iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

4
votes
2answers
4k views

iptables port forwarding

I have a CentOS server with Java/J2EE(Tomcat) installed on TCP port 8080. I have two interfaces, eth0 and lo. I need to forward all incoming connection on TCP port 80 to 8080. I tried doing the ...
4
votes
1answer
3k views

How can I redirect all traffic except local through external proxy with iptables in dd-wrt?

I have a router with dd-wrt. I have a firewall running to direct all traffic through an external proxy. It works great except that it also redirects local Ips and my proxy does not allow Ips, so I can ...
4
votes
1answer
99 views

iptables change log

Somehow an iptables rule was added to one of my systems. Does (or can) iptables keep a log about when and (maybe) who made a rule change? If iptables itself can't, is there a wrapper that might do ...
4
votes
1answer
482 views

NAT with transparent proxy

is there a way to redirect all non local http requests that through my computer to use my transparent proxy, so i can log all websites are they visiting? and if possible all https requests too.. my ...
4
votes
2answers
1k views

Screen session running as root? (it shouldn't be) node.js

cd /serv screen -R node {in the screen} node test.js C^a d initially, ls -l /dev/pts total 0 crw--w---- 1 tick-tock tty 136, 0 2011-04-19 16:41 0 crw--w---- 1 tick-tock tty 136, ...
4
votes
1answer
2k views

multigateway routing for specific src port

I have two gateway to access internet, somehow I want to load balancing it, so far its working, but some connection or service need persistent gateway IP to be used, so the client should never change ...
4
votes
1answer
92 views

Dovecot/Postfix mail server replies to [SYN] with [RST, ACK] when user attempts to connect (POP3). Likely iptables?

Currently I'm trying to troubleshoot an e-mail server that will allow users to send e-mail, but not log in to the server (POP3) or receive e-mail using their Outlook clients. Previously this was ...
4
votes
1answer
67 views

Is there any difference between these two configuration options?

Is there any actual difference between iptables -P FORWARD DROP and net.ipv4.ip_forward = 0 ? I know that one is a firewall command while the other one is a kernel option. But: I don't know ...
4
votes
2answers
1k views

Port fowarding and load balancer in ubuntu server 12.04

I am looking to create a load balancing server. Essentially here is what I want to do: I have a public IP address, lets say 1.1.1.1 I have a second public IP address, lets say 2.2.2.2. I have a ...
3
votes
3answers
1k views

Undo iptables modification

I ran the following iptables commands to create a blacklist rule but used the wrong port: iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH iptables -A INPUT -p tcp ...
3
votes
3answers
348 views

How to get all IPtables rules

I'm trying to see a list of all the rules in IPtables in a Debian 7 server. when I try: iptables -L -n I only get one rule (which I entered 5 minutes ago). I have many others, for port 80, mysql ...
3
votes
2answers
921 views

iptables multiple -d flags not allowed

I am trying to log all my outbound connections to a file using iptables. This is my rule: -A OUTPUT ! -o lo ! --destination 127.0.0.1 -m state --state NEW -j LOG --log-prefix "new_connection " ...
3
votes
2answers
3k views

What is the tun network interface for?

I noticed when running ifconfig that there is a network interface called tun0 and it has an ipv4 address. A bit of research shows that it is a tunneling device, but I don't really know how it's used, ...
3
votes
1answer
2k views

iptables does not list rules i have created

I'm using this guide to set-up a shared internet connection between two PC's. At step 8 it says I should run the commands: iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE /etc/rc.d/iptables ...
3
votes
2answers
571 views

Meaning of log entries from an iptables configuration

My router has Linux as its OS. The system log has a lot of rows about iptable and klogd that I don't understand, could someone explain them to me? The iptables setup: iptables -t nat -A PREROUTING ...
3
votes
1answer
1k views

What's the difference between ULOG and NFLog?

Various places suggest to use ULOG or NFLOG instead of LOG for getting dedicated netfilter logging (see for example here or here). From looking at man iptables those two look quite alike. Except that ...
3
votes
3answers
2k views

What does this firewall record mean?

