to my NIC: 15:07:47.174643 00:19:e2:9e:df:f0 > 00:01:6c:55:3a:72, ethertype IPv4 (0x0800), length 194: (tos 0x0, ttl 63, id ...
3
votes
1answer
47 views

How to limit port range in Ubuntu 14.04?

I want to limit source port range in my ubuntu machine upto 20000 , that means no Application should be able to use port higher than that.I have this command in mind iptables -A OUTPUT -p tcp ...
0
votes
2answers
138 views

IPTables - hex string block DNS query

I have a customer that is sending a lot of queries for a particular domain on my DNS server. I want block that queries and I found the hex string that is possible to be implemented. That is the ...
0
votes
0answers
21 views

hostapd in wlan0 makes eth1 interface stop working

I have an embedded system that creates a captive portal so the clients must to login in order to get internet access. The system is running apache and has a webpanel on port 8080 to which I connect ...
0
votes
0answers
181 views

ERROR: CHECK_NRPE: Socket timeout after 10 seconds

getting following error : # /usr/local/nagios/libexec/check_nrpe -H nagios-server-ip CHECK_NRPE: Socket timeout after 10 seconds. But it's working for localhost # ...
0
votes
1answer
19 views

Find my rules in iptables

The iptables rules can be annotated with comments. How to select and remove rules using these comments? Maybe there is another solution to tag rules and remove them based on that tag?
2
votes
1answer
13 views

Firewall that allows to tag or comment rules for easy filtering

I am going to use iptables for port forwarding to listen on requests from my LAN on port 8080 and answer with container at port 80 , like this: iptables -t nat -A PREROUTING -p tcp -d 192.168.1.15 ...
5
votes
0answers
83 views

Linux iptables ssh port forwarding (martian rejection)

I have a Linux gateway performing NAT for my home network. I have another network which I'd like to transparently forward packets to, but only to/from specific IP/ports (ie. not a VPN). Here's some ...
0
votes
0answers
20 views

IPTables weird behaviour

I am running Debian 8.0 with IPTables ... I have many smartphones and tablets that connect to my wireless lan (wlan0) to the net ... wlan0 -> br0 -> eth0 -> router -> internet Everything works just ...
4
votes
1answer
115 views

What is the IPv6 equivalent for 127.0.0.0/8

I am trying to set up an IP6tables firewall on Linux and I basically want to start copying my IPv4 configuration. One of my rules simply accepts all traffic to the localhost subnet: iptables -A ...
1
vote
1answer
48 views

ipset v4.5: Unknown set type

I compiled ipset on CentOS5 32bit machine and i am getting weird errors My kernel: [root@localhost ipset-4.5]# uname -a Linux localhost.localdomain 2.6.18-400.1.1.el5 #1 SMP Thu Dec 18 00:58:32 EST ...
0
votes
1answer
18 views

In what order are the rules handled in the Linux Firewall Module in webmin?

If I'm not mistaken it's top to bottom correct? And the catch-all default action at the end is to just drop any packets that don't match the rules above. Should I be logging the dropped packets as ...
3
votes
2answers
75 views

Ban IP using Iptables/Firewalld

I was DDos Attacked by Chinese Great Firewall twice this year. Now I download zone file from http://www.ipdeny.com/ipblocks/ .I want to do these things: If Someone from Anywhere wants to connect to ...
3
votes
1answer
138 views

iptables: change local source address if destination address matches

I have a Linux machine (RHEL 6.7) with 2 IP's configured on a single NIC (eth1). The primary address, and therefore the address that all traffic appears to come from, is 10.0.0.23. The other is ...
2
votes
0answers
68 views

Iptables proxy, redirect all connections from a certain port to the internet?

I have an ubuntu pc and an android phone conneted to my router through a cable and wi-fi respectively. I set the android phone to use a proxy my-wan-ip:5555 and enabled port forwarding on my router on ...
0
votes
2answers
43 views

How block all request as ServerIP:Port by iptables

I see many http ddos requests to my server as serverIP:80. Its possible to block all incoming requests to myServerIP:Port?
6
votes
1answer
219 views

netfilter/iptables: why not using the raw table?

