iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

1
vote
1answer
72 views

IPv6 firewall rules seem to impede all connections

After deciding that my small server needed a firewall, I used ferm to configure iptables and ip6tables for me (this question should be tagged ferm, but I cannot create the tag). I am using the same ...
1
vote
1answer
30 views

Redirect packets and save the content to disk

I want to reroute a connection just like rinetd does but save the client and server messages. Is there any tool like this out there ? I'm using Debian.
1
vote
1answer
40 views

IPtables on ubuntu 12.04

I've problem with iptables on ubuntu 12.4. I type ufw status, it show result Status: inactive but I type iptbles -L -nv, it still shows many rules, and these rules are running. I can't understand.
1
vote
1answer
77 views

Absolutely cannot get FTP access after adding many rules to iptables in CentOS5

I'm a complete noob and am just having the worst time trying to get FTP access to the server. I want to keep the firewall enabled. Edit: Updated the iptables information. I have the following ...
1
vote
0answers
99 views

Running a Transparent Proxy for LAN and Webserver for WAN

I am running a LAMP stack on an Arch Linux server in my home, and my router firewall port 80 is open to the world. Recently, I've decided to set up a dansguardian transparent proxy to do some web ...
1
vote
0answers
33 views

How do I route traffic between eth0:0 and eth0 [duplicate]

I have been trying to convert my linux box which is running Mint into a router. eth0 has a public IP address of 71.xx.xx.xx. I created an eth0:0 and gave it an IP address of 10.0.0.100. I started a ...
5
votes
1answer
145 views

What are the definitions of addrtype in iptables?

I am keen to use addrtype in combination with -src as a rule in one of my filter chain like so to drop some bogon ips: -A INPUT -p tcp --dport 80 -m addrtype --src-type UNICAST ! -s 127.0.0.0/8 -j ...
2
votes
1answer
67 views

What does lo in iptables mean exactly?

I have seen countless examples of this rule in iptables: -A INPUT -i lo -j ACCEPT I thought lo means localhost (a.k.a. 127.0.0.1), but when I commented it out, I can't access the server using its ...
2
votes
1answer
72 views

IPTables Port Redirection Should Have Broken Apache But Didn't

I have a Load Balance set up in Apache httpd: <VirtualHost *:80> DocumentRoot /var/www/html ServerName xxx.xxx.xxx.com ProxyRequests Off ...
1
vote
1answer
23 views

Unable to access external content with this IPTABLES ruleset

My application server is on a network protected by a organization wide firewall, and my server is also using fail2ban. That said, I'd like to set up an additional layer of protection with iptables. ...
0
votes
3answers
53 views

Iptables in linux

Please explain me the use of bold character below iptables -A INPUT -i eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT -A -i -p -m state --state -j
2
votes
1answer
36 views

Do I have to swap IP sets, or can I add/remove on the fly?

I was wondering about the semantics of ipset(8). Is it possible to add a rule matching a set to iptables and then manipulate the set, or can I only create a set and swap it for an older set in order ...
2
votes
1answer
147 views

Problem setting up iptables (LDAP traffic blocked)

My application server is on a network protected by a organization wide firewall, and my server is also using fail2ban. That said, I'd like to set up an additional layer of protection with iptables. ...
1
vote
1answer
68 views

How to log incoming icmp traffic?

I am watching my ip6table and observing an icmp packet arriving and getting dropped at the rate of 1 per second. I am trying to find out what that message is about. I tried using tcpdump (it is ...
1
vote
0answers
270 views

Port redirection on loopback with IP other than 127.0.0.1

I want to redirect port 80 on the loopback network interface so that accesses to that port actually go to port 8080. I tried using the following command, but it only works if the application is ...
2
votes
1answer
232 views

How does connlimit in iptables supposed to work?

I wanted to set a limit to the number of concurrent connections allowed on my web server. I tried the following rules on an iptables (v1.4.19.1) kernel 3.14.4-200.fc20.x86_64 with a default DROP ...
1
vote
0answers
124 views

iptables server behind NAT accessible from outside as well as inside the nat

I have 2 machines with a KVM running on each machine - so two kvms with the below networking Host 1: 192.168.10.100 (eth2) 10.10.100.1 (virbr1) KVM 1 (NAT with Host 1): 10.10.100.128 (eth0 ...
0
votes
2answers
127 views

What is the simplest method to redirect traffic using either a proxy or iptables?

