iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

3
votes
2answers
563 views

iptables routing marked packets from router to PC and routing them back to router

I'm trying to do deep packet inspection on HTTP packets. The purpose of this is to collect HTTP payload data and then create some proxy/cache-independent reports. Following this, the idea is to ...
3
votes
1answer
2k views

tc don't see marked with -j MARK packets

Server has 2 network interfaces: eth1 with address 13.0.0.254/24 eth0 with address 172.20.203.4/24. It's routing traffic between this two networks. Task is to limit bandwidth between this two ...
3
votes
1answer
404 views

User associated with a socket

I use ss -p to see TCP sockets information. But process info are not printed for some sockets. Below: $ ss -p4 State Recv-Q Send-Q Local Address:Port Peer Address:Port ESTAB 0 0 ...
3
votes
1answer
389 views

1000 iptables entries on CentOS?

I just got a new dedicated server with CentOS and I'm trying to debug some network problems. In doing so, I found over one thousand iptables entries. Is this the default on a CentOS system? Is there ...
3
votes
1answer
3k views

Default mark for packets using iptables

I am trying to set up a QOS script on my Tomato-enabled WRT54G router. The script does the basics of what I need (make sure that a particular machine on my network has lower priority than anything ...
3
votes
0answers
31 views

Is iptables able to filter off UNREPLIED connections?

I am a using dd-wrt router and trying to get some per-user metrics, I was wondering about filtering only ESTABLISHED connections or include NEW and RELATED, I have read a lot about this last two, but ...
3
votes
0answers
44 views

Route VPN traffic through different proxies

I want to setup VPN server and route (based on my routing algorithm) all traffic through different proxy servers. Let's say I have one host, with many users, connected to my VPN. I want to route all ...
3
votes
1answer
93 views

Why are these connections not classified as “established” under conntrack?

I have the following rule for iptables: -A OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT such that outgoing connections not classified as established will be logged. Occasionally, the ...
3
votes
0answers
30 views

Which tool is used to create firewall rules on Fedora 20? [closed]

What is a recommended way to set up firewall rules on Fedora 20/Centos 7/RHEL 7 currently? I know about relatively new replacement of itpables service by firewalld service. Which command-line user ...
3
votes
1answer
79 views

IP rule table look up does not seem to work

I have a sytem with three network interfaces. Below is the configuration that I'm trying to set up. wlan0 (its actually an WiFi AP interface) - other devices connects via this interface. net1 - ...
3
votes
0answers
168 views

iptables rule no actions on scapy packets

I wrote this rule to change all udp destination IP addresses to 8.8.8.8 when dport is 53: iptables -t nat -A OUTPUT -p udp -m udp --dport 53 -j DNAT --to-destination 8.8.8.8 The rule worked when ...
3
votes
2answers
63 views

Iptables not forward traffic

I need to redirect all traffic incoming on port 9750 (the port chat server) to another machine on the same subnet. Ports clients - dynamic. iptables -t nat -A PREROUTING -p tcp -d x.x.x.a --dport ...
3
votes
0answers
77 views

Packets do not cross IP tables Postrouting when originating from an external IP

I'm trying to reflect traffic from the internet to an internal device that I only want to have local access. I have a host in my DMZ that I'm trying to DNAT traffic to this internal device, and SNAT ...
3
votes
1answer
91 views

iptables: refuse immediately when blocking particular domain from visiting by browser

I need to block particular domain "megafonpro.ru" and all subdomains from visiting by browser. Here's rule that I wrote: sudo iptables -I OUTPUT -p tcp --dport 80 -m string --string "megafonpro.ru" ...
3
votes
3answers
653 views

dmesg flooded with firewall logs

In my iptables, I have a rule which logs dropped packets: -A INPUT -i eth0 -j LOG --log-prefix "FW: " --log-level 7 -A INPUT -i eth0 -j DROP And in /etc/rsyslog.conf, I have ...
3
votes
1answer
116 views

What are the requierements to sniff UDP packets in a Wireless Ad-Hoc network?

