iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

0
votes
1answer
133 views

PPTP: Allow remote clients to communicate with each other

I have a PPTP server. Clients log in to the server, but can not ping each other. The clients are at different locations. The problem is with my IPTABLES forward chain .... here is my iptables: ...
0
votes
1answer
67 views

why debian repository does not contain lokkit?

I was using lokkit in redhat, and I want to use it in debian, but it seems that debian doesn't contain it...
1
vote
2answers
1k views

FTP and iptables. Connection fails but ports are open

I installed proftp on my machine. With iptables disabled I can connect to the machine, using ftp-client or telnet. With iptables connection fails - telnet says "Connection failed" # works telnet ...
0
votes
0answers
29 views

Run Sys V Init daemon as certain user?

When I installed dansguardian from the repos a long time ago, it set itself up such that in iptablesI could refer to it as --uid-owner dansguardian, which allows me to allow/deny it access to certain ...
11
votes
1answer
859 views

Is it better to set -j REJECT or -j DROP in iptables?

There's an example of iptables rules on archlinux wiki: # Generated by iptables-save v1.4.18 on Sun Mar 17 14:21:12 2013 *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [0:0] :TCP - ...
1
vote
0answers
138 views

Portforwarding: router nat vs iptables [closed]

I would like to host some services on my pc and make them available from internet. (I'm aware of the security implications, it's more like a test for now). I don't have experience with iptables but I ...
2
votes
1answer
75 views

Internet sharing with iptables: choosing which connection to share

I have a computer with two network devices (eth0 and wlan0), both connected to the internet (two different connections/isp). I'm trying to share the connection of wlan0 to another computer connected ...
2
votes
1answer
341 views

Understanding the iptables rules created by FirewallD

I am having a hard time trying to figure out what the iptables rules generated by FirewallD say. Focusing on the "public" input zone, I have the following rules: *filter :INPUT ACCEPT [0:0] :FORWARD ...
7
votes
1answer
140 views

What is the difference between -j DROP and -j STEAL?

I often see that people set STEAL target in iptables rules. It's possible to get this target by installing (on debian) xtables-addons-common and xtables-addons-dkms. I was curious why people prefer ...
9
votes
2answers
2k views

What do numbers in INPUT,FORWARD,OUTPUT chains mean in iptables config file?

I came across the following config file: # Generated by iptables-save v1.3.1 on Sun Apr 23 06:19:53 2006 *filter :INPUT ACCEPT [368:102354] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [92952:20764374] -A ...
7
votes
1answer
3k views

What is the difference between -m conntrack --ctstate and -m state --state

I'm reading this howto, and there's something like this: We can allow established sessions to receive traffic: $ sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT ...
1
vote
0answers
31 views

How to send packets coming from a second router on a particular port back to the router, using iptables not a route

I have a Linux server which runs a particular service listening on a single TCP port. The Linux server connects to the internet using a PPP connection and also acts as router for a local network using ...
0
votes
0answers
46 views

APF IPTABLES automaticly removing allow hosts

I'm using apf for configure iptables. From last 5 days, apf automaticly removing IP from /etc/apf/allow_hosts.rules Please help me to clear this issue.
5
votes
3answers
2k views

Is it better to set rules in ip6tables or disable ipv6?

I have the following network configuration: # ifconfig -a eth0 Link encap:Ethernet HWaddr 00:e0:1c:73:02:09 inet addr:10.1.4.41 Bcast:10.1.255.255 Mask:255.255.0.0 inet6 ...
1
vote
0answers
67 views

setting up a local VoIP to use as a Wifi Headset

I had this idea of using Wi-fi in a vehicle to connect my cell to the car call handler.Just as it works with bluetooth nowadays. Just to demonstrate that such a thing is possible , i had three Linux ...
0
votes
0answers
578 views

Use iptable do redirect all the HTTP traffic to localhost

I use a Linux machine as WLAN Router with the help of hostapd and udhcpd. There's also an Apache web server installed on the same machine. Now I want to redirect all the traffic which comes through ...
3
votes
1answer
191 views

listen to a conversation using port forwarding

I have been able to make a phone calls using the SIP client Pjsua from one Linux computer to another one. In case you have not heard of this user agent, explaining it's functionality is quite easy. It ...
3
votes
1answer
135 views

How to deny access to specific port when destination is NOT a specific host?

