iptables allow creation of rules to define packet filtering behavior.
-1
votes
1answer
123 views
need to my server's ip changes when it needs to connect port 'x' on ip 'y'
simple question: "need a way to proxify a port"
I have a linux server and have a proxy server on another machine.
My linux server needs connect to port 'x' on ip 'y'
Is it possible to create ...
3
votes
1answer
269 views
User associated with a socket
I use ss -p to see TCP sockets information. But process info are not printed for some sockets. Below:
$ ss -p4
State Recv-Q Send-Q Local Address:Port Peer Address:Port
ESTAB 0 0 ...
1
vote
2answers
403 views
How would I direct local(127.0.0.1) MySQL traffic to an external SQL server?
Basically, I have two EC2 instances on Amazon Web Services. They are both running Ubuntu 11.10 x64. They both have a private and a public (Elastic) IP addresses. I'm having trouble setting up iptables ...
1
vote
1answer
536 views
IPTABLES to block all outgoing connections except selected networks
There is a firewall/gateway machine with eth0 Public and eth1 Private network (192.168.1.0).
I would like to block all OUTPUT connections for private users (eth1)
except couple of networks like: ...
2
votes
2answers
268 views
Is xinetd still the best method to let non root daemons listen on privileged ports?
When I need to use SNMP monitoring for java applications, there is the need to that application (usually ran as daemon user) to listen on snmp port.
If there is no other alternative, of course I can ...
1
vote
1answer
124 views
iptable rule to redirect only https handshake?
I was reading this interesting article today: http://www.moserware.com/2009/06/first-few-milliseconds-of-https.html
A crazy thought came to mind...Is it possible to write an iptable rule that only ...
2
votes
0answers
323 views
Iptables - modprobe: FATAL - Fail2ban random restarts
I have been running fail2ban on my server for a while without any problems but have recently seen fail2ban restart randomly. After some looking in my logs I noticed that the restarts occur when ever ...
8
votes
4answers
470 views
iptables on tor exit node
I want to run an open Tor router.
My exit policy will be similar to ReducedExitPolicy.
But I also want to make it hard for the tor network to abuse my resources.
Cases I want to prevent clients ...
1
vote
1answer
432 views
Port Mirroring in Fedora?
I have set up an application that listens constantly to a port for network packets, and I would like to create another one that receives the same network packets ( for use as a test bed). Getting the ...
1
vote
2answers
1k views
Remote SSH login not working
I have a PC behind a router with port forwarding setup Port 22 for SSH which works perfectly - I can login and everything. What I am trying to do is let this PC connect to a VPN and only allow ...
2
votes
3answers
3k views
Restrict bandwidth with DD-WRT
I have DD-WRT installed on my router and I would like to be able to restrict the bandwidth both up and down on a certain IP or Mac address. I am happy to get my hands dirty and use console.
I am sure ...
5
votes
2answers
2k views
Per process firewall?
I've been reading around but can't seem to find a way to create per-process firewall rules. I know about iptables --uid-owner but that only works for outgoing traffic. I've considered scripting ...
0
votes
1answer
551 views
How can I Forward a subDomain to a specific port?
My apologies if this has been asked before. I haven't found an adequate solution so... yeah.
When a specific domain, "example.com" is accessed, I want it to act normally. In other words, it should go ...
5
votes
2answers
2k views
iptables, how to redirect port from loopback?
The main rules are:
OUTIF=eth0
/sbin/iptables --policy INPUT DROP
/sbin/iptables --policy FORWARD DROP
/sbin/iptables --policy OUTPUT ACCEPT
/sbin/iptables -A INPUT -i lo -j ACCEPT
...
1
vote
1answer
1k views
Port Mirroring using iptables - copy all traffic among nginx on :80 and apache on :8080
I have nginx running on port 80 and apache running on port 8080
I want to transfer all the traffic to both nginx and apache asynchronously i.e the performance of one server wont be dependent on the ...
2
votes
1answer
510 views
Will the Firewall GUI in CentOS overwrite changes implemented by IPTABLES manual edits?
I would like to restrict access to the SSH port of a new CentOS 6.2 server to select IP addresses but the Firewall GUI utility seems to be an all-or-nothing scenario. Either the port is firewalled or ...
