iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

3
votes
3answers
8k views

How can I make iptables service start automatically after reboot on CenOS/RHEL7?

I am having a few issues with a newly installed home server I am preparing. I have installed CentOS7 on it and I found that port 80 and 443 are off by default. I therefore added them to the iptables ...
3
votes
1answer
4k views

Settings when using a bridge

I have a bridge set up between my physical Ethernet interface, eth0, and the virtual interface for OpenVPN, tap0. The bridge has an IP address, and the machine can be contacted on that IP address from ...
3
votes
1answer
526 views

listen to a conversation using port forwarding

I have been able to make a phone calls using the SIP client Pjsua from one Linux computer to another one. In case you have not heard of this user agent, explaining it's functionality is quite easy. It ...
3
votes
1answer
6k views

Set up firwall with iptables to only allow VPN

Im using IPredator VPN with openVPN and I want to make sure that if the connection is dropped, i wont submit data from the internet without the VPN. I heard that I could do that with iptables and a ...
3
votes
1answer
906 views

Routing through iptables

I have this vpn client that touches the routing table and then keeps watching it to exit if it gets touched. It is the kind of setup needed for an endpoint, such as a laptop. I want to use a small ...
3
votes
2answers
853 views

Need help with routing

I have set up a Ubuntu server, that I want to use as a router for my local office. The problem is, that I want to make 2 VPN connections, to remote branches, and then I want to route all traffic to ...
3
votes
2answers
125 views

Ban IP using Iptables/Firewalld

I was DDos Attacked by Chinese Great Firewall twice this year. Now I download zone file from http://www.ipdeny.com/ipblocks/ .I want to do these things: If Someone from Anywhere wants to connect to ...
3
votes
2answers
123 views

How to disable network access for a user?

Trying to disable the network access for the user: [root@notebook ~]# iptables -I OUTPUT -m owner --uid-owner tempuser -j DROP [root@notebook ~]# ip6tables -I OUTPUT -m owner --uid-owner tempuser -j ...
3
votes
1answer
398 views

How to combine connlimit with IP sets?

connlimit lets me limit the number of connections per client/service. How would I go about to combine such a rule with the IP sets available in more recent versions of the Linux kernel and netfilter?
3
votes
1answer
51 views

Which network services depend on the “accept related input” iptables rule?

Background I am setting up a firewall for a webserver and was wondering if it would be a good security meassure to even reject RELATED input traffic and only except established connections by ...
3
votes
1answer
2k views

How do I route different users over different OpenVPN tunnels in Linux?

The setup: I have multiple, static-key OpenVPN client/server configurations, labeled "client1", "client2", and "client3" with server/client IPs 10.10.1.1/10.10.1.2, 10.10.2.1/10.10.2.2, and ...
3
votes
1answer
2k views

I opened a port with iptables but still doesnt work

I have a CentOS installation as a guest VM with VirtualBox. I have two ethernet interfaces, eth0 with NAT and DHCP, and eth1 with Host-only adaptor and static IP. I have oracle installed in this ...
3
votes
2answers
926 views

iptables routing marked packets from router to PC and routing them back to router

I'm trying to do deep packet inspection on HTTP packets. The purpose of this is to collect HTTP payload data and then create some proxy/cache-independent reports. Following this, the idea is to ...
3
votes
1answer
3k views

tc don't see marked with -j MARK packets

Server has 2 network interfaces: eth1 with address 13.0.0.254/24 eth0 with address 172.20.203.4/24. It's routing traffic between this two networks. Task is to limit bandwidth between this two ...
3
votes
1answer
541 views

User associated with a socket

I use ss -p to see TCP sockets information. But process info are not printed for some sockets. Below: $ ss -p4 State Recv-Q Send-Q Local Address:Port Peer Address:Port ESTAB 0 0 ...
3
votes
1answer
408 views

1000 iptables entries on CentOS?

