iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

2
votes
0answers
169 views

iptables rule to transfer UDP through a SSH tunnel

The problem I have two programs that runs on two distant computers and communicate through a specific protocol. All I know is that this protocol only communicates through UDP and uses the ports 1101 ...
0
votes
0answers
486 views

Upon bootup, all iptables are lost because the kernel module ip_set is not loaded

i can get iptables to whitelist / blacklist using ipset members, but after a reboot, the iptables are emptied out because the kernel module is not loaded. Have limped along in the past by customizing ...
0
votes
1answer
70 views

how to find out wich chain in iptables in listing

Suppose I have the following two entries line of iptables: iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE iptables -A INPUT -s 192.168.1.0/24 -j DROP So, I have POSTROUTING and INPUT chains. ...
3
votes
1answer
2k views

Configuring OpenVPN to use Firewalld instead of iptables on Centos 7

I need some help configuring OpenVPN on Centos 7 using firewalld. I used iptables on Centos 6.5 and only had to add the following lines to /etc/sysconfig/iptables: -A POSTROUTING -s "10.0.0.0/24" ...
0
votes
0answers
223 views

IPtables Packet Balancing

I would like to see the below work as a result of seeing several posts online that have this working but not quite the same as my situation. Forgive me if it appears to be a stupid idea as I'm now ...
1
vote
1answer
49 views

Confused by different output from iptables -L

I keep following this tutorial using a bash shell on ubuntu 12.04 as I open more and more ports on my server. I usually open up ports like this sudo iptables -A INPUT -p tcp --dport PortNumberToOpen ...
0
votes
1answer
49 views

What this Iptables rules does?

I think I can understand this iptable rule, but I want to make sure what it does, so can someone explain to me technically what this does? well this two rules combined. /sbin/iptables -t nat -A ...
2
votes
0answers
31 views

Extra overhead in MASQUERADE target

There's a part in iptables manual concerning SNAT and MASQUERADE targets. I know the key difference between the two, but I don't fully get the following sentence: It is still possible to use the ...
0
votes
0answers
97 views

How can I use 0.0.0.0/0 in ipset hash:net,port?

Right now, if I do ipset a ansible_allowed 0.0.0.0/0,tcp:22 I get ipset v6.19: The value of the CIDR parameter of the IP address is invalid and instead I have to add 0.0.0.0/1,tcp:22 ...
3
votes
1answer
137 views

IPTables rules for specific processes [duplicate]

I have a lot more experience with the Windows Firewall with advanced functionality than I do with IPTables. With the WFAF, I was able to lock down a program so that it could only connect over specific ...
3
votes
1answer
42 views

Which network services depend on the “accept related input” iptables rule?

Background I am setting up a firewall for a webserver and was wondering if it would be a good security meassure to even reject RELATED input traffic and only except established connections by ...
-1
votes
1answer
187 views

MYSQL : Connecting to mysql from : 127.0.0.1 + telling ip tables to allow only 127.0.0.1 for mysql port : Logic vs Common Sense

If i make 1 billion or 1 trillion queries to MYSQL database from 127.0.0.1 via port 3306. vs If i make same amount of queries to MYSQL database also from 127.0.0.1 via port 3306. but with ...
6
votes
2answers
2k views

Move iptables rule (w/o removing and adding)

Is there a way to move a rule in the iptables and change it position ? I'm aware i can use -I to insert a rule in a specific position, but i also like to keep the counters.
2
votes
0answers
48 views

How can I configure iptables for per application setup?

I am working on a project where we are building lots of micro-services. Each service is neatly packaged as an RPM. Ideally I'd like for us to have iptables enabled on all of our machines and it would ...
0
votes
0answers
52 views

Why SAMP is not listening to the port

I have forwarded 38474 port to internal port 7778. Then I launched San Andreas Multiplayer on my CentOS server. When I'm typing netstat -npl I see this: Proto: tcp Recv-Q: 0 Send-Q: 0 Local Address: ...
1
vote
1answer
401 views

Curious about strange ICMP type 3 code 10 traffic to my IP address

My firewall (iptables) logs some strange ICMP type 3 code 10 traffic that I am curious to understand (specifically how or if this could be an exploit of some sort). Type 3 = Destination ...
1
vote
0answers
164 views

Forward local port to remote port in a Vagrant machine

I have MySQL running on my local machine and I need to publish this port to a Vagrant box without any special SSH hackery. Is there a way for me to forward 10.0.2.2:3306 to 127.0.0.1:3306 on the ...
10
votes
2answers
14k views

How to ensure SSH port is only open to a specific IP address?

