iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

0
votes
1answer
75 views

Redirect https request on local network

I'm trying to implement a local web server that handle all the http requests. Basically, when a user connect to the network and open an url, he is redirected to my local web server. I'm using dns ...
1
vote
1answer
55 views

lxc container <-> external internet, what I missed?

I have Ethernet on my machine (enp0s10) that connected to real network, and I have lxcbr0 Ethernet bridge which gather lxc containers. And I want to make available one of lxc containers. So I wrote: ...
1
vote
0answers
30 views

Why does a connection from my LAN to my public IP address fails?

I have an OpenVPN server on server. It is available from Internet via a two NATs: first the ISP box relays to 192.168.0.10, then 192.168.0.10 relays to 10.10.10.254 (relays = DNAT). I can connect ...
2
votes
1answer
127 views

Redirect secondary network interface traffic along with port forwarding to tun0 (OpenVPN) using iptables

I have a NAS server which I should do port forwarding for it in order to make its services accessible from internet. However my ISP is blocking ports, so I've managed to buy myself a cheap Ubuntu VPS ...
1
vote
1answer
21 views

What order of iptables rules to use for specific SRC IPs?

I would like to block traffic from a specific address during some hours. I use firehol to manage my rules. The following rule does block all traffic during my target hours ACCEPT all -- ...
0
votes
0answers
28 views

Firewall rules: banned localhost

I recently had an issue with a server that was refusing local connections. I was doing some wget domain.com/somePath. And while the resolution was correct and returned the right EXTERNAL_IP, the ...
0
votes
1answer
35 views

iptables REJECT icmp-admin-prohibited

The iptables man page says: Using icmp-admin-prohibited with kernels that do not support it will result in a plain DROP instead of REJECT I have been unsuccessful at finding out at which kernel ...
1
vote
0answers
16 views

OpenVPN maintain connection state during tunnel reconnect

Sometimes I want to do a short maintenance like restarting a tunnel, all connection running on top such as file transfer...etc will receive connection lost signal, is it possible to maintain those ...
0
votes
1answer
61 views

NAT for second interface on private network

I have the following configured for my two network interfaces. eth1 10.93.90.1 (Production Network) eth0 192.160.0.1 (Private Network/Labb Network) I want to configure eth0 with NAT so I can ...
0
votes
0answers
22 views

RHEL Jenkins email notifications failing

RHEL Server release 6.7 (Santiago) I know there have been multiple questions about this on SO (none of which have helped me solve my problem), but I think my problem pertains to Linux more so than it ...
1
vote
0answers
43 views

How to prevent responding to arp scan requests from outside (except the router) in ubuntu?

How do I prevent my computer from responding to arp scans in my network? A solution using iptables or something similar is very welcome. The network interface is wlan0. Some malicious users are ...
4
votes
0answers
20 views

Routing policy is not working

I have an Access Point with OpenWrt. On other host of the same LAN there is a squid (IP Address 192.168.80.148). I'd like to route packages with destination port 80 to 192.168.80.148. So I have root@...
4
votes
1answer
78 views

How to redirect web traffic to specific host with iptables

I want to be able to redirect a host in my Lan to an specific ip address and port. I can achieve one thing which is that only my desired host can access the ip address, but I can't get the user to ...
4
votes
0answers
167 views

iptables and ip forwarding for failover

hi i have an ethernet nic interface with 4 additional virtual interfaces (failovers) all configured with public ip4 (IP-1 to IP-5) / netmask 255.255.255.255 / broadcast addr same as ip: eth0 -...
1
vote
0answers
54 views

Automatically manage whitelisting (e.g. in tinyproxy) of dynamic IPs?

I have a VPS that runs tinyproxy for private use, and another that runs nginx for development. Is there a protocol/daemon that I can use to automate whitelisting for my dynamic IP? So that tinyproxy ...
1
vote
1answer
132 views

How to block broadcast messages (Apple's mDNS traffic)

I am in a network and a user is sending broadcast messages on udp port 5353. Regardless of what that is and what their purpose is, I decided to block all the traffic, so I ran: sudo iptables -A INPUT ...
1
vote
1answer
147 views

What am I doing wrong when trying to open port 8080 on iptables using Ubuntu?