I just got a new dedicated server with CentOS and I'm trying to debug some network problems. In doing so, I found over one thousand iptables entries. Is this the default on a CentOS system? Is there ...
3
votes
1answer
4k views

Default mark for packets using iptables

I am trying to set up a QOS script on my Tomato-enabled WRT54G router. The script does the basics of what I need (make sure that a particular machine on my network has lower priority than anything ...
3
votes
0answers
16 views

Routing policy is not working

I have an Access Point with OpenWrt. On other host of the same LAN there is a squid (IP Address 192.168.80.148). I'd like to route packages with destination port 80 to 192.168.80.148. So I have ...
3
votes
0answers
79 views

iptables and ip forwarding for failover

hi i have an ethernet nic interface with 4 additional virtual interfaces (failovers) all configured with public ip4 (IP-1 to IP-5) / netmask 255.255.255.255 / broadcast addr same as ip: eth0 ...
3
votes
1answer
45 views

Unable to get NAT working via iptables PREROUTING chain

So, not concerning ourselves with the WHY, and more so with the HOW, I'd like to see if anyone knows where I'm going wrong here. Basically, I'd like to forward all packets headed for port 80 on an IP ...
3
votes
0answers
33 views

Configuring a Linux Wi-Fi access point to redirect a one-word URL to http://192.168.42.1:8888

've created a Wi-Fi access point on a Linux box (thanks to hostapd). I'm trying to make it easy for clients to access the Freenet service that's running on said box. Ideally, the user would be able ...
3
votes
1answer
216 views

iptables: change local source address if destination address matches

I have a Linux machine (RHEL 6.7) with 2 IP's configured on a single NIC (eth1). The primary address, and therefore the address that all traffic appears to come from, is 10.0.0.23. The other is ...
3
votes
0answers
271 views

Captive Portal on Raspberry Pi (raspbian) with Bridged Adapter

I am trying to create a captive portal on a Raspberry Pi by following the steps from this GitHub project: https://github.com/thgh/pilon I have 2 network interfaces on the pi. wlan0 TP-Link ...
3
votes
0answers
1k views

Is it possible to throttle upload bandwidth per `IP` basis using `tc`, `htb` and `iptables` ? (Download limitation not required)

Problem I've searched internet like anything but couldn't find much about limiting upload. The solutions given are not limiting IP basis like this one but LAN as a whole. +-----+ ...
3
votes
0answers
190 views

Restrict the maximum number of independent IP connection on specific port at the same time

I set up a server as a socks5 proxy. I'd like restrict the maximum number(1 or 5 or 20) independent IP connection on specific port at the same time. I have searched on google, only see some articles ...
3
votes
0answers
359 views

iptables: using “conntrack” and “recent” modules to block unsolicited packets

When I only allow RELATED and ESTABLISHED packets, and DROP everything else, my firewall rules work perfectly and I have no problems: ### VARIANT A -A INPUT -i wlan0 -m conntrack --ctstate ...
3
votes
0answers
222 views

Is iptables able to filter off UNREPLIED connections?

I am a using dd-wrt router and trying to get some per-user metrics, I was wondering about filtering only ESTABLISHED connections or include NEW and RELATED, I have read a lot about this last two, but ...
3
votes
1answer
252 views

Route VPN traffic through different proxies

I want to setup VPN server and route (based on my routing algorithm) all traffic through different proxy servers. Let's say I have one host, with many users, connected to my VPN. I want to route all ...
3
votes
1answer
162 views

Why are these connections not classified as “established” under conntrack?

I have the following rule for iptables: -A OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT such that outgoing connections not classified as established will be logged. Occasionally, the ...
3
votes
0answers
55 views

Which tool is used to create firewall rules on Fedora 20? [closed]

What is a recommended way to set up firewall rules on Fedora 20/Centos 7/RHEL 7 currently? I know about relatively new replacement of itpables service by firewalld service. Which command-line user ...
3
votes
0answers
830 views

Forward multicast between two LAN segments (Chromecast)

I've found some rules but most are inconclusive. Chromecast uses DIAL and discovers via multicast from what I've understood.. I have an Ethernet-connected computer which I would like to route via my ...
3
votes
1answer
357 views

IP rule table look up does not seem to work

I have a sytem with three network interfaces. Below is the configuration that I'm trying to set up. wlan0 (its actually an WiFi AP interface) - other devices connects via this interface. net1 - ...
3
votes
0answers
526 views

iptables hangs at applying rules

I have a set of rules that are supposed to give me the most protection before things like fail2ban and other things are added to the mix. The issue is that although everything checks out in the test, ...
3
votes
2answers
243 views

