iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

3
votes
1answer
103 views

Why are these connections not classified as “established” under conntrack?

I have the following rule for iptables: -A OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT such that outgoing connections not classified as established will be logged. Occasionally, the ...
0
votes
0answers
55 views

Port randomly closing (iptables)

I'm running CentOS 6.5 on a VPS and one of the services I have running is murmur/mumble (A voip application). The issue I'm having is that the port clients connect on will be open when I initially ...
1
vote
0answers
27 views

iptables packet header capture and compare

We are using multicast program to listen up multicast data from our provider, there are couple cases where the multicast having issue: 1. their server hang, hence no multicast data received from our ...
2
votes
0answers
167 views

how to open up socks/SSH on different network interfaces?

iptables -A PREROUTING -i usb0 -t mangle -p tcp --dport 8080 -j MARK --set-mark 1 iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination Chain ...
0
votes
1answer
4k views

can not telnet to a server connection refuse

I have two server with these specifications: IP address: 192.168.1.94 IP address: 192.168.1.221 I want to telnet to the first one from the second one (to port 5029) but I get this error: ...
1
vote
0answers
72 views

How to route pakets from an aliased interface towards a gateway?

I'm having trouble setting up the following: Router IP: 192.168.1.1 PC Eth0 - 192.168.1.104 Eth0:1 - 10.0.0.1 (must be an alias) Besides ip_forward enabled, what should I add to iptables rules, so ...
2
votes
3answers
121 views

Bridge/Router with custom logic

I've a Linux box with 3 network adapaters, which I'd like to configure as follow: Adapter A is connected to computer A Adapter B is connected to computer B Adapter C is connected to the Internet. ...
1
vote
0answers
71 views

Forwarding DNS traffic for specific domain

I'm trying to control which IP address I use for DNS based on the domain string. I'm on Fedora with firewalld and have tried the command: firewall-cmd --direct --add-rule ipv4 filter PREROUTING 0 -t ...
0
votes
1answer
207 views

iptables NAT on Debian openvz

So i want to create a nat rule for an openVPN server. After getting trouble with the TAP/TUN Devices, it's finally working i think. Now i have to make a nat rule like so : >iptables -t nat -A ...
5
votes
1answer
463 views

How does a transparent SOCKS proxy know which destination IP to use?

There are two SOCKS proxies that I know about that support transparent proxying for any outgoing TCP connection: Tor and redsocks. Unlike HTTP proxies, these SOCKS proxies can transparently proxy any ...
2
votes
1answer
74 views

iptables, what is truly open?

We have an RSA appliance, I've reviewed the firewall rules on this appliance to determine what ports are enabled. To me, it looks like its wide open; but the vendor states that I am wrong about this, ...
1
vote
1answer
49 views

How to wrap iptables commands around Ruby webrick server going up and down in a single command/script?

I would like to use this Ruby WEBrick server solution for on-demand showcasing of some random web pages. So I set up some forwarding exception on my adsl modem local web interface(192.168.2.1). Then ...
2
votes
1answer
236 views

How to completely block a website like Facebook?

I'm trying to block Facebook access from my home system (Ubuntu). I could add facebook.com to /etc/hosts, but that would only prevent accessing facebook.com. There are many other ways I could use ...
2
votes
2answers
224 views

Is there a specific reason why iptables would return an exit code of 3 (instead of 1?) when executed without sufficient privileges?

I simply forgot to use sudo: usr@arch ~[0] $ iptables -L iptables v1.4.21: can't initialize iptables table `filter': Permission denied (you must be root) Perhaps iptables or your kernel needs to be ...
4
votes
1answer
135 views

Dovecot/Postfix mail server replies to [SYN] with [RST, ACK] when user attempts to connect (POP3). Likely iptables?

Currently I'm trying to troubleshoot an e-mail server that will allow users to send e-mail, but not log in to the server (POP3) or receive e-mail using their Outlook clients. Previously this was ...
1
vote
0answers
19 views

Making sense of this iptables http proxy config

I've never touched iptables before and I'm trying to understand exactly what these three lines do. I have ip_forward switched on and I know the end effect is that all traffic on eth0 is forwarded ...
0
votes
0answers
83 views

iptables rate limit error

This is on centos 6.5, I want to limit number of maximum connections using iptables: iptables -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 15 --connlimit-mask 32 -j REJECT ...
1
vote
1answer
100 views

Can I forward all traffic on a port to a complete different IP address?