Running iptables -L -n gives me the following info: Chain IN_ZONE_work_allow (1 references) target prot opt source destination ACCEPT tcp -- 0.0.0.0/0 ...
3
votes
1answer
5k views

How to re-enable iptables on Fedora 18?

FirewallD is the default firewall in Fedora 18. I have been using iptables for quite some time and have a custom configuration which I need for logging of ip traffic. I am not used to the new ...
3
votes
1answer
215 views

iptables infographic

Is there an infographic somewhere that describes the logical flow of iptables? Specifically, I'm looking for something that diagrams which point in the process ip_conntrack applies.
3
votes
1answer
178 views

Linux App that monitors log and add rules to iptables

I used to use a linux software that monitors logs like http, ssh, etc and if it detects that someone is trying to use brute force, it blocks that ip by adding a rule to iptables. I forgot what that ...
3
votes
1answer
3k views

Using /etc/hosts or iptables to redirect site to https:// version

I'd like to have my system automatically take me to https://facebook.com even if I put http://facebook.com into my browser. I can get /etc/hosts to redirect to me to different domains, but it seems ...
3
votes
1answer
3k views

How to Block SSH Brute Force via Iptables and How does it work?

I'm planning to add the following rules to iptables to stop ssh brute force attack which are common these days. -A INPUT -i eth0.103 -p tcp -m tcp --dport 4522 -m state --state NEW -m recent --set ...
3
votes
2answers
808 views

How do I fix iptables in ChromeOS?

Using the shell in chrosh in ChromeOS I followed some (apparently terrible) advice to flush my IP tables. using the command sudo iptables -F I am now unable to connect to the internet at all. All ...
3
votes
1answer
4k views

What is the difference between OUTPUT and FORWARD chains in iptables?

CentOS 6.0 I'm studying iptables and am getting confused on the difference between FORWARD and OUTPUT chains. In my training documentation, it states: If you're appending to (-A) or deleting ...
3
votes
1answer
806 views

iptables: multiple exclusions on port forwarding

I have an existing iptables setup that does port forwarding. In this port forwarding scenario there are some instances where I do not want it to port forward. So, for instance I have this defined: ...
3
votes
2answers
2k views

What is a solid iptables configuration for my desktop?

On my desktop, I want to configure iptables pretty strictly. I see no reason why I need to allow anything except for internet traffic that I initiated. And maybe even that could be limited to only a ...
3
votes
2answers
2k views

How do I build the iptables kernel module for a loaded kernel?

I've built a kernel with loadable module support for various reasons, one of them the possibility to compile modules and load them without rebooting. This is supposed to be useful when I need a module ...
3
votes
2answers
83 views

How can I determine what program or user connected to a particular port after the fact?

I am examining the egress IPTABLES log of my computer for yesterday and notice the following: IN= OUT=eth0 SRC=192.168.1.1 DST=69.46.36.10 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=12345 DF PROTO=TCP ...
3
votes
1answer
241 views

How to deny access to specific port when destination is NOT a specific host?

I'm trying to DENY access to port 1000 when it is being accessed through any host or IP that is NOT a specific host. I.e. If I try to access the service on sub.domain.com:1000 I should get in. If I ...
3
votes
2answers
2k views

iptables: The “script” way or the “*filter, rules, COMMIT” way?

I'm trying to figure out how NAT and iptables work. While I'm in the trial-and-error phase of learning about it, I found two somewhat conflicting howtos. One howto uses a script to call iptables ...
3
votes
3answers
1k views

Can't add large number of rules to iptables

I made a very simple bash script (echo at start, runs commands, echos at end) to add approx 7300 rules to iptables blocking much of China and Russia, however it gets through adding approximately 400 ...
3
votes
1answer
2k views

iptables/pf rule to only allow XY application/user?

I think there is no iptables/pf solution to only allow an XY application on e.g.: outbound tcp port 80, eth0. So if I have a userid: "500" then how could I block any other communications then the ...
3
votes
1answer
206 views

Is there a standard way to configure what policy iptables loads on startup under Debian?