I'm trying to open port 8080 so I can use a web panel application (McMyAdmin) I have installed on my Ubuntu server. I'm rather new to Linux / SSH in general but I'm getting there thanks to various ...
1
vote
1answer
41 views

unmanaged vps centos6.4 need to open port 20/21

I brought an unmanaged vps which is running Centos 6.4 and the only port which was open was 22. I need help opening port 20 and 21 so I can ftp, but every time I try to it won't save and let me login ...
0
votes
2answers
42 views

Count Bytes by Ports

Using RHEL/CentOS 6.7 -- I want to be be able to know byte counts on IPv4 ports. We have thousands.. I would think counting via IP Tables for that would be a bit unweldy and slow the firewall a wee ...
1
vote
1answer
63 views

Iptables rules doesn't work as expected

I need to block access to my server from the outside of my private network. I need to allow pings from my server out only to my private network and answer pings initiated from my private network as ...
1
vote
0answers
39 views

How to not going through openvpn tunnel for a specific port

After long hours of digging and many tries I still cannot figure out how to not have a traffic on a given port going through the openvpn tunnel. Below my setup: (enp0s25)<ovpn server>(tun0) <...
1
vote
0answers
70 views

How to block access to “private” host-only network from VirtualBox nat interface (separate host-only networks)?

Scenario: 1 VirtualBox host with many vms. Different host-only networks are configured for different vm categories: Some vms are "private", others are "standard" vms. Most of these vms, including some ...
2
votes
1answer
40 views

How do you block a port on your loopback?

I am doing some testing and want to be able to test situations where my database goes down. Its running on the same box as my tests, and it appears that things like the following are not doing the ...
0
votes
1answer
53 views

ip tables by route command and iptables's table by iptables command, is the same?

There are two command : route, and iptables. Both of it have a/many tables: route tables and iptables's table. Does those two kind of tables describe the diffrent thing, or iptables can also be ...
0
votes
1answer
33 views

iptables - How to allow all connections to the local lan?

What's the simplest way to express "allow all connections to the local lan" for iptables output? Including connections to 192.*, 172.*, 10.*, etc. Can all of this compressed within a single rule?
0
votes
0answers
27 views

Setting up VPN on Linux

I have problems setting up networking on my laptop over VPN. I need to connect from my home to VPN which has the same IP address space as my home network. My network: 192.168.0.0/24 Other side of ...
0
votes
1answer
27 views

Can't access webmin due to iptables missconfiguration

I installed webmin, but I cant access it because iptables blocks the connection. I have added the chain that webmin suggests right here: http://www.webmin.com/firewall.html This is the result of ...
0
votes
0answers
13 views

Adding IP Blocklists to OSSEC

I've been reading through some documentations for OSSEC trying to learn some new tricks and such to make it more effective, and what I got really interested was looking into was seeing if it's ...
1
vote
1answer
105 views

IP forwarding through ssh tunnel

The situation involves 3 machines: A. Some laptop connected somewhere to the internet via any mean B. A server connected to the internet through a standard ISP (static IP provided by dyndns: ...
1
vote
1answer
40 views

Is it possible to save iptable rules that have a name for destination instead of IP?

For instance, I have the rule #iptables -A OUTPUT -d www.google.com -j ACCEPT When I type this rule in a terminal it resolves to the appropriate IPs, and that is what is stored in rules.v4 when I ...
3
votes
1answer
234 views

Debian-Jessie: How do you check iptables status?

In old sysvinit I would just do service iptables status and see if it was running or not. But in newer Debian-Jessie I grep for iptables in the list of services and don't see iptables listed anywhere....
4
votes
1answer
71 views

Unable to get NAT working via iptables PREROUTING chain

So, not concerning ourselves with the WHY, and more so with the HOW, I'd like to see if anyone knows where I'm going wrong here. Basically, I'd like to forward all packets headed for port 80 on an IP ...
0
votes
2answers
49 views

Block IP if it connects to port 22

How can I effectively (so do it fast when talking about firewall level and can do it with many-many IP's) block an IP address for a given time, ex.: a month if it tried to contact port 22 TCP in any ...
0
votes
1answer
117 views

redirect to localhost using iptables

I'd like to redirect the outgoing traffic (whether coming from localhost or elsewhere, as the machine is a gateway) going from 192.168.0.2:80 to localhost:80. I've tried setting this rule in the nat ...
1
vote
0answers
38 views

Redirect the traffic of one port to one chain with iptable?

