iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

3
votes
0answers
666 views

tunneling FON traffic via Tor

I would like to tunnel the traffic of my FON router through Tor. For that I added a second network card to a local server and connected the FON router to it. Then I set up a DHCP server and configured ...
3
votes
2answers
719 views

Open and redirect port

I'm trying to set up SNMP for a router so I can monitor it from an existing Nagios installation on an off-site server. I'm having trouble getting the router to respond to SNMP requests from the WAN, ...
2
votes
2answers
4k views

iptables log file

I have ubuntu and I want to know where can I find the log file of iptables? I find out /var/log/messages, but I am not sure this is a correct log file or not. And I also want to know when this log ...
2
votes
6answers
401 views

Recommend a reading for learning Linux firewalls configuration for beginner? [closed]

I am using Linux at home and want to be able to configure firewall. I would like to understand what I am doing not just copy paste some rules from internet :).
2
votes
2answers
85 views

Are there ways to break into a machine if iptables drops all traffic?

Say I install Linux on an blank computer (no other OS, disk is formatted for installation), and I configure this in iptables: iptables -F iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P ...
2
votes
1answer
263 views

No internet even with iptables ACCEPT all

I was trying to setup the firewall settings, and probably did something wrong. I don't have internet now unless I stop iptables service I tried flushing,and accepting everything sudo iptables -F ...
2
votes
4answers
517 views

What does this iptables command do?

Does iptables -I INPUT -j ACCEPT open all ports?
2
votes
3answers
62 views

bash: iptables: command not found

How do I fix the iptables: command not found problem that happened to Debian 7.6? batman@gotham:~$ uname -a Linux gotham 3.14-0.bpo.2-amd64 #1 SMP Debian 3.14.13-2~bpo70+1 (2014-07-31) x86_64 ...
2
votes
1answer
2k views

Why does iptables still block my samba?

I'm currently fighting with iptables and samba. I read that samba needs ports 137-139 and 445 open on both tcp and udp. Here is the relevant part of my iptables config ... # forward valid incoming ...
2
votes
2answers
185 views

IPTables rule to allow incoming SSH connections

The aim of this script is to only allow traffic over the VPN, except for localhost<->localhost and incoming SSH traffic. But when I run the script over SSH I am disconnected and forced to restart ...
2
votes
1answer
191 views

Bad argument `127.0.0.1' in iptables

-A OUTPUT --destination ! '127.0.0.1' -m state --state NEW -j LOG --log-prefix "new_connection " --log-level 7 gives me Bad argument `127.0.0.1' What am I doing wrong? I used this docs : ...
2
votes
2answers
1k views

What is a solid iptables configuration for my desktop?

On my desktop, I want to configure iptables pretty strictly. I see no reason why I need to allow anything except for internet traffic that I initiated. And maybe even that could be limited to only a ...
2
votes
2answers
2k views

Remote SSH login not working

I have a PC behind a router with port forwarding setup Port 22 for SSH which works perfectly - I can login and everything. What I am trying to do is let this PC connect to a VPN and only allow ...
2
votes
1answer
2k views

iptables rule to allow access to internet

I made default policy of my machine- iptables -A INPUT -j REJECT #DROP ALL PACKETS TO INPUT CHANNEL INPUT channel has been blocked. Now I want to allow only some specific services like I should be ...
2
votes
3answers
105 views

What iptables command do I need to allow web server traffic?

I have a hard time understanding iptables rules. I am running a centos 6.5 VM on my laptop (vmware hypervisor) and it looks like it comes with this setup for iptables: # iptables -L Chain INPUT ...
2
votes
2answers
80 views

Temporary redirect ports

I need a temporary redirection of some ports to another machine. I've tried: iptables -t nat -A PREROUTING -p tcp --dport 4321 -j DNAT --to-destination 192.168.121.4:80 But shorewall blocks all ...
2
votes
1answer
78 views

Remove an IPTable Rule

I'm having troubles removing this ipables rule in Ubuntu: $ iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 3128 I've tried using the -D attribute but with no success. How can ...
2
votes
1answer
67 views

What does lo in iptables mean exactly?

I have seen countless examples of this rule in iptables: -A INPUT -i lo -j ACCEPT I thought lo means localhost (a.k.a. 127.0.0.1), but when I commented it out, I can't access the server using its ...
2
votes
2answers
302 views

Why isn't the Iptables persistent service saving my changes?