1
vote
1answer
154 views
How can I use the same IP from the Internet and intranet?
I have an Ubuntu firewall box (Alma), at the office, with a web server on it. It looks like this:
[Internet] <-> [DSL Router] <-> [Alma]
|
...
2
votes
1answer
527 views
Need to access port on LAN through IPTABLES firewall on static IP interface
I have a Linux firewall with 3 NIC's. Eth1 is my LAN's default gateway and has IP address 10.1.2.250 and is connected to my LAN with IP range 10.1.2.0/24. Eth2 has IP address of 10.0.0.6 and gateway ...
1
vote
1answer
217 views
portsentry and IPTables on constant reboot, but not sure why
I have been doing some hardening on a new server [ centos 5.7 final ]
i also have logwatch and seem to be getting these strange logs
Commands Run:
User root:
/sbin/service portsentry restart ...
3
votes
2answers
515 views
Need help with routing
I have set up a Ubuntu server, that I want to use as a router for my local office.
The problem is, that I want to make 2 VPN connections, to remote branches, and then I want to route all traffic to ...
2
votes
1answer
5k views
Fedora 16 - Iptables installed, but no iptables service available
I'm trying to open ports on my fedora OS.
In the past, this was as easy as adding an rule like
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
I went to restart my iptables ...
4
votes
6answers
4k views
iptables to block https websites
I wish to block a few websites that also run upon https, like facebook, twitter, and gmail, in my organization. Squid is not supposed to be used here as per the orders from higher management. We can ...
2
votes
3answers
826 views
Blocking outgoing connects with iptables
I have a (non production) machine where external supporters have shell-access (non-root). I want to prevent them from going further on into our network from that machine using iptables.
The "normal" ...
6
votes
2answers
289 views
Does Fedora's firewall use iptables?
Fedora has a Firewall Configuration interface:
Does this use iptables underneath to enforce the rules?
4
votes
2answers
166 views
Why were tables built into ipchains?
Why are tables built into ipchains? What was the benefit of adding tables to ipchains? Is there a simple scenario that would illustrate how tables are used to increase performance or offer some other ...
1
vote
1answer
358 views
How can I move firewall settings from one Debian Squeeze web server to another?
I configured a Debian Squeeze virtual machine in VMWare on my laptop. I configured it with a very restrictive set of firewall rules using Firestarter. I then uploaded a copy of its disk image to use ...
1
vote
2answers
591 views
Iptables GEOIP not working under Debian Squeeze
I've just installed xtables-*, compiled the geoip database, but when I try to use an iptables command it always gives back the following error:
Command:
iptables -I INPUT -p tcp --dport 80 -m geoip ...
2
votes
1answer
335 views
iptables rule for limiting bandwidth in given time
Under Linux/iptables how can I limit the bandwidth in given time? ex.: don't limit the connection speed from 22h to 06h, but limit it from 06h to 22h, ex.: the max speed would be only 1Mbit/second! ...
4
votes
1answer
1k views
Why doesn't my iptables rule work?
I have two interfaces on my VPS: eth0 and eth0:0. I want to block incoming packets on port 80 on eth0:0 using iptables. I tried this, but it doesn't work:
iptables -A INPUT -i "eth0:0" -p tcp ...
1
vote
1answer
381 views
Allow Windows file share through a Linux Firewall
I'm struggling to enable NTFS share between two Windows (XP and 7) hosts through a Linux firewall.
Here's my setup:
[XPMachine-LAN1]---------->[LINUX FIREWALL]---------->[Win7-LAN2]
What I ...
2
votes
0answers
527 views
tunneling FON traffic via Tor
I would like to tunnel the traffic of my FON router through Tor.
For that I added a second network card to a local server and connected the FON router to it. Then I set up a DHCP server and configured ...
2
votes
1answer
470 views
What does this iptables entry mean?
iptables-save output:
*filter
:INPUT DROP [2929:172650]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [74596344:6265371965]
These are the opening lines of the iptables-save command. What do the numbers in the ...
1
vote
2answers
711 views
Checking the type of NAT
I have read that there are many types of NATs available like symmetric NAT, full-cone NAT, etc. If I am behind a NAT, is there any way to find out the type of NAT behind which I am currently working ...
7
votes
1answer
3k views
Why are incoming packets on a TAP interface seen with tcpdump but not with iptables?
