iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

4
votes
1answer
2k views

multigateway routing for specific src port

I have two gateway to access internet, somehow I want to load balancing it, so far its working, but some connection or service need persistent gateway IP to be used, so the client should never change ...
4
votes
1answer
36 views

Dovecot/Postfix mail server replies to [SYN] with [RST, ACK] when user attempts to connect (POP3). Likely iptables?

Currently I'm trying to troubleshoot an e-mail server that will allow users to send e-mail, but not log in to the server (POP3) or receive e-mail using their Outlook clients. Previously this was ...
4
votes
0answers
38 views

Setting traffic class on return packets

I have a network topology: Server <-> router1 <-> router2 <-> router3 <-> edgeRouter <-> "internet" All routers are linux based, and support iptables. The server sets ...
4
votes
1answer
66 views

Is there any difference between these two configuration options?

Is there any actual difference between iptables -P FORWARD DROP and net.ipv4.ip_forward = 0 ? I know that one is a firewall command while the other one is a kernel option. But: I don't know ...
4
votes
2answers
1k views

Port fowarding and load balancer in ubuntu server 12.04

I am looking to create a load balancing server. Essentially here is what I want to do: I have a public IP address, lets say 1.1.1.1 I have a second public IP address, lets say 2.2.2.2. I have a ...
3
votes
3answers
834 views

Undo iptables modification

I ran the following iptables commands to create a blacklist rule but used the wrong port: iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH iptables -A INPUT -p tcp ...
3
votes
3answers
205 views

How to get all IPtables rules

I'm trying to see a list of all the rules in IPtables in a Debian 7 server. when I try: iptables -L -n I only get one rule (which I entered 5 minutes ago). I have many others, for port 80, mysql ...
3
votes
2answers
593 views

iptables multiple -d flags not allowed

I am trying to log all my outbound connections to a file using iptables. This is my rule: -A OUTPUT ! -o lo ! --destination 127.0.0.1 -m state --state NEW -j LOG --log-prefix "new_connection " ...
3
votes
1answer
1k views

iptables does not list rules i have created

I'm using this guide to set-up a shared internet connection between two PC's. At step 8 it says I should run the commands: iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE /etc/rc.d/iptables ...
3
votes
2answers
510 views

Meaning of log entries from an iptables configuration

My router has Linux as its OS. The system log has a lot of rows about iptable and klogd that I don't understand, could someone explain them to me? The iptables setup: iptables -t nat -A PREROUTING ...
3
votes
3answers
4k views

Blocking outgoing connects with iptables

I have a (non production) machine where external supporters have shell-access (non-root). I want to prevent them from going further on into our network from that machine using iptables. The "normal" ...
3
votes
1answer
651 views

What's the difference between ULOG and NFLog?

Various places suggest to use ULOG or NFLOG instead of LOG for getting dedicated netfilter logging (see for example here or here). From looking at man iptables those two look quite alike. Except that ...
3
votes
2answers
2k views

What is the tun network interface for?

I noticed when running ifconfig that there is a network interface called tun0 and it has an ipv4 address. A bit of research shows that it is a tunneling device, but I don't really know how it's used, ...
3
votes
3answers
2k views

What does this firewall record mean?

Running iptables -L -n gives me the following info: Chain IN_ZONE_work_allow (1 references) target prot opt source destination ACCEPT tcp -- 0.0.0.0/0 ...
3
votes
1answer
5k views

How to re-enable iptables on Fedora 18?

FirewallD is the default firewall in Fedora 18. I have been using iptables for quite some time and have a custom configuration which I need for logging of ip traffic. I am not used to the new ...
3
votes
1answer
207 views

iptables infographic

Is there an infographic somewhere that describes the logical flow of iptables? Specifically, I'm looking for something that diagrams which point in the process ip_conntrack applies.
3
votes
1answer
175 views

Linux App that monitors log and add rules to iptables

I used to use a linux software that monitors logs like http, ssh, etc and if it detects that someone is trying to use brute force, it blocks that ip by adding a rule to iptables. I forgot what that ...
3
votes
1answer
3k views

Using /etc/hosts or iptables to redirect site to https:// version

I'd like to have my system automatically take me to https://facebook.com even if I put http://facebook.com into my browser. I can get /etc/hosts to redirect to me to different domains, but it seems ...
3
votes
1answer
2k views

How to Block SSH Brute Force via Iptables and How does it work?