This is my /etc/sysconfig/iptables: It has two ports open 80 apache and 22 for ssh. # Firewall configuration written by system-config-firewall # Manual customization of this file is not recommended. ...
1
vote
0answers
88 views

Redirect shared internet to tor/privoxy [closed]

I have shared my internet and set my client gateway to my IP, every thing works. I need to client goes through tor. I configured privoxy to use tor and with this iptable command I defined a rule: ...
2
votes
1answer
720 views

Unable to access website hosted on virtual machine

I'm on a mac (osx 10.9.3) running CentOS7 in virtualbox. I would like to access the website hosted on the virtual machine. Browsing to the Guest IP returns webpage not available. I'm able to ping and ...
2
votes
0answers
211 views

iptables hangs at applying rules

I have a set of rules that are supposed to give me the most protection before things like fail2ban and other things are added to the mix. The issue is that although everything checks out in the test, ...
0
votes
1answer
62 views

how to get effect of IP rules script in RHEL 6?

I have written one ip.sh file in that I have written one rule and then saved the iprules with the corresponding commands. Now when I opened /etc/sysconfig/iptables nothing is reflecting. I need the ...
1
vote
0answers
69 views

ISC DHCP Server - A Client's Uplink Is Not Working

Running a DHCP server, client(s) does not have up-link (0Mbps) and has a downlink (50Mbps.) I am setting up a gateway/router on a PC running Debian Wheezy with ISC-DHCP. I have 1 WAN (eth0) and 2 LAN ...
3
votes
0answers
230 views

iptables rule no actions on scapy packets

I wrote this rule to change all udp destination IP addresses to 8.8.8.8 when dport is 53: iptables -t nat -A OUTPUT -p udp -m udp --dport 53 -j DNAT --to-destination 8.8.8.8 The rule worked when ...
9
votes
2answers
5k views

( /etc/sysconfig/iptables ) “Manual customization of this file is not recommended.” Why?

Editing this file directly /etc/sysconfig/iptables can save me so much headaches so much time and so on... and yet on the very top of the file it says.. Manual customization of this file is not ...
0
votes
1answer
115 views

Is it OK to copy /etc/sysconfig/iptables to another machine?

This is my original server with very loose security given that it does not block all ports via iptables. /etc/sysconfig/iptables contents: # Generated by iptables-save v1.4.7 on Mon Jun 16 ...
-1
votes
1answer
2k views

/etc/sysconfig/iptables : how to block everything except for port 80 and 22?

My new centos 6.5 cloud server came with this /etc/sysconfig/iptables inside we have: # Generated by iptables-save v1.4.7 on Mon Jun 16 20:04:05 2014 *filter :INPUT ACCEPT [8:607] :FORWARD ACCEPT ...
1
vote
1answer
8k views

How to modify iptables rules via editing a file rather than interacting via command line?

In the history, i would simply edit a file and then reboot the whole server. i would clone the line that had port 22 open change it to 80 and then save the file.. and reboot the whole system so ...
2
votes
1answer
369 views

In iptables, what is the difference between targets DNAT and REDIRECT?

More specifically, is -A PREROUTING -i $INT -p $PROTO --dport $PORT -j REDIRECT --to-ports $NEWPORT equivalent to one or both of these? -A PREROUTING -i $INT -p $PROTO --dport $PORT -j DNAT ...
13
votes
3answers
6k views

Iptables to redirect DNS lookup IP and Port

I have discovered that my ISP (verizon) is intercepting all DNS traffic on port 53. Using iptables, I want to redirect all DNS lookup traffic to a specific IP and Port (5353). Any attempt for my ...
3
votes
2answers
103 views

Iptables not forward traffic

I need to redirect all traffic incoming on port 9750 (the port chat server) to another machine on the same subnet. Ports clients - dynamic. iptables -t nat -A PREROUTING -p tcp -d x.x.x.a --dport ...
1
vote
2answers
100 views

Reject ssh connections made from proxies

I was seeing this question which was concerned with blocking access to the users who do not belong to a particular region. I am sure that blocking is possible but I see there is a workaround to this. ...
1
vote
1answer
594 views

DROP all for port 22 if not geoip set of US for iptables and xtables

I want to simply block all ssh access from anywhere but with in the US. This is my whole iptables, and I have followed ...
0
votes
0answers
112 views

iptables blocking email from my wordpress site

I cant seem to send email from my Wordpress site. Here is what my iptables script looks like. Ports 25 and 110 are commented but even uncommented the send email does not work. #!/bin/bash # A Linux ...
2
votes
3answers
246 views

What iptables command do I need to allow web server traffic?

