iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

0
votes
0answers
31 views

bridge or iptables or route?

iptables vs bridge-utils vs route I have two network cards in a Linux server and don't know how to make them communicate. After searching a lot I still don't know which method is the one that should ...
0
votes
0answers
23 views

Set source address for incoming packets on a server

I'm developing a UDP reverse proxy for a game server, and so far, everything has gone fine except for one thing - getting the backend server to submit requests to the master server list (run by a 3rd ...
1
vote
0answers
44 views

SNAT with firewall-cmd?

I have an interface with multiple IP Addresses (on CentOS 7), which is in zone "external" (with masquerade on). I want to specify that, if a connectiona attempt to a specific address goes out, to use ...
0
votes
1answer
29 views

How to set up a stateful firewall on an am335x Starter Kit board?

In the past, I have used the following script to set up a stateful firewall (on a normal x64 Ubuntu machine) without issue: iptables -P INPUT DROP iptables -P FORWARD DROP iptables -N TCP iptables -N ...
2
votes
1answer
176 views

Forwarding packets from loopback interface with policy-based routing

I have the following iptables rule: iptables -t mangle -A PREROUTING -p udp -m udp --dport 10000 -j MARK --set-xmark 0x4/0xffffffff which sets fwmark 4 on all udp packets with destination port ...
1
vote
2answers
207 views

ping: unknown host with iptables enabled

I can't ping www.google.com. However I can ping the IP address: ping 74.125.237.142 At first, I thought it is a problem with my DNS settings. But I checked my resolv.conf, hosts, and hostname ...
1
vote
0answers
79 views

Iptables and --tcp-flags

If I have the following rule in the nat-table in the prerouting chain: 0 0 REDIRECT tcp -- eth5 any anywhere anywhere tcp flags:FIN,SYN,RST,ACK/SYN redir ports ...
2
votes
2answers
325 views

Tunnel yum traffic through another server via ssh

I am running a Fedora desktop behind a corporate proxy that is blocking yum traffic (specifically *.gz and *.bz2). I have access to a separate RedHat machine via ssh which can download anything it ...
1
vote
0answers
115 views

Forward multicast between two LAN segments (Chromecast)

I've found some rules but most are inconclusive. Chromecast uses DIAL and discovers via multicast from what I've understood.. I have an Ethernet-connected computer which I would like to route via my ...
1
vote
0answers
27 views

Is iptables -p proto -m proto redundant?

I keep seeing "-p tcp -m tcp" all over the place, but it looks redundant. Why the '-m' if the '-p' already matches the protocol?
0
votes
1answer
44 views

How to map IP by iptables ?

I create a network namespace In this namespace, I open a nginx So for now, I can visit web server by 172.17.0.2 What I want to do is mapping this IP to 127.0.0.1 Lets say if I visit 127.0.0.1, I ...
0
votes
0answers
78 views

Iptables and Ip6tables redirect traffic

I want to deny all the network traffic and just allow a few ports and redirect them through tor or the socket I have set in /etc/tor/torrc, where tor binds to. And I am currently setting up these ...
1
vote
0answers
42 views

How do I write the rule that has an edge server forward a clients request to an internal network server and back?

I have a network situation as follows: -server1:1.1.1.1 -server2:2.2.2.2 -tunnel 10.8.0.0/24 -client: 3.3.3.3 I'm trying to have client IP 3.3.3.3 do an HTTP request from the 1.1.1.1 server. ...
2
votes
1answer
65 views

iptables routing incoming IP to another destination IP question

I have a test setup: server1:1.1.1.1 server2:2.2.2.2 client: 3.3.3.3 I'm trying to have client IP 3.3.3.3 do a HTTP request from the 1.1.1.1 server. However I want the 1.1.1.1 server to pass this ...
1
vote
1answer
26 views

Does -o and -i make sense when the target host is already connected to the interface specified?

iptables -A FORWARD -s 192.168.20.7 -d 10.10.48.3 -p tcp --dport 25 -o eth1 -j ACCEPT iptables -A FORWARD -s 10.10.48.3 -d 192.168.20.7 -p tcp --sport 25 -i eth1 -j ACCEPT Tuning the firewall of my ...
4
votes
0answers
38 views

Setting traffic class on return packets

I have a network topology: Server <-> router1 <-> router2 <-> router3 <-> edgeRouter <-> "internet" All routers are linux based, and support iptables. The server sets ...
0
votes
0answers
48 views