Here's my situation. I own a VPS that provides 3 public IPs / public interfaces. let's call these IP address V1 (on eth1), V2(on eth2) and V3 (on eth3) At home, I have a router. The home WAN IP is H. ...
-1
votes
1answer
21 views

iptables fowarding rules

I have an iptables rule in the FORWARD section that looks like this: 17 0 0 CONFIRMED tcp -- * * 0.0.0.0/0 172.16.30.240 tcp spt:587 dpt:587 ctorigdst ...
0
votes
1answer
36 views

What means the numbers besides my default policy chain rules?

I am investigating a potential security issue in one of my system. My firewall tables currently look as, :INPUT ACCEPT [527:57388] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [189:35832] -A INPUT -p tcp -m ...
1
vote
0answers
80 views

Only allow http and SSH traffic

I ran the below. What I expected was to be able to browse websites without issues. No sites work and I have no idea what. When I executed iptables -P OUTPUT ACCEPT it works so I'm assuming I missed an ...
1
vote
0answers
86 views

IPTable rules for transparent outbound proxy

I've recently installed MITMProxy (similar to Squid) which I'm currently using to route outbound HTTP requests from my Ubuntu machine to another server (adding a header along the way). When I use ...
1
vote
0answers
208 views

Setting up a 802.11s mesh network for mobile devices to communicate with a wired server

I'm in the process of developing an android app that maintains a device's connectivity to a linux-based WiFi mesh network, and periodically sends status information (GPS, battery life, etc.) to a ...
4
votes
2answers
120 views

set connection limit via iptables

I want to limit the IP traffic of an application (AceStream Player). The problem is that I get disconnected, if too many IP connections are established. Does anyone know, how to use iptables to limit ...
0
votes
0answers
68 views

CentOS IPTABLES how to block requests from router

I have a CentOS machine that I use in private LAN for development and as file server. I did the following setting to allow httpd, GlassFish, Samba and SSH. Chain INPUT (policy ACCEPT 0 packets, 0 ...
3
votes
3answers
417 views

How to get all IPtables rules

I'm trying to see a list of all the rules in IPtables in a Debian 7 server. when I try: iptables -L -n I only get one rule (which I entered 5 minutes ago). I have many others, for port 80, mysql ...
3
votes
2answers
1k views

set packet rate limit via iptables

I have a packet rate limit (max. 10 per seconds) which is set by my internet provider. This is a problem if I want to use the AceStream player, because if I exceed the limit I get disconnected. How ...
0
votes
1answer
121 views

Isolate subnets on the same interface

I need to isolate Subnets on a linux machine CentOS that act as gateway. I have the following scenario. CentOS eth0 pub ip addres eth0.1 192.168.1.1 eth0.2 192.168.2.1 Now eth0.1 and eth0.2 can ...
-1
votes
1answer
128 views

Fail2ban consuming lot of bandwith

I have a raspberry pi on which I have a nginx and a ssh server, I have installed iptables and fail2ban in order to limit the attempts of ssh connection. The problem is that it seems that fail2ban ...
1
vote
0answers
33 views

NAT-T set up using 3 linux machines

I am trying to have a simple NAT-T setup using 3 linux machines. Linux1 Linux2(NATdevice) Linux3 (eth0) 192.168.1.51 <--->(eth1)192.168.1.80 & ...
1
vote
0answers
138 views

UFW before rules for VPN forwarding

I'm trying to setup an OpenVPN server on Debian 7, following this guide: How to install and set-up OpenVPN in Debian 7 (Wheezy) In step 15 I have to setup forwarding and IPtables rules. I prefer to ...
0
votes
1answer
298 views

IPTABLES comment: No chain/target/match by that name

Faced with error when adding new rule with 'comment': # iptables -I INPUT 1 --source 66.***.***.78 -j REJECT -m comment --comment "Some" iptables: No chain/target/match by that name. Without ...
0
votes
0answers
183 views

Routing incoming source IP traffic to a loopback IP issue

I'm wanting to accomplish the following: I have a BIND DNS server setup where it is listening on ANY address and also listening in a BIND config ACL on 127.0.1.1. If there is another way where you ...
0
votes
1answer
89 views

