iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

1
vote
1answer
106 views

ipset v4.5: Unknown set type

I compiled ipset on CentOS5 32bit machine and i am getting weird errors My kernel: [root@localhost ipset-4.5]# uname -a Linux localhost.localdomain 2.6.18-400.1.1.el5 #1 SMP Thu Dec 18 00:58:32 EST ...
0
votes
1answer
112 views

In what order are the rules handled in the Linux Firewall Module in webmin?

If I'm not mistaken it's top to bottom correct? And the catch-all default action at the end is to just drop any packets that don't match the rules above. Should I be logging the dropped packets as ...
3
votes
2answers
140 views

Ban IP using Iptables/Firewalld

I was DDos Attacked by Chinese Great Firewall twice this year. Now I download zone file from http://www.ipdeny.com/ipblocks/ .I want to do these things: If Someone from Anywhere wants to connect to ...
3
votes
1answer
269 views

iptables: change local source address if destination address matches

I have a Linux machine (RHEL 6.7) with 2 IP's configured on a single NIC (eth1). The primary address, and therefore the address that all traffic appears to come from, is 10.0.0.23. The other is ...
1
vote
0answers
170 views

Iptables proxy, redirect all connections from a certain port to the internet?

I have an ubuntu pc and an android phone conneted to my router through a cable and wi-fi respectively. I set the android phone to use a proxy my-wan-ip:5555 and enabled port forwarding on my router on ...
0
votes
2answers
73 views

How block all request as ServerIP:Port by iptables

I see many http ddos requests to my server as serverIP:80. Its possible to block all incoming requests to myServerIP:Port?
6
votes
1answer
721 views

netfilter/iptables: why not using the raw table?

Under Linux, we usually use the "filter" table to do common filtering: iptables --table filter --append INPUT --source 1.2.3.4 --jump DROP iptables --table filter --append INPUT --in-interface lo ...
0
votes
2answers
97 views

iptables rules apply with delay

I'm using iptables to block Internet (by redirecting to an internal server) access on devices connected to my hotspot. That's my command: iptables -t nat -I PREROUTING -p tcp -s 192.168.43.51 -j DNAT ...
0
votes
0answers
34 views

iptables DNS guard protection

I' m going to implement some DNS security features on my DNS server and I was wondering if iptables can do the same job that cisco ASA/PIX does: DNS guard DNS Guard identifies an outbound DNS query ...
0
votes
0answers
19 views

Redirect Port to another servers Port, not working

I have dig around a lot and found out this batch of code to excute. My main goal is to redirect xxx.xxx.xxx.xxx:30000 to yyy.yyy.yyy.yyy:30333 i execute this code sysctl net.ipv4.ip_forward=1 ...
0
votes
1answer
421 views

Debian 8 iptables-persistent setup is not correct?

I'm renting a vps with debian 8 on it. I'm trying to set up my iptables, following this blog: http://bencane.com/2012/09/iptables-linux-firewall-rules-for-a-basic-web-server/ The problem is that my ...
0
votes
1answer
972 views

Connection refused on port 8081 using curl

I have two CentOS 7 boxes, called Turbo and Demo. I started a daemon/service on the first one, Turbo, and wish to call the service from the second one, Demo. I started the service to monitor port ...
0
votes
1answer
81 views

Iptables: does dropping UDP packets take place in the user-space or kernel-space?

I know that Iptables is a user-space module, I also read it "configures" kernel modules to do big part of the filtering. So my question is, if I add a rule to allow only TCP:443 packets, would this be ...
1
vote
0answers
108 views

IPtables Test/Simulator/WhatIf/Dry run

I am currently debugging a rather strange network phenomenon and still believe my Linux netfilter firewall is the problem. These automagically generated rules and chains give me quite a headache and I ...
2
votes
1answer
71 views

What is the purpose of -m, --match in an Iptables rule?

Many Iptables rules contain this -m or --match option, for example -I INPUT -p tcp -m state --state NEW -m limit --limit 30/minute --limit-burst 5 -j ACCEPT -A INPUT -p udp -m conntrack --ctstate NEW ...
0
votes
0answers
16 views

socks to remote vpn clients on single server

I have the following setup: [user1] > ssh -D 1080 server > [server A a.a.a.a] openvpn --config vpn1.ovpn > [vpn server #1 x.x.x.x] [user2] > ssh -D 1081 server > [server A a.a.a.a] openvpn --config ...
1
vote
2answers
81 views

Is it Safe to open port 35000:40000 for FTP data connections

I recently got hacked so im being careful when changing the settings in my CentOS 7 iptables. I just opened ports 35000 to 40000 for FTP PASV connection, will this represent any security risks?
0
votes
1answer
75 views

Route Locally generated packets to different gateway [duplicate]

I need to send the packets of specific port to different gateway. This is the situation: The server has different services, like http, dns, and mail (smtp,pop,imap), and it has two gateways. eth2: ...
4
votes
1answer
148 views

Using tc for traffic quotas?