I need to redirect all incoming traffic on port 7777 to a specific destination_ip:port. I have about 40 Litecoin (scrypt) mining rigs that I have to manually reconfigure each time I'd like to switch ...
3
votes
3answers
174 views

dmesg flooded with firewall logs

In my iptables, I have a rule which logs dropped packets: -A INPUT -i eth0 -j LOG --log-prefix "FW: " --log-level 7 -A INPUT -i eth0 -j DROP And in /etc/rsyslog.conf, I have ...
2
votes
0answers
34 views

iptables drop length and TTL condition doesn't work

With iptables utility on Linux host need to create mini firewall. I need to drop all incoming connections with package length greater than 722 AND TTL greater than 22. Need exactly AND. Drop only if ...
1
vote
1answer
124 views

RHEL 6.5 won't boot after loading APF firewall

We have an RHEL 6.5 system which boots to the point of loading APF firewall and then just hangs indefinitely. The console shows the following: ... Loading autofs4: [OK] Starting automount: [OK] ...
0
votes
1answer
242 views

Disable iptables service on CentOS

I don't want the service to start after reboot. my code does this: service iptables stop service iptables save chkconfig --level 123456 iptables off service iptables status iptables: Firewall is not ...
-1
votes
2answers
137 views

Use IP tables to port forward behind a router?

Is it possible to use IP tables to port forward behind a router? My setup is thus: I have a Raspberry Pi running a small website on port 80, and a beefier computer running a Minecraft server on port ...
1
vote
1answer
289 views

Create a iptables rule if the rule does not all ready exist

Hi I've created a script to setup Nagios on my remote servers. My Script checks iptables to see if a firewall rule all ready exists and then is supposed to add the rule if it's not all ready there. ...
5
votes
1answer
159 views

Skip routing via `lo` interface for outgoing packets

Introduction I have following load balancing configuration: 10.0.1.31 - lb 10.0.1.35 - virtual IP 10.0.1.32 - node1 (tomcat + mysql) 10.0.1.33 - node2 (tomcat + mysql) I'm using keepalived which ...
1
vote
1answer
32 views

View blocked address from sshguard

How can I view all the addresses that sshguard has blocked to iptables?
1
vote
2answers
70 views

Does IP tables need to be configured or is a stand alone firewall sufficient?

I have two desktops and a laptop running Arch Linux. I have not setup any iptable rules on any of the machines, and I am curious if I should. One desktop is only used in my home network and is ...
4
votes
1answer
105 views

Can iptables be used to monitor TCP timeouts/resets system-wide?

I'm trying to determine if an application's connection to a database is internal to the application or due to a networking event. This seems like something netfilter would have system-wide visibility ...
0
votes
2answers
55 views

iptables advice with upd ports blocking in debian linux [closed]

please advice: I add next iptables rules: iptables -I OUTPUT 2 -p udp --dport 53 -j ACCEPT iptables -I OUTPUT 2 -p udp --dport 1700:1750 -j ACCEPT iptables -I OUTPUT 3 -p udp -m udp --dport 1812 -j ...
0
votes
0answers
114 views

What is wrong with these iptables' rules?

The following is what I got after googling: iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT #allow loopback access iptables -A OUTPUT -d 255.255.255.255 -j ACCEPT #make sure you ...
0
votes
1answer
468 views

iptables forward all traffic to interface

I have two interfaces eth1 and eth0. I want all traffic on eth0to be forwarded to eth1. I created an iptable rule like this: iptables -A FORWARD -s 0/0 -i eth0 -p tcp -o eth1 -j ACCEPT But this ...
0
votes
1answer
438 views

IPTables allow NTP Time Server

I am new to IPTables. I have an existing config that seems to work well. I am not sure I know how to add NTP to the rule Chain RH-Firewall-1-INPUT correctly. My goal is to add an additional rule to ...
1
vote
1answer
97 views

configure exim for system email forwarding (outside) , on a server with dynamic ip, behind a DNS router

Trying to configure exim to deleaver email to the outside world. I/We need to send email outside just for centralize certain admin notifications. Working on an already configured debian webserver, ...
2
votes
2answers
298 views

Why isn't the Iptables persistent service saving my changes?

