iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

-1
votes
2answers
101 views

Use IP tables to port forward behind a router?

Is it possible to use IP tables to port forward behind a router? My setup is thus: I have a Raspberry Pi running a small website on port 80, and a beefier computer running a Minecraft server on port ...
1
vote
1answer
199 views

Create a iptables rule if the rule does not all ready exist

Hi I've created a script to setup Nagios on my remote servers. My Script checks iptables to see if a firewall rule all ready exists and then is supposed to add the rule if it's not all ready there. ...
5
votes
1answer
129 views

Skip routing via `lo` interface for outgoing packets

Introduction I have following load balancing configuration: 10.0.1.31 - lb 10.0.1.35 - virtual IP 10.0.1.32 - node1 (tomcat + mysql) 10.0.1.33 - node2 (tomcat + mysql) I'm using keepalived which ...
1
vote
1answer
28 views

View blocked address from sshguard

How can I view all the addresses that sshguard has blocked to iptables?
1
vote
2answers
62 views

Does IP tables need to be configured or is a stand alone firewall sufficient?

I have two desktops and a laptop running Arch Linux. I have not setup any iptable rules on any of the machines, and I am curious if I should. One desktop is only used in my home network and is ...
4
votes
1answer
84 views

Can iptables be used to monitor TCP timeouts/resets system-wide?

I'm trying to determine if an application's connection to a database is internal to the application or due to a networking event. This seems like something netfilter would have system-wide visibility ...
0
votes
2answers
51 views

iptables advice with upd ports blocking in debian linux [closed]

please advice: I add next iptables rules: iptables -I OUTPUT 2 -p udp --dport 53 -j ACCEPT iptables -I OUTPUT 2 -p udp --dport 1700:1750 -j ACCEPT iptables -I OUTPUT 3 -p udp -m udp --dport 1812 -j ...
0
votes
0answers
103 views

What is wrong with these iptables' rules?

The following is what I got after googling: iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT #allow loopback access iptables -A OUTPUT -d 255.255.255.255 -j ACCEPT #make sure you ...
0
votes
1answer
166 views

iptables forward all traffic to interface

I have two interfaces eth1 and eth0. I want all traffic on eth0to be forwarded to eth1. I created an iptable rule like this: iptables -A FORWARD -s 0/0 -i eth0 -p tcp -o eth1 -j ACCEPT But this ...
0
votes
1answer
255 views

IPTables allow NTP Time Server

I am new to IPTables. I have an existing config that seems to work well. I am not sure I know how to add NTP to the rule Chain RH-Firewall-1-INPUT correctly. My goal is to add an additional rule to ...
1
vote
1answer
82 views

configure exim for system email forwarding (outside) , on a server with dynamic ip, behind a DNS router

Trying to configure exim to deleaver email to the outside world. I/We need to send email outside just for centralize certain admin notifications. Working on an already configured debian webserver, ...
2
votes
2answers
179 views

Why isn't the Iptables persistent service saving my changes?

I followed this tutorial to set up IP rules on ubuntu 12.04. Everything worked fine on setup -- but now I've made changes to the firewall that do not persist upon reboot. I do not understand why that ...
3
votes
1answer
93 views

Settings when using a bridge

I have a bridge set up between my physical Ethernet interface, eth0, and the virtual interface for OpenVPN, tap0. The bridge has an IP address, and the machine can be contacted on that IP address from ...
1
vote
1answer
31 views

What is the meaning “MAC MISSMATCH”? [closed]

I have every day in the log the few lines start with: MAC MISSMATCH:IN=vlanXX OUT= MAC=ff:ff:ff:ff:ff:ff:bc:ae:c5:da:70:a6:08:00:45:00:00:4e SRC=xx.xx.xx.xx DST=xx.xx.255.255 LEN=78 TOS=0x00 ...
2
votes
2answers
74 views

Are there ways to break into a machine if iptables drops all traffic?

Say I install Linux on an blank computer (no other OS, disk is formatted for installation), and I configure this in iptables: iptables -F iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P ...
1
vote
0answers
23 views

How can I use iptables to block certain processes from accessing the network? [duplicate]

I can set the processes to run under special uid's and use the technique from this SF answer: -A OUTPUT -m owner --uid-owner 400 -j DROP ...But are there any other ways to blacklist based on the ...
4
votes
1answer
94 views

Debian Wheezy subnet configuration (proxy, MASQUARADing etc.)