Is it possible to implement traffic quotas (absolute limits, not rate limits) based on the network classifier cgroup? I see there is the iptables netfilter 'quota' extension, which seems to do ...
0
votes
0answers
17 views

Ubuntu Network Crashed?

So I have a server from ovh. When I was messing with the network I went to flush iptables and reload the network, and well it crashed all of the ports. So I thought I just need to reboot the server, ...
0
votes
1answer
47 views

iptables selectable tunnel

I have this configuration script: I OPENVPN TUNNELS openvpn --config serverx.ovpn > /dev/null 2>&1 & openvpn --config servery.ovpn > /dev/null 2>&1 & TEST ON MY ...
1
vote
1answer
265 views

On Centos7 firewalld overwrite iptables modules [duplicate]

Simple question: i want to load two modules /usr/sbin/modprobe ip_nat_ftp /usr/sbin/modprobe ip_conntrack_ftp I can put those lines in rc.local or use /etc/sysconfig/iptables-config But at reboot ...
0
votes
1answer
35 views

How to customize Shorewall firewall logs

I am using Fedora 13 machine with shorewall installed. shorewall 4.6.6-RC1 iptables v1.4.7 Below is log format by shorewall: Oct 23 05:28:17 localhost kernel: shorewall:LAN-LAN:ACCEPT:IN= OUT=lo ...
1
vote
0answers
39 views

cups: connection timed out

Per title I'm showing connection timed out in the /var/log/cups/error_log. D [29/Oct/2015:17:43:32 -0400] cupsdSetBusyState: Printing jobs D [29/Oct/2015:17:44:04 -0400] [Job 11441] Connection ...
1
vote
1answer
69 views

iptables DNAT+SNAT: unwanted multiplication of the same udp datagram (and malfunction)

trying to figure out my mistake in the following very simple scenario: |peerA|(Aip:Aport) <--> (Bdev:Bip:Bport)|NatNode|(Cdev:Cip:Cport) <--> (Dip:Dport)| peerD (peer A emits datagrams ...
0
votes
1answer
354 views

route on specific interface based on port

I have a php / bash application on top of a Linux machine with 1 physical interface connecting to e.g., outbound webserver 123.123.123.123 :80. I do this via several openvpn providers. I have both tun ...
0
votes
1answer
26 views

Packet forwarding under Linux shakey compared to Windows, why?

I was previously using Windows 7 to to share wireless internet to a device without wireless capability over Ethernet, and it worked perfectly. I've now switched to a Linux machine and am trying to do ...
1
vote
1answer
52 views

How to fail fast with iptables?

Inspired by the Pi-hole I set up my own one. What it does: The Pi-hole is configured as a dedicated IP in my local net on a virtual adapter of Raspberry Pi. Get list of known spam / phishing / ad ...
1
vote
0answers
56 views

Counter MAC spoofing

I use a public wifi. (connect with id/password on an open network) The network is unstable (download stream 500ko/s then drop 0ko/s and stream stop, if a click a later in the stream it's working ...
0
votes
1answer
37 views

iptables logging for all except ICMP

I have iptables firewalls and its logging for all DROP packets or Deny. I want to tell it to no LOG any packet for ICMP protocol. How do i tell that *filter :INPUT DROP [0:0] :FORWARD ACCEPT [0:0] ...
1
vote
1answer
21 views

Why are traffic from hosted VMs classified as iptables OUTPUT?

