iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

5
votes
3answers
4k views

Why can't I use the REJECT policy on my iptables OUTPUT chain?

I currently have my OUTPUT chain set to DROP. I'd like to change it to REJECT, so that I have a clue that it's my firewall stopping me from getting somewhere rather than a problem with whatever ...
5
votes
2answers
3k views

How to redirect kernel messages having the unique id substring into separate log file (using `rsyslog`)?

I am using iptables's logging feature to debug my network activity. I use certain prefix with --log-prefix parameter to uniquely identify messages in kernel log belonging to iptables output, for ...
5
votes
1answer
738 views

Why should the ECN on your machine be disabled?

I was going through this article on iptables and there the author said that: It's important to turn off ECN (explicit congestion notification) so that Internet communications will work ...
5
votes
1answer
5k views

What -A INPUT -j REJECT --reject-with icmp-host-prohibited Iptables line does exactly?

What do the following lines do? I have been reading redhat iptables documentation but can't figure it out. ... -j REJECT --reject-with icmp-host-prohibited ... -j REJECT --reject-with ...
5
votes
3answers
4k views

Is it better to set rules in ip6tables or disable ipv6?

I have the following network configuration: # ifconfig -a eth0 Link encap:Ethernet HWaddr 00:e0:1c:73:02:09 inet addr:10.1.4.41 Bcast:10.1.255.255 Mask:255.255.0.0 inet6 ...
5
votes
2answers
5k views

iptables port-mirroring

I need to be able to get a copy of packets received on port 8001 to port 8002. I have tried the following but I get an error that --tee is undefined. sudo iptables -t nat -A PREROUTING -p TCP -s ...
5
votes
1answer
472 views

forward outgoing traffic port using iptables

I am trying to forward all outgoing traffic from port 80 to port 8080 using iptables and I tried the following rule, though it did not work: iptables -t nat -A OUTPUT -p tcp --dport 80 -j REDIRECT ...
5
votes
4answers
7k views

iptables rules not reloading on CentOS 6.x

I have one single ipset added to my iptables on a CentOS 6.x box and this rule is lost when the machine reboots. I've found this answer showing how to make a Ubuntu system reload the iptables rules ...
5
votes
1answer
10k views

How to reset all iptables settings?

Are there any simpler commands to these? (e.g.: a oneliner? can one command reset iptables/netfilter settings to this?) IPTABLES="$(which iptables)" # RESET DEFAULT POLICIES $IPTABLES -P INPUT ...
5
votes
2answers
874 views

Move iptables rule (w/o removing and adding)

Is there a way to move a rule in the iptables and change it position ? I'm aware i can use -I to insert a rule in a specific position, but i also like to keep the counters.
5
votes
4answers
5k views

Help configuring a custom log file for iptables

I'm trying to log dropped packages to a custom file instead of /var/log/messages. To achieve this, I have added these two lines at the end of my configuration file: -A INPUT -m limit --limit ...
5
votes
1answer
9k views

IPTables - Port to another ip & port (from the inside)

I currently have a NAS box running under port 80. To access the NAS from the outside, I mapped the port 8080 to port 80 on the NAS as follow: iptables -t nat -A PREROUTING -p tcp --dport 8080 -j DNAT ...
5
votes
1answer
498 views

Creating a NAT from loopback to a remote server

My goal is to redirect connections from the local host to a remote server, and be able to change the remote address on the fly, without any client config changes. I can do this now using a nat on the ...
5
votes
1answer
376 views

Using source routing (LSRR) - any ideas?

What I want to do is conceptually very simple, but I can't find any information or help about how to go about doing this. Basically, I want to configure my networking to use source routing (LSRR). ...
5
votes
1answer
3k views

Enable RTSP in iptables

I'd like to receive a RTSP stream via VLC, but when I try to run sudo -u non_root_user cvlc -vvv -I dummy rtsp://ip:port/x.sdp I get: Unable to determine our source address: This computer has an ...
5
votes
0answers
56 views

Setting traffic class on return packets

I have a network topology: Server <-> router1 <-> router2 <-> router3 <-> edgeRouter <-> "internet" All routers are linux based, and support iptables. The server sets ...
5
votes
1answer
135 views

Is there a way to match an inet and inet6 IP set in a single rule?

Is it possible to have one IPv4 and one IPv6 IP set (ipset(8)) within the same rule? I have several rules that depend on one set of IPv4 addresses and another set of IPv6 addresses respectively, but ...
5
votes
1answer
328 views

What are the definitions of addrtype in iptables?

