iptables allow creation of rules to define packet filtering behavior.
6
votes
2answers
5k views
Output traffic on different interfaces based on destination port
My question is basically the same as Only allow certain outbound traffic on certain interfaces.
I have two interfaces eth1 (10.0.0.2) and wlan0 (192.168.0.2).
My default route is for eth1.
Let's say ...
2
votes
1answer
341 views
Why should the ECN on your machine be disabled?
I was going through this article on iptables and there the author said that:
It's important to turn off ECN (explicit congestion notification) so
that Internet communications will work ...
-1
votes
1answer
2k views
What is sport and dport?
I want to stop internet on my system using iptables so what should I do?
iptables -A INPUT -p tcp --sport 80 -j DROP
or
iptables -A INPUT -p tcp --dport 80 -j DROP ?
2
votes
1answer
829 views
iptables rule to allow access to internet
I made default policy of my machine-
iptables -A INPUT -j REJECT #DROP ALL PACKETS TO INPUT CHANNEL
INPUT channel has been blocked. Now I want to allow only some specific services like I should be ...
5
votes
4answers
500 views
How can I send spoofed packets in Linux
In order to test a firewall, I want to send malformed packets to its interface, regardless of my routing table.
Is there a way to ask linux "send this exact tcp package, to this MAC address, ...
2
votes
0answers
317 views
Why are packets not moving forward? [closed]
I have a server with forwarding turned on. I placed an iptables LOG target in the PREROUTING, INPUT, and FORWARD chains of the mangle table. I can see the LOG messages from PREROUTING, but not INPUT ...
4
votes
4answers
3k views
Set some firewall ports to only accept local network connections?
Basic firewall question:
How do I set up the firewall on a system in a LAN so that some ports are only open to connections from the local area network, and not from the outside world?
For instance, ...
2
votes
1answer
1k views
Why does iptables still block my samba?
I'm currently fighting with iptables and samba.
I read that samba needs ports 137-139 and 445 open on both tcp and udp.
Here is the relevant part of my iptables config
...
# forward valid incoming ...
2
votes
2answers
518 views
use iptables to allow incoming connections to some computer on port XYZ?
This is what I have: iptables -i em1 -A INPUT -j ACCEPT -p tcp --dport 9001 -v. If I want to accept incoming connections on port 9001 at this (127.0.0.1, or on the network 192.168.1.143) address, ...
4
votes
4answers
1k views
How to share the internet connection?
An ordinally network topology in picture:
In words:
- "server" (e.g.: an Ubuntu 10.04 LTS) is connected to the "internet" through pppoe connection
- "server" is using it's wireless card in AP ...
2
votes
2answers
2k views
How to redirect kernel messages having the unique id substring into separate log file (using `rsyslog`)?
I am using iptables's logging feature to debug my network activity. I use certain prefix with --log-prefix parameter to uniquely identify messages in kernel log belonging to iptables output, for ...
4
votes
1answer
1k views
Is it possible to redirect a logging output of the iptables' LOG chain into a separate log file?
I don't want to mix iptables's log output with other system logs. How could I specify a dedicated log file for iptables LOG chains output?
4
votes
1answer
2k views
iptables port-mirroring
I need to be able to get a copy of packets received on port 8001 to port 8002. I have tried the following but I get an error that --tee is undefined.
sudo iptables -t nat -A PREROUTING -p TCP -s ...
1
vote
2answers
502 views
How to Optimize an IPTABLES script?
If I could list that which iptables rule has how many matched packets, then I could create a better/faster iptables script that's faster. That rule would be at top/first that has the more packets ...
1
vote
1answer
706 views
Why am I getting a “Listing remote folder failed” error when I try to connect with SFTP?
I set up SFTP, but I have a problem regarding iptables. Here are my rules:
A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT
A RH-Firewall-1-INPUT -m state --state NEW -m ...
1
vote
1answer
1k views
Limit the max connections per IP using OpenWRT?
Would the following iptables command on an OpenWRT router assure that no one client has more than 50 active connections?
