iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

3
votes
0answers
44 views

Configuring a Linux Wi-Fi access point to redirect a one-word URL to http://192.168.42.1:8888

've created a Wi-Fi access point on a Linux box (thanks to hostapd). I'm trying to make it easy for clients to access the Freenet service that's running on said box. Ideally, the user would be able ...
0
votes
1answer
421 views

nc command and iptables on CentOS7

I have practised in using iptables on CentOS 7 (It is a guest machine on Virtual Box). At first I disabled firewalld: systemctl disable firewalld systemctl stop firewalld Then I installed iptables: ...
1
vote
1answer
253 views

How to get a deterministic complete dump of all iptables rules?

How to get a deterministic complete dump of all iptables rules? By complete, I mean all tables of iptables. By deterministic, I mean when the command is run multiple times without modifying any ...
1
vote
1answer
77 views

Log source IPs of all incoming packets

How does one log the IP addresses of all machines that send packets or connect to the server? Also, how can one block IPs which are involved in a DDoS and are flooding the server with packets?
1
vote
1answer
50 views

Is there a way to automatically restart docker after updating firewall rules with iptables?

A recent update of iptables and firewall rules caused errors in our app. The culprit was finally found: the docker daemon needed to be restarted because it adds its own NAT rules to the firewall. How ...
1
vote
1answer
60 views

1:1 NAT through VM VPN

I've got a few client servers that I connect to with different VPN clients (e.g. Cisco, OpenVPN, etc). I'm trying to set up an Ubuntu 14 VM (with VPN client permanently connected) for each server to ...
0
votes
1answer
61 views

Debian 8.0 minimal IPtables Persistent not loading on boot

First thing I will say is that I am a really fresh beginner with Linux servers. For my company we are working on a phone system that is running on a Debian 8.0 minimal VPS hosted at Wable.com. ...
0
votes
1answer
66 views

How to remove specified IP address from iptables?

I can access to my CentOS server from specified IP address, when I am using VPN, everything is OK. When I am running iptables-save | grep ip.add.re.ss -A INPUT -s ip.add.re.ss/32 -j ACCEPT -A DENYIN ...
1
vote
1answer
86 views

FreeBSD equivalent of Linux's “xt_bpf” filtering module

In Linux 3.9 there's a packet filter module called xt_bpf that can take compiled BPF bytecode and use it directly in an iptables rule. Is there any equivalent for FreeBSD's ipfw system?
1
vote
0answers
58 views

iptables Forward port range on dd-wrt for proxmox vnc

I am running proxmox on my LAN and DD-WRT for my router... I want to use cloudflare with proxmox, but cloud flare only allows these ports(https): 2087, 2096, 8443. But proxmox VNC ports are 5900-5999.....
-2
votes
1answer
30 views

What happens if I block ssh connection from any IP address? [closed]

Does it any good for security, if so why developers put it in, in the first place? I just started learning about iptables and i wonder why there is such an option? What does it do?
0
votes
0answers
122 views

Limit upload speed to port 80/443 per ip address

I'd like to implement a max-upload speed to protect my server that accepts uploads. I'd like to throttle inbound to 80 and 443 to 1 Mbps. I know it can be done with iptables/tc but I can't figure it ...
0
votes
1answer
42 views

Can't access web sites when running iptables script!

I have wrote script for protecting my machine: #!/bin/bash ssh=1.1.1.1 http='1.1.1.1 2.2.2.2' # Clear any previous rules. iptables -F # Default drop policy. iptables -P INPUT DROP iptables -P ...
0
votes
0answers
45 views

multiple firewalld services with source addresses

If I have three services: port 111 should only be accessed by IP 192.168.1.111 port 222 should only be accessed by IP 192.168.1.222 port 333 should only be accessed by IP 192.168.1.333 ...
1
vote
1answer
107 views

Managing iptables for specific ips and ports

I disable firewall like so: #!/bin/bash iptables -F iptables -X iptables -P INPUT ACCEPT iptables -P OUTPUT ACCEPT iptables -P FORWARD ACCEPT Update I also enable my firewall: #!/bin/bash ssh=x....
1
vote
0answers
48 views

What puts TCPMSS in iptables?