I'm planning to add the following rules to iptables to stop ssh brute force attack which are common these days. -A INPUT -i eth0.103 -p tcp -m tcp --dport 4522 -m state --state NEW -m recent --set ...
3
votes
1answer
757 views

iptables: multiple exclusions on port forwarding

I have an existing iptables setup that does port forwarding. In this port forwarding scenario there are some instances where I do not want it to port forward. So, for instance I have this defined: ...
3
votes
2answers
2k views

How do I build the iptables kernel module for a loaded kernel?

I've built a kernel with loadable module support for various reasons, one of them the possibility to compile modules and load them without rebooting. This is supposed to be useful when I need a module ...
3
votes
2answers
52 views

How can I determine what program or user connected to a particular port after the fact?

I am examining the egress IPTABLES log of my computer for yesterday and notice the following: IN= OUT=eth0 SRC=192.168.1.1 DST=69.46.36.10 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=12345 DF PROTO=TCP ...
3
votes
1answer
193 views

How to deny access to specific port when destination is NOT a specific host?

I'm trying to DENY access to port 1000 when it is being accessed through any host or IP that is NOT a specific host. I.e. If I try to access the service on sub.domain.com:1000 I should get in. If I ...
3
votes
3answers
920 views

Can't add large number of rules to iptables

I made a very simple bash script (echo at start, runs commands, echos at end) to add approx 7300 rules to iptables blocking much of China and Russia, however it gets through adding approximately 400 ...
3
votes
1answer
204 views

Is there a standard way to configure what policy iptables loads on startup under Debian?

I've just started playing with Debian 6.0 (Squeeze) in a VPS environment, as a way to learn more about system administration. One thing I'd like to configure is a default packet filtering policy. ...
3
votes
2answers
550 views

Block specific IP from accessing gateway

Suppose you are on linux internet gateway/router. What would you do to block a client with specific IP using bash script. I prefer something like ./block_client.sh 192.168.1.123 to block and ...
3
votes
1answer
90 views

How to combine iptables rulesets

Say there are several iptables scripts (run at boot time), all of which run something like iptables -A ... to add rules. I'm thinking this could be improved, turning all those shell scripts into text ...
3
votes
1answer
148 views

Configure iptables on remote server without locking me up

I have a little remote server that I can access only with SSH, and what I want to do, is block all the traffic except port 22 for SSH. The first time, what I did was : iptables -P INPUT DROP And ...
3
votes
2answers
544 views

How do I fix iptables in ChromeOS?

Using the shell in chrosh in ChromeOS I followed some (apparently terrible) advice to flush my IP tables. using the command sudo iptables -F I am now unable to connect to the internet at all. All ...
3
votes
1answer
3k views

What is the difference between OUTPUT and FORWARD chains in iptables?

CentOS 6.0 I'm studying iptables and am getting confused on the difference between FORWARD and OUTPUT chains. In my training documentation, it states: If you're appending to (-A) or deleting ...
3
votes
1answer
330 views

IPtables : Limit number of new ssh connections per minute

I need to ensure on my server that maximum new ssh connections per minute are not more then 5. sudo /sbin/iptables -A INPUT -p tcp --syn --dport 22 -m connlimit --connlimit-above 5 -j REJECT Above ...
3
votes
2answers
476 views

Is it possible to whitelist a specific program in iptables?

Is it possible to allow all traffic for a specific program in iptables? Otherwise using nmap and a strict iptables configuration at the same time seems impossible.
3
votes
1answer
775 views

Changing firewall settings after installation of CentOS via kickstart

I was trying to install CentOS 6.3 via Windows Deployment Server. And to automate the installation process I used kickstart file in which i provided various details required during installation.Then i ...
3
votes
2answers
280 views

What tool to execute a command on repeated syslog entries?

