iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

6
votes
3answers
13k views

What prevents a machine from responding to pings?

I have a CentOS release 5.4 linux box on Amazon EC2 that I'm trying to set up to be monitored via Nagios. The machine is in the same security group as the nagios server, but it seems to be ...
6
votes
2answers
2k views

Is it possible to redirect a logging output of the iptables' LOG chain into a separate log file?

I don't want to mix iptables's log output with other system logs. How could I specify a dedicated log file for iptables LOG chains output?
6
votes
2answers
7k views

iptables port-mirroring

I need to be able to get a copy of packets received on port 8001 to port 8002. I have tried the following but I get an error that --tee is undefined. sudo iptables -t nat -A PREROUTING -p TCP -s ...
6
votes
2answers
14k views

IPTables - Port to another ip & port (from the inside)

I currently have a NAS box running under port 80. To access the NAS from the outside, I mapped the port 8080 to port 80 on the NAS as follow: iptables -t nat -A PREROUTING -p tcp --dport 8080 -j DNAT ...
6
votes
1answer
12k views

How to reset all iptables settings?

Are there any simpler commands to these? (e.g.: a oneliner? can one command reset iptables/netfilter settings to this?) IPTABLES="$(which iptables)" # RESET DEFAULT POLICIES $IPTABLES -P INPUT ...
6
votes
1answer
984 views

forward outgoing traffic port using iptables

I am trying to forward all outgoing traffic from port 80 to port 8080 using iptables and I tried the following rule, though it did not work: iptables -t nat -A OUTPUT -p tcp --dport 80 -j REDIRECT ...
6
votes
1answer
7k views

Have someone ever audited the default OpenWrt firewall rules?

I have an Openwrt 10.03.1 installed from: openwrt-ar71xx-wrt160nl-squashfs-factory.bin (firewall only customized with this: sed 's/REJECT/DROP/g' /etc/config/firewall) - so besides this, IT'S A ...
6
votes
2answers
6k views

iptables, how to redirect port from loopback?

The main rules are: OUTIF=eth0 /sbin/iptables --policy INPUT DROP /sbin/iptables --policy FORWARD DROP /sbin/iptables --policy OUTPUT ACCEPT /sbin/iptables -A INPUT -i lo -j ACCEPT ...
6
votes
1answer
4k views

NAT (Internet connection sharing) switching between multiple public interfaces

My Ubuntu 12.04 (precise) laptop has three network interfaces: eth0: wired interface sometimes connected to the Internet wlan0: wireless interface sometimes connected to the Internet vboxnet0: wired ...
6
votes
1answer
833 views

Skip routing via `lo` interface for outgoing packets

Introduction I have following load balancing configuration: 10.0.1.31 - lb 10.0.1.35 - virtual IP 10.0.1.32 - node1 (tomcat + mysql) 10.0.1.33 - node2 (tomcat + mysql) I'm using keepalived which ...
6
votes
1answer
187 views

Setting traffic class on return packets

I have a network topology: Server <-> router1 <-> router2 <-> router3 <-> edgeRouter <-> "internet" All routers are linux based, and support iptables. The server sets ...
6
votes
1answer
3k views

Terminal commands equivalent to NetworkManager's “Use as Hotspot” option

I'm making a gui application which will control my laptop in order to make it act as a wifi hotspot. I may change distributions so I want to find a solution which will work generally for all ...
5
votes
4answers
8k views

Whitelist IP's in CentOS 7

I want to setup CentOS 7 firewall such that, all the incoming requests will be blocked except from the originating IP's that I whitelist. And for the Whitelist IP's all the ports should be accessible. ...
5
votes
3answers
8k views

route traffic out different gateway by destination network

I have several gateways and would like to route some traffic out of different gateways based on its destination. I'm guessing I'd need to use a combination of iproute2 and iptables rules, but am not ...
5
votes
1answer
7k views

How to understand why the packet was considered INVALID by the `iptables`?

I set up some iptables rules so it logs and drops the packets that are INVALID (--state INVALID). Reading the logs how can I understand why the packet was considered invalid? For example, the ...
5
votes
3answers
4k views

Transform a UDP unicast packet into a broadcast?

