iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

4
votes
1answer
228 views

How does a transparent SOCKS proxy know which destination IP to use?

There are two SOCKS proxies that I know about that support transparent proxying for any outgoing TCP connection: Tor and redsocks. Unlike HTTP proxies, these SOCKS proxies can transparently proxy any ...
2
votes
1answer
60 views

iptables, what is truly open?

We have an RSA appliance, I've reviewed the firewall rules on this appliance to determine what ports are enabled. To me, it looks like its wide open; but the vendor states that I am wrong about this, ...
1
vote
1answer
33 views

How to wrap iptables commands around Ruby webrick server going up and down in a single command/script?

I would like to use this Ruby WEBrick server solution for on-demand showcasing of some random web pages. So I set up some forwarding exception on my adsl modem local web interface(192.168.2.1). Then ...
2
votes
1answer
192 views

How to completely block a website like Facebook?

I'm trying to block Facebook access from my home system (Ubuntu). I could add facebook.com to /etc/hosts, but that would only prevent accessing facebook.com. There are many other ways I could use ...
2
votes
2answers
156 views

Is there a specific reason why iptables would return an exit code of 3 (instead of 1?) when executed without sufficient privileges?

I simply forgot to use sudo: usr@arch ~[0] $ iptables -L iptables v1.4.21: can't initialize iptables table `filter': Permission denied (you must be root) Perhaps iptables or your kernel needs to be ...
4
votes
1answer
92 views

Dovecot/Postfix mail server replies to [SYN] with [RST, ACK] when user attempts to connect (POP3). Likely iptables?

Currently I'm trying to troubleshoot an e-mail server that will allow users to send e-mail, but not log in to the server (POP3) or receive e-mail using their Outlook clients. Previously this was ...
1
vote
0answers
18 views

Making sense of this iptables http proxy config

I've never touched iptables before and I'm trying to understand exactly what these three lines do. I have ip_forward switched on and I know the end effect is that all traffic on eth0 is forwarded ...
0
votes
0answers
73 views

iptables rate limit error

This is on centos 6.5, I want to limit number of maximum connections using iptables: iptables -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 15 --connlimit-mask 32 -j REJECT ...
1
vote
1answer
83 views

Can I forward all traffic on a port to a complete different IP address?

Here's my situation. I own a VPS that provides 3 public IPs / public interfaces. let's call these IP address V1 (on eth1), V2(on eth2) and V3 (on eth3) At home, I have a router. The home WAN IP is H. ...
-1
votes
1answer
21 views

iptables fowarding rules

I have an iptables rule in the FORWARD section that looks like this: 17 0 0 CONFIRMED tcp -- * * 0.0.0.0/0 172.16.30.240 tcp spt:587 dpt:587 ctorigdst ...
0
votes
1answer
31 views

What means the numbers besides my default policy chain rules?

I am investigating a potential security issue in one of my system. My firewall tables currently look as, :INPUT ACCEPT [527:57388] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [189:35832] -A INPUT -p tcp -m ...
1
vote
0answers
54 views

Only allow http and SSH traffic

I ran the below. What I expected was to be able to browse websites without issues. No sites work and I have no idea what. When I executed iptables -P OUTPUT ACCEPT it works so I'm assuming I missed an ...
1
vote
0answers
53 views

IPTable rules for transparent outbound proxy

I've recently installed MITMProxy (similar to Squid) which I'm currently using to route outbound HTTP requests from my Ubuntu machine to another server (adding a header along the way). When I use ...
1
vote
0answers
134 views

Setting up a 802.11s mesh network for mobile devices to communicate with a wired server

I'm in the process of developing an android app that maintains a device's connectivity to a linux-based WiFi mesh network, and periodically sends status information (GPS, battery life, etc.) to a ...
4
votes
2answers
84 views

set connection limit via iptables

I want to limit the IP traffic of an application (AceStream Player). The problem is that I get disconnected, if too many IP connections are established. Does anyone know, how to use iptables to limit ...
0
votes
0answers
62 views

CentOS IPTABLES how to block requests from router

I have a CentOS machine that I use in private LAN for development and as file server. I did the following setting to allow httpd, GlassFish, Samba and SSH. Chain INPUT (policy ACCEPT 0 packets, 0 ...
3
votes
3answers
348 views