On the machine serving as the firewall for a network, I've installed a VM to bridge to a remote VPN. Since then, I've noticed none of the devices connected to the said VPN had their connections ...
1
vote
1answer
138 views

iptables mangle table with custom chain

I create a new chain in mangle table: $IPTABLES -N newchain -t mangle After that all the 80's port packets I put to that new chain: $IPTABLES -t mangle -A PREROUTING -i eth1 -p tcp --dport 80 -j ...
1
vote
1answer
95 views

iptables LOG only once

I run the following iptables commands to detect and log a port scan: iptables -A INPUT -p tcp -i eth0 -m state --state NEW -m recent --set iptables -A INPUT -p tcp -i eth0 -m state --state NEW -m ...
0
votes
1answer
68 views

Automatically initiate an outbound SSH connection on a server when a client connects

How can I automatically initiate an outbound SSH connection on a server when an internal client connects to that server on a specific port, for any given service, from a given IP range? Note that the ...
0
votes
1answer
42 views

Configure linux PC as a Router

I want to configure my Rasberry Pi as a router. I have two network interfaces eth0 and eth1 connected to two networks. eth0 is connected to a private network and eth1 is connected to a public network ...
0
votes
1answer
297 views

Have iptables run command/script on new connection attempt [duplicate]

How can iptables run a command or script on a new connection attempt? Requirement: External packet to (server interface eth0) ---> (Server interface eth0) input table detects new packet received on ...
1
vote
1answer
46 views

iptables inside bridge

if i have: eth0 (no address) wlan0 (no address, providing wifi-hotspot by 'hostapd') br0 (local IP, bridging eth0+wlan0) eth1 (public IP, providing internet to above by net.ipv4.ip_forward=1) ...
0
votes
0answers
57 views

iptables - ignore logging a single rule

Currently my iptables log all dropped packets. I have the log rule at the bottom. The problem is, I have a noisy neighbor who is flooding the subnet with UDP 17500 packets. I'm assuming its Dropbox ...
0
votes
1answer
90 views

Problem adding iptables rule

I just installed OMSA and need to open up port 1311 to access the web tool. Here's iptables before: [root@mybox ~]# iptables -nvL --line-numbers Chain INPUT (policy ACCEPT 0 packets, 0 bytes) num ...
0
votes
1answer
78 views

iptables resolved addresses differs from nslookup

To block personal emails on a corporate network, I've blocked FORWARD to mail.google.com and mail.live.com. The following is how iptables resolved those addresses: $ sudo iptables -L Chain FORWARD ...
2
votes
0answers
126 views

Can I add iptables rule from the inside of a C Linux program only with capabilities or do I need necessarily root?

I need to add an iptables rule from the inside of a C Linux program. How should I do? Do I need root privilege or can I just grant some capabilities? I tried granting CAP_NET_RAW+iep and using ...
1
vote
1answer
213 views

Can I setup a local transparent proxy to forward requests to another another web proxy

I would like to set up a local Linux system to tunnel all http/https requests transparently through a corporate proxy. Many scripts honor http_proxy environment variables but some don't and it is a ...
3
votes
0answers
302 views

Captive Portal on Raspberry Pi (raspbian) with Bridged Adapter

I am trying to create a captive portal on a Raspberry Pi by following the steps from this GitHub project: https://github.com/thgh/pilon I have 2 network interfaces on the pi. wlan0 TP-Link ...
2
votes
0answers
39 views

iptables not working on mobile broadband

I access the internet using a VPN. With the help of iptables rules all out-going traffic from my machine to the internet is dropped instantly when my VPN connection is abruptly terminated. The ...
0
votes
0answers
29 views

help with iptables configuration

i want to run two vpns on local host. I want that all traffic is sent first to the first vpn, and then to the second vpn, and no other outside leaks. Could you help me please to realize this? ...
1
vote
0answers
116 views

Sniff on SWITCH(lan) traffic openWRT

Is it possible to sniff (with tcpdump) or mirror LAN traffic that doesn't get routed to WAN using openWRT? Say I have two PCs connected to LAN ports and I want to sniff on traffic one PC is sending ...
2
votes
0answers
116 views

How to restrict openvpn clients to communicate with other vpn clients

I have this Openvpn scenario.. I have Lot of openvpn clients connected to my server, All i want is to restrict client to client communication. for eg. i have ...
1
vote
0answers
35 views

Filtering bridged packets by IP address

I am using a small Ubuntu 12.04 box as a Wi-Fi Access Point. The box has two interfaces which are bridged together as follows: brctl addbr br0 brctl stp br0 off brctl addif br0 wlan0 brctl addif br0 ...
1
vote
1answer
83 views

iptables forward from host to guest interferes with vm-vm communication

My iptables -L: Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT udp -- anywhere anywhere udp dpt:domain ACCEPT tcp ...
0
votes
0answers
24 views

forwarding port to an server on the Internet

Now I need to use iptables on an internal server(the server is not a gateway and has one nic) to forward a port to a server on the Internet. So when I access the port on the Internet it will forward ...