I followed this tutorial to set up IP rules on ubuntu 12.04. Everything worked fine on setup -- but now I've made changes to the firewall that do not persist upon reboot. I do not understand why that ...
2
votes
1answer
131 views

Lost connectivity after iptables change

I attempted to add a couple web ports to iptables and in doing so lost the ability to resolve any external address. I have a working SSH session open and can get to the box easily if needed. Here's ...
2
votes
2answers
3k views

Debugging iptables using live packet views

Are there any CLI or GUI functions that I can use to monitor hits to iptables and watch as packets interact with iptables?
2
votes
2answers
623 views

Iptables port forwarding to qemu vm

Is it possible to create an IPtables rule that forwards all incoming traffic on port 80 on the host to port 80 of the qemu VM? Is such a scenario possible with qemu?
2
votes
1answer
2k views

system wide SOCKS5 Proxy

I connect to my Server on the internet using ssh -D 3128 user@rootserver.com. If I am right I thereby open a SOCKS v5 Proxy to my Server. Using firefox and FoxyProxy I can now add this to my proxys ...
2
votes
2answers
121 views

Bonding two broadband connections to serve LAN as a gateway

I need to increase the connectivity and speed of the Internet to my LAN users. These are the things I have in my hand to do so. PC with 3 NICs 1 for LAN and 2 for routers 2 broadband connections ...
2
votes
1answer
36 views

Do I have to swap IP sets, or can I add/remove on the fly?

I was wondering about the semantics of ipset(8). Is it possible to add a rule matching a set to iptables and then manipulate the set, or can I only create a set and swap it for an older set in order ...
2
votes
1answer
44 views

Should IP tables rules affect a serial port on Linux

I'm trying to setup some iptables rules on my embedded Debian Linux system, using a serial console I entered this: root@ts7600-47aad3:~# iptables -F root@ts7600-47aad3:~# iptables -P INPUT DROP ...
2
votes
1answer
87 views

Port forwarding using iptables on Linux

I want to forward a local port to a remote port (8041) to a port (8042) on a remote machine (10.0.0.42). I can do this via ssh -L 10.0.0.41:8041:10.0.0.42:8042 user@localhost where 10.0.0.41 is ...
2
votes
1answer
51 views

How would I go about making this IPTABLE rule for every ip and not just one?

iptables -I PREROUTING -t nat -p udp -s 192.168.0.62 --dport 53 -j DNAT --to-destination 23.21.182.24 Instead of 192.168.0.62 I'd like to set that as a global rule, EVERY ip that needs dns should ...
2
votes
5answers
156 views

Difficulty setting up iptables

I'm very new to *nix operating systems, and I'm having some trouble which I believe is because of misconfiguration of the iptables firewall. My server has SSH running on port 22, and server software ...
2
votes
2answers
1k views

Why must loopback traffic be authorized using iptables to get web access?

I thought the following was necessary was necessary for outgoing HTTP on a desktop (non-server): iptables -A INPUT -p tcp -m multiport --sports 80,443 -m conntrack --ctstate ESTABLISHED -j ACCEPT ...
2
votes
1answer
359 views

IPTables string match redirection

The issue: I am currently redirecting port 80 requests to another system on port 1000. This is done like so: iptables -t nat -A PREROUTING ! -s 172.20.1.2 -p tcp --dport 80 -j DNAT --to-destination ...
2
votes
1answer
2k views

Log the dropped packets by IPTables only if its DROPPED by a specific rule

I have IPTables rules set on a Linux device. I have a particular rule to drop the packets, and I wish to log the packets only if they're dropped by that specific rule, and not by the other rules. ...
2
votes
1answer
716 views

iptables rules too restrictive; Drupal webserver cannot access repositories, ntp or even websites

This is a Drupal website running Ubuntu 12.04 LTS on Linode. Someone recently changed our iptables rules and a number of problems started. These include: Our Mollom spam protection is not working ...
2
votes
1answer
291 views

Can iptables be used to convert a single-homed host into a NAT server?