I'm trying to DENY access to port 1000 when it is being accessed through any host or IP that is NOT a specific host. I.e. If I try to access the service on sub.domain.com:1000 I should get in. If I ...
0
votes
0answers
140 views

Cloning packets with iptables

I can't figure out for sure, is there a way to clone packets with iptables on one machine? I have an UDP stream to the specific addres (e.g. 192.168.207.201:9702) and I want to do some processing on ...
3
votes
1answer
1k views

IPTABLES is slow after adding '-A INPUT -j DROP' to rule list

I am just getting started with iptables and stumbled across something I don't really understand. FYI, I followed the instructions of Ubuntu wiki's IptablesHowTo. The nat and mangle tables are empty, ...
1
vote
3answers
2k views

iptables-restore just says “FAILED”

I am not sure what's wrong with my rule in the Iptables. I am actually trying to build a SSH server and following a cyberciti tutorial. My Iptables configuration looks like this: # Firewall ...
0
votes
1answer
53 views

Configuring iptables by software

Is there a software, or a linux distro which has such a software built-in, which makes configuring the iptables easier? If not, I thought that some of the mostly used configuarations with a simple GUI ...
2
votes
2answers
110 views

RELATED,ESTABLISHED state in iptables

What do the words 'RELATED' and 'ESTABLISHED' individually signify in RELATED,ESTABLISHED state in iptables?
4
votes
1answer
4k views

How to Allow Outgoing SMTP on iptables Debian Linux

If I choose to allow all traffic on the OUTPUT chain (iptables -P OUTPUT ACCEPT) mail sends fine. As soon as I lock down my server with these rules, outgoing mail stops working. All else works though, ...
4
votes
2answers
193 views

How can I prevent iptables from counting bytes and packets on empty chains?

Background I occasionally have firewall rules that I need to use for maintenance windows, but don't want active (and therefore consuming CPU cycles or slowing the network interface) the rest of the ...
1
vote
2answers
1k views

Block specific application with iptables [duplicate]

I have to harden a Linux desktop as an assignment in my college. But I got stuck at a specific problem: I have to control the outgoing traffic with iptables. It should be possible to prevent a ...
2
votes
1answer
177 views

pptpd dead but subsys locked? on cent os

i install point to point tunnel (PPTP) in my VPS. (Cent OS 6 64 Bit) everything fine after reboot the PPTP not worked client side. the pptpd status shows " pptpd dead but subsys locked ". how to ...
2
votes
1answer
262 views

No internet even with iptables ACCEPT all

I was trying to setup the firewall settings, and probably did something wrong. I don't have internet now unless I stop iptables service I tried flushing,and accepting everything sudo iptables -F ...
1
vote
2answers
628 views

iptables: The “script” way or the “*filter, rules, COMMIT” way?

I'm trying to figure out how NAT and iptables work. While I'm in the trial-and-error phase of learning about it, I found two somewhat conflicting howtos. One howto uses a script to call iptables ...
1
vote
2answers
149 views

How is the loopback device traffic allowed?

How can I allow the traffic to be sent on the loopback device (lo)? What is the iptables command for it?
0
votes
1answer
300 views

iptables couldn't load target allow

I am using the command below to allow all traffic from hosts on my internal network but it says "iptables v1.4.18: Couldn't load target `ALLOW':No such file or directory". What is the problem here? ...
1
vote
1answer
307 views

Archlinux not configured with iptables

I have been trying to set up iptables on my archlinux server, however when I run iptables -nvL I receive the error iptables v1.4.20: can't initialize iptables table 'filter': Table does not exist ...
2
votes
0answers
284 views

Route all HTTP traffic through polipo

I've set up polipo on my machine to listen to the default port 8123. To test it, I set the in-memory cache to a ridiculously high 2 GB and downloaded a 50 MB file using wget utilizing the proxy. ...
0
votes
2answers
451 views

Route wlan0 to openVPN tunnel and rest to eth0

I'm having problems to create route/iptables rules for following configuration: I have an openVPN server (tun type) running on my raspberry machine at home At work i have company pc (behind proxy) ...
4
votes
1answer
92 views

How do you do NAT port redirection with PF?