I have a "server" with eth1 having a full IP address, DNS, gateway and proxy name connected to the university internet/intranet provider and eth0 IP 192.168.1.2 connected by a gigabit switch with two ...
2
votes
1answer
1k views

What -A INPUT -j REJECT --reject-with icmp-host-prohibited Iptables line does exactly?

What do the following lines do? I have been reading redhat iptables documentation but can't figure it out. ... -j REJECT --reject-with icmp-host-prohibited ... -j REJECT --reject-with ...
1
vote
1answer
150 views

rtorrent: 'Tracker Timeout' caused by IPtables

I'm trying to secure my rtorrent-running-homeserver with IPtables. With the aim to allow only incoming connections to the rtorrent port 6890 and 5292 for ftp (both are forwarded by the router), I ...
1
vote
1answer
104 views

Masquerade not working sometimes

I have an issue with private network traffic not being masqueraded in very specific circumstances. The network is a group of VMware guests using the 10.1.0.0/18 network. The problematic host is ...
0
votes
1answer
29 views

Simple iptables filter rule for 101/8 block not working

I run a webserver that caters to an entirely local crowd, so to keep hacking attempts to a minimum, I have inserted a bunch of international IP-blocking rules into my iptables, but my filters don't ...
3
votes
1answer
95 views

Configure iptables on remote server without locking me up

I have a little remote server that I can access only with SSH, and what I want to do, is block all the traffic except port 22 for SSH. The first time, what I did was : iptables -P INPUT DROP And ...
0
votes
1answer
67 views

Blanket blocking SMTP with whitelist

So using a VPS environment, whereby we need to block outbound SMTP by default (spammers), with the ability to unblock when needed. We have found some scripts eg: iptables -I FORWARD 1 -d $VPS_IP -p ...
0
votes
4answers
71 views

Linux routing tables

I'm trying to learn Linux routing tables and ran into bit of snag. In the example below I'm not sure what is happening. My understanding is 0.0.0.0 means that for line 1 and 2 any packets outside of ...
3
votes
2answers
277 views

iptables multiple -d flags not allowed

I am trying to log all my outbound connections to a file using iptables. This is my rule: -A OUTPUT ! -o lo ! --destination 127.0.0.1 -m state --state NEW -j LOG --log-prefix "new_connection " ...
2
votes
1answer
161 views

Bad argument `127.0.0.1' in iptables

-A OUTPUT --destination ! '127.0.0.1' -m state --state NEW -j LOG --log-prefix "new_connection " --log-level 7 gives me Bad argument `127.0.0.1' What am I doing wrong? I used this docs : ...
1
vote
1answer
72 views

tcp/ip - trigger action or event after period of no network activity on certain port(s)

Is it possible, perhaps using iptables or one of the wrappers/frontends to iptables, to trigger an action or run a script after a certain period of time has elapsed with no network activity on a ...
0
votes
1answer
287 views

Socket Connection Refused (raspbian) but ports are open for connections

I'd like to establish a connection between my client and raspbian. Within my network, I can connect to my service at any time without any problems. Now I want to connect to my service via the ...
1
vote
2answers
64 views

iptables ignores other rules after add last rule

I have written these rules in iptables: -A FORWARD -i eth1 -o eth0 -p icmp -m limit --limit 1/hour --limit-burst 5000 -j ACCEPT -A FORWARD -i eth1 -o eth0 -p udp -m limit --limit 1/hour --limit-burst ...
1
vote
1answer
61 views

How to see content of dropped packages at OUTPUT chain in iptables

iptables is as below: # iptables -t filter -nvL Chain INPUT (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 ...
1
vote
1answer
83 views

iptables adding rules in OUTPUT chain

We can insert iptables rules based on IP/Network/Hostname: iptables -t filter -A OUTPUT -p tcp -d www.google.com -j ACCEPT -m comment --comment "www.google.com" It is not accepting: iptables ...
1
vote
1answer
68 views

FTP download problems with iptables — Port 21 connection is allowed but “Network is unreachable”

I'm trying to connect to an FTP site but with, e.g., wget: Logging in as anonymous ... Logged in! ==> SYST ... done. ==> PWD ... done. ==> TYPE I ... done. ==> CWD (1) /gcrypt/gnutls ...
0
votes
3answers
62 views

iptables rules - input and output

I'm new with Linux and iptables. I have a Ubuntu Server distro (12.04) on a PC which has 2 network interfaces (eth0 and eth1). I also have 2 laptops, one is plugged to eth0 and the other to eth1. ...
2
votes
1answer
218 views

Bad built-in chain name with iptables-restore

I saved my iptable settings on a Ubuntu 11.4 system using iptables-save >filename I then replaced the Ubuntu system with CentOS 6.5 and tried to restore iptables using iptables-restore ...
1
vote
2answers
58 views

What network protocols do database servers use?

