iptables allow creation of rules to define packet filtering behavior.
9
votes
2answers
4k views
iptables --set-mark - Route diferent ports through different interfaces
Short story,
3 interfaces, eth0 (LAN), eth1(ADSL), eth2(4G).
eth0 -> eth1: Works
(ports 80, 443, 4070) eth0 -> eth2: Doesn't happen
This is a graphical representation of the idea:
Port 80 & ...
0
votes
0answers
109 views
fail2ban ignoring ignoreip list
Despite setting the ignoreip value to the IP of our network, it would seem that fail2ban is ignoring this config and still bans us when multiple people access the server via SSH. The ignore list has ...
2
votes
3answers
118 views
Undo iptables modification
I ran the following iptables commands to create a blacklist rule but used the wrong port:
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH
iptables -A INPUT -p tcp ...
3
votes
1answer
239 views
How to understand why the packet was considered INVALID by the `iptables`?
I set up some iptables rules so it logs and drops the packets that are INVALID (--state INVALID). Reading the logs how can I understand why the packet was considered invalid? For example, the ...
2
votes
1answer
157 views
iptables doesn't forward from WAN to virtual machines
I have a machine working like gateway and have two network interfaces:
eth0 LAN : 192.168.1.0/24
eth1 WAN : XXX.XXX.XXX.XXX (my public ip)
This machine has 3 VM guest over virtualbox. All have ...
0
votes
3answers
414 views
How to make sense of an iptables chain configuration
This is about how to make sense of the chains found in the iptables default configuration on a typical home router running OpenWrt (a stripped down Linux for router devices), but which ultimately may ...
2
votes
1answer
389 views
Allow IP packet forwarding from LAN to modem via router
In short: I'd like to be able to telnet to my modem from my PC via my router.
There is a simple home router on 192.168.33.1. It is running OpenWrt. It has the following interfaces defined:
br-lan ...
1
vote
1answer
181 views
Firewall/routing rule in Centos for this setup
I have two ethernet interfaces, namely eth0 and eth1.
I want to implement an advanced routing rule but I am totally new to firewall/routing rules in CentOS.
Here is what I am trying to do:
Both my ...
4
votes
1answer
1k views
Have someone ever audited the default OpenWrt firewall rules?
I have an Openwrt 10.03.1 installed from: openwrt-ar71xx-wrt160nl-squashfs-factory.bin (firewall only customized with this: sed 's/REJECT/DROP/g' /etc/config/firewall) - so besides this, IT'S A ...
3
votes
2answers
2k views
Port forward to VPN Client?
I've run into a bit of a puzzle and haven't had much luck finding a solution. Right now I am (sadly) connected to the net via Verizon 3G. They filter all incoming traffic so it is impossible for me to ...
0
votes
1answer
80 views
darkstat shown blocked traffic
I've installed Darkstat on a Qemu VM which is connected to a bridge interface on top of main server's interface ( eth0 )
In Darkstat report I can see many hosts in the same IP range of specified VMs ...
0
votes
1answer
324 views
Allow incoming connections from Google Translate only
I have a small web server running on port 80, and I'd like to allow only Google Translate to have access to it.
First I tried running dig translate.google.com and dig translate.googleusercontent.com ...
3
votes
1answer
139 views
Using source routing (LSRR) - any ideas?
What I want to do is conceptually very simple, but I can't find any information or help about how to go about doing this.
Basically, I want to configure my networking to use source routing (LSRR). ...
2
votes
2answers
284 views
policy routing problem with load balanced ppp connections
This my setup using Debian 6.0.6. It's role is a proxy server and a load balancer using eight 3G modems.
First and foremost:
Whenever a ppp connection dials it takes over the default gateway which ...
3
votes
2answers
226 views
Meaning of log entries from an iptables configuration
My router has Linux as its OS. The system log has a lot of rows about iptable and klogd that I don't understand, could someone explain them to me?
The iptables setup:
iptables -t nat -A PREROUTING ...
3
votes
3answers
268 views
Can't add large number of rules to iptables
I made a very simple bash script (echo at start, runs commands, echos at end) to add approx 7300 rules to iptables blocking much of China and Russia, however it gets through adding approximately 400 ...
4
votes
1answer
129 views
Creating a NAT from loopback to a remote server
My goal is to redirect connections from the local host to a remote server, and be able to change the remote address on the fly, without any client config changes. I can do this now using a nat on the ...