I followed this tutorial to set up IP rules on ubuntu 12.04. Everything worked fine on setup -- but now I've made changes to the firewall that do not persist upon reboot. I do not understand why that ...
3
votes
1answer
134 views

Settings when using a bridge

I have a bridge set up between my physical Ethernet interface, eth0, and the virtual interface for OpenVPN, tap0. The bridge has an IP address, and the machine can be contacted on that IP address from ...
1
vote
1answer
31 views

What is the meaning “MAC MISSMATCH”? [closed]

I have every day in the log the few lines start with: MAC MISSMATCH:IN=vlanXX OUT= MAC=ff:ff:ff:ff:ff:ff:bc:ae:c5:da:70:a6:08:00:45:00:00:4e SRC=xx.xx.xx.xx DST=xx.xx.255.255 LEN=78 TOS=0x00 ...
2
votes
2answers
85 views

Are there ways to break into a machine if iptables drops all traffic?

Say I install Linux on an blank computer (no other OS, disk is formatted for installation), and I configure this in iptables: iptables -F iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P ...
1
vote
0answers
23 views

How can I use iptables to block certain processes from accessing the network? [duplicate]

I can set the processes to run under special uid's and use the technique from this SF answer: -A OUTPUT -m owner --uid-owner 400 -j DROP ...But are there any other ways to blacklist based on the ...
4
votes
1answer
131 views

Debian Wheezy subnet configuration (proxy, MASQUARADing etc.)

I have a "server" with eth1 having a full IP address, DNS, gateway and proxy name connected to the university internet/intranet provider and eth0 IP 192.168.1.2 connected by a gigabit switch with two ...
2
votes
1answer
2k views

What -A INPUT -j REJECT --reject-with icmp-host-prohibited Iptables line does exactly?

What do the following lines do? I have been reading redhat iptables documentation but can't figure it out. ... -j REJECT --reject-with icmp-host-prohibited ... -j REJECT --reject-with ...
1
vote
1answer
215 views

rtorrent: 'Tracker Timeout' caused by IPtables

I'm trying to secure my rtorrent-running-homeserver with IPtables. With the aim to allow only incoming connections to the rtorrent port 6890 and 5292 for ftp (both are forwarded by the router), I ...
1
vote
1answer
112 views

Masquerade not working sometimes

I have an issue with private network traffic not being masqueraded in very specific circumstances. The network is a group of VMware guests using the 10.1.0.0/18 network. The problematic host is ...
0
votes
1answer
32 views

Simple iptables filter rule for 101/8 block not working

I run a webserver that caters to an entirely local crowd, so to keep hacking attempts to a minimum, I have inserted a bunch of international IP-blocking rules into my iptables, but my filters don't ...
3
votes
1answer
101 views

Configure iptables on remote server without locking me up

I have a little remote server that I can access only with SSH, and what I want to do, is block all the traffic except port 22 for SSH. The first time, what I did was : iptables -P INPUT DROP And ...
0
votes
1answer
74 views

Blanket blocking SMTP with whitelist

So using a VPS environment, whereby we need to block outbound SMTP by default (spammers), with the ability to unblock when needed. We have found some scripts eg: iptables -I FORWARD 1 -d $VPS_IP -p ...
0
votes
4answers
76 views

Linux routing tables

I'm trying to learn Linux routing tables and ran into bit of snag. In the example below I'm not sure what is happening. My understanding is 0.0.0.0 means that for line 1 and 2 any packets outside of ...
3
votes
2answers
344 views

iptables multiple -d flags not allowed

I am trying to log all my outbound connections to a file using iptables. This is my rule: -A OUTPUT ! -o lo ! --destination 127.0.0.1 -m state --state NEW -j LOG --log-prefix "new_connection " ...
2
votes
1answer
191 views

Bad argument `127.0.0.1' in iptables

-A OUTPUT --destination ! '127.0.0.1' -m state --state NEW -j LOG --log-prefix "new_connection " --log-level 7 gives me Bad argument `127.0.0.1' What am I doing wrong? I used this docs : ...
1
vote
1answer
79 views

tcp/ip - trigger action or event after period of no network activity on certain port(s)

Is it possible, perhaps using iptables or one of the wrappers/frontends to iptables, to trigger an action or run a script after a certain period of time has elapsed with no network activity on a ...
0
votes
1answer
368 views

Socket Connection Refused (raspbian) but ports are open for connections

I'd like to establish a connection between my client and raspbian. Within my network, I can connect to my service at any time without any problems. Now I want to connect to my service via the ...