I have a postgres 9.1 server running on the default port 5432 on an ubuntu 12.04 cloud server. I want to open up the port so I can make remote queries -- but I have to open the port on IP tables, ...
0
votes
1answer
81 views

SSH E-mail login alert if SSH port is as NAT

Can you help me with this problem please? How can I set e-mail alerting after SSH login when port 22 is NATed? I use Linux Debian 7. I have used these iptables rules: eth0 - external network, eth1 - ...
1
vote
1answer
104 views

Why aren't my iptables rules appearing in the relevant list after reboot?

I am trying to write two persistent NAT rules, which I save via iptables-save > /etc/iptables.ipv4.nat, and restore upon reboot via pre-up iptables-restore < /etc/iptables.ipv4.nat in my ...
1
vote
0answers
307 views

How to redirect tun SSL VPN through HTTP CONNECT proxy, using iptables?

I use a VPN under SSL solution (Firepass) on Android. VPN opens an SSL connection on port 443 of remote VPN server. My mobile carrier doesn't allow direct connections on port 443 but allow SSL ...
1
vote
1answer
84 views

Is this what it looks like in the terminal on the client side when you are blocked out via fail2ban?

I am a new server admin. I just setup fail2ban on an ubuntu 12.04 VPS. I used this tutorial. Then I tried to login to the system via ssh from a friend's machine. It is showing "operation timed out." ...
1
vote
1answer
191 views

High performance routing with high churn ruleset. What approach is most likely to scale to C10K and beyond?

I've been asked to create a high throughput router using PC / server hardware. I'm modestly familiar with pf, iptables, and tc, but I've never had such high churn and so many rules. I hope you can ...
0
votes
0answers
218 views

iptables: how to redirect outgoing, public ip traffic to localhost:6666, not touching private ips

I want all outgoing to traffic that is directed to a private IP (10.0.0.0 - 10.255.255.255, 172.16.0.0 - 172.31.255.255, 192.168.0.0 - 192.168.255.255) to be untouched. I want all other traffic ...
0
votes
1answer
64 views

iptables correctness verification

I have so many questions around iptables and how it works. But we're using a modified kernel, and hence whatever experiment I try and fail, I can't be sure if it happens with Linux in common or just ...
0
votes
1answer
131 views

Iptables rule to allow only one port and block others

We have two apps running (on top of linux) and both communicates through port 42605. I wanted to quickly verify if this is the only port that's been used for communication between them. I tried below ...
3
votes
1answer
56 views

Did this tutorial block pings to my server?

I am a programmer teaching myself linux admin stuff. I followed this tutorial to setup a firewall on a VPS. As a part of that tutorial, I block all traffic except for web traffic and SSH traffic. I ...
1
vote
1answer
26 views

Will this open up a non-standard port to ssh?

I am following tutorials on iptable and want to allow ssh traffic on my non-standard SSH port = YYY. I think this is how you do it, but want to double check so I don't lock myself out of my server. ...
0
votes
1answer
51 views

What does the last column in this IP table mean?

From a tutorial, I run $sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT $ sudo iptables -L and get target prot opt source destination ACCEPT ...
0
votes
2answers
117 views

What is the default action for incoming packets that don't match explicit iptables rules?

CentOS 5.x I'd like to understand what is specifically happening to incoming packets that don't explicitly match rules in my iptables chains. Is the default action to reject them? Or drop them? ...
0
votes
1answer
94 views

The Iptables don´t allow update the system [closed]

These rules don´t allow update the system (Debian wheezy on raspberry pi). Don´t allow ping: ping: sendmsg: Operation not permitted. I am trying to install a home web server and this rules don´t work ...
0
votes
2answers
86 views

what process is listening on a given port

I have several problems: some process is attempting to send data and the firewall is rejecting it at the rate it is sending it out firewall logs flood the system (may need to rate-limit the logging) ...
2
votes
1answer
67 views

Forward a host's network traffic to another host with the exception of SSH traffic

I am trying to redirect all the network traffic received in a old host to a different host. For that I created two new rules with iptables on the old host: echo 1 > /proc/sys/net/ipv4/ip_forward ...