2
votes
0answers
113 views
iCloud stuff stops working while connected to OpenVPN
I have a fairly simple OpenVPN setup on an OpenVZ VPS with Ubuntu 11.10. Client is the Viscosity client on Mac OS X 10.8.2, and after some testing, we can rule out the client as being part of the ...
4
votes
2answers
2k views
Iptables: matching outgoing traffic with conntrack and owner. Works with strange drops
In my iptables script I have been experimenting with writing as finely grained rules as possible. I limit which users are allowed to use which services, partly for security and partly as a learning ...
3
votes
2answers
1k views
Why do iptables rules disappear when restarting my Debian system?
I add this rule:
sudo iptables -t nat -A OUTPUT -d a.b.c.d -p tcp \
--dport 1723 -j DNAT --to-destination a.b.c.d:10000
When restart computer rules are deleted. Why?
What I can do to make ...
2
votes
1answer
227 views
How to config iptables for pppoe?
When I create the only rule disabling all input,
iptables -P INPUT DROP
I can not connect anything. So it looks like I should allow some incoming activity to get PPPoE working correctly. What rules ...
5
votes
1answer
416 views
iptables beginner question about ACCEPT
I'm just reading up on iptables, finally. I'm a little confused because the input chain from the filter table (as installed, fedora 17), looks like this:
target prot opt source ...
1
vote
1answer
479 views
Redirect Output with Iptables
Is possible on Debian change the port of packets that going to a specific port, using iptables?
Example:
I want packets going out the direction a.b.c.d for port 1723 to be redirected to the address ...
3
votes
1answer
592 views
tc don't see marked with -j MARK packets
Server has 2 network interfaces:
eth1 with address 13.0.0.254/24
eth0 with address 172.20.203.4/24.
It's routing traffic between this two networks. Task is to limit bandwidth between this two ...
1
vote
0answers
293 views
iptables not starting up
I have inherited a custom built Linux kernel 2.6.30.9 and am just upgrading the underlying OS from RHEL 5.4 to 5.8 (kernels 2.6.18.164 and 2.6.18.308 respectively).
When booting, the following is ...
4
votes
1answer
949 views
Enable RTSP in iptables
I'd like to receive a RTSP stream via VLC, but when I try to run
sudo -u non_root_user cvlc -vvv -I dummy rtsp://ip:port/x.sdp
I get:
Unable to determine our source address: This computer has an ...
1
vote
1answer
1k views
iptables forwarding and routing
In fact, this question is about openwrt and CoovaAP, but I guess it's the same in other linux distributions.
I've two interfaces, a "wan" and a "wlan" interface.
Is there by default any filter, ...
1
vote
0answers
99 views
What other rules should I use to allow PPTP outbound connection?
I already allowed outbound connection to TCP/UDP port number 1723, but PPTP connection still fail to establish,
If I allow all outbound connection, the tunnel will just go fine.
2
votes
1answer
506 views
Changing firewall settings after installation of CentOS via kickstart
I was trying to install CentOS 6.3 via Windows Deployment Server. And to automate the installation process I used kickstart file in which i provided various details required during installation.Then i ...
1
vote
1answer
282 views
How to provide a “guest LAN” on one ethernet device
I have an always-on machine running Debian/Squeeze with a couple of ethernet ports (it's doing various serverish jobs, including DHCP) and a LAN on each.
eth0 is on 192.168.7.* and has access to the ...
4
votes
3answers
1k views
Why can't I use the REJECT policy on my iptables OUTPUT chain?
I currently have my OUTPUT chain set to DROP. I'd like to change it to REJECT, so that I have a clue that it's my firewall stopping me from getting somewhere rather than a problem with whatever ...
2
votes
1answer
595 views
system wide SOCKS5 Proxy
I connect to my Server on the internet using ssh -D 3128 user@rootserver.com. If I am right I thereby open a SOCKS v5 Proxy to my Server. Using firefox and FoxyProxy I can now add this to my proxys ...
4
votes
2answers
2k views
What prevents a machine from responding to pings?
I have a CentOS release 5.4 linux box on Amazon EC2 that I'm trying to set up to be monitored via Nagios. The machine is in the same security group as the nagios server, but it seems to be ...