We need to wake-up some computers on our internal LAN, from the Internet. We have a somewhat closed router, with very few ways to configure it. I'd like to use netfilter (iptables) to do this because ...
5
votes
4answers
2k views

How can I send spoofed packets in Linux

In order to test a firewall, I want to send malformed packets to its interface, regardless of my routing table. Is there a way to ask linux "send this exact tcp package, to this MAC address, ...
5
votes
4answers
2k views

How to share the internet connection?

An ordinally network topology in picture: In words: - "server" (e.g.: an Ubuntu 10.04 LTS) is connected to the "internet" through pppoe connection - "server" is using it's wireless card in AP ...
5
votes
2answers
343 views

Does Fedora's firewall use iptables?

Fedora has a Firewall Configuration interface: Does this use iptables underneath to enforce the rules?
5
votes
1answer
7k views

What is the difference between OUTPUT and FORWARD chains in iptables?

CentOS 6.0 I'm studying iptables and am getting confused on the difference between FORWARD and OUTPUT chains. In my training documentation, it states: If you're appending to (-A) or deleting ...
5
votes
2answers
4k views

How to redirect kernel messages having the unique id substring into separate log file (using `rsyslog`)?

I am using iptables's logging feature to debug my network activity. I use certain prefix with --log-prefix parameter to uniquely identify messages in kernel log belonging to iptables output, for ...
5
votes
1answer
2k views

What's the difference between ULOG and NFLog?

Various places suggest to use ULOG or NFLOG instead of LOG for getting dedicated netfilter logging (see for example here or here). From looking at man iptables those two look quite alike. Except that ...
5
votes
3answers
6k views

Why can't I use the REJECT policy on my iptables OUTPUT chain?

I currently have my OUTPUT chain set to DROP. I'd like to change it to REJECT, so that I have a clue that it's my firewall stopping me from getting somewhere rather than a problem with whatever ...
5
votes
2answers
3k views

Tunnel yum traffic through another server via ssh

I am running a Fedora desktop behind a corporate proxy that is blocking yum traffic (specifically *.gz and *.bz2). I have access to a separate RedHat machine via ssh which can download anything it ...
5
votes
3answers
3k views

iptables: The “script” way or the “*filter, rules, COMMIT” way?

I'm trying to figure out how NAT and iptables work. While I'm in the trial-and-error phase of learning about it, I found two somewhat conflicting howtos. One howto uses a script to call iptables ...
5
votes
1answer
955 views

Why should the ECN on your machine be disabled?

I was going through this article on iptables and there the author said that: It's important to turn off ECN (explicit congestion notification) so that Internet communications will work ...
5
votes
2answers
10k views

Where is iptables script stored on DD-WRT filesystem?

I have an ASUS RT-N16 router that I've flashed with the open-source DD-WRT firmware. According to my ssh login, I'm running: DD-WRT v24-sp2 mega (c) 2010 NewMedia-NET GmbH Release: 08/07/10 (SVN ...
5
votes
4answers
10k views

iptables rules not reloading on CentOS 6.x

I have one single ipset added to my iptables on a CentOS 6.x box and this rule is lost when the machine reboots. I've found this answer showing how to make a Ubuntu system reload the iptables rules ...
5
votes
1answer
734 views

Creating a NAT from loopback to a remote server

My goal is to redirect connections from the local host to a remote server, and be able to change the remote address on the fly, without any client config changes. I can do this now using a nat on the ...
5
votes
1answer
75 views

IPtables - new vs new, established, related

I'm «pretty» new to IPtables, or I have used IPtables a few years, but never with advanced features. I understand the concept of stateful IPtables rules, but recently I discovered that some people ...
5
votes
1answer
4k views

Enable RTSP in iptables

I'd like to receive a RTSP stream via VLC, but when I try to run sudo -u non_root_user cvlc -vvv -I dummy rtsp://ip:port/x.sdp I get: Unable to determine our source address: This computer has an ...
5
votes
1answer
448 views

Using source routing (LSRR) - any ideas?

What I want to do is conceptually very simple, but I can't find any information or help about how to go about doing this. Basically, I want to configure my networking to use source routing (LSRR). ...
5
votes
0answers
34 views

Why doesn't NAT reserve ports from the machine's TCP and UDP port pool?

I made two experiments. This is the network for both of them: [private network] [public network] A -------------------- R ----------------- B 192.168.0.5 192.168.0.1|192.0.2.1 ...
5
votes
1answer
384 views

Is there a way to match an inet and inet6 IP set in a single rule?