I have a hard time understanding iptables rules. I am running a centos 6.5 VM on my laptop (vmware hypervisor) and it looks like it comes with this setup for iptables: # iptables -L Chain INPUT ...
2
votes
0answers
76 views

Transparent Proxy

I am setting up attempting to set up a transparent proxy on CentOS using Squid. So far I have managed to filter the content and get it working perfectly. The only issue I am having is getting a form ...
1
vote
0answers
218 views

Open ports for local samba server with iptables

I can't seem to connect from Windows 7 to my network share on Ubuntu (Samba). Why won't this work? Heres a bit of information, that would perhaps be useful. user1@computer:/etc$ sudo iptables -L ...
6
votes
1answer
640 views

forward outgoing traffic port using iptables

I am trying to forward all outgoing traffic from port 80 to port 8080 using iptables and I tried the following rule, though it did not work: iptables -t nat -A OUTPUT -p tcp --dport 80 -j REDIRECT ...
1
vote
1answer
195 views

forwarding not working in iptables from 8006 to 443

My dedicated server was bridged to vmbr0 and it has 2 Ethernet cards eth0 and eth1 its bridged. I have enabled forwarding with net.ipv4.ip_forward=1. I want to redirect the Port 8006 to 443. Now ...
0
votes
2answers
216 views

iptables and securing an smtp

I am trying to block all SMTP out of my network, that is not from my internal mail server address. So i would just like to know if there could be anything i am missing or perhaps anything i could ...
8
votes
6answers
322 views

iptables rule adviser script

There is a server without any iptables defense: ACCEPT all.. There could be custom applications on this server. If we should need to harden this server (so deny all, and only let what is needed by ...
-1
votes
2answers
1k views

My Centos Server cannot resolve the DNS host name [closed]

My Server OS: Centos 6.3 x64. The server iptables is: *filter :INPUT DROP [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT -A INPUT -p tcp -m tcp --dport ...
0
votes
1answer
242 views

Linux iptables DNAT 53306 to 127.0.0.1 3306

mysql real port is 3306。 I want public network using 53306 to visit mysql, and 3306 is not allowed access from public network. How to write the iptables rules DNAT 53306 to 127.0.0.1 3306?
1
vote
0answers
3k views

set rules for openvpn by iptables in firewall CentOS 6.2

Firewall (FW), three leg: eth0: 172.16.1.101 eth1: 192.168.99.99 (LAN) eth2: 10.0.0.1 (DMZ) I installed openvpn in FW by tunnel mode, already ok: tun0: 192.168.10.0/24. If I use shorewall and ...
1
vote
0answers
3k views

Error: iptables: No chain/target/match by that name

I am trying to configure proxy server on RHEL Server 6.5 using Squid and iptables. Below is the command I executed and the error message it displayed: vzlptest01 root [root] > iptables -A INPUT -i ...
1
vote
1answer
418 views

Bridged TAP interface to virtualbox

I need bridged TAP interface on client side of my VPN to virtual machine. I use VirtualBox 4.3.12. But in Adapter Network options in Attached to: Bridged adapter I do not see my TUN adapter. I have ...
2
votes
1answer
107 views

How do I enable IPv6 inbound traffic to get forwarded to my machine?

It seems that IPv6 traffic on my router is being dropped. How do I configure ip6tables appropriately, so that traffic is forwarded/accepted to my machine? Here's the syslog for my IPv6 traffic: Jun ...
1
vote
0answers
196 views

Packets sent through TUN interface not routed

I have a C program attached to a TUN interface. In my C program, I'm building packets and writing them to the TUN interface. Now to check if packets are really sent from my TUN interface I use ...
7
votes
3answers
9k views

Limit max connections per IP address and new connections per second with iptables

We have an Ubuntu 12.04 server with httpd on port 80 and we want to limit: the maximum connections per IP address to httpd to 10 the maximum new connections per second to httpd to 150 How can we ...
2
votes
1answer
37 views

My iptables works the opposite from what I wanted

I have this set of iptables rules ... $ sudo iptables -n -L Chain INPUT (policy ACCEPT) target prot opt source destination LOG all -- 0.0.0.0/0 0.0.0.0/0 ...