iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

2
votes
2answers
2k views

IPTables rule to allow incoming SSH connections

The aim of this script is to only allow traffic over the VPN, except for localhost<->localhost and incoming SSH traffic. But when I run the script over SSH I am disconnected and forced to restart ...
0
votes
0answers
153 views

Port forwarding only works for first packet sent

I'm trying to configure port forwarding (80 and 443) on my new router. The router is a Xiaomi Mi Wi-fi, that establishes a PPPOE session with a VDSL2 modem/router (BBox2). The Xiaomi router runs a ...
1
vote
1answer
109 views

How do you route to secondary interface on the same physical port?

INTERNET<->(wan)BRIDGED_DEVICE(lan)<->ETH_ROUTER<->LAN Problem: Need to access web server on BRIDGED_DEVICE's LAN from INTERNET via ROUTER (BRIDGED_DEVICE web server cannot be accessed form ...
3
votes
1answer
90 views

How to combine iptables rulesets

Say there are several iptables scripts (run at boot time), all of which run something like iptables -A ... to add rules. I'm thinking this could be improved, turning all those shell scripts into text ...
2
votes
1answer
206 views

iptables - add rule for interface before it comes up

Right now I'm using /etc/rc.local to add some iptables rules on my Linux router on boot however some of the rules aren't added. I assume this is because the interface hasn't come up yet. This is what ...
1
vote
0answers
318 views

Why does this iptables rule doesn't get configured after a reboot once in a while? [closed]

On my Android network device, iptables firewall rules service script is started by the init.rc scripts during boot time. One of the firewall INPUT chain rules doesn't get configured in the iptables ...
0
votes
0answers
45 views

DNAT in iptables

Help me set rules in IPTABLES! I used rules in firewall - shorewall as below: DNAT net dmz:10.10.10.200 tcp 21,80,3306 DNAT net local:192.168.1.99 tcp 502,8008 Where: IP firewall: ...
5
votes
1answer
122 views

Is there a way to match an inet and inet6 IP set in a single rule?

Is it possible to have one IPv4 and one IPv6 IP set (ipset(8)) within the same rule? I have several rules that depend on one set of IPv4 addresses and another set of IPv6 addresses respectively, but ...
1
vote
0answers
10 views

List of netfilter modules for which I can leave out the -m option and other implied information

Rules in iptables/ip6tables can sometimes become a bit verbose to read. I am looking for a list of information that I can skip from iptables/ip6tables that I write. Examples: if you say -s 1.2.3.4 ...
1
vote
1answer
106 views

iptables - masqueraded NAT has delayed first hop in traceroute

I'm just in the process of setting up my Linux (Debian-based) router with a PPPoE connection via an ADSL/PPPoA -> PPPoE bridge. The connection works perfectly on the router itself but a traceroute ...
0
votes
1answer
152 views

iptables applied in local machine, Can't access remote ssh

I want to SSH to 192.168.1.15 server from my machine, my ip was 192.168.1.99. Source destination was UP, with IP 192.168.1.15. This is a LAN, there are 30 machines connected to the network and ...
2
votes
0answers
55 views

Defining IPv6 chains in ip6tables-restore/iptables-restore files, is it possible?

The format for the files generated by iptables-save/ip6tables-save and loadable through iptables-restore/ip6tables-restore stipulates that one can prepend -4 or -6 respectively so as to maintain the ...
2
votes
1answer
90 views

Remove an IPTable Rule

I'm having troubles removing this ipables rule in Ubuntu: $ iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 3128 I've tried using the -D attribute but with no success. How can ...
1
vote
1answer
42 views

Creating a virtual interface to always access a DHCPed interface with the same ip

I have an interface that on connect always gets a new IP. So I want to create a virtual interface with a static IP that "relays" everything over the physical interface. This would be useful to bind ...
1
vote
0answers
96 views

CPU usage by kernel modules, routing and forwarding rules

I have a system with a loopback kernel module installed. Through a bunch of routing and iptable rules, packets coming out of the loopback interface are sent over an ipsec tunnel. I am seeing that ...
1
vote
1answer
77 views

Routing packets between networks with iptables

I'm trying to create a proxy of sorts using just iptables. The linux computer (my proxy) has two ports: p2p1 is connected to the Internet. em1 is connected to a local network. There are two ...
0
votes
2answers
321 views