I am keen to use addrtype in combination with -src as a rule in one of my filter chain like so to drop some bogon ips: -A INPUT -p tcp --dport 80 -m addrtype --src-type UNICAST ! -s 127.0.0.0/8 -j ...
4
votes
3answers
13k views

How can I redirect ports 80 and 443 to 8080 and 8443 with iptables?

I'm looking at the documentation for a Tomcat 6 webapp called DSpace, specifically in regardds to running Running DSpace on Standard Ports (80 for http:// and 443 for https://) I am trying to use ...
4
votes
2answers
507 views

Why can I reach a different interface's IP address?

I'm wondering about this, and I can't seem to find an explanation on the internet. I have a linux gateway which has multiple interfaces: eth0: external ip eth1: 172.16.1.1/24 eth2: 172.16.2.1/24 ...
4
votes
2answers
8k views

incoming ACCEPT all iptables rule still appearing

I'm following this guide here: http://isalazyadmin.net/2009/07/02/configuring-a-basic-firewall-for-debian-linux/ And I have the iptables listed shown, but my server still appears to be accepting all ...
4
votes
2answers
218 views

Can iptables rules manipulate IP sets?

In iptables-extensions(8) the set module is described and it is discussed that it is possible to react to the presence or absence of an IP or more generally a match against an IP set. However, it ...
4
votes
1answer
197 views

How does iptables recognize packet state?

Consider these two sets of rules: Set A -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT -A INPUT -j REJECT -A OUTPUT -j ACCEPT Set B -A INPUT -m conntrack --ctstate ...
4
votes
1answer
578 views

Why is my computer trying to send ICMP type 3 to OpenDNS?

In my firewall logs I see lots of entries like this. IN= OUT=eth0 SRC=192.168.1.105 DST=208.67.220.220 LEN=148 TOS=0x00 PREC=0xC0 TTL=64 ID=55705 PROTO=ICMP TYPE=3 CODE=3 [SRC=208.67.220.220 ...
4
votes
1answer
3k views

iptables: recent module

I am using the "recent" module to prevent port scanning, such as: -A INPUT -i eth0 -m recent --name PORTSCAN --update --seconds 60 -j DROP -A INPUT -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT -A INPUT ...
4
votes
2answers
10k views

Port forward to VPN Client?

I've run into a bit of a puzzle and haven't had much luck finding a solution. Right now I am (sadly) connected to the net via Verizon 3G. They filter all incoming traffic so it is impossible for me to ...
4
votes
1answer
214 views

Can iptables be used to monitor TCP timeouts/resets system-wide?

I'm trying to determine if an application's connection to a database is internal to the application or due to a networking event. This seems like something netfilter would have system-wide visibility ...
4
votes
1answer
8k views

How to Allow Outgoing SMTP on iptables Debian Linux

If I choose to allow all traffic on the OUTPUT chain (iptables -P OUTPUT ACCEPT) mail sends fine. As soon as I lock down my server with these rules, outgoing mail stops working. All else works though, ...
4
votes
2answers
9k views

How can I redirect outbound traffic to port 80 using iptables locally?

I'm trying to locally redirect ports on my Ubuntu machine using iptables. Similar to transparent proxying. I want to catch anything trying to leave my system on port 80 and redirect it to a remote ...
4
votes
2answers
7k views

Where is iptables script stored on DD-WRT filesystem?

I have an ASUS RT-N16 router that I've flashed with the open-source DD-WRT firmware. According to my ssh login, I'm running: DD-WRT v24-sp2 mega (c) 2010 NewMedia-NET GmbH Release: 08/07/10 (SVN ...
4
votes
2answers
209 views

Why were tables built into ipchains?

Why are tables built into ipchains? What was the benefit of adding tables to ipchains? Is there a simple scenario that would illustrate how tables are used to increase performance or offer some other ...
4
votes
2answers
66 views

set connection limit via iptables

I want to limit the IP traffic of an application (AceStream Player). The problem is that I get disconnected, if too many IP connections are established. Does anyone know, how to use iptables to limit ...
4
votes
2answers
132 views

Redirecting loopback traffic through a router

For some tests purposes, I am running multiple socket-based applications on one machine and want to simulate "real" network conditions between them. I thought the simplest would be to redirect all ...
4
votes
2answers
7k views

iptables redirect outside requests to 127.0.0.1

I have a service running on 127.0.0.1 with port 2222. I need to forward all requests to 192.168.2.2:2222 (outside IP) only from subnet 192.168.1.0/24 to 127.0.0.1:2222. I'm trying to use this, but ...
4
votes
1answer
8k views

How can I configure syslog.conf file, to log iptables messages in a separate file?