Sabayon: UFW blocking all incoming connections, although default policies are set to “Allow”

I have the following problem with ufw/iptables: When I start/reboot my computer, ufw fails to load: # ufw status Status: inactive I did enable it: # systemctl enable ufw Still I do have many ...
0
votes
1answer
81 views

Route OpenVPN clients to another different OpenVPN server

I have this scenario.. Server(Primary) with a multiple OpenVPN connections (so server is connected as a client to multiple OpenVPN servers.. lets say secondary servers) This server runs OpenVPN ...
1
vote
2answers
152 views

Drop TCP packets and prevent TCP retransmission

I have an application that sends TCP data to a server. My server is made to intentionally drop the packets sent by the application, and as a result the client retransmits the packets. I need to ...
0
votes
0answers
58 views

How to disable domain service at port 53 on WAN side in OpenWRT?

nmap on the WAN IP shows PORT STATE SERVICE 53/tcp open domain after basic configuration on a fresh OpenWRT (version Chaos Calmer) system. But the service should not be visible from WAN, but ...
3
votes
2answers
52 views

How can I determine what program or user connected to a particular port after the fact?

I am examining the egress IPTABLES log of my computer for yesterday and notice the following: IN= OUT=eth0 SRC=192.168.1.1 DST=69.46.36.10 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=12345 DF PROTO=TCP ...
0
votes
0answers
239 views

iptables to allow teamviewer

I'm having some trouble to allow TeamViewer in a restrictive iptables configuration. I'm running Fedora 20. After some research I found out TeamViewer uses ports 80, 443 and I have created this ...
1
vote
0answers
161 views

How do I route bittorrent through a second interface?

I've managed to configure openvpn on my DD-WRT router such that the tunnel is up and working, but that it doesn't mess with routes at all (the default configuration wants all traffic to go through ...
3
votes
1answer
68 views

IP rule table look up does not seem to work

I have a sytem with three network interfaces. Below is the configuration that I'm trying to set up. wlan0 (its actually an WiFi AP interface) - other devices connects via this interface. net1 - ...
2
votes
1answer
41 views

psad: do not block access to HTTP

I want to block intruders via psad, but HTTP and HTTPS should not be blocked. For example, if someone is scanning my dedicated server via nmap, psad should block him for 2 hours, but he should still ...
-1
votes
1answer
48 views

How to use partial IP address in /etc/sysconfig/iptables for the “-s” flag?

in this example it is a full ip ip is: 1.1.1.1 -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -s 1.1.1.1 -j ACCEPT but suppose i want to allow any ip that simply starts with: 1.1. ...
0
votes
1answer
336 views

iptables redirect traffic from VPN interface to next interface

Can you help me with this problem please? I need redirect all traffic from tun0 interface (OpenVPN tunnel) to eth1 interface. eth1 is internal network behind this system which works as special ...
4
votes
2answers
107 views

Redirecting loopback traffic through a router

For some tests purposes, I am running multiple socket-based applications on one machine and want to simulate "real" network conditions between them. I thought the simplest would be to redirect all ...
0
votes
3answers
275 views

Redirect domains to different ports on same machine

I used the following command to redirect 80 to 3000. All the requests that come, from any domain, are redirected to 3000: sudo iptables -t nat -I PREROUTING -p tcp --dport 80 -j REDIRECT --to-port ...
-2
votes
2answers
204 views

Domain Name problems in CentOS hosted under VirtualBox

When I ping www.google.com I get: [root@ryanPC ~]# ping www.google.com ping: unknown host www.google.com Also, when I run ping -n 8.8.8.8, I get: connect: Network is unreachable So I have ran the ...
1
vote
1answer
61 views

iptables routing

I believe this question has been answered a 100 times before, but I'm almost sure that I'm searching into the wrong direction. My desired setup is the following: I have a virtual host using KVM and ...
2
votes
3answers
905 views

bash: iptables: command not found

How do I fix the iptables: command not found problem that happened to Debian 7.6? batman@gotham:~$ uname -a Linux gotham 3.14-0.bpo.2-amd64 #1 SMP Debian 3.14.13-2~bpo70+1 (2014-07-31) x86_64 ...
2
votes
2answers
1k views

How can I make iptables service start automatically after reboot on CenOS/RHEL7?