Iptables not forward traffic

I need to redirect all traffic incoming on port 9750 (the port chat server) to another machine on the same subnet. Ports clients - dynamic. iptables -t nat -A PREROUTING -p tcp -d x.x.x.a --dport ...
3
votes
0answers
152 views

Packets do not cross IP tables Postrouting when originating from an external IP

I'm trying to reflect traffic from the internet to an internal device that I only want to have local access. I have a host in my DMZ that I'm trying to DNAT traffic to this internal device, and SNAT ...
3
votes
1answer
225 views

iptables: refuse immediately when blocking particular domain from visiting by browser

I need to block particular domain "megafonpro.ru" and all subdomains from visiting by browser. Here's rule that I wrote: sudo iptables -I OUTPUT -p tcp --dport 80 -m string --string "megafonpro.ru" ...
3
votes
0answers
865 views

Route all HTTP traffic through polipo

I've set up polipo on my machine to listen to the default port 8123. To test it, I set the in-memory cache to a ridiculously high 2 GB and downloaded a 50 MB file using wget utilizing the proxy. ...
3
votes
1answer
141 views

What are the requierements to sniff UDP packets in a Wireless Ad-Hoc network?

In a wireless Ad-Hoc network, I have two computers which communicates in UDP together from 192.168.1.3 to 192.168.1.5 I have a third computer (192.168.1.6) which wants to listen to the packets which ...
3
votes
0answers
535 views

Redirect all non-local traffic to a socks proxy

Is it possible to redirect all non-local traffic to a socks proxy? so, for example i have: 4 computers (clients A-D: 10.0.0.1-4 or dhcp) 1 computer with 2 network cards (gateway-server, eth0: ...
3
votes
0answers
201 views

iCloud stuff stops working while connected to OpenVPN

I have a fairly simple OpenVPN setup on an OpenVZ VPS with Ubuntu 11.10. Client is the Viscosity client on Mac OS X 10.8.2, and after some testing, we can rule out the client as being part of the ...
3
votes
0answers
756 views

tunneling FON traffic via Tor

I would like to tunnel the traffic of my FON router through Tor. For that I added a second network card to a local server and connected the FON router to it. Then I set up a DHCP server and configured ...
3
votes
2answers
1k views

Open and redirect port

I'm trying to set up SNMP for a router so I can monitor it from an existing Nagios installation on an off-site server. I'm having trouble getting the router to respond to SNMP requests from the WAN, ...
3
votes
1answer
725 views

Port Mirroring in Fedora? [closed]

I have set up an application that listens constantly to a port for network packets, and I would like to create another one that receives the same network packets ( for use as a test bed). Getting the ...
2
votes
1answer
417 views

Why does iptables accept packets on a given port, when it is closed?

Here is my situation. I have a public address on my router and have manually forwarded a given port for torrenting, so not via UPnP, that is disabled both in the router and the application. It works ...
2
votes
6answers
488 views

Recommend a reading for learning Linux firewalls configuration for beginner? [closed]

I am using Linux at home and want to be able to configure firewall. I would like to understand what I am doing not just copy paste some rules from internet :).
2
votes
2answers
288 views

Block all IPs from accessing anything on the server

I want to block all IPs except for my own home IP from doing anything on my server. How can I do this with iptables? For the example lets say my home IP is 1.2.3.4 My server still needs to be able ...
2
votes
2answers
211 views

Are there ways to break into a machine if iptables drops all traffic?

Say I install Linux on an blank computer (no other OS, disk is formatted for installation), and I configure this in iptables: iptables -F iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P ...
2
votes
1answer
446 views

No internet even with iptables ACCEPT all

I was trying to setup the firewall settings, and probably did something wrong. I don't have internet now unless I stop iptables service I tried flushing,and accepting everything sudo iptables -F ...
2
votes
4answers
6k views

How to change user agent on all http requests made from my machine with Squid intercepting proxy?

I'd like to change the user agent on all HTTP requests made from this machine. It's easy enough to change the user agent in each browser, but other apps also make http requests. It's vital I catch ...
2
votes
1answer
19k views

What is sport and dport?

I want to stop internet on my system using iptables so what should I do? iptables -A INPUT -p tcp --sport 80 -j DROP or iptables -A INPUT -p tcp --dport 80 -j DROP ?