iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

0
votes
1answer
65 views

Automatically initiate an outbound SSH connection on a server when a client connects

How can I automatically initiate an outbound SSH connection on a server when an internal client connects to that server on a specific port, for any given service, from a given IP range? Note that the ...
0
votes
1answer
41 views

Configure linux PC as a Router

I want to configure my Rasberry Pi as a router. I have two network interfaces eth0 and eth1 connected to two networks. eth0 is connected to a private network and eth1 is connected to a public network ...
0
votes
1answer
229 views

Have iptables run command/script on new connection attempt [duplicate]

How can iptables run a command or script on a new connection attempt? Requirement: External packet to (server interface eth0) ---> (Server interface eth0) input table detects new packet received on ...
1
vote
1answer
42 views

iptables inside bridge

if i have: eth0 (no address) wlan0 (no address, providing wifi-hotspot by 'hostapd') br0 (local IP, bridging eth0+wlan0) eth1 (public IP, providing internet to above by net.ipv4.ip_forward=1) ...
0
votes
0answers
55 views

iptables - ignore logging a single rule

Currently my iptables log all dropped packets. I have the log rule at the bottom. The problem is, I have a noisy neighbor who is flooding the subnet with UDP 17500 packets. I'm assuming its Dropbox ...
0
votes
1answer
87 views

Problem adding iptables rule

I just installed OMSA and need to open up port 1311 to access the web tool. Here's iptables before: [root@mybox ~]# iptables -nvL --line-numbers Chain INPUT (policy ACCEPT 0 packets, 0 bytes) num ...
0
votes
1answer
74 views

iptables resolved addresses differs from nslookup

To block personal emails on a corporate network, I've blocked FORWARD to mail.google.com and mail.live.com. The following is how iptables resolved those addresses: $ sudo iptables -L Chain FORWARD ...
2
votes
0answers
117 views

Can I add iptables rule from the inside of a C Linux program only with capabilities or do I need necessarily root?

I need to add an iptables rule from the inside of a C Linux program. How should I do? Do I need root privilege or can I just grant some capabilities? I tried granting CAP_NET_RAW+iep and using ...
1
vote
1answer
207 views

Can I setup a local transparent proxy to forward requests to another another web proxy

I would like to set up a local Linux system to tunnel all http/https requests transparently through a corporate proxy. Many scripts honor http_proxy environment variables but some don't and it is a ...
3
votes
0answers
281 views

Captive Portal on Raspberry Pi (raspbian) with Bridged Adapter

I am trying to create a captive portal on a Raspberry Pi by following the steps from this GitHub project: https://github.com/thgh/pilon I have 2 network interfaces on the pi. wlan0 TP-Link ...
2
votes
0answers
35 views

iptables not working on mobile broadband

I access the internet using a VPN. With the help of iptables rules all out-going traffic from my machine to the internet is dropped instantly when my VPN connection is abruptly terminated. The ...
0
votes
0answers
29 views

help with iptables configuration

i want to run two vpns on local host. I want that all traffic is sent first to the first vpn, and then to the second vpn, and no other outside leaks. Could you help me please to realize this? ...
1
vote
0answers
101 views

Sniff on SWITCH(lan) traffic openWRT

Is it possible to sniff (with tcpdump) or mirror LAN traffic that doesn't get routed to WAN using openWRT? Say I have two PCs connected to LAN ports and I want to sniff on traffic one PC is sending ...
2
votes
0answers
106 views

How to restrict openvpn clients to communicate with other vpn clients

I have this Openvpn scenario.. I have Lot of openvpn clients connected to my server, All i want is to restrict client to client communication. for eg. i have ...
1
vote
0answers
32 views

Filtering bridged packets by IP address

I am using a small Ubuntu 12.04 box as a Wi-Fi Access Point. The box has two interfaces which are bridged together as follows: brctl addbr br0 brctl stp br0 off brctl addif br0 wlan0 brctl addif br0 ...
1
vote
1answer
75 views

iptables forward from host to guest interferes with vm-vm communication

My iptables -L: Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT udp -- anywhere anywhere udp dpt:domain ACCEPT tcp ...
0
votes
0answers
23 views

forwarding port to an server on the Internet

Now I need to use iptables on an internal server(the server is not a gateway and has one nic) to forward a port to a server on the Internet. So when I access the port on the Internet it will forward ...
1
vote
0answers
27 views