IPtables reset on reboot, how do I tell what is causing this

Using RHEL, and I have had some "Cyber Security" people work on my server. I'm now using this server in a completely closed environment with no outward network connection, and would like my iptables ...
1
vote
1answer
960 views

iptables based redirect captive portal style

What is a iptables set of rules that will force hosts connected to a access point, that try to access any website (port 80 of any ip or hostname) to be redirected to another device on the network ...
3
votes
1answer
80 views

iptables: refuse immediately when blocking particular domain from visiting by browser

I need to block particular domain "megafonpro.ru" and all subdomains from visiting by browser. Here's rule that I wrote: sudo iptables -I OUTPUT -p tcp --dport 80 -m string --string "megafonpro.ru" ...
2
votes
2answers
303 views

Bonding two broadband connections to serve LAN as a gateway

I need to increase the connectivity and speed of the Internet to my LAN users. These are the things I have in my hand to do so. PC with 3 NICs 1 for LAN and 2 for routers 2 broadband connections ...
4
votes
2answers
185 views

Can iptables rules manipulate IP sets?

In iptables-extensions(8) the set module is described and it is discussed that it is possible to react to the presence or absence of an IP or more generally a match against an IP set. However, it ...
1
vote
1answer
115 views

IPv6 firewall rules seem to impede all connections

After deciding that my small server needed a firewall, I used ferm to configure iptables and ip6tables for me (this question should be tagged ferm, but I cannot create the tag). I am using the same ...
1
vote
1answer
42 views

Redirect packets and save the content to disk

I want to reroute a connection just like rinetd does but save the client and server messages. Is there any tool like this out there ? I'm using Debian.
1
vote
1answer
55 views

IPtables on ubuntu 12.04

I've problem with iptables on ubuntu 12.4. I type ufw status, it show result Status: inactive but I type iptbles -L -nv, it still shows many rules, and these rules are running. I can't understand.
1
vote
1answer
146 views

Absolutely cannot get FTP access after adding many rules to iptables in CentOS5

I'm a complete noob and am just having the worst time trying to get FTP access to the server. I want to keep the firewall enabled. Edit: Updated the iptables information. I have the following ...
1
vote
0answers
147 views

Running a Transparent Proxy for LAN and Webserver for WAN

I am running a LAMP stack on an Arch Linux server in my home, and my router firewall port 80 is open to the world. Recently, I've decided to set up a dansguardian transparent proxy to do some web ...
1
vote
0answers
33 views

How do I route traffic between eth0:0 and eth0 [duplicate]

I have been trying to convert my linux box which is running Mint into a router. eth0 has a public IP address of 71.xx.xx.xx. I created an eth0:0 and gave it an IP address of 10.0.0.100. I started a ...
5
votes
1answer
270 views

What are the definitions of addrtype in iptables?

I am keen to use addrtype in combination with -src as a rule in one of my filter chain like so to drop some bogon ips: -A INPUT -p tcp --dport 80 -m addrtype --src-type UNICAST ! -s 127.0.0.0/8 -j ...
2
votes
1answer
121 views

What does lo in iptables mean exactly?

I have seen countless examples of this rule in iptables: -A INPUT -i lo -j ACCEPT I thought lo means localhost (a.k.a. 127.0.0.1), but when I commented it out, I can't access the server using its ...
2
votes
1answer
147 views

IPTables Port Redirection Should Have Broken Apache But Didn't

I have a Load Balance set up in Apache httpd: <VirtualHost *:80> DocumentRoot /var/www/html ServerName xxx.xxx.xxx.com ProxyRequests Off ...
1
vote
1answer
50 views

Unable to access external content with this IPTABLES ruleset

My application server is on a network protected by a organization wide firewall, and my server is also using fail2ban. That said, I'd like to set up an additional layer of protection with iptables. ...
0
votes
3answers
69 views

Iptables in linux

Please explain me the use of bold character below iptables -A INPUT -i eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT -A -i -p -m state --state -j
2
votes
1answer
59 views

Do I have to swap IP sets, or can I add/remove on the fly?

I was wondering about the semantics of ipset(8). Is it possible to add a rule matching a set to iptables and then manipulate the set, or can I only create a set and swap it for an older set in order ...
2
votes
1answer
373 views

Problem setting up iptables (LDAP traffic blocked)

My application server is on a network protected by a organization wide firewall, and my server is also using fail2ban. That said, I'd like to set up an additional layer of protection with iptables. ...
1
vote
1answer
126 views

How to log incoming icmp traffic?