How to get all IPtables rules

I'm trying to see a list of all the rules in IPtables in a Debian 7 server. when I try: iptables -L -n I only get one rule (which I entered 5 minutes ago). I have many others, for port 80, mysql ...
3
votes
2answers
671 views

set packet rate limit via iptables

I have a packet rate limit (max. 10 per seconds) which is set by my internet provider. This is a problem if I want to use the AceStream player, because if I exceed the limit I get disconnected. How ...
0
votes
1answer
92 views

Isolate subnets on the same interface

I need to isolate Subnets on a linux machine CentOS that act as gateway. I have the following scenario. CentOS eth0 pub ip addres eth0.1 192.168.1.1 eth0.2 192.168.2.1 Now eth0.1 and eth0.2 can ...
-1
votes
1answer
125 views

Fail2ban consuming lot of bandwith

I have a raspberry pi on which I have a nginx and a ssh server, I have installed iptables and fail2ban in order to limit the attempts of ssh connection. The problem is that it seems that fail2ban ...
1
vote
0answers
32 views

NAT-T set up using 3 linux machines

I am trying to have a simple NAT-T setup using 3 linux machines. Linux1 Linux2(NATdevice) Linux3 (eth0) 192.168.1.51 <--->(eth1)192.168.1.80 & ...
1
vote
0answers
119 views

UFW before rules for VPN forwarding

I'm trying to setup an OpenVPN server on Debian 7, following this guide: How to install and set-up OpenVPN in Debian 7 (Wheezy) In step 15 I have to setup forwarding and IPtables rules. I prefer to ...
0
votes
1answer
227 views

IPTABLES comment: No chain/target/match by that name

Faced with error when adding new rule with 'comment': # iptables -I INPUT 1 --source 66.***.***.78 -j REJECT -m comment --comment "Some" iptables: No chain/target/match by that name. Without ...
0
votes
0answers
133 views

Routing incoming source IP traffic to a loopback IP issue

I'm wanting to accomplish the following: I have a BIND DNS server setup where it is listening on ANY address and also listening in a BIND config ACL on 127.0.1.1. If there is another way where you ...
0
votes
1answer
78 views

IPtables don't block IP

I'm running Postfix SMTP server. Some hosts trying to connect with wrong passwords. warning: s15393678.onlinehome-server.com[74.208.17.126]: SASL LOGIN authentication failed: I'm adding iptables ...
0
votes
0answers
14 views

iptables/netfilter behavior if DNAT changes mid-connection

I'm planning to leverage iptables to act as a 'poor-man's active/passive load balancer'. The plan is to have a pair of these rules: -t nat -A PREROUTING -d 10.1.2.3/32 -m condition --condition ...
3
votes
0answers
34 views

Which tool is used to create firewall rules on Fedora 20? [closed]

What is a recommended way to set up firewall rules on Fedora 20/Centos 7/RHEL 7 currently? I know about relatively new replacement of itpables service by firewalld service. Which command-line user ...
2
votes
1answer
292 views

How to measure iptables load?

I have added about 3500 IP addresses to iptables using ufw on a Debian 7 and I am wondering if this has any impact on the performance of my server. How can I measure that?
0
votes
1answer
171 views

CentOS 7 iptables problems and doubts?

I have a CentOS 7 image on VM VirtualBox (bridged Ethernet with static IP) I was trying to set iptables filter table but I have the following problems: Whatever I did to open Apache on port 80 ...
4
votes
2answers
2k views

Whitelist IP's in CentOS 7

I want to setup CentOS 7 firewall such that, all the incoming requests will be blocked except from the originating IP's that I whitelist. And for the Whitelist IP's all the ports should be accessible. ...
0
votes
0answers
71 views

How to bridge the eth0 (ethernet) and eth1 (WiFi_Ap)?

I am in the WiFi test embedded board. The ethernet port eth0 is connected to the Internet. The interface eth1 is caused due to the WiFi chip. The Access Point can be used as a WiFi eth1 is. We use the ...
0
votes
1answer
59 views

Allowing web server communication in Linux firewall

I have a unique situation. Let's say my webserver ( e.g. 10.0.0.2) is connected to eth0 of my firewall (gw 10.0.0.1). A local network (192.168.0.0/24) is also connected to eth1 (192.168.0.1/24) of my ...
1
vote
0answers
44 views

What is the point of the second route lookup after OUTPUT?

According to the packet path diagram, and its description: Table 6-2. Source local host (our own machine) [...] Routing decision, since the previous mangle and nat changes may have ...
0
votes
0answers
40 views

bridge or iptables or route?

iptables vs bridge-utils vs route I have two network cards in a Linux server and don't know how to make them communicate. After searching a lot I still don't know which method is the one that should ...
0
votes
0answers
73 views

Set source address for incoming packets on a server

I'm developing a UDP reverse proxy for a game server, and so far, everything has gone fine except for one thing - getting the backend server to submit requests to the master server list (run by a 3rd ...
1
vote
0answers
61 views

SNAT with firewall-cmd?