$ iptables -I FORWARD -m connlimit --connlimit-above 50 -j REJECT ...
3
votes
1answer
187 views
iptables infographic
Is there an infographic somewhere that describes the logical flow of iptables? Specifically, I'm looking for something that diagrams which point in the process ip_conntrack applies.
1
vote
3answers
5k views
iptables drop all incoming ICMP requests except from one IP
Currently, I have something like:
iptables -A INPUT -p ICMP --icmp-type 8 -j DROP
iptables -A INPUT -s x.x.x.x -p ICMP --icmp-type 8 -j ACCEPT
However, when I run the second command, it ...
6
votes
4answers
3k views
Fail2ban block with IPtables doesn't work on Debian Lenny. [moved ssh port]
I've recently decided to do some security maintenance. I saw my logs, and there were some tries against my SSH server. At first, I moved away the SSH port from the default 22. After it, I read ...
1
vote
2answers
6k views
Problems setting up TigerVNC and firewall :-/
I have a box running a fresh install of Fedora 15. I've installed TigerVNC server on it and client on my windows machine.
I've done this:
vi /etc/sysconfig/iptables
(added) -A INPUT -m state --state ...
1
vote
1answer
177 views
List iptables rules as append command
A while back I was watching over the shoulder of a Linux guru and he issued a command that listed all the iptables rules in the format of the append commands you would need to issue in order to build ...
0
votes
0answers
294 views
Iptables rules conflict [closed]
I am using a CentOS 5 VPS. I am running sshd and pptpd on it. Both work fine ( having no firewall rules ), but I felt the need of a firewall. I'm not really into iptables and I think there's some sort ...
2
votes
1answer
640 views
Unable to make outbound SNMP connections when IPTables is enabled
I have a bunch of windows servers configured with the windows SNMP agent. Each server has four IP addresses and SNMP listens on all of them.
There is something very odd with my monitoring server ...
5
votes
1answer
6k views
How to reset all iptables settings?
Are there any simpler commands to these? (e.g.: a oneliner? can one command reset iptables/netfilter settings to this?)
IPTABLES="$(which iptables)"
# RESET DEFAULT POLICIES
$IPTABLES -P INPUT ...
2
votes
1answer
1k views
iptables/pf rule to only allow XY application/user?
I think there is no iptables/pf solution to only allow an XY application on e.g.: outbound tcp port 80, eth0. So if I have a userid: "500" then how could I block any other communications then the ...
0
votes
3answers
737 views
IP Tables / netfilters and modules
I am trying to understand how firewall works in linux...
I have read documentation but i am not sure about some things....
Netfilters is included in the modern kernels which allows you using hooks ...
7
votes
3answers
4k views
Only allow certain outbound traffic on certain interfaces
I have rather an odd issue. I have a server with two network interfaces eth0 and eth1. Each are connected to a different network. Each network has a internet gateway. The server has various outbound ...
2
votes
2answers
3k views
iptables: allow certain ips and block all other connection
How do I allow certain ips and block all other connection in iptables?
4
votes
2answers
736 views
Screen session running as root? (it shouldn't be) node.js
cd /serv
screen -R node
{in the screen}
node test.js
C^a d
initially,
ls -l /dev/pts
total 0
crw--w---- 1 tick-tock tty 136, 0 2011-04-19 16:41 0
crw--w---- 1 tick-tock tty 136, ...
3
votes
1answer
160 views
Linux App that monitors log and add rules to iptables
I used to use a linux software that monitors logs like http, ssh, etc and if it detects that someone is trying to use brute force, it blocks that ip by adding a rule to iptables. I forgot what that ...
1
vote
0answers
289 views
tun0+ iptables rule
I'm trying to figure out what that + sign means in a rule such as this:
-A FORWARD -i tun0+ -j ACCEPT
I'm pretty positive it relates to vpn. I noticed a /dev/net/tun interface and a tun0 in ...
2
votes
4answers
359 views
9
votes
3answers
865 views
Is there a way to find which iptables rule was responsible for dropping a packet?