1
vote
1answer
449 views
Losing wifi connection to access point after a few minutes (hostapd, dnsmasq, iptables)
I'm using a laptop as a wifi access point. Since this laptop has the proper hardware, I was able to use hostapd. I wanted to use DHCP and iptables/NAT forwarding instead of a bridge to have more ...
1
vote
1answer
713 views
Redirect http using iptables for an ip range
I have a range of ip addresses (10.13.13.10-19) that I want to redirect all outgoing http traffic to an internal webserver. So if someone in that range tried to access any site, the html from my ...
1
vote
1answer
171 views
iptables logging prefix gets corrupted
I've been using iptables for some time but recently noticed that the log prefix I'd set had got corrupted. In /etc/iptables/rules.v4` I have:
-A LOGNDROP -j LOG --log-prefix "iptables denied: " ...
1
vote
2answers
464 views
What is a solid iptables configuration for my desktop?
On my desktop, I want to configure iptables pretty strictly. I see no reason why I need to allow anything except for internet traffic that I initiated. And maybe even that could be limited to only a ...
3
votes
2answers
172 views
What tool to execute a command on repeated syslog entries?
Occasionally, one VPS under my control gets bombarded with POP3 login attempts. They all fail, but the huge number of spawned processes and active connections pretty much amount to a DoS attack.
When ...
3
votes
1answer
291 views
Routing through iptables
I have this vpn client that touches the routing table and then keeps watching it to exit if it gets touched.
It is the kind of setup needed for an endpoint, such as a laptop.
I want to use a small ...
5
votes
1answer
1k views
Terminal commands equivalent to NetworkManager's “Use as Hotspot” option
I'm making a gui application which will control my laptop in order to make it act as a wifi hotspot. I may change distributions so I want to find a solution which will work generally for all ...
1
vote
1answer
934 views
Why can't I add any iptables rule?
Why can't I add any iptables rule?
root@ROUTER:~# iptables -L INPUT -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
6934 685K ACCEPT 0 -- any ...
0
votes
1answer
1k views
IPtables string match
I'm trying to write iptables string match rule To block http://domain.com:8888 and https://domain.com:8888 when it matches the supplied string in the rule. And another rule to redirect the ports also ...
2
votes
1answer
92 views
Is there a way to redirect requests from foo.com to a VM on that server?
I saw a tutorial about redirecting client requests to a specific port to a VM inside the server using IPTables.
Is there a way to redirect client requests for foo.com to a VM using only IPTables?
or ...
4
votes
1answer
2k views
NAT (Internet connection sharing) switching between multiple public interfaces
My Ubuntu 12.04 (precise) laptop has three network interfaces:
eth0: wired interface sometimes connected to the Internet
wlan0: wireless interface sometimes connected to the Internet
vboxnet0: wired ...
0
votes
2answers
142 views
How To See Which Ports Are Open On A Particular Firewall
Using the terminal I was wondering if it would be possible to see a list of all the active firewalls on a particular system that I have shelled into. I want to be able to see which ports are active ...
3
votes
2answers
590 views
How do I build the iptables kernel module for a loaded kernel?
I've built a kernel with loadable module support for various reasons, one of them the possibility to compile modules and load them without rebooting. This is supposed to be useful when I need a module ...
4
votes
2answers
834 views
Having Linux port remap to itself
I have a scenario: I have 4 server and 3 web inbound requests that I have to allow through a modem/router. the ports are https(ssl)443 ssh22 and http80. All 4 servers want them.
I had set up the ...
1
vote
2answers
644 views
TOR Transparent Proxy - How does to the TCP redirecting work
I used an iptables ruleset based on the sample ruleset from https://trac.torproject.org/projects/tor/wiki/doc/TransparentProxy, Section Linux, Local Redirection Through Tor, to set up Tor as a ...
1
vote
1answer
257 views
How do I shut down ports remotely without shutting myself out?
I have an Ubuntu 11.04 server in a remote location on another continent, so I have no physical access to it. I only interact with it by ssh (and scp), and intend to only ever interact with it that ...
1
vote
1answer
433 views
Having trouble with packets not making it into Fedora 16 Apache
Background: I haven't done anything with iptables in a few years... I have Fedora 16 running in a VM on VMWare, with my firewall (TomatoUSB) port forwarding to the VM.
VM is at 192.168.1.155. I know ...