A program injects packets on a Linux TAP interface (these packets are coming from a virtual machine). Specifically, these are DHCP requests (so they're UDP). I can see the packets with tcpdump but not ...
4
votes
1answer
627 views
Force VPN using IPtables?
I want to force the use of VPN using iptables, therefore while VPN is disabled no outgoing traffic shall be allowed (except maybe some DHCP stuff...). Now i guess I could just block everything not ...
4
votes
1answer
2k views
Difference between SNAT and Masquerade
I am confused what's the actual difference between SNAT and Masquerade?
If I want to share my internet connection on local network than whether should I select SNAT or Masquerade?
Give me some ...
5
votes
2answers
981 views
How to restrict internet access for a particular user on the lan using iptables in Linux
Let's say there are two users on the LAN, A and B. How do I restrict user A from internet access using iptables rules and saving the rules so that after reboot, they are still effective. And suppose I ...
4
votes
3answers
1k views
IPTables and transparent proxies
I have set up a local, transparent TCP proxy on localhost. I want to redirect ALL TCP traffic to this proxy, so it can handle it and nothing "leaks out," circumventing the proxy. I need to use ...
6
votes
2answers
5k views
Output traffic on different interfaces based on destination port
My question is basically the same as Only allow certain outbound traffic on certain interfaces.
I have two interfaces eth1 (10.0.0.2) and wlan0 (192.168.0.2).
My default route is for eth1.
Let's say ...
2
votes
1answer
323 views
Why should the ECN on your machine be disabled?
I was going through this article on iptables and there the author said that:
It's important to turn off ECN (explicit congestion notification) so
that Internet communications will work ...
-1
votes
1answer
2k views
What is sport and dport?
I want to stop internet on my system using iptables so what should I do?
iptables -A INPUT -p tcp --sport 80 -j DROP
or
iptables -A INPUT -p tcp --dport 80 -j DROP ?
2
votes
1answer
767 views
iptables rule to allow access to internet
I made default policy of my machine-
iptables -A INPUT -j REJECT #DROP ALL PACKETS TO INPUT CHANNEL
INPUT channel has been blocked. Now I want to allow only some specific services like I should be ...
5
votes
4answers
464 views
How can I send spoofed packets in Linux
In order to test a firewall, I want to send malformed packets to its interface, regardless of my routing table.
Is there a way to ask linux "send this exact tcp package, to this MAC address, ...
2
votes
0answers
310 views
Why are packets not moving forward? [closed]
I have a server with forwarding turned on. I placed an iptables LOG target in the PREROUTING, INPUT, and FORWARD chains of the mangle table. I can see the LOG messages from PREROUTING, but not INPUT ...
4
votes
4answers
3k views
Set some firewall ports to only accept local network connections?
Basic firewall question:
How do I set up the firewall on a system in a LAN so that some ports are only open to connections from the local area network, and not from the outside world?
For instance, ...
2
votes
1answer
1k views
Why does iptables still block my samba?
I'm currently fighting with iptables and samba.
I read that samba needs ports 137-139 and 445 open on both tcp and udp.
Here is the relevant part of my iptables config
...
# forward valid incoming ...
2
votes
2answers
514 views
use iptables to allow incoming connections to some computer on port XYZ?
This is what I have: iptables -i em1 -A INPUT -j ACCEPT -p tcp --dport 9001 -v. If I want to accept incoming connections on port 9001 at this (127.0.0.1, or on the network 192.168.1.143) address, ...
3
votes
4answers
1k views
How to share the internet connection?
An ordinally network topology in picture:
In words:
- "server" (e.g.: an Ubuntu 10.04 LTS) is connected to the "internet" through pppoe connection
- "server" is using it's wireless card in AP ...
2
votes
2answers
2k views
How to redirect kernel messages having the unique id substring into separate log file (using `rsyslog`)?
I am using iptables's logging feature to debug my network activity. I use certain prefix with --log-prefix parameter to uniquely identify messages in kernel log belonging to iptables output, for ...
4
votes
1answer
1k views
Is it possible to redirect a logging output of the iptables' LOG chain into a separate log file?
I don't want to mix iptables's log output with other system logs. How could I specify a dedicated log file for iptables LOG chains output?