I've just started playing with Debian 6.0 (Squeeze) in a VPS environment, as a way to learn more about system administration. One thing I'd like to configure is a default packet filtering policy. ...
3
votes
2answers
587 views

Block specific IP from accessing gateway

Suppose you are on linux internet gateway/router. What would you do to block a client with specific IP using bash script. I prefer something like ./block_client.sh 192.168.1.123 to block and ...
3
votes
1answer
2k views

Configuring OpenVPN to use Firewalld instead of iptables on Centos 7

I need some help configuring OpenVPN on Centos 7 using firewalld. I used iptables on Centos 6.5 and only had to add the following lines to /etc/sysconfig/iptables: -A POSTROUTING -s "10.0.0.0/24" ...
3
votes
1answer
125 views

How to combine iptables rulesets

Say there are several iptables scripts (run at boot time), all of which run something like iptables -A ... to add rules. I'm thinking this could be improved, turning all those shell scripts into text ...
3
votes
1answer
225 views

Configure iptables on remote server without locking me up

I have a little remote server that I can access only with SSH, and what I want to do, is block all the traffic except port 22 for SSH. The first time, what I did was : iptables -P INPUT DROP And ...
3
votes
1answer
437 views

IPtables : Limit number of new ssh connections per minute

I need to ensure on my server that maximum new ssh connections per minute are not more then 5. sudo /sbin/iptables -A INPUT -p tcp --syn --dport 22 -m connlimit --connlimit-above 5 -j REJECT Above ...
3
votes
2answers
556 views

Is it possible to whitelist a specific program in iptables?

Is it possible to allow all traffic for a specific program in iptables? Otherwise using nmap and a strict iptables configuration at the same time seems impossible.
3
votes
1answer
824 views

Changing firewall settings after installation of CentOS via kickstart

I was trying to install CentOS 6.3 via Windows Deployment Server. And to automate the installation process I used kickstart file in which i provided various details required during installation.Then i ...
3
votes
2answers
297 views

What tool to execute a command on repeated syslog entries?

Occasionally, one VPS under my control gets bombarded with POP3 login attempts. They all fail, but the huge number of spawned processes and active connections pretty much amount to a DoS attack. When ...
3
votes
2answers
1k views

Tunnel yum traffic through another server via ssh

I am running a Fedora desktop behind a corporate proxy that is blocking yum traffic (specifically *.gz and *.bz2). I have access to a separate RedHat machine via ssh which can download anything it ...
3
votes
1answer
237 views

Proper way to handle FTP over SSL with restrictive firewall rules?

Without SSL, FTP works fine over a stateful Firewall, like netfilter (iptables) + the nf_conntrack_ftp kernel module like this: # modprobe nf_conntrack_ftp # iptables -A INPUT -m conntrack --ctstate ...
3
votes
1answer
130 views

IPTables rules for specific processes [duplicate]

I have a lot more experience with the Windows Firewall with advanced functionality than I do with IPTables. With the WFAF, I was able to lock down a program so that it could only connect over specific ...
3
votes
1answer
824 views

Settings when using a bridge

I have a bridge set up between my physical Ethernet interface, eth0, and the virtual interface for OpenVPN, tap0. The bridge has an IP address, and the machine can be contacted on that IP address from ...
3
votes
1answer
93 views

Did this tutorial block pings to my server?

I am a programmer teaching myself linux admin stuff. I followed this tutorial to setup a firewall on a VPS. As a part of that tutorial, I block all traffic except for web traffic and SSH traffic. I ...
3
votes
1answer
291 views

listen to a conversation using port forwarding

I have been able to make a phone calls using the SIP client Pjsua from one Linux computer to another one. In case you have not heard of this user agent, explaining it's functionality is quite easy. It ...
3
votes
1answer
3k views

Set up firwall with iptables to only allow VPN

Im using IPredator VPN with openVPN and I want to make sure that if the connection is dropped, i wont submit data from the internet without the VPN. I heard that I could do that with iptables and a ...
3
votes
1answer
2k views

iptables: how to allow traffic from redirected port

I have a web service running on debian 7 and listening on port 8080. I want to redirect 80 to 8080 for inbound connections and allow only port 80. Here is my iptables configuration: root@localhost:~# ...
3
votes
1answer
667 views

Routing through iptables

I have this vpn client that touches the routing table and then keeps watching it to exit if it gets touched. It is the kind of setup needed for an endpoint, such as a laptop. I want to use a small ...