Forward public network around current network

For the purposes of this discussion, I have a very current always-on linux machine with two nics: wifi0 eth0 A very crude diagram of my desired configuration looks like this: ...
0
votes
1answer
81 views

Access my web server publicly

On my Debian server I have a eth0 interface (192.168.10.x) and I just added eth1 (176.31.36.x). I would like to set up a public access for ssh, web, ..etc. allow-hotplug eth1 iface eth1 inet static ...
1
vote
1answer
370 views

Conditional Check for IPTables

I am trying to check whether specific rules in IPTables exists or not. #!/bin/bash if iptables -L -n | grep -- "ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:8880"; then ...
1
vote
0answers
146 views

How to replace udp packets on the fly

I've used iptables to reroute traffic to netsed like this, but it seems to route the traffic to another location. I've used hexinject like this: hexinject -s -i eth0 -c 1 -f 'arp' | replace '06 04 ...
1
vote
1answer
219 views

How to route traffic through different proxy servers based on destination

Background I work on a corporate network that is behind a proxy server. I also work with some remote sites that I am able to access via a bastion / jump host ssh proxy. In my ~/.ssh/config I have a ...
2
votes
2answers
95 views

Best practises: Applying iptables firewall rules for SSH

I need to add some firewall rules in our QA environment using iptables. I have to do the changes remotely . Some of the changes also include disabling SSH for few Networks . What are best practices ...
0
votes
0answers
59 views

Incoming internet SSH traffic to eth0 and outgoing internet traffic to wlan0

I have this setup: kali linux on raspberry PI connected to eth0 and wlan0. eth0 has internet access and public ip with port 22 open. wlan0 has internet access. I want to be able to connect to my ...
1
vote
1answer
48 views

Iptables dropping HTTP 302 packages contain suspicious domain string

The HTTP 302 packages I want to block have: Header HTTP/1.1 302 Found Location: ...
0
votes
1answer
111 views

Open port on one IP

I have spent all day looking this up with no luck. So, I own the IP range xxx.xxx.xxx.xxx/27 and I want to open port 22 on IP xxx.xxx.xxx.66 yet close port 22 on all others, then open port ...
1
vote
1answer
247 views

What order are mangle dscp rules applied with iptables?

I'm using iptables mangle to mark traffic with different DSCP values. I'd like to confirm the order in which overlapping rules will be applied. I assumed that the logic would be the same as with ...
2
votes
1answer
418 views

Why does iptables accept packets on a given port, when it is closed?

Here is my situation. I have a public address on my router and have manually forwarded a given port for torrenting, so not via UPnP, that is disabled both in the router and the application. It works ...
-2
votes
1answer
254 views

iptables: command not found - CentOS 5.5

I am using CentOS 5.5. I want to add new IP in my iptables. But I cannot do it. Tried everything with 'iptables'. The latest version of 'iptables' is at sbin. I'm in 'sbin' directory. But it says ...
6
votes
2answers
149 views

How can I silently drop some outgoing packets?

I'm doing some testing of an application I am working on, and I need to be able to silently drop outgoing UDP packets for a short period of time to replicate a possible failure mode. Is there any way ...
0
votes
1answer
69 views

iptables nat not work for sctp

i have a server in internal network and i want to access it from external. the network is like this: Server A (132.196.28.229) is in external network Server B (10.35.202.24) can access both network ...
0
votes
1answer
231 views

IPTABLES - Bad IP Address

I am trying to turn my Raspberry Pi into a VPN server. To do this I am following this tutorial. The only issue is when it tells to to run this command iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o ...
2
votes
0answers
46 views

Detect which program is blocked by firewall

The linux firewall can show a lot of information in the LOG target, for example via --log-uid. How can the executable doing the network call be logged, too? I did not find anything in the FAQ, the ...
0
votes
0answers
129 views

Raspberry Pi OpenVPN SSH problem

I followed this tutorial to configure OpenVPN and it and runs very well: http://blog.frd.mn/raspberry-pi-vpn-gateway/ Now I want to access my Raspberry Pi via SSH. OpenVPN is most of the time ...
0
votes
1answer
183 views

How to set up a clear SuSE-Firewall?