In a wireless Ad-Hoc network, I have two computers which communicates in UDP together from 192.168.1.3 to 192.168.1.5 I have a third computer (192.168.1.6) which wants to listen to the packets which ...
3
votes
2answers
579 views

Policy routing with load balanced ppp connections

This my setup using Debian 6.0. 6. It's role is a proxy server and a load balancer using eight 3G modems. Whenever a ppp connection dials it takes over the default gateway which is ok but it also ...
3
votes
0answers
179 views

iCloud stuff stops working while connected to OpenVPN

I have a fairly simple OpenVPN setup on an OpenVZ VPS with Ubuntu 11.10. Client is the Viscosity client on Mac OS X 10.8.2, and after some testing, we can rule out the client as being part of the ...
3
votes
0answers
696 views

tunneling FON traffic via Tor

I would like to tunnel the traffic of my FON router through Tor. For that I added a second network card to a local server and connected the FON router to it. Then I set up a DHCP server and configured ...
3
votes
1answer
664 views

Port Mirroring in Fedora? [closed]

I have set up an application that listens constantly to a port for network packets, and I would like to create another one that receives the same network packets ( for use as a test bed). Getting the ...
3
votes
2answers
886 views

Open and redirect port

I'm trying to set up SNMP for a router so I can monitor it from an existing Nagios installation on an off-site server. I'm having trouble getting the router to respond to SNMP requests from the WAN, ...
2
votes
2answers
4k views

iptables log file

I have ubuntu and I want to know where can I find the log file of iptables? I find out /var/log/messages, but I am not sure this is a correct log file or not. And I also want to know when this log ...
2
votes
6answers
412 views

Recommend a reading for learning Linux firewalls configuration for beginner? [closed]

I am using Linux at home and want to be able to configure firewall. I would like to understand what I am doing not just copy paste some rules from internet :).
2
votes
3answers
1k views

bash: iptables: command not found

How do I fix the iptables: command not found problem that happened to Debian 7.6? batman@gotham:~$ uname -a Linux gotham 3.14-0.bpo.2-amd64 #1 SMP Debian 3.14.13-2~bpo70+1 (2014-07-31) x86_64 ...
2
votes
2answers
140 views

Are there ways to break into a machine if iptables drops all traffic?

Say I install Linux on an blank computer (no other OS, disk is formatted for installation), and I configure this in iptables: iptables -F iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P ...
2
votes
1answer
291 views

No internet even with iptables ACCEPT all

I was trying to setup the firewall settings, and probably did something wrong. I don't have internet now unless I stop iptables service I tried flushing,and accepting everything sudo iptables -F ...
2
votes
4answers
552 views

What does this iptables command do?

Does iptables -I INPUT -j ACCEPT open all ports?
2
votes
1answer
3k views

Why does iptables still block my samba?

I'm currently fighting with iptables and samba. I read that samba needs ports 137-139 and 445 open on both tcp and udp. Here is the relevant part of my iptables config ... # forward valid incoming ...
2
votes
2answers
3k views

IPTables rule to allow incoming SSH connections

The aim of this script is to only allow traffic over the VPN, except for localhost<->localhost and incoming SSH traffic. But when I run the script over SSH I am disconnected and forced to restart ...
2
votes
1answer
322 views

Bad argument `127.0.0.1' in iptables

-A OUTPUT --destination ! '127.0.0.1' -m state --state NEW -j LOG --log-prefix "new_connection " --log-level 7 gives me Bad argument `127.0.0.1' What am I doing wrong? I used this docs : ...
2
votes
2answers
4k views

Debugging iptables using live packet views

Are there any CLI or GUI functions that I can use to monitor hits to iptables and watch as packets interact with iptables?
2
votes
2answers
2k views

Remote SSH login not working

I have a PC behind a router with port forwarding setup Port 22 for SSH which works perfectly - I can login and everything. What I am trying to do is let this PC connect to a VPN and only allow ...
2
votes
1answer
2k views

iptables rule to allow access to internet

I made default policy of my machine- iptables -A INPUT -j REJECT #DROP ALL PACKETS TO INPUT CHANNEL INPUT channel has been blocked. Now I want to allow only some specific services like I should be ...
2
votes
3answers
203 views

What iptables command do I need to allow web server traffic?