I am very sorry for that I can't describe the title more concretely. I would appreciate if someone can give a better title than mine. On the raspberry Pi, I install the privoxy and a socks proxy ...
1
vote
3answers
95 views

preventing DoS attack in Apache webserver

This is the version of apache we're using - httpd-2.2.15-39.el6.centos.x86_64 We recently had our website down due to DoS attack and hence started exploring iptables, and how to use it to prevent DoS ...
0
votes
0answers
51 views

iptables Dynamic SNAT, how to force to use different src ip from pool?

Requirement: I need to translate a private-ip range to a public-ip range while going out on the internet. It should be a one-one mapping, if public-ip range exhausts it should drop to the next nat ...
-2
votes
1answer
28 views

Execute command with specific routing (ip/iptables)?

I saw great solution for binding application based on some routing table alias... not sure now what it was, but for sure with ip, route or iptables tools... anybody knows the procedure? What was the ...
0
votes
0answers
152 views

Iptables Port Forwarding is not working for Host Only Network. What am I doing wrong?

Host OS Ubuntu with live(public) IP address 1.2.3.4 . And a Ubuntu VM running in Virtual Box with Host Only and NAT network configuration. Configuration of both network cards are according to this ...
1
vote
1answer
101 views

iptables rule explanation

I was looking to update iptables in our webserver which would prevent DoS attack to an extent. 1) Related to web traffic, below are the iptables rules i found. iptables -I INPUT -p tcp --dport 80 -...
0
votes
0answers
86 views

Which iptables chain does a new stream created by TEE go to?

Where do packets go after being created by the TEE target? I am working on mirroring some traffic that needs to go to multiple computers on my network. So what happens to both streams after using ...
0
votes
2answers
287 views

Routing all traffic from eth0 to wlan0

I have a wifi access point that I'm connecting to through my Raspberry Pi on wlan0. I have a DHCP server setup on my Raspberry Pi to give out addresses on eth0. I have an old router setup attached to ...
1
vote
1answer
105 views

Do I need a return at the end of iptables chain?

This is probably an incredibly basic question, but maybe there's some nuance and maybe it's been hashed out ad inifinitum and I'm oblivious to it. I'm making a suite of custom iptables scripts that ...
1
vote
1answer
46 views

Configuring iptables for incoming static NAT

I got a router with ssh access to it, iptables are there waiting for me. I am trying to map any connection to port 1337 on both WAN/LAN to my computer's port 1337. How do I do that?
3
votes
3answers
445 views

Blocking Websites by days and hours using Iptables in OpenWRT

I want to block Facebook the whole day with the exception of the night. I want to implement that in my Linux-based router OpenWRT. The archive I need to modify is /etc/firewall.user (or at least that'...
2
votes
2answers
151 views

Traffic of specific program through vpn [duplicate]

is it possible to only let the traffic of Deluge through a VPN (OpenVPN) and the other traffic not with iptables? Kind regards
2
votes
0answers
51 views

Why could policy routing on iptables marks applied in FORWARD or OUTPUT chains be inconsistent?

I am routing HTTPS connections down a SSH tunnel (-w) using iptables marks and iproute2 rules, the reasons I need to do it this way are contrived, to say the least, so most alternate solutions may not ...
1
vote
2answers
136 views

Opening port on IPTables not working

I'm trying to get Jenkins running on a RHEL 6 server. Jenkins is installed but not accessible due to firewall rules. If I stop iptables with service iptables stop, I can access Jenkins in my browser ...
1
vote
0answers
56 views

How to limit the number of connections per-host passing through a router/bridge?

For some reasons, our Internet provider has a limitation on the number of simultaneous opened connections between the machines hosted in our private network and the Internet which is around 4000 ...
0
votes
0answers
7 views

Why doesn't iptables show my rule? [duplicate]

I ran the following command to configured NAT: iptables -t nat -A OUTPUT -p all -d 57.5.179.19 -j DNAT --to-destination 127.0.0.1 The rule seems to be working as when I make a request to that IP it ...