IPtables don't block IP

I'm running Postfix SMTP server. Some hosts trying to connect with wrong passwords. warning: s15393678.onlinehome-server.com[74.208.17.126]: SASL LOGIN authentication failed: I'm adding iptables ...
0
votes
0answers
15 views

iptables/netfilter behavior if DNAT changes mid-connection

I'm planning to leverage iptables to act as a 'poor-man's active/passive load balancer'. The plan is to have a pair of these rules: -t nat -A PREROUTING -d 10.1.2.3/32 -m condition --condition ...
3
votes
0answers
37 views

Which tool is used to create firewall rules on Fedora 20? [closed]

What is a recommended way to set up firewall rules on Fedora 20/Centos 7/RHEL 7 currently? I know about relatively new replacement of itpables service by firewalld service. Which command-line user ...
2
votes
1answer
462 views

How to measure iptables load?

I have added about 3500 IP addresses to iptables using ufw on a Debian 7 and I am wondering if this has any impact on the performance of my server. How can I measure that?
0
votes
1answer
207 views

CentOS 7 iptables problems and doubts?

I have a CentOS 7 image on VM VirtualBox (bridged Ethernet with static IP) I was trying to set iptables filter table but I have the following problems: Whatever I did to open Apache on port 80 ...
4
votes
2answers
4k views

Whitelist IP's in CentOS 7

I want to setup CentOS 7 firewall such that, all the incoming requests will be blocked except from the originating IP's that I whitelist. And for the Whitelist IP's all the ports should be accessible. ...
0
votes
1answer
71 views

Allowing web server communication in Linux firewall

I have a unique situation. Let's say my webserver ( e.g. 10.0.0.2) is connected to eth0 of my firewall (gw 10.0.0.1). A local network (192.168.0.0/24) is also connected to eth1 (192.168.0.1/24) of my ...
1
vote
0answers
70 views

What is the point of the second route lookup after OUTPUT?

According to the packet path diagram, and its description: Table 6-2. Source local host (our own machine) [...] Routing decision, since the previous mangle and nat changes may have ...
0
votes
0answers
41 views

bridge or iptables or route?

iptables vs bridge-utils vs route I have two network cards in a Linux server and don't know how to make them communicate. After searching a lot I still don't know which method is the one that should ...
0
votes
0answers
113 views

Set source address for incoming packets on a server

I'm developing a UDP reverse proxy for a game server, and so far, everything has gone fine except for one thing - getting the backend server to submit requests to the master server list (run by a 3rd ...
1
vote
0answers
78 views

SNAT with firewall-cmd?

I have an interface with multiple IP Addresses (on CentOS 7), which is in zone "external" (with masquerade on). I want to specify that, if a connectiona attempt to a specific address goes out, to use ...
0
votes
1answer
116 views

How to set up a stateful firewall on an am335x Starter Kit board?

In the past, I have used the following script to set up a stateful firewall (on a normal x64 Ubuntu machine) without issue: iptables -P INPUT DROP iptables -P FORWARD DROP iptables -N TCP iptables -N ...
2
votes
1answer
586 views

Forwarding packets from loopback interface with policy-based routing

I have the following iptables rule: iptables -t mangle -A PREROUTING -p udp -m udp --dport 10000 -j MARK --set-xmark 0x4/0xffffffff which sets fwmark 4 on all udp packets with destination port ...
1
vote
2answers
1k views

ping: unknown host with iptables enabled

I can't ping www.google.com. However I can ping the IP address: ping 74.125.237.142 At first, I thought it is a problem with my DNS settings. But I checked my resolv.conf, hosts, and hostname ...
1
vote
0answers
122 views

Iptables and --tcp-flags

If I have the following rule in the nat-table in the prerouting chain: 0 0 REDIRECT tcp -- eth5 any anywhere anywhere tcp flags:FIN,SYN,RST,ACK/SYN redir ports ...
5
votes
2answers
2k views

Tunnel yum traffic through another server via ssh

I am running a Fedora desktop behind a corporate proxy that is blocking yum traffic (specifically *.gz and *.bz2). I have access to a separate RedHat machine via ssh which can download anything it ...
1
vote
0answers
219 views

Forward multicast between two LAN segments (Chromecast)

I've found some rules but most are inconclusive. Chromecast uses DIAL and discovers via multicast from what I've understood.. I have an Ethernet-connected computer which I would like to route via my ...