iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

2
votes
1answer
17 views

iptables routing incoming IP to another destination IP question

I have a test setup: server1:1.1.1.1 server2:2.2.2.2 client: 3.3.3.3 I'm trying to have client IP 3.3.3.3 do a HTTP request from the 1.1.1.1 server. However I want the 1.1.1.1 server to pass this ...
2
votes
1answer
24 views

psad: do not block access to HTTP

I want to block intruders via psad, but HTTP and HTTPS should not be blocked. For example, if someone is scanning my dedicated server via nmap, psad should block him for 2 hours, but he should still ...
2
votes
1answer
529 views

Configuring OpenVPN to use Firewalld instead of iptables on Centos 7

I need some help configuring OpenVPN on Centos 7 using firewalld. I used iptables on Centos 6.5 and only had to add the following lines to /etc/sysconfig/iptables: -A POSTROUTING -s "10.0.0.0/24" ...
2
votes
1answer
137 views

Unable to access website hosted on virtual machine

I'm on a mac (osx 10.9.3) running CentOS7 in virtualbox. I would like to access the website hosted on the virtual machine. Browsing to the Guest IP returns webpage not available. I'm able to ping and ...
2
votes
1answer
65 views

In iptables, what is the difference between targets DNAT and REDIRECT?

More specifically, is -A PREROUTING -i $INT -p $PROTO --dport $PORT -j REDIRECT --to-ports $NEWPORT equivalent to one or both of these? -A PREROUTING -i $INT -p $PROTO --dport $PORT -j DNAT ...
2
votes
1answer
60 views

How do I enable IPv6 inbound traffic to get forwarded to my machine?

It seems that IPv6 traffic on my router is being dropped. How do I configure ip6tables appropriately, so that traffic is forwarded/accepted to my machine? Here's the syslog for my IPv6 traffic: Jun ...
2
votes
1answer
34 views

My iptables works the opposite from what I wanted

I have this set of iptables rules ... $ sudo iptables -n -L Chain INPUT (policy ACCEPT) target prot opt source destination LOG all -- 0.0.0.0/0 0.0.0.0/0 ...
2
votes
1answer
96 views

iptables - add rule for interface before it comes up

Right now I'm using /etc/rc.local to add some iptables rules on my Linux router on boot however some of the rules aren't added. I assume this is because the interface hasn't come up yet. This is what ...
2
votes
1answer
99 views

IPTables Port Redirection Should Have Broken Apache But Didn't

I have a Load Balance set up in Apache httpd: <VirtualHost *:80> DocumentRoot /var/www/html ServerName xxx.xxx.xxx.com ProxyRequests Off ...
2
votes
1answer
190 views

Problem setting up iptables (LDAP traffic blocked)

My application server is on a network protected by a organization wide firewall, and my server is also using fail2ban. That said, I'd like to set up an additional layer of protection with iptables. ...
2
votes
1answer
79 views

Forward a host's network traffic to another host with the exception of SSH traffic

I am trying to redirect all the network traffic received in a old host to a different host. For that I created two new rules with iptables on the old host: echo 1 > /proc/sys/net/ipv4/ip_forward ...
2
votes
1answer
301 views

iptables: redirect local request with NAT

I'd like to redirect local requests to port which is translated with NAT. I have following rules: iptables -t nat -A PREROUTING -p tcp --dport 9020 -j DNAT --to 10.0.3.11:80 however request coming ...
2
votes
1answer
125 views

Randomizing the source port for new connections

Generally whenever source port is selected by a network application, it is selected in a sequential manner among the free ports like 32000, 32001 and so on. I want to randomize the source port ...
2
votes
1answer
82 views

Internet sharing with iptables: choosing which connection to share

I have a computer with two network devices (eth0 and wlan0), both connected to the internet (two different connections/isp). I'm trying to share the connection of wlan0 to another computer connected ...
2
votes
2answers
137 views

RELATED,ESTABLISHED state in iptables

What do the words 'RELATED' and 'ESTABLISHED' individually signify in RELATED,ESTABLISHED state in iptables?
2
votes
1answer
147 views

What are the pros and cons to editing iptables configuration file vs adding rules via the iptables command

I am working with a product on CentOS that occasionally needs to automatically add and remove rules from the iptables configuration. For example, during an update, we want to explicitly refuse ...
2
votes
2answers
2k views

Open a port in my CentOS

I'm trying top open a port on my CentOS machine: I edit the /etc/sysconfig/iptables file and add my rule: -A INPUT -p TCP -m state --state NEW -m tcp --dport 143 -j ACCEPT Then I restart the ...
2
votes
1answer
1k views

Set up firwall with iptables to only allow VPN

Im using IPredator VPN with openVPN and I want to make sure that if the connection is dropped, i wont submit data from the internet without the VPN. I heard that I could do that with iptables and a ...
2
votes
1answer
992 views

Local port forwarding automatically configured on boot?

