iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

1
vote
1answer
169 views

Absolutely cannot get FTP access after adding many rules to iptables in CentOS5

I'm a complete noob and am just having the worst time trying to get FTP access to the server. I want to keep the firewall enabled. Edit: Updated the iptables information. I have the following ...
1
vote
0answers
152 views

Running a Transparent Proxy for LAN and Webserver for WAN

I am running a LAMP stack on an Arch Linux server in my home, and my router firewall port 80 is open to the world. Recently, I've decided to set up a dansguardian transparent proxy to do some web ...
1
vote
0answers
33 views

How do I route traffic between eth0:0 and eth0 [duplicate]

I have been trying to convert my linux box which is running Mint into a router. eth0 has a public IP address of 71.xx.xx.xx. I created an eth0:0 and gave it an IP address of 10.0.0.100. I started a ...
5
votes
1answer
322 views

What are the definitions of addrtype in iptables?

I am keen to use addrtype in combination with -src as a rule in one of my filter chain like so to drop some bogon ips: -A INPUT -p tcp --dport 80 -m addrtype --src-type UNICAST ! -s 127.0.0.0/8 -j ...
2
votes
1answer
150 views

What does lo in iptables mean exactly?

I have seen countless examples of this rule in iptables: -A INPUT -i lo -j ACCEPT I thought lo means localhost (a.k.a. 127.0.0.1), but when I commented it out, I can't access the server using its ...
2
votes
1answer
153 views

IPTables Port Redirection Should Have Broken Apache But Didn't

I have a Load Balance set up in Apache httpd: <VirtualHost *:80> DocumentRoot /var/www/html ServerName xxx.xxx.xxx.com ProxyRequests Off ...
1
vote
1answer
50 views

Unable to access external content with this IPTABLES ruleset

My application server is on a network protected by a organization wide firewall, and my server is also using fail2ban. That said, I'd like to set up an additional layer of protection with iptables. ...
0
votes
3answers
75 views

Iptables in linux

Please explain me the use of bold character below iptables -A INPUT -i eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT -A -i -p -m state --state -j
2
votes
1answer
68 views

Do I have to swap IP sets, or can I add/remove on the fly?

I was wondering about the semantics of ipset(8). Is it possible to add a rule matching a set to iptables and then manipulate the set, or can I only create a set and swap it for an older set in order ...
2
votes
1answer
433 views

Problem setting up iptables (LDAP traffic blocked)

My application server is on a network protected by a organization wide firewall, and my server is also using fail2ban. That said, I'd like to set up an additional layer of protection with iptables. ...
1
vote
1answer
145 views

How to log incoming icmp traffic?

I am watching my ip6table and observing an icmp packet arriving and getting dropped at the rate of 1 per second. I am trying to find out what that message is about. I tried using tcpdump (it is ...
1
vote
0answers
574 views

Port redirection on loopback with IP other than 127.0.0.1

I want to redirect port 80 on the loopback network interface so that accesses to that port actually go to port 8080. I tried using the following command, but it only works if the application is ...
2
votes
1answer
812 views

How does connlimit in iptables supposed to work?

I wanted to set a limit to the number of concurrent connections allowed on my web server. I tried the following rules on an iptables (v1.4.19.1) kernel 3.14.4-200.fc20.x86_64 with a default DROP ...
1
vote
0answers
207 views

iptables server behind NAT accessible from outside as well as inside the nat

I have 2 machines with a KVM running on each machine - so two kvms with the below networking Host 1: 192.168.10.100 (eth2) 10.10.100.1 (virbr1) KVM 1 (NAT with Host 1): 10.10.100.128 (eth0 ...
0
votes
2answers
185 views

What is the simplest method to redirect traffic using either a proxy or iptables?

I need to redirect all incoming traffic on port 7777 to a specific destination_ip:port. I have about 40 Litecoin (scrypt) mining rigs that I have to manually reconfigure each time I'd like to switch ...
3
votes
3answers
640 views

dmesg flooded with firewall logs

In my iptables, I have a rule which logs dropped packets: -A INPUT -i eth0 -j LOG --log-prefix "FW: " --log-level 7 -A INPUT -i eth0 -j DROP And in /etc/rsyslog.conf, I have ...
2
votes
0answers
43 views

iptables drop length and TTL condition doesn't work

With iptables utility on Linux host need to create mini firewall. I need to drop all incoming connections with package length greater than 722 AND TTL greater than 22. Need exactly AND. Drop only if ...
1
vote
1answer
254 views

RHEL 6.5 won't boot after loading APF firewall

We have an RHEL 6.5 system which boots to the point of loading APF firewall and then just hangs indefinitely. The console shows the following: ... Loading autofs4: [OK] Starting automount: [OK] ...
0
votes
1answer
652 views

Disable iptables service on CentOS

I don't want the service to start after reboot. my code does this: service iptables stop service iptables save chkconfig --level 123456 iptables off service iptables status iptables: Firewall is not ...
-1
votes
2answers
265 views

Use IP tables to port forward behind a router?