In Linux, you can do NAT port redirection with a command like this: iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8000 What is the equivalent with BSD's PF?
0
votes
1answer
172 views

iptables - why the stun, turn ports are not working to allow end points to access the server?

I have this iptables where all working except tcp/udp port 3478 and 5349. $ cat /etc/sysconfig/iptables # Generated by iptables-save v1.4.7 on Thu Nov 21 10:21:41 2013 *filter :FORWARD ACCEPT [0:0] ...
2
votes
1answer
86 views

Port forwarding using iptables on Linux

I want to forward a local port to a remote port (8041) to a port (8042) on a remote machine (10.0.0.42). I can do this via ssh -L 10.0.0.41:8041:10.0.0.42:8042 user@localhost where 10.0.0.41 is ...
1
vote
1answer
180 views

Session limit for OpenSSH server on Ubuntu Desktop 7.10

I need restrict session limit on my OpenSSH server only for one session (one connection). I use Ubuntu Desktop 7.10. Of course Version is old, but I need it for experimental purposes. I tried modify ...
5
votes
3answers
2k views

route traffic out different gateway by destination network

I have several gateways and would like to route some traffic out of different gateways based on its destination. I'm guessing I'd need to use a combination of iproute2 and iptables rules, but am not ...
0
votes
0answers
520 views

Fail2ban - alternative robust for enterprise protection against DoS attack in SIP and similar to fail2ban features

Is there any fail2ban like software for CentOS 2.6.32-358.6.2.el6.x86_64 ? (fail2ban is 0.8.10 installed) but its slowing down the system completely, i was looking for something which can be similar ...
2
votes
0answers
213 views

iptables REDIRECT in combination with matching on interface vs. IP address

I've successfully set up Tor for transparent proxying using iptables (ie, all outgoing traffic is sent through Tor without the application's knowledge). In doing so, I discovered both an odd problem ...
3
votes
2answers
2k views

iptables: rules for tftp server

I have a tftp server which listens on standard UDP port 69. I have added following rule to my iptables to block everything except UDP 69. -A INPUT -i eth0 -s 192.168.1.0/24 -p udp -m udp --dport 69 ...
0
votes
2answers
89 views

Modifying one line in Iptables

How would one modify the following line in iptables file (debian)? ACCEPT all -- XXX.XXX.XX.X anywhere PHYSDEV match --physdev-in vif3.1 TO ACCEPT all -- ...
1
vote
1answer
147 views

Bandwidth throttling per user group

I am wondering if it is possible to create a bandwidth shaping/throttling script that shapes traffic based on user group. That is, if user1, user2, are in user group group1, they will have 1mb/s ...
0
votes
1answer
278 views

iptables rules for iscsi initiator

I need to configure iptables on my client (iscsi-initiator). From tcpdump, I can see that the server (iscsi target) sends tcp from port 3260. So I have added following iptables rule on my client ...
1
vote
0answers
276 views

destination IP mangle table

I have machine with 2 interfaces: eth1 connected to internet (ip xx.xx.xx.xx) eth0 connected to my laptop (ip yy.yy.yy.yy) I add those lines to the firewall file in order to manage the bandwidth ...
4
votes
2answers
418 views

fail2ban log parsing too slow on Raspberry Pi - options?

I'm running fail2ban on a Raspberry Pi at 950MHz which I cannot overclock further. The Pi is occasionally subject to SYN floods on particular ports. I've set up iptables to throttle the rate of SYNs ...
0
votes
0answers
111 views

prioritize traffic for some bridge interfaces using prio qdisc

Im configuring my router to give preference to some WAN interfaces. This interfaces are named ppp0 (PPP interface), vc2 (RFC1483 bridge interface) and vc3 (RFC1483 bridge interface). I had understood ...
2
votes
1answer
1k views

Linux Fedora 19 - iptables failed to start

I've been trying to start the iptables firewall service, but it keeps failing. What's going wrong? # systemctl status iptables.service iptables.service - IPv4 firewall with iptables Loaded: loaded ...
1
vote
1answer
197 views

How do I allow only certain IPSet set's to access a certain port with iptables?

I'm using IPSet to build IP ranges for different countries as follows : # Canada ipset -F ca.zone ipset -N ca.zone nethash for IP in $(wget -O - http://www.ipdeny.com/ipblocks/data/countries/ca.zone) ...