I have a system that came with a firewall already in place. The firewall consists of over 1000 iptables rules. One of these rule is dropping packets I don't want dropped. (I know this because I did ...
3
votes
1answer
337 views
1000 iptables entries on CentOS?
I just got a new dedicated server with CentOS and I'm trying to debug some network problems. In doing so, I found over one thousand iptables entries. Is this the default on a CentOS system? Is there ...
1
vote
2answers
629 views
iptables rule for local network with free internet blocking unrequested connection from internet to server?
I have a home server (with slackware 13) with a eth0 for the local network and a eth1 for the internet (cable modem with dynamic ip).
While I do want to learn more about iptables I am still on the ...
2
votes
2answers
2k views
iptables log file
I use ubuntu I want to know where is the log file of iptables?
I find /var/log/messages but I am not sure find correct log file or not.
and also want to know when this log file is changed? I add 1 ...
1
vote
1answer
502 views
Sharing bandwidth between IPs
There are 200 users in my network, and these users are in two AD groups and cannot set specific IP ranges for each group. I want to set, for each group, the amount of bandwidth that can be shared ...
0
votes
2answers
128 views
Where to handle packets between clients?
"Server": 192.168.1.1
I want to "theoretically" disable that the clients can "ping" each other.
Can i use an iptables rule for it? e.g.:
iptables -A FORWARD -m iprange --src-range ...
3
votes
1answer
178 views
Is there a standard way to configure what policy iptables loads on startup under Debian?
I've just started playing with Debian 6.0 (Squeeze) in a VPS environment, as a way to learn more about system administration.
One thing I'd like to configure is a default packet filtering policy. ...
3
votes
1answer
2k views
Using /etc/hosts or iptables to redirect site to https:// version
I'd like to have my system automatically take me to https://facebook.com even if I put http://facebook.com into my browser. I can get /etc/hosts to redirect to me to different domains, but it seems ...
1
vote
1answer
625 views
2
votes
1answer
214 views
Bash script and Database
I have an iptables firewall in Linux bridge (RHEL5). I want to extract information like IP address, port number, port type, date and time, etc. from log messages using a Bash script, and then want to ...
9
votes
2answers
5k views
Reply on same interface as incoming?
I have a system with two interfaces. Both interfaces are connected to the internet. One of them is set as the default route; a side effect of this is that if a packet comes in on the non-default-route ...
7
votes
1answer
870 views
Dual network connection
I have a usb cellular modem and a Home LAN connection on my Ubuntu 10.10 box.
Both work independently.
I want to know how to have both connected at the same time, and be able to specify which ...
1
vote
1answer
411 views
How would I go about getting UPnP working on a Slackware server/firewall?
I'm a long time fan of Slackware and I've always had a machine serving as my main server/firewall with the latest version installed.
I have it now but I'm struggling to find information on how to ...
7
votes
1answer
600 views
Shaping outgoing traffic with iptables
On my laptop, when I run any downloads, torrents, etc, browsing is crippled.
I read somewhere that you could configure your iptables powered router to prioritize certain network traffic.
Could I do ...
3
votes
1answer
2k views
Default mark for packets using iptables
I am trying to set up a QOS script on my Tomato-enabled WRT54G router. The script does the basics of what I need (make sure that a particular machine on my network has lower priority than anything ...
2
votes
1answer
496 views
iptables does not list rules i have created
I'm using this guide to set-up a shared internet connection between two PC's.
At step 8 it says I should run the commands:
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
/etc/rc.d/iptables ...
4
votes
1answer
904 views
multigateway routing for specific src port
I have two gateway to access internet, somehow I want to load balancing it, so far its working, but some connection or service need persistent gateway IP to be used, so the client should never change ...
3
votes
2answers
334 views
Block specific IP from accessing gateway
Suppose you are on linux internet gateway/router. What would you do to block a client with specific IP using bash script. I prefer something like ./block_client.sh 192.168.1.123 to block and ...