I have software which needs to run as a non-root user, but needs to listen on port 80 and 443. With iptables, this isn't all that difficult: sudo iptables -t nat -A PREROUTING -i eth0 -p tcp ...
2
votes
1answer
218 views

Allow application specific access in iptables using guid

I would like to get Skype working with iptables and don't want to allow a huge range of ports thus I thought a solution might be iptables -A OUTPUT -m owner --gid-owner skypeGrp -j ACCEPT iptables ...
2
votes
1answer
113 views

Using iptables to block for specific services

I am using ipset in conjunction with iptables to create a list of IPs I want to block. I did this: ipset -N blocking iphash ipset -A blocking 124.205.11.230 // and repeated this line for all IPs I ...
2
votes
1answer
206 views

Linux nat/iptables configuration for a chain of peer-to-peer links

I have an experimental setup, of 4 Linux (CentOS) machines: All 4 machines are internally connected using different networks and can ping eachother directly connected interfaces. However only PC4 ...
2
votes
1answer
221 views

PPTP server with NIC aliases

I have set up a VPN on a VPS Server using PPTP. I have one NIC with two aliases. eth0 eth0:1 eth0:2 The 3 interfaces have public addresses. eth0 is a French IP, eth0:1 is UK, and eth0:2 is ...
2
votes
1answer
929 views

Need to access port on LAN through IPTABLES firewall on static IP interface

I have a Linux firewall with 3 NIC's. Eth1 is my LAN's default gateway and has IP address 10.1.2.250 and is connected to my LAN with IP range 10.1.2.0/24. Eth2 has IP address of 10.0.0.6 and gateway ...
2
votes
2answers
749 views

use iptables to allow incoming connections to some computer on port XYZ?

This is what I have: iptables -i em1 -A INPUT -j ACCEPT -p tcp --dport 9001 -v. If I want to accept incoming connections on port 9001 at this (127.0.0.1, or on the network 192.168.1.143) address, ...
2
votes
1answer
2k views

Limit the max connections per IP using OpenWRT?

Would the following iptables command on an OpenWRT router assure that no one client has more than 50 active connections? $ iptables -I FORWARD -m connlimit --connlimit-above 50 -j REJECT ...
2
votes
1answer
233 views

Bash script and Database

I have an iptables firewall in Linux bridge (RHEL5). I want to extract information like IP address, port number, port type, date and time, etc. from log messages using a Bash script, and then want to ...
2
votes
2answers
249 views

How can I make iptables service start automatically after reboot on CenOS/RHEL7?

I am having a few issues with a newly installed home server I am preparing. I have installed CentOS7 on it and I found that port 80 and 443 are off by default. I therefore added them to the iptables ...
2
votes
2answers
47 views

Delay when iptables icmp rules take effect

I have setup my iptables to disable all incoming connection, i.e. :INPUT DROP [0:65535] When the iptables has been started, I run the following command to enable ping: /usr/sbin/iptables -A INPUT ...
2
votes
1answer
52 views

How is whonix blocking UDP traffic (except udp-dns related traffic)?

I want to know how whonix manages to block unwanted UDP-Traffic i.e. all UDP-traffic but DNS related udp traffic. I looked at the iptable rules both in the Workstation and Gateway. There are no ...
2
votes
1answer
1k views

Linux Fedora 19 - iptables failed to start

I've been trying to start the iptables firewall service, but it keeps failing. What's going wrong? # systemctl status iptables.service iptables.service - IPv4 firewall with iptables Loaded: loaded ...
2
votes
2answers
77 views

ipset accounting information

I know that iptables keeps accounting information for ip traffic blocked or passed. However, it appears that when using ipsets with iptables, the accounting information is aggregated for the entire ...
2
votes
1answer
115 views

Mark packets between machines (client and router)?

Can I mark a packet on the client's OUTPUT chain and add an iproute policy on the router to route them via a specific gateway? This what I tried to do, but it isn't working. My client's mangle table ...
2
votes
1answer
532 views

Port Forwarding using iptables on Open-Mesh

A quick overview for those who are unfamiliar with Open-Mesh: The system uses small wireless access points that automagically build their own mesh network. As long as one of the access points is ...
2
votes
1answer
311 views

iptables string not dropping packet from tcp streams while using conntrack and string

I'm facing an unusual issue where specific TCP steams are not getting dropped by iptables; instead it's like iptables is just removing those specific packets. We're getting the following traffic: ...
2
votes
1answer
2k views

How to setup iptables rules to allow skype

Here are my iptables rules to allow Squid to connect to a web server: # Accept internally-requested input iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT #http,https traffic only ...
2
votes
1answer
446 views

Why is a echo-request ping packet 84 bytes in the log of iptables?

When I log the length of a echo-request packet, iptables -A OUTPUT -p icmp -m icmp --icmp-type 8 -j LOG I saw the length was LEN=84, but in wireshark, the captured packet size was 0x60, why does it ...
2
votes
1answer
854 views

Allow IP packet forwarding from LAN to modem via router

In short: I'd like to be able to telnet to my modem from my PC via my router. There is a simple home router on 192.168.33.1. It is running OpenWrt. It has the following interfaces defined: br-lan ...
2
votes
1answer
605 views

How to config iptables for pppoe?

When I create the only rule disabling all input, iptables -P INPUT DROP I can not connect anything. So it looks like I should allow some incoming activity to get PPPoE working correctly. What rules ...
2
votes
1answer
101 views

Is there a way to redirect requests from foo.com to a VM on that server?

I saw