Given: I have a machine (HostA) with only one NIC which has Internet connectivity. I have another machine (HostB) with one NIC on the same switch. HostB is not configured for Internet access yet. ...
2
votes
1answer
188 views

Explanation of bandwidth management script calling tc

I have some scripts in Linux to manage internet bandwidth, but I do not understand what they do. What is the meaning of the following scripts: tc qdisc add dev $IF root handle 1: htb default 256 tc ...
2
votes
1answer
259 views

iptables is not blocking

I have a script running every minute by a crontab. This script scans the system logs and grabs the IPs of every failed attempt to login on the server's dovecot, exim or ssh and add them to an ipset, ...
2
votes
1answer
292 views

IPtables command shows libipt_random.so missing

When I run a command, it shows error. I searched on net, but no one give me the correct answer. Googling shows only wrong answers for this questions. So please help me to overcome this problem. ...
2
votes
2answers
523 views

Is xinetd still the best method to let non root daemons listen on privileged ports?

When I need to use SNMP monitoring for java applications, there is the need to that application (usually ran as daemon user) to listen on snmp port. If there is no other alternative, of course I can ...
2
votes
1answer
2k views

Port Mirroring using iptables - copy all traffic among nginx on :80 and apache on :8080

I have nginx running on port 80 and apache running on port 8080 I want to transfer all the traffic to both nginx and apache asynchronously i.e the performance of one server wont be dependent on the ...
2
votes
1answer
8k views

Fedora 16 - Iptables installed, but no iptables service available

I'm trying to open ports on my fedora OS. In the past, this was as easy as adding an rule like -A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT I went to restart my iptables ...
2
votes
1answer
1k views

What does this iptables entry mean?

iptables-save output: *filter :INPUT DROP [2929:172650] :FORWARD DROP [0:0] :OUTPUT ACCEPT [74596344:6265371965] These are the opening lines of the iptables-save command. What do the numbers in the ...
2
votes
1answer
2k views

Unable to make outbound SNMP connections when IPTables is enabled

I have a bunch of windows servers configured with the windows SNMP agent. Each server has four IP addresses and SNMP listens on all of them. There is something very odd with my monitoring server ...
2
votes
1answer
2k views

iptables/pf rule to only allow XY application/user?

I think there is no iptables/pf solution to only allow an XY application on e.g.: outbound tcp port 80, eth0. So if I have a userid: "500" then how could I block any other communications then the ...
2
votes
1answer
20 views

psad: do not block access to HTTP

I want to block intruders via psad, but HTTP and HTTPS should not be blocked. For example, if someone is scanning my dedicated server via nmap, psad should block him for 2 hours, but he should still ...
2
votes
1answer
250 views

Configuring OpenVPN to use Firewalld instead of iptables on Centos 7

I need some help configuring OpenVPN on Centos 7 using firewalld. I used iptables on Centos 6.5 and only had to add the following lines to /etc/sysconfig/iptables: -A POSTROUTING -s "10.0.0.0/24" ...
2
votes
1answer
95 views

Unable to access website hosted on virtual machine

I'm on a mac (osx 10.9.3) running CentOS7 in virtualbox. I would like to access the website hosted on the virtual machine. Browsing to the Guest IP returns webpage not available. I'm able to ping and ...
2
votes
1answer
53 views

In iptables, what is the difference between targets DNAT and REDIRECT?

More specifically, is -A PREROUTING -i $INT -p $PROTO --dport $PORT -j REDIRECT --to-ports $NEWPORT equivalent to one or both of these? -A PREROUTING -i $INT -p $PROTO --dport $PORT -j DNAT ...
2
votes
1answer
56 views

How do I enable IPv6 inbound traffic to get forwarded to my machine?

It seems that IPv6 traffic on my router is being dropped. How do I configure ip6tables appropriately, so that traffic is forwarded/accepted to my machine? Here's the syslog for my IPv6 traffic: Jun ...
2
votes
1answer
32 views

My iptables works the opposite from what I wanted

I have this set of iptables rules ... $ sudo iptables -n -L Chain INPUT (policy ACCEPT) target prot opt source destination LOG all -- 0.0.0.0/0 0.0.0.0/0 ...
2
votes
1answer
46 views

How to combine iptables rulesets

Say there are several iptables scripts (run at boot time), all of which run something like iptables -A ... to add rules. I'm thinking this could be improved, turning all those shell scripts into text ...