I used to have (well, I still sort of do) have a script that expects: -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu to have been entered in to iptables ahead of my ...
1
vote
1answer
79 views

Strange behaviour of whiptail

My code: read -ra var <<<$(sed -ne's/^ *:\([[:upper:]]*\).*/\1/p' /etc/sysconfig/iptables) chains=$(whiptail --title "Add rule" --menu "chains" 16 78 5 "${var[@]}" 3>&1 1>&2 2&...
1
vote
1answer
91 views

Firewalling Samba

at the moment I'm trying to implement the firewall for my linux file server. Everything is working as expected except form the samba server. I have searched through the internet already but non of the ...
0
votes
0answers
116 views

IPTables if more than 30 connection in 1 minute ban IP for 1 hour?

I am trying to setup a firewall that limits to 3 connections per IP and also ban the IP for an hour if > 30 connection attempts in one minute. Is this all possible with iptables? So far I have only ...
6
votes
1answer
47 views

connlimit counters start over after iptables restored

I have a connlimit rule in iptables that allow only 5 connection to port 80. iptables -A FORWARD -p tcp -m tcp --syn --dport 80 -m connlimit --connlimit-above 5 --connlimit-saddr -j DROP This ...
1
vote
1answer
47 views

Characterizing iptables impact

Circumstances force us to open a port to the internet and we want to set up a "white list" of IP ranges that are allowed to access that port. I have prototyped the solution so I understand the ...
0
votes
1answer
164 views

after masquerading , proxy server not work

In normal mode i can get site content with proxy server (tinyproxy): curl https://anysite.any/ or curl -x 127.0.0.1:8888 https://anysite.any/ BUT, i want enable iptable masquerading for some ...
2
votes
0answers
25 views

Can I use iptables to forward between interfaces without setting /proc/sys/net/ipv4/ip_forward?

Can I use iptables to forward between interfaces without setting /proc/sys/net/ipv4/ip_forward? I want a secure default of not forwarding anything and then specifying exactly what should be forwarded....
3
votes
2answers
53 views

Why does my iptables firewall reject connections to port 1531?

When installing RHEL, iptables seems to be rejecting connections from 1531 (oracle). This is my configuration: # Firewall configuration written by system-config-firewall # Manual customization of ...
0
votes
0answers
256 views

string matching not working in iptables

We have a RHEL 6.7 DNS server and we are trying to discard packets that contain certain domains. For example, one of our DNS servers was involved in a random subdomain attack, where external hosts or ...
0
votes
0answers
40 views

libvirtd fails with iptables on Linux 4.3.2 (Debian)

When I start libvirtd on a selfbuild kernel (make olddefconfig), it fails setting up bridge virbr0 with: internal error: Failed to apply firewall rules /sbin/iptables --table nat --insert POSTROUTING ...
2
votes
0answers
65 views

Need for IPTables expert, possibly with knowledge of u32 module

A customer is sending queries against DNS root-servers on my recursive DNS server. I need to block it with iptables. I tried 3 examples but it is not working. 0 0 DROP udp -- * * ...
1
vote
1answer
76 views

Mutt hangs sometimes when connection is limited to imap.gmail.com

I wanted to restrict email clients to connect to only 1 IMAP server - imap.gmail.com. And wrote this iptables rule: iptables -A OUTPUT -d imap.gmail.com -p tcp --dport imaps -j ACCEPT I have an ...
0
votes
1answer
31 views

What does this command do in Linux iptables

What does this command do and how to revert this command. in linux. iptables -I INPUT -i eth1 -p tcp -m tcp --dport 80 -j ACCEPT Will It cause any problem?
0
votes
0answers
188 views

Block IP Fragmentation attack using iptables

I am trying to stop all MF flag packet which has more fragment big set. because i have seen many IP Frag attack taking advantage of it. I know its not a good idea to do but, I have test my application ...
1
vote
1answer
17 views

ip_conntrack_max test not working

I am trying to do some ip_conntrack_max kernel parameter testing, but somehow its not working. -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT I have set following value to see its filling ...
1
vote
1answer
24 views

shorewall / iptables - restrict outbound ports by user

I have filtering working for some users and groups; however, it is not working for SSH. For SSH, I am specifying members of the ssh group can have outbound SSH traffic. I am using the same syntax ...
1
vote
0answers
68 views

How to properly port forwarding between different machines using UFW / iptables and DD-Wrt?