I have a hard time understanding iptables rules. I am running a centos 6.5 VM on my laptop (vmware hypervisor) and it looks like it comes with this setup for iptables: # iptables -L Chain INPUT ...
2
votes
2answers
154 views

Temporary redirect ports

I need a temporary redirection of some ports to another machine. I've tried: iptables -t nat -A PREROUTING -p tcp --dport 4321 -j DNAT --to-destination 192.168.121.4:80 But shorewall blocks all ...
2
votes
1answer
92 views

Remove an IPTable Rule

I'm having troubles removing this ipables rule in Ubuntu: $ iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 3128 I've tried using the -D attribute but with no success. How can ...
2
votes
1answer
154 views

What does lo in iptables mean exactly?

I have seen countless examples of this rule in iptables: -A INPUT -i lo -j ACCEPT I thought lo means localhost (a.k.a. 127.0.0.1), but when I commented it out, I can't access the server using its ...
2
votes
2answers
1k views

Why isn't the Iptables persistent service saving my changes?

I followed this tutorial to set up IP rules on ubuntu 12.04. Everything worked fine on setup -- but now I've made changes to the firewall that do not persist upon reboot. I do not understand why that ...
2
votes
1answer
161 views

Lost connectivity after iptables change

I attempted to add a couple web ports to iptables and in doing so lost the ability to resolve any external address. I have a working SSH session open and can get to the box easily if needed. Here's ...
2
votes
1answer
632 views

Why iptables does not fetch information from /etc/sysconfig/iptables on centOs?

I'm new in Linux and encountered with problem with iptables. Here is content of /etc/sysconfig/iptables file # Generated by iptables-save v1.4.7 on Tue Nov 27 21:41:04 2012 *filter :INPUT ACCEPT ...
2
votes
2answers
907 views

Iptables port forwarding to qemu vm

Is it possible to create an IPtables rule that forwards all incoming traffic on port 80 on the host to port 80 of the qemu VM? Is such a scenario possible with qemu?
2
votes
1answer
2k views

system wide SOCKS5 Proxy

I connect to my Server on the internet using ssh -D 3128 user@rootserver.com. If I am right I thereby open a SOCKS v5 Proxy to my Server. Using firefox and FoxyProxy I can now add this to my proxys ...
2
votes
2answers
9k views

Problems setting up TigerVNC and firewall

I have a box running a fresh install of Fedora 15. I've installed TigerVNC server on it and client on my Windows machine. I've added -A INPUT -m state --state NET -m tcp -p tcp --dport 5900 -j ACCEPT ...
2
votes
2answers
75 views

Is there a specific reason why iptables would return an exit code of 3 (instead of 1?) when executed without sufficient privileges?

I simply forgot to use sudo: usr@arch ~[0] $ iptables -L iptables v1.4.21: can't initialize iptables table `filter': Permission denied (you must be root) Perhaps iptables or your kernel needs to be ...
2
votes
1answer
699 views

Whitelist IP's in CentOS 7

I want to setup CentOS 7 firewall such that, all the incoming requests will be blocked except from the originating IP's that I whitelist. And for the Whitelist IP's all the ports should be accessible. ...
2
votes
2answers
366 views

Bonding two broadband connections to serve LAN as a gateway

I need to increase the connectivity and speed of the Internet to my LAN users. These are the things I have in my hand to do so. PC with 3 NICs 1 for LAN and 2 for routers 2 broadband connections ...
2
votes
1answer
69 views

Do I have to swap IP sets, or can I add/remove on the fly?

I was wondering about the semantics of ipset(8). Is it possible to add a rule matching a set to iptables and then manipulate the set, or can I only create a set and swap it for an older set in order ...
2
votes
1answer
60 views

Should IP tables rules affect a serial port on Linux

I'm trying to setup some iptables rules on my embedded Debian Linux system, using a serial console I entered this: root@ts7600-47aad3:~# iptables -F root@ts7600-47aad3:~# iptables -P INPUT DROP ...
2
votes
1answer
98 views

Port forwarding using iptables on Linux

I want to forward a local port to a remote port (8041) to a port (8042) on a remote machine (10.0.0.42). I can do this via ssh -L 10.0.0.41:8041:10.0.0.42:8042 user@localhost where 10.0.0.41 is ...
2
votes
1answer
54 views

How would I go about making this IPTABLE rule for every ip and not just one?

iptables -I PREROUTING -t nat -p udp -s 192.168.0.62 --dport 53 -j DNAT --to-destination 23.21.182.24 Instead of 192.168.0.62 I'd like to set that as a global rule, EVERY ip that needs dns should ...