Is it possible to have one IPv4 and one IPv6 IP set (ipset(8)) within the same rule? I have several rules that depend on one set of IPv4 addresses and another set of IPv6 addresses respectively, but ...
5
votes
1answer
782 views

What are the definitions of addrtype in iptables?

I am keen to use addrtype in combination with -src as a rule in one of my filter chain like so to drop some bogon ips: -A INPUT -p tcp --dport 80 -m addrtype --src-type UNICAST ! -s 127.0.0.0/8 -j ...
4
votes
3answers
58 views

Why do some TCP reset packets show up in my iptables log?

I started to add some basic iptables rules on my Debian Jessie server. My objective is to filter and log network traffic (for security and learning purposes). Disregarding ICMP packets, these are ...
4
votes
3answers
2k views

iptables multiple -d flags not allowed

I am trying to log all my outbound connections to a file using iptables. This is my rule: -A OUTPUT ! -o lo ! --destination 127.0.0.1 -m state --state NEW -j LOG --log-prefix "new_connection " ...
4
votes
3answers
18k views

How can I redirect ports 80 and 443 to 8080 and 8443 with iptables?

I'm looking at the documentation for a Tomcat 6 webapp called DSpace, specifically in regardds to running Running DSpace on Standard Ports (80 for http:// and 443 for https://) I am trying to use ...
4
votes
2answers
574 views

Why can I reach a different interface's IP address?

I'm wondering about this, and I can't seem to find an explanation on the internet. I have a linux gateway which has multiple interfaces: eth0: external ip eth1: 172.16.1.1/24 eth2: 172.16.2.1/24 ...
4
votes
2answers
447 views

Can iptables rules manipulate IP sets?

In iptables-extensions(8) the set module is described and it is discussed that it is possible to react to the presence or absence of an IP or more generally a match against an IP set. However, it ...
4
votes
1answer
787 views

How does iptables recognize packet state?

Consider these two sets of rules: Set A -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT -A INPUT -j REJECT -A OUTPUT -j ACCEPT Set B -A INPUT -m conntrack --ctstate ...
4
votes
1answer
4k views

How to Block SSH Brute Force via Iptables and How does it work?

I'm planning to add the following rules to iptables to stop ssh brute force attack which are common these days. -A INPUT -i eth0.103 -p tcp -m tcp --dport 4522 -m state --state NEW -m recent --set ...
4
votes
1answer
1k views

Why is my computer trying to send ICMP type 3 to OpenDNS?

In my firewall logs I see lots of entries like this. IN= OUT=eth0 SRC=192.168.1.105 DST=208.67.220.220 LEN=148 TOS=0x00 PREC=0xC0 TTL=64 ID=55705 PROTO=ICMP TYPE=3 CODE=3 [SRC=208.67.220.220 ...
4
votes
1answer
5k views

iptables: recent module

I am using the "recent" module to prevent port scanning, such as: -A INPUT -i eth0 -m recent --name PORTSCAN --update --seconds 60 -j DROP -A INPUT -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT -A INPUT ...
4
votes
1answer
415 views

Can iptables be used to monitor TCP timeouts/resets system-wide?

I'm trying to determine if an application's connection to a database is internal to the application or due to a networking event. This seems like something netfilter would have system-wide visibility ...
4
votes
2answers
344 views

What tool to execute a command on repeated syslog entries?

Occasionally, one VPS under my control gets bombarded with POP3 login attempts. They all fail, but the huge number of spawned processes and active connections pretty much amount to a DoS attack. When ...
4
votes
2answers
230 views

Why were tables built into ipchains?

Why are tables built into ipchains? What was the benefit of adding tables to ipchains? Is there a simple scenario that would illustrate how tables are used to increase performance or offer some other ...
4
votes
2answers
201 views

set connection limit via iptables

I want to limit the IP traffic of an application (AceStream Player). The problem is that I get disconnected, if too many IP connections are established. Does anyone know, how to use iptables to limit ...
4
votes
2answers
400 views

Redirecting loopback traffic through a router

For some tests purposes, I am running multiple socket-based applications on one machine and want to simulate "real" network conditions between them. I thought the simplest would be to redirect all ...
4
votes
4answers
7k views

Restrict bandwidth with DD-WRT

I have DD-WRT installed on my router and I would like to be able to restrict the bandwidth both up and down on a certain IP or Mac address. I am happy to get my hands dirty and use console. I am sure ...