I’m doing some rules in a machine with the firewall disabled, but when I run rcSuSEfirewall2 a lot of rules and policies are applyed by default: iptables -L Chain INPUT (policy DROP) target prot ...
0
votes
1answer
265 views

ufw won't allow connections to port 5432

I've installed Postgresql 9.4 on Ubuntu Trusty from the PGDG ppa. I've created a database and set it listen-addresses to '*'. I've made an entry in the pg_hba.conf file. I can connect locally with no ...
0
votes
0answers
265 views

Use iptables to redirect **all* requests, even DNS-unsolved domain?

Context: With iptables, I redirect all the traffic - incoming at port 80 - to a distant server IP (X.X.X.X). I aim that anywhat you write in the urlbar of browser, you get X.X.X.X. IP That works ...
4
votes
1answer
505 views

forward all mysql traffic to a ssh tunnel

I have a local application that needs to connect to a remote mysql server at 40.40.40.40:3306 The main firewall blocks all connections but ssh, I can set up a ssh tunnel and connect to the server ...
2
votes
1answer
75 views

Per user routing on wifi

I'm using vpn but i want to have one user that could access network not through vpn but using my real ip address. The problem is that all solutions i found by quick google'ing, for example this ...
1
vote
1answer
74 views

iptables and ssh

I'm running Arch Linux and I have a running SSH daemon to access my machine when I'm out side my LAN. I can do the connection, but iptables keeps blocking SSH Daemon, so I can only connect if I turn ...
0
votes
1answer
35 views

iptables rules' weird behavior

I have a set of iptables rules (see below) whose purpose is to disallow traffic to go out of my machine when my VPN connection is abruptly lost or manually terminated: #!/bin/bash echo "Please wait ...
0
votes
0answers
37 views

RHEL 6 IPTables filtering of IPSEC protected Traffic

looking for some guidance to make sure I'm going in the right direction and maybe get some hints or gotcha's I need to be thinking about. I'm working on RHEL 6.4. I have a cluster of computers that ...
6
votes
1answer
166 views

Why doesn't NAT reserve ports from the machine's TCP and UDP port pool?

I made two experiments. This is the network for both of them: [private network] [public network] A -------------------- R ----------------- B 192.168.0.5 192.168.0.1|192.0.2.1 ...
0
votes
1answer
233 views

Default gateway is not reachable

I have a vmware player on which i have installed CentOS 6.5. And on that CentOS 6.5 i have installed lxc and on that lxc i have installed centos 6.3. I am using NAT and bridger as a Network adaptor ...
4
votes
1answer
52 views

Is it possible to reduce information in iptables log?

I noticed that there are data in the iptables log that I don't need, so I was wondering if it's possible to change some configuration so that the log has less information, thus reducing the log's ...
2
votes
1answer
233 views

Rewrite source IP in TCP replies using iptables

I'd like to rewrite the source IP on TCP/514 traffic leaving a redhat machine, for connections that weren't initiated from the machine. The machine receives TCP/514 traffic on an interface, for ...
0
votes
0answers
53 views

server1 ssh's to server2 but server2 sees server1 by it's private ip due to both servers being on the same firm/network

I ssh into server1 via it's public IP from server2. I then ask server1 what my IP is. i.e. server2's IP. It shows me server2's private IP. I want it to show me server2's public IP. If server2 was ...
0
votes
1answer
143 views

Apache VirtualHost redirect 302 (cyclic link)

I seek some wisdom, so please help... I have one VM acting as router/web server/dnsmasq server on IP: 192.168.100.1. And I have other machine acting as client. Server has IPTables rule to redirect ...
0
votes
1answer
306 views

iptables - how to drop protocols [closed]

I have the desktop-server Debian Jessie machine running for testing purposes just for 19 hours now. I have already set a few rules as you can see above. But I am not really into networking. So it ...
0
votes
0answers
122 views

iptables: block communication with others in same subnet

I have a couple of devices in my subnet (e.g. 192.168.0.0/24) and would like to make sure that one of these devices (identified by MAC or IP) can only talk via the router (where I'd like to set up ...