Is it possible to use IP tables to port forward behind a router? My setup is thus: I have a Raspberry Pi running a small website on port 80, and a beefier computer running a Minecraft server on port ...
1
vote
1answer
731 views

Create a iptables rule if the rule does not all ready exist

Hi I've created a script to setup Nagios on my remote servers. My Script checks iptables to see if a firewall rule all ready exists and then is supposed to add the rule if it's not all ready there. ...
6
votes
1answer
430 views

Skip routing via `lo` interface for outgoing packets

Introduction I have following load balancing configuration: 10.0.1.31 - lb 10.0.1.35 - virtual IP 10.0.1.32 - node1 (tomcat + mysql) 10.0.1.33 - node2 (tomcat + mysql) I'm using keepalived which ...
1
vote
1answer
60 views

View blocked address from sshguard

How can I view all the addresses that sshguard has blocked to iptables?
1
vote
2answers
114 views

Does IP tables need to be configured or is a stand alone firewall sufficient?

I have two desktops and a laptop running Arch Linux. I have not setup any iptable rules on any of the machines, and I am curious if I should. One desktop is only used in my home network and is ...
4
votes
1answer
210 views

Can iptables be used to monitor TCP timeouts/resets system-wide?

I'm trying to determine if an application's connection to a database is internal to the application or due to a networking event. This seems like something netfilter would have system-wide visibility ...
0
votes
2answers
79 views

iptables advice with upd ports blocking in debian linux [closed]

please advice: I add next iptables rules: iptables -I OUTPUT 2 -p udp --dport 53 -j ACCEPT iptables -I OUTPUT 2 -p udp --dport 1700:1750 -j ACCEPT iptables -I OUTPUT 3 -p udp -m udp --dport 1812 -j ...
0
votes
0answers
156 views

What is wrong with these iptables' rules?

The following is what I got after googling: iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT #allow loopback access iptables -A OUTPUT -d 255.255.255.255 -j ACCEPT #make sure you ...
1
vote
1answer
4k views

iptables forward all traffic to interface

I have two interfaces eth1 and eth0. I want all traffic on eth0to be forwarded to eth1. I created an iptable rule like this: iptables -A FORWARD -s 0/0 -i eth0 -p tcp -o eth1 -j ACCEPT But this ...
0
votes
1answer
1k views

IPTables allow NTP Time Server

I am new to IPTables. I have an existing config that seems to work well. I am not sure I know how to add NTP to the rule Chain RH-Firewall-1-INPUT correctly. My goal is to add an additional rule to ...
1
vote
1answer
137 views

configure exim for system email forwarding (outside) , on a server with dynamic ip, behind a DNS router

Trying to configure exim to deleaver email to the outside world. I/We need to send email outside just for centralize certain admin notifications. Working on an already configured debian webserver, ...
2
votes
2answers
1k views

Why isn't the Iptables persistent service saving my changes?

I followed this tutorial to set up IP rules on ubuntu 12.04. Everything worked fine on setup -- but now I've made changes to the firewall that do not persist upon reboot. I do not understand why that ...
3
votes
1answer
519 views

Settings when using a bridge

I have a bridge set up between my physical Ethernet interface, eth0, and the virtual interface for OpenVPN, tap0. The bridge has an IP address, and the machine can be contacted on that IP address from ...
1
vote
1answer
33 views

What is the meaning “MAC MISSMATCH”? [closed]

I have every day in the log the few lines start with: MAC MISSMATCH:IN=vlanXX OUT= MAC=ff:ff:ff:ff:ff:ff:bc:ae:c5:da:70:a6:08:00:45:00:00:4e SRC=xx.xx.xx.xx DST=xx.xx.255.255 LEN=78 TOS=0x00 ...
2
votes
2answers
139 views

Are there ways to break into a machine if iptables drops all traffic?