This is my network I want to see my ip_camera (192.168.3.4:80) from outside my house. It is on dd-wrt router (192.168.3.1) without internet. The router 192.168.1.1 has internet. However, i have a ...
1
vote
0answers
20 views

Access NATed network service behind dynamic public IP from the local network

I have a dynamic public IPv4 address configured on my router. There is a TCP based service running somewhere behind that router at 192.168.1.11:8448. With a dynamic DNS I can access this service using ...
1
vote
1answer
482 views

ufw: how to forward single port to another port on different interface

I have two interfaces eth0 (192.168.1.2) and eth1 (192.168.3.2). I receive data from 8080 at eth0. I want to forward it to eth1 port 80. I'm using UFW, because i don't understand iptables and how to ...
3
votes
1answer
185 views

How can Wireshark see packets dropped by iptables?

I recently installed my hard drive in a new computer and after some fiddling around I noticed my iptables rules were dropping DNS responses for some reason, turns out they were configured to allow ...
1
vote
0answers
24 views

Reducing Apache-Spam

I got a hack-attack and all my Wordpress instances got modified. Now it seems that I have fixed everything and all my "backdoor-shells" and Wordpress-instances are back running secure (hopefully). ...
0
votes
0answers
9 views

how to safely increate ip_conntrack value

How do i calculate how much memory my single ip_conntrack connection will eat? I am planning to increate ip_conntrack on system but i want to be careful to not overcommit number. Is that any basic ...
0
votes
1answer
24 views

iptables and OpenVPN configuration

I have following iptables rules: -A INPUT -i eth0 -p udp -m udp --dport 1194 -m state --state NEW -j ACCEPT -A INPUT -i tun+ -j ACCEPT -A INPUT -j DROP -A FORWARD -i tun+ -j ACCEPT -A FORWARD -i tun+ ...
1
vote
0answers
16 views

don't jump to same user-defined chain twice

In my /etc/pam.d/sshd I have a line: session optional pam_exec.so /usr/local/bin/pam_exec_sshd It calls my script whenever I do ssh login or logout. Script contents: #!/bin/bash IPTABLES=/usr/sbin/...
0
votes
1answer
31 views

Whiptail radiolist

I am trying to build a iptables configure with whiptail. And I am stuck at the moment. I have got code below and I am trying to develop radio list where user choose between INPUT or OUPUT. io=$(...
0
votes
0answers
120 views

IPv6 router advertisement seems to break OpenVPN setup

I have an OpenVPN setup on Debian Jessie, or Raspbian to be precise, that provides an IPv4 and IPv6 subnet for the clients. The server configuration of OpenVPN contains: dev tun server-ipv6 fdd2:af8b:...
0
votes
1answer
622 views

iptables bad argument '80'

I am running KALI-linux, and i am trying to execute this command: iptables -t nat -A PREROUTING -p tcp –destination-port 80 -j REDIRECT –to-ports 10000 i get this as response: "Bad argument `80'" ...
2
votes
2answers
223 views

iptables: No chain/target/match by that name - adding SSH ATTACK rule

I have a problem with adding rule against brute-force SSH attacks. I try to do it in the following way: iptables -F iptables -L iptables -N SSHATTACK iptables -A SSHATTACK -j LOG --log-prefix "...
0
votes
0answers
71 views

change destination IP address with iptables for infoming traffic

If I run tcpdump on eth0 interface, then I see following ingress packets to my NIC: 15:07:47.174643 00:19:e2:9e:df:f0 > 00:01:6c:55:3a:72, ethertype IPv4 (0x0800), length 194: (tos 0x0, ttl 63, id ...
3
votes
1answer
116 views

How to limit port range in Ubuntu 14.04?

I want to limit source port range in my ubuntu machine upto 20000 , that means no Application should be able to use port higher than that.I have this command in mind iptables -A OUTPUT -p tcp --...
0
votes
2answers
788 views

IPTables - hex string block DNS query

I have a customer that is sending a lot of queries for a particular domain on my DNS server. I want block that queries and I found the hex string that is possible to be implemented. That is the string:...
0
votes
0answers
39 views

hostapd in wlan0 makes eth1 interface stop working

I have an embedded system that creates a captive portal so the clients must to login in order to get internet access. The system is running apache and has a webpanel on port 8080 to which I connect ...
0
votes
0answers
1k views

ERROR: CHECK_NRPE: Socket timeout after 10 seconds

getting following error : # /usr/local/nagios/libexec/check_nrpe -H nagios-server-ip CHECK_NRPE: Socket timeout after 10 seconds. But it's working for localhost # /usr/local/nagios/libexec/...
0
votes
1answer
28 views

Find my rules in iptables

The iptables rules can be annotated with comments. How to select and remove rules using these comments? Maybe there is another solution to tag rules and remove them based on that tag?