iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

7
votes
3answers
5k views

Transform a UDP unicast packet into a broadcast?

We need to wake-up some computers on our internal LAN, from the Internet. We have a somewhat closed router, with very few ways to configure it. I'd like to use netfilter (iptables) to do this because ...
7
votes
2answers
15k views

incoming ACCEPT all iptables rule still appearing

I'm following this guide here: http://isalazyadmin.net/2009/07/02/configuring-a-basic-firewall-for-debian-linux/ And I have the iptables listed shown, but my server still appears to be accepting all ...
7
votes
2answers
6k views

Iptables: matching outgoing traffic with conntrack and owner. Works with strange drops

In my iptables script I have been experimenting with writing as finely grained rules as possible. I limit which users are allowed to use which services, partly for security and partly as a learning ...
7
votes
1answer
837 views

Why are packages being rejected even through there's a rule that accepts them all before hand?

I'm just reading up on iptables, finally. I'm a little confused because the input chain from the filter table (as installed, fedora 17), looks like this: target prot opt source ...
7
votes
1answer
2k views

Shaping outgoing traffic with iptables

On my laptop, when I run any downloads, torrents, etc, browsing is crippled. I read somewhere that you could configure your iptables powered router to prioritize certain network traffic. Could I do ...
7
votes
4answers
10k views

Help configuring a custom log file for iptables

I'm trying to log dropped packages to a custom file instead of /var/log/messages. To achieve this, I have added these two lines at the end of my configuration file: -A INPUT -m limit --limit 5/...
7
votes
1answer
1k views

iptables will match the following ICMP request packet as ESTABLISHED state after the first reply packet is sent

Test environment: CentOS 6.3 - kernel 2.6.32-279.el6.i686, iptables v1.4.7 Win7 <---> CentOS Windows is constantly replaying ICMP echo request in 10pkt/sec rate to CentOS. In iptables, I added the ...
7
votes
1answer
9k views

Why are incoming packets on a TAP interface seen with tcpdump but not with iptables?

A program injects packets on a Linux TAP interface (these packets are coming from a virtual machine). Specifically, these are DHCP requests (so they're UDP). I can see the packets with tcpdump but not ...
7
votes
2answers
4k views

Terminal commands equivalent to NetworkManager's “Use as Hotspot” option

I'm making a gui application which will control my laptop in order to make it act as a wifi hotspot. I may change distributions so I want to find a solution which will work generally for all ...
6
votes
3answers
10k views

Blocking outgoing connects with iptables

I have a (non production) machine where external supporters have shell-access (non-root). I want to prevent them from going further on into our network from that machine using iptables. The "normal" ...
6
votes
1answer
11k views

How to understand why the packet was considered INVALID by the `iptables`?

I set up some iptables rules so it logs and drops the packets that are INVALID (--state INVALID). Reading the logs how can I understand why the packet was considered invalid? For example, the ...
6
votes
2answers
21k views

How can I redirect outbound traffic to port 80 using iptables locally?

I'm trying to locally redirect ports on my Ubuntu machine using iptables. Similar to transparent proxying. I want to catch anything trying to leave my system on port 80 and redirect it to a remote ...
6
votes
2answers
7k views

Tunnel yum traffic through another server via ssh

I am running a Fedora desktop behind a corporate proxy that is blocking yum traffic (specifically *.gz and *.bz2). I have access to a separate RedHat machine via ssh which can download anything it ...
6
votes
3answers
14k views

Where is iptables script stored on DD-WRT filesystem?

I have an ASUS RT-N16 router that I've flashed with the open-source DD-WRT firmware. According to my ssh login, I'm running: DD-WRT v24-sp2 mega (c) 2010 NewMedia-NET GmbH Release: 08/07/10 (SVN ...
6
votes
2answers
4k views

How to redirect kernel messages having the unique id substring into separate log file (using `rsyslog`)?

I am using iptables's logging feature to debug my network activity. I use certain prefix with --log-prefix parameter to uniquely identify messages in kernel log belonging to iptables output, for ...
6
votes
2answers
9k views

iptables port-mirroring

I need to be able to get a copy of packets received on port 8001 to port 8002. I have tried the following but I get an error that --tee is undefined. sudo iptables -t nat -A PREROUTING -p TCP -s 127....
6
votes
2answers
4k views

What's the difference between ULOG and NFLog?