How can I configure /etc/syslog.conf file in order to save log information about iptables in a specific file. I want to save these information separately, so I can extract what I want easily and ...
4
votes
4answers
6k views

Restrict bandwidth with DD-WRT

I have DD-WRT installed on my router and I would like to be able to restrict the bandwidth both up and down on a certain IP or Mac address. I am happy to get my hands dirty and use console. I am sure ...
4
votes
1answer
1k views

Why does my firewall (iptables) interfere in my bridge (brctl)?

I set up a bridge br0 "attached" to two interfaces: eth0, my physical interface connected to the real LAN, vnet0, a KVM virtual interface (connected to a Windows VM). And I have this single ...
4
votes
1answer
2k views

IPTABLES is slow after adding '-A INPUT -j DROP' to rule list

I am just getting started with iptables and stumbled across something I don't really understand. FYI, I followed the instructions of Ubuntu wiki's IptablesHowTo. The nat and mangle tables are empty, ...
4
votes
2answers
195 views

Is it possible to set-up a VPN in such a way that I disconnect from the Internet if it goes down?

How can I set-up a VPN so I loose connection to the Internet if it goes down? I use Ubuntu and have used the network-dialog to use a VPN; but if the VPN goes down, it just switches to the non-VPN ...
4
votes
2answers
1k views

Having Linux port remap to itself

I have a scenario: I have 4 server and 3 web inbound requests that I have to allow through a modem/router. the ports are https(ssl)443 ssh22 and http80. All 4 servers want them. I had set up the ...
4
votes
1answer
839 views

Force VPN using IPtables?

I want to force the use of VPN using iptables, therefore while VPN is disabled no outgoing traffic shall be allowed (except maybe some DHCP stuff...). Now i guess I could just block everything not ...
4
votes
3answers
2k views

IPTables and transparent proxies

I have set up a local, transparent TCP proxy on localhost. I want to redirect ALL TCP traffic to this proxy, so it can handle it and nothing "leaks out," circumventing the proxy. I need to use ...
4
votes
1answer
228 views

Debian Wheezy subnet configuration (proxy, MASQUARADing etc.)

I have a "server" with eth1 having a full IP address, DNS, gateway and proxy name connected to the university internet/intranet provider and eth0 IP 192.168.1.2 connected by a gigabit switch with two ...
4
votes
2answers
268 views

How can I prevent iptables from counting bytes and packets on empty chains?

Background I occasionally have firewall rules that I need to use for maintenance windows, but don't want active (and therefore consuming CPU cycles or slowing the network interface) the rest of the ...
4
votes
1answer
128 views

How do you do NAT port redirection with PF?

In Linux, you can do NAT port redirection with a command like this: iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8000 What is the equivalent with BSD's PF?
4
votes
2answers
526 views

fail2ban log parsing too slow on Raspberry Pi - options?

I'm running fail2ban on a Raspberry Pi at 950MHz which I cannot overclock further. The Pi is occasionally subject to SYN floods on particular ports. I've set up iptables to throttle the rate of SYNs ...
4
votes
2answers
3k views

iptables port forwarding

I have a CentOS server with Java/J2EE(Tomcat) installed on TCP port 8080. I have two interfaces, eth0 and lo. I need to forward all incoming connection on TCP port 80 to 8080. I tried doing the ...
4
votes
1answer
2k views

How can I redirect all traffic except local through external proxy with iptables in dd-wrt?

I have a router with dd-wrt. I have a firewall running to direct all traffic through an external proxy. It works great except that it also redirects local Ips and my proxy does not allow Ips, so I can ...
4
votes
1answer
93 views

iptables change log

Somehow an iptables rule was added to one of my systems. Does (or can) iptables keep a log about when and (maybe) who made a rule change? If iptables itself can't, is there a wrapper that might do ...
4
votes
1answer
466 views

NAT with transparent proxy

is there a way to redirect all non local http requests that through my computer to use my transparent proxy, so i can log all websites are they visiting? and if possible all https requests too.. my ...