I have an interface with multiple IP Addresses (on CentOS 7), which is in zone "external" (with masquerade on). I want to specify that, if a connectiona attempt to a specific address goes out, to use ...
0
votes
1answer
79 views

How to set up a stateful firewall on an am335x Starter Kit board?

In the past, I have used the following script to set up a stateful firewall (on a normal x64 Ubuntu machine) without issue: iptables -P INPUT DROP iptables -P FORWARD DROP iptables -N TCP iptables -N ...
2
votes
1answer
418 views

Forwarding packets from loopback interface with policy-based routing

I have the following iptables rule: iptables -t mangle -A PREROUTING -p udp -m udp --dport 10000 -j MARK --set-xmark 0x4/0xffffffff which sets fwmark 4 on all udp packets with destination port ...
1
vote
2answers
837 views

ping: unknown host with iptables enabled

I can't ping www.google.com. However I can ping the IP address: ping 74.125.237.142 At first, I thought it is a problem with my DNS settings. But I checked my resolv.conf, hosts, and hostname ...
1
vote
0answers
115 views

Iptables and --tcp-flags

If I have the following rule in the nat-table in the prerouting chain: 0 0 REDIRECT tcp -- eth5 any anywhere anywhere tcp flags:FIN,SYN,RST,ACK/SYN redir ports ...
3
votes
2answers
1k views

Tunnel yum traffic through another server via ssh

I am running a Fedora desktop behind a corporate proxy that is blocking yum traffic (specifically *.gz and *.bz2). I have access to a separate RedHat machine via ssh which can download anything it ...
1
vote
0answers
168 views

Forward multicast between two LAN segments (Chromecast)

I've found some rules but most are inconclusive. Chromecast uses DIAL and discovers via multicast from what I've understood.. I have an Ethernet-connected computer which I would like to route via my ...
1
vote
0answers
36 views

Is iptables -p proto -m proto redundant?

I keep seeing "-p tcp -m tcp" all over the place, but it looks redundant. Why the '-m' if the '-p' already matches the protocol?
1
vote
1answer
55 views

How to map IP by iptables ?

I create a network namespace In this namespace, I open a nginx So for now, I can visit web server by 172.17.0.2 What I want to do is mapping this IP to 127.0.0.1 Lets say if I visit 127.0.0.1, I ...
0
votes
0answers
135 views

Iptables and Ip6tables redirect traffic

I want to deny all the network traffic and just allow a few ports and redirect them through tor or the socket I have set in /etc/tor/torrc, where tor binds to. And I am currently setting up these ...
1
vote
0answers
43 views

How do I write the rule that has an edge server forward a clients request to an internal network server and back?

I have a network situation as follows: -server1:1.1.1.1 -server2:2.2.2.2 -tunnel 10.8.0.0/24 -client: 3.3.3.3 I'm trying to have client IP 3.3.3.3 do an HTTP request from the 1.1.1.1 server. ...
2
votes
1answer
171 views

iptables routing incoming IP to another destination IP question

I have a test setup: server1:1.1.1.1 server2:2.2.2.2 client: 3.3.3.3 I'm trying to have client IP 3.3.3.3 do a HTTP request from the 1.1.1.1 server. However I want the 1.1.1.1 server to pass this ...
1
vote
1answer
33 views

Does -o and -i make sense when the target host is already connected to the interface specified?

iptables -A FORWARD -s 192.168.20.7 -d 10.10.48.3 -p tcp --dport 25 -o eth1 -j ACCEPT iptables -A FORWARD -s 10.10.48.3 -d 192.168.20.7 -p tcp --sport 25 -i eth1 -j ACCEPT Tuning the firewall of my ...
6
votes
1answer
79 views

Setting traffic class on return packets

I have a network topology: Server <-> router1 <-> router2 <-> router3 <-> edgeRouter <-> "internet" All routers are linux based, and support iptables. The server sets ...
0
votes
0answers
99 views

Sabayon: UFW blocking all incoming connections, although default policies are set to “Allow”

I have the following problem with ufw/iptables: When I start/reboot my computer, ufw fails to load: # ufw status Status: inactive I did enable it: # systemctl enable ufw Still I do have many ...