Various places suggest to use ULOG or NFLOG instead of LOG for getting dedicated netfilter logging (see for example here or here). From looking at man iptables those two look quite alike. Except that ...
6
votes
3answers
5k views

iptables: The “script” way or the “*filter, rules, COMMIT” way?

I'm trying to figure out how NAT and iptables work. While I'm in the trial-and-error phase of learning about it, I found two somewhat conflicting howtos. One howto uses a script to call iptables ...
6
votes
4answers
20k views

What prevents a machine from responding to pings?

I have a CentOS release 5.4 linux box on Amazon EC2 that I'm trying to set up to be monitored via Nagios. The machine is in the same security group as the nagios server, but it seems to be ...
6
votes
2answers
3k views

Is it possible to redirect a logging output of the iptables' LOG chain into a separate log file?

I don't want to mix iptables's log output with other system logs. How could I specify a dedicated log file for iptables LOG chains output?
6
votes
2answers
174 views

How can I silently drop some outgoing packets?

I'm doing some testing of an application I am working on, and I need to be able to silently drop outgoing UDP packets for a short period of time to replicate a possible failure mode. Is there any way ...
6
votes
1answer
2k views

forward outgoing traffic port using iptables

I am trying to forward all outgoing traffic from port 80 to port 8080 using iptables and I tried the following rule, though it did not work: iptables -t nat -A OUTPUT -p tcp --dport 80 -j REDIRECT --...
6
votes
4answers
14k views

iptables rules not reloading on CentOS 6.x

I have one single ipset added to my iptables on a CentOS 6.x box and this rule is lost when the machine reboots. I've found this answer showing how to make a Ubuntu system reload the iptables rules ...
6
votes
1answer
8k views

Have someone ever audited the default OpenWrt firewall rules?

I have an Openwrt 10.03.1 installed from: openwrt-ar71xx-wrt160nl-squashfs-factory.bin (firewall only customized with this: sed 's/REJECT/DROP/g' /etc/config/firewall) - so besides this, IT'S A ...
6
votes
2answers
6k views

iptables, how to redirect port from loopback?

The main rules are: OUTIF=eth0 /sbin/iptables --policy INPUT DROP /sbin/iptables --policy FORWARD DROP /sbin/iptables --policy OUTPUT ACCEPT /sbin/iptables -A INPUT -i lo -j ACCEPT /sbin/...
6
votes
1answer
868 views

netfilter/iptables: why not using the raw table?

Under Linux, we usually use the "filter" table to do common filtering: iptables --table filter --append INPUT --source 1.2.3.4 --jump DROP iptables --table filter --append INPUT --in-interface lo --...
6
votes
1answer
4k views

NAT (Internet connection sharing) switching between multiple public interfaces

My Ubuntu 12.04 (precise) laptop has three network interfaces: eth0: wired interface sometimes connected to the Internet wlan0: wireless interface sometimes connected to the Internet vboxnet0: wired ...
6
votes
1answer
42 views

connlimit counters start over after iptables restored

I have a connlimit rule in iptables that allow only 5 connection to port 80. iptables -A FORWARD -p tcp -m tcp --syn --dport 80 -m connlimit --connlimit-above 5 --connlimit-saddr -j DROP This ...
6
votes
1answer
186 views

Why doesn't NAT reserve ports from the machine's TCP and UDP port pool?

I made two experiments. This is the network for both of them: [private network] [public network] A -------------------- R ----------------- B 192.168.0.5 192.168.0.1|192.0.2.1 ...
6
votes
1answer
1k views

IPtables - new vs new, established, related

I'm «pretty» new to IPtables, or I have used IPtables a few years, but never with advanced features. I understand the concept of stateful IPtables rules, but recently I discovered that some people ...
6
votes
1answer
1k views

Skip routing via `lo` interface for outgoing packets

Introduction I have following load balancing configuration: 10.0.1.31 - lb 10.0.1.35 - virtual IP 10.0.1.32 - node1 (tomcat + mysql) 10.0.1.33 - node2 (tomcat + mysql) I'm using keepalived which ...
6
votes
1answer
1k views

What are the definitions of addrtype in iptables?