I am having a few issues with a newly installed home server I am preparing. I have installed CentOS7 on it and I found that port 80 and 443 are off by default. I therefore added them to the iptables ...
2
votes
2answers
108 views

Delay when iptables icmp rules take effect

I have setup my iptables to disable all incoming connection, i.e. :INPUT DROP [0:65535] When the iptables has been started, I run the following command to enable ping: /usr/sbin/iptables -A INPUT ...
3
votes
1answer
83 views

Proper way to handle FTP over SSL with restrictive firewall rules?

Without SSL, FTP works fine over a stateful Firewall, like netfilter (iptables) + the nf_conntrack_ftp kernel module like this: # modprobe nf_conntrack_ftp # iptables -A INPUT -m conntrack --ctstate ...
2
votes
1answer
95 views

How is whonix blocking UDP traffic (except udp-dns related traffic)?

I want to know how whonix manages to block unwanted UDP-Traffic i.e. all UDP-traffic but DNS related udp traffic. I looked at the iptable rules both in the Workstation and Gateway. There are no ...
2
votes
0answers
155 views

iptables rule to transfer UDP through a SSH tunnel

The problem I have two programs that runs on two distant computers and communicate through a specific protocol. All I know is that this protocol only communicates through UDP and uses the ports 1101 ...
0
votes
0answers
240 views

Upon bootup, all iptables are lost because the kernel module ip_set is not loaded

i can get iptables to whitelist / blacklist using ipset members, but after a reboot, the iptables are emptied out because the kernel module is not loaded. Have limped along in the past by customizing ...
0
votes
1answer
52 views

how to find out wich chain in iptables in listing

Suppose I have the following two entries line of iptables: iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE iptables -A INPUT -s 192.168.1.0/24 -j DROP So, I have POSTROUTING and INPUT chains. ...
2
votes
1answer
1k views

Configuring OpenVPN to use Firewalld instead of iptables on Centos 7

I need some help configuring OpenVPN on Centos 7 using firewalld. I used iptables on Centos 6.5 and only had to add the following lines to /etc/sysconfig/iptables: -A POSTROUTING -s "10.0.0.0/24" ...
0
votes
0answers
108 views

IPtables Packet Balancing

I would like to see the below work as a result of seeing several posts online that have this working but not quite the same as my situation. Forgive me if it appears to be a stupid idea as I'm now ...
1
vote
1answer
38 views

Confused by different output from iptables -L

I keep following this tutorial using a bash shell on ubuntu 12.04 as I open more and more ports on my server. I usually open up ports like this sudo iptables -A INPUT -p tcp --dport PortNumberToOpen ...
0
votes
1answer
44 views

What this Iptables rules does?

I think I can understand this iptable rule, but I want to make sure what it does, so can someone explain to me technically what this does? well this two rules combined. /sbin/iptables -t nat -A ...
2
votes
0answers
21 views

Extra overhead in MASQUERADE target

There's a part in iptables manual concerning SNAT and MASQUERADE targets. I know the key difference between the two, but I don't fully get the following sentence: It is still possible to use the ...
0
votes
0answers
57 views

How can I use 0.0.0.0/0 in ipset hash:net,port?

Right now, if I do ipset a ansible_allowed 0.0.0.0/0,tcp:22 I get ipset v6.19: The value of the CIDR parameter of the IP address is invalid and instead I have to add 0.0.0.0/1,tcp:22 ...
3
votes
1answer
85 views

IPTables rules for specific processes [duplicate]

I have a lot more experience with the Windows Firewall with advanced functionality than I do with IPTables. With the WFAF, I was able to lock down a program so that it could only connect over specific ...
3
votes
1answer
40 views

Which network services depend on the “accept related input” iptables rule?

Background I am setting up a firewall for a webserver and was wondering if it would be a good security meassure to even reject RELATED input traffic and only except established connections by ...
-1
votes
1answer
118 views

MYSQL : Connecting to mysql from : 127.0.0.1 + telling ip tables to allow only 127.0.0.1 for mysql port : Logic vs Common Sense

If i make 1 billion or 1 trillion queries to MYSQL database from 127.0.0.1 via port 3306. vs If i make same amount of queries to MYSQL database also from 127.0.0.1 via port 3306. but with ...
5
votes
2answers
500 views

Move iptables rule (w/o removing and adding)

Is there a way to move a rule in the iptables and change it position ? I'm aware i can use -I to insert a rule in a specific position, but i also like to keep the counters.
2
votes
0answers
43 views

How can I configure iptables for per application setup?

I am working on a project where we are building lots of micro-services. Each service is neatly packaged as an RPM. Ideally I'd like for us to have iptables enabled on all of our machines and it would ...