Say I install Linux on an blank computer (no other OS, disk is formatted for installation), and I configure this in iptables: iptables -F iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P ...
1
vote
0answers
23 views

How can I use iptables to block certain processes from accessing the network? [duplicate]

I can set the processes to run under special uid's and use the technique from this SF answer: -A OUTPUT -m owner --uid-owner 400 -j DROP ...But are there any other ways to blacklist based on the ...
4
votes
1answer
226 views

Debian Wheezy subnet configuration (proxy, MASQUARADing etc.)

I have a "server" with eth1 having a full IP address, DNS, gateway and proxy name connected to the university internet/intranet provider and eth0 IP 192.168.1.2 connected by a gigabit switch with two ...
5
votes
1answer
5k views

What -A INPUT -j REJECT --reject-with icmp-host-prohibited Iptables line does exactly?

What do the following lines do? I have been reading redhat iptables documentation but can't figure it out. ... -j REJECT --reject-with icmp-host-prohibited ... -j REJECT --reject-with ...
1
vote
1answer
503 views

rtorrent: 'Tracker Timeout' caused by IPtables

I'm trying to secure my rtorrent-running-homeserver with IPtables. With the aim to allow only incoming connections to the rtorrent port 6890 and 5292 for ftp (both are forwarded by the router), I ...
1
vote
1answer
169 views

Masquerade not working sometimes

I have an issue with private network traffic not being masqueraded in very specific circumstances. The network is a group of VMware guests using the 10.1.0.0/18 network. The problematic host is ...
0
votes
1answer
38 views

Simple iptables filter rule for 101/8 block not working

I run a webserver that caters to an entirely local crowd, so to keep hacking attempts to a minimum, I have inserted a bunch of international IP-blocking rules into my iptables, but my filters don't ...
3
votes
1answer
166 views

Configure iptables on remote server without locking me up

I have a little remote server that I can access only with SSH, and what I want to do, is block all the traffic except port 22 for SSH. The first time, what I did was : iptables -P INPUT DROP And ...
0
votes
1answer
100 views

Blanket blocking SMTP with whitelist

So using a VPS environment, whereby we need to block outbound SMTP by default (spammers), with the ability to unblock when needed. We have found some scripts eg: iptables -I FORWARD 1 -d $VPS_IP -p ...
0
votes
4answers
109 views

Linux routing tables

I'm trying to learn Linux routing tables and ran into bit of snag. In the example below I'm not sure what is happening. My understanding is 0.0.0.0 means that for line 1 and 2 any packets outside of ...
3
votes
2answers
694 views

iptables multiple -d flags not allowed

I am trying to log all my outbound connections to a file using iptables. This is my rule: -A OUTPUT ! -o lo ! --destination 127.0.0.1 -m state --state NEW -j LOG --log-prefix "new_connection " ...
2
votes
1answer
320 views

Bad argument `127.0.0.1' in iptables

-A OUTPUT --destination ! '127.0.0.1' -m state --state NEW -j LOG --log-prefix "new_connection " --log-level 7 gives me Bad argument `127.0.0.1' What am I doing wrong? I used this docs : ...
1
vote
1answer
99 views

tcp/ip - trigger action or event after period of no network activity on certain port(s)

Is it possible, perhaps using iptables or one of the wrappers/frontends to iptables, to trigger an action or run a script after a certain period of time has elapsed with no network activity on a ...
0
votes
1answer
714 views

Socket Connection Refused (raspbian) but ports are open for connections

I'd like to establish a connection between my client and raspbian. Within my network, I can connect to my service at any time without any problems. Now I want to connect to my service via the ...
1
vote
2answers
111 views

iptables ignores other rules after add last rule

I have written these rules in iptables: -A FORWARD -i eth1 -o eth0 -p icmp -m limit --limit 1/hour --limit-burst 5000 -j ACCEPT -A FORWARD -i eth1 -o eth0 -p udp -m limit --limit 1/hour --limit-burst ...
1
vote
1answer
142 views

How to see content of dropped packages at OUTPUT chain in iptables

iptables is as below: # iptables -t filter -nvL Chain INPUT (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 ...
1
vote
1answer
183 views

iptables adding rules in OUTPUT chain

We can insert iptables rules based on IP/Network/Hostname: iptables -t filter -A OUTPUT -p tcp -d www.google.com -j ACCEPT -m comment --comment "www.google.com" It is not accepting: iptables ...