I am keen to use addrtype in combination with -src as a rule in one of my filter chain like so to drop some bogon ips: -A INPUT -p tcp --dport 80 -m addrtype --src-type UNICAST ! -s 127.0.0.0/8 -j ...
6
votes
0answers
96 views

Simulate ethernet cable unplugged on a remote machine while staying connected

I am working from home on remote embedded Linux machine "X" via ssh. It has one physical network card. I need to simulate Ethernet cable unplugged condition on the same remote machine "X" , while ...
6
votes
2answers
309 views

Setting traffic class on return packets

I have a network topology: Server <-> router1 <-> router2 <-> router3 <-> edgeRouter <-> "internet" All routers are linux based, and support iptables. The server sets ...
5
votes
4answers
20k views

Whitelist IP's in CentOS 7

I want to setup CentOS 7 firewall such that, all the incoming requests will be blocked except from the originating IP's that I whitelist. And for the Whitelist IP's all the ports should be accessible. ...
5
votes
2answers
32k views

IPTables rule to allow incoming SSH connections

The aim of this script is to only allow traffic over the VPN, except for localhost<->localhost and incoming SSH traffic. But when I run the script over SSH I am disconnected and forced to restart ...
5
votes
3answers
12k views

bash: iptables: command not found

How do I fix the iptables: command not found problem that happened to Debian 7.6? batman@gotham:~$ uname -a Linux gotham 3.14-0.bpo.2-amd64 #1 SMP Debian 3.14.13-2~bpo70+1 (2014-07-31) x86_64 GNU/...
5
votes
3answers
14k views

route traffic out different gateway by destination network

I have several gateways and would like to route some traffic out of different gateways based on its destination. I'm guessing I'd need to use a combination of iproute2 and iptables rules, but am not ...
5
votes
3answers
9k views

Why can't I use the REJECT policy on my iptables OUTPUT chain?

I currently have my OUTPUT chain set to DROP. I'd like to change it to REJECT, so that I have a clue that it's my firewall stopping me from getting somewhere rather than a problem with whatever ...
5
votes
4answers
3k views

How can I send spoofed packets in Linux

In order to test a firewall, I want to send malformed packets to its interface, regardless of my routing table. Is there a way to ask linux "send this exact tcp package, to this MAC address, ...
5
votes
4answers
3k views

How to share the internet connection?

An ordinally network topology in picture: In words: - "server" (e.g.: an Ubuntu 10.04 LTS) is connected to the "internet" through pppoe connection - "server" is using it's wireless card in AP ...
5
votes
2answers
353 views

Does Fedora's firewall use iptables?

Fedora has a Firewall Configuration interface: Does this use iptables underneath to enforce the rules?
5
votes
1answer
28k views

iptables forward all traffic to interface

I have two interfaces eth1 and eth0. I want all traffic on eth0to be forwarded to eth1. I created an iptable rule like this: iptables -A FORWARD -s 0/0 -i eth0 -p tcp -o eth1 -j ACCEPT But this ...
5
votes
2answers
11k views

Debugging iptables using live packet views

Are there any CLI or GUI functions that I can use to monitor hits to iptables and watch as packets interact with iptables?
5
votes
1answer
3k views

How iptables tables and chains are traversed

I know linux has 3 built-in tables and each of them has its own chains as follow: FILTER: PREROUTING, FORWARD, POSTROUTING NAT: PREROUTING, INPUT, OUTPUT, POSTROUTING MANGLE: PREROUTING, INPUT, ...
5
votes
1answer
2k views

Why is my computer trying to send ICMP type 3 to OpenDNS?

In my firewall logs I see lots of entries like this. IN= OUT=eth0 SRC=192.168.1.105 DST=208.67.220.220 LEN=148 TOS=0x00 PREC=0xC0 TTL=64 ID=55705 PROTO=ICMP TYPE=3 CODE=3 [SRC=208.67.220.220 ...
5
votes
1answer
6k views

iptables: recent module

I am using the "recent" module to prevent port scanning, such as: -A INPUT -i eth0 -m recent --name PORTSCAN --update --seconds 60 -j DROP -A INPUT -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT -A INPUT ...
5
votes
1answer
1k views

Why should the ECN on your machine be disabled?

I was going through this article on iptables and there the author said that: It's important to turn off ECN (explicit congestion notification) so that Internet communications will work properly....
5
votes
1answer
212 views

port forwarding to application in network namespace with vpn

I was able to set up a network namespace, establish a tunnel with openvpn and start an application that uses this tunnel inside the namespace. So far so good, but this application can be accessed via ...
5
votes
2answers
9k views

set packet rate limit via iptables

I have a packet rate limit (max. 10 per seconds) which is set by my internet provider. This is a problem if I want to use the AceStream player, because if I exceed the limit I get disconnected. How ...