Occasionally, one VPS under my control gets bombarded with POP3 login attempts. They all fail, but the huge number of spawned processes and active connections pretty much amount to a DoS attack. When ...
3
votes
1answer
83 views

Proper way to handle FTP over SSL with restrictive firewall rules?

Without SSL, FTP works fine over a stateful Firewall, like netfilter (iptables) + the nf_conntrack_ftp kernel module like this: # modprobe nf_conntrack_ftp # iptables -A INPUT -m conntrack --ctstate ...
3
votes
1answer
85 views

IPTables rules for specific processes [duplicate]

I have a lot more experience with the Windows Firewall with advanced functionality than I do with IPTables. With the WFAF, I was able to lock down a program so that it could only connect over specific ...
3
votes
1answer
405 views

Settings when using a bridge

I have a bridge set up between my physical Ethernet interface, eth0, and the virtual interface for OpenVPN, tap0. The bridge has an IP address, and the machine can be contacted on that IP address from ...
3
votes
1answer
81 views

Did this tutorial block pings to my server?

I am a programmer teaching myself linux admin stuff. I followed this tutorial to setup a firewall on a VPS. As a part of that tutorial, I block all traffic except for web traffic and SSH traffic. I ...
3
votes
1answer
247 views

listen to a conversation using port forwarding

I have been able to make a phone calls using the SIP client Pjsua from one Linux computer to another one. In case you have not heard of this user agent, explaining it's functionality is quite easy. It ...
3
votes
1answer
2k views

iptables: how to allow traffic from redirected port

I have a web service running on debian 7 and listening on port 8080. I want to redirect 80 to 8080 for inbound connections and allow only port 80. Here is my iptables configuration: root@localhost:~# ...
3
votes
1answer
625 views

Routing through iptables

I have this vpn client that touches the routing table and then keeps watching it to exit if it gets touched. It is the kind of setup needed for an endpoint, such as a laptop. I want to use a small ...
3
votes
2answers
684 views

Need help with routing

I have set up a Ubuntu server, that I want to use as a router for my local office. The problem is, that I want to make 2 VPN connections, to remote branches, and then I want to route all traffic to ...
3
votes
1answer
40 views

Which network services depend on the “accept related input” iptables rule?

Background I am setting up a firewall for a webserver and was wondering if it would be a good security meassure to even reject RELATED input traffic and only except established connections by ...
3
votes
1answer
1k views

I opened a port with iptables but still doesnt work

I have a CentOS installation as a guest VM with VirtualBox. I have two ethernet interfaces, eth0 with NAT and DHCP, and eth1 with Host-only adaptor and static IP. I have oracle installed in this ...
3
votes
1answer
771 views

tc on bridge port

I have a 4 port bridge: root@Linux-Switch:~# brctl show bridge name bridge id STP enabled interfaces br0 8000.000024cd2cb0 no eth0 eth1 ...
3
votes
2answers
528 views

iptables routing marked packets from router to PC and routing them back to router

I'm trying to do deep packet inspection on HTTP packets. The purpose of this is to collect HTTP payload data and then create some proxy/cache-independent reports. Following this, the idea is to ...
3
votes
1answer
2k views

tc don't see marked with -j MARK packets

Server has 2 network interfaces: eth1 with address 13.0.0.254/24 eth0 with address 172.20.203.4/24. It's routing traffic between this two networks. Task is to limit bandwidth between this two ...
3
votes
1answer
396 views

User associated with a socket

I use ss -p to see TCP sockets information. But process info are not printed for some sockets. Below: $ ss -p4 State Recv-Q Send-Q Local Address:Port Peer Address:Port ESTAB 0 0 ...
3
votes
1answer
387 views

1000 iptables entries on CentOS?

I just got a new dedicated server with CentOS and I'm trying to debug some network problems. In doing so, I found over one thousand iptables entries. Is this the default on a CentOS system? Is there ...
3
votes
1answer
3k views

Default mark for packets using iptables

I am trying to set up a QOS script on my Tomato-enabled WRT54G router. The script does the basics of what I need (make sure that a particular machine on my network has lower priority than anything ...