I am watching my ip6table and observing an icmp packet arriving and getting dropped at the rate of 1 per second. I am trying to find out what that message is about. I tried using tcpdump (it is ...
1
vote
0answers
539 views

Port redirection on loopback with IP other than 127.0.0.1

I want to redirect port 80 on the loopback network interface so that accesses to that port actually go to port 8080. I tried using the following command, but it only works if the application is ...
2
votes
1answer
715 views

How does connlimit in iptables supposed to work?

I wanted to set a limit to the number of concurrent connections allowed on my web server. I tried the following rules on an iptables (v1.4.19.1) kernel 3.14.4-200.fc20.x86_64 with a default DROP ...
1
vote
0answers
197 views

iptables server behind NAT accessible from outside as well as inside the nat

I have 2 machines with a KVM running on each machine - so two kvms with the below networking Host 1: 192.168.10.100 (eth2) 10.10.100.1 (virbr1) KVM 1 (NAT with Host 1): 10.10.100.128 (eth0 ...
0
votes
2answers
170 views

What is the simplest method to redirect traffic using either a proxy or iptables?

I need to redirect all incoming traffic on port 7777 to a specific destination_ip:port. I have about 40 Litecoin (scrypt) mining rigs that I have to manually reconfigure each time I'd like to switch ...
3
votes
3answers
544 views

dmesg flooded with firewall logs

In my iptables, I have a rule which logs dropped packets: -A INPUT -i eth0 -j LOG --log-prefix "FW: " --log-level 7 -A INPUT -i eth0 -j DROP And in /etc/rsyslog.conf, I have ...
2
votes
0answers
42 views

iptables drop length and TTL condition doesn't work

With iptables utility on Linux host need to create mini firewall. I need to drop all incoming connections with package length greater than 722 AND TTL greater than 22. Need exactly AND. Drop only if ...
1
vote
1answer
226 views

RHEL 6.5 won't boot after loading APF firewall

We have an RHEL 6.5 system which boots to the point of loading APF firewall and then just hangs indefinitely. The console shows the following: ... Loading autofs4: [OK] Starting automount: [OK] ...
0
votes
1answer
592 views

Disable iptables service on CentOS

I don't want the service to start after reboot. my code does this: service iptables stop service iptables save chkconfig --level 123456 iptables off service iptables status iptables: Firewall is not ...
-1
votes
2answers
260 views

Use IP tables to port forward behind a router?

Is it possible to use IP tables to port forward behind a router? My setup is thus: I have a Raspberry Pi running a small website on port 80, and a beefier computer running a Minecraft server on port ...
1
vote
1answer
655 views

Create a iptables rule if the rule does not all ready exist

Hi I've created a script to setup Nagios on my remote servers. My Script checks iptables to see if a firewall rule all ready exists and then is supposed to add the rule if it's not all ready there. ...
5
votes
1answer
351 views

Skip routing via `lo` interface for outgoing packets

Introduction I have following load balancing configuration: 10.0.1.31 - lb 10.0.1.35 - virtual IP 10.0.1.32 - node1 (tomcat + mysql) 10.0.1.33 - node2 (tomcat + mysql) I'm using keepalived which ...
1
vote
1answer
54 views

View blocked address from sshguard

How can I view all the addresses that sshguard has blocked to iptables?
1
vote
2answers
100 views

Does IP tables need to be configured or is a stand alone firewall sufficient?

I have two desktops and a laptop running Arch Linux. I have not setup any iptable rules on any of the machines, and I am curious if I should. One desktop is only used in my home network and is ...
4
votes
1answer
186 views

Can iptables be used to monitor TCP timeouts/resets system-wide?

I'm trying to determine if an application's connection to a database is internal to the application or due to a networking event. This seems like something netfilter would have system-wide visibility ...
0
votes
2answers
76 views

iptables advice with upd ports blocking in debian linux [closed]

please advice: I add next iptables rules: iptables -I OUTPUT 2 -p udp --dport 53 -j ACCEPT iptables -I OUTPUT 2 -p udp --dport 1700:1750 -j ACCEPT iptables -I OUTPUT 3 -p udp -m udp --dport 1812 -j ...