Under Linux, we usually use the "filter" table to do common filtering: iptables --table filter --append INPUT --source 1.2.3.4 --jump DROP iptables --table filter --append INPUT --in-interface lo ...
0
votes
2answers
70 views

iptables rules apply with delay

I'm using iptables to block Internet (by redirecting to an internal server) access on devices connected to my hotspot. That's my command: iptables -t nat -I PREROUTING -p tcp -s 192.168.43.51 -j DNAT ...
0
votes
0answers
21 views

iptables DNS guard protection

I' m going to implement some DNS security features on my DNS server and I was wondering if iptables can do the same job that cisco ASA/PIX does: DNS guard DNS Guard identifies an outbound DNS query ...
0
votes
0answers
19 views

Redirect Port to another servers Port, not working

I have dig around a lot and found out this batch of code to excute. My main goal is to redirect xxx.xxx.xxx.xxx:30000 to yyy.yyy.yyy.yyy:30333 i execute this code sysctl net.ipv4.ip_forward=1 ...
0
votes
1answer
113 views

Debian 8 iptables-persistent setup is not correct?

I'm renting a vps with debian 8 on it. I'm trying to set up my iptables, following this blog: http://bencane.com/2012/09/iptables-linux-firewall-rules-for-a-basic-web-server/ The problem is that my ...
0
votes
1answer
183 views

Connection refused on port 8081 using curl

I have two CentOS 7 boxes, called Turbo and Demo. I started a daemon/service on the first one, Turbo, and wish to call the service from the second one, Demo. I started the service to monitor port ...
0
votes
1answer
54 views

Iptables: does dropping UDP packets take place in the user-space or kernel-space?

I know that Iptables is a user-space module, I also read it "configures" kernel modules to do big part of the filtering. So my question is, if I add a rule to allow only TCP:443 packets, would this be ...
0
votes
0answers
41 views

IPtables Test/Simulator/WhatIf/Dry run

I am currently debugging a rather strange network phenomenon and still believe my Linux netfilter firewall is the problem. These automagically generated rules and chains give me quite a headache and I ...
2
votes
1answer
35 views

What is the purpose of -m, --match in an Iptables rule?

Many Iptables rules contain this -m or --match option, for example -I INPUT -p tcp -m state --state NEW -m limit --limit 30/minute --limit-burst 5 -j ACCEPT -A INPUT -p udp -m conntrack --ctstate NEW ...
0
votes
0answers
12 views

socks to remote vpn clients on single server

I have the following setup: [user1] > ssh -D 1080 server > [server A a.a.a.a] openvpn --config vpn1.ovpn > [vpn server #1 x.x.x.x] [user2] > ssh -D 1081 server > [server A a.a.a.a] openvpn --config ...
1
vote
2answers
39 views

Is it Safe to open port 35000:40000 for FTP data connections

I recently got hacked so im being careful when changing the settings in my CentOS 7 iptables. I just opened ports 35000 to 40000 for FTP PASV connection, will this represent any security risks?
0
votes
1answer
26 views

Route Locally generated packets to different gateway [duplicate]

I need to send the packets of specific port to different gateway. This is the situation: The server has different services, like http, dns, and mail (smtp,pop,imap), and it has two gateways. eth2: ...
4
votes
1answer
89 views

Using tc for traffic quotas?

Is it possible to implement traffic quotas (absolute limits, not rate limits) based on the network classifier cgroup? I see there is the iptables netfilter 'quota' extension, which seems to do ...
0
votes
0answers
12 views

Ubuntu Network Crashed?

So I have a server from ovh. When I was messing with the network I went to flush iptables and reload the network, and well it crashed all of the ports. So I thought I just need to reboot the server, ...
0
votes
1answer
36 views

iptables selectable tunnel

I have this configuration script: I OPENVPN TUNNELS openvpn --config serverx.ovpn > /dev/null 2>&1 & openvpn --config servery.ovpn > /dev/null 2>&1 & TEST ON MY ...
1
vote
1answer
106 views

On Centos7 firewalld overwrite iptables modules [duplicate]

Simple question: i want to load two modules /usr/sbin/modprobe ip_nat_ftp /usr/sbin/modprobe ip_conntrack_ftp I can put those lines in rc.local or use /etc/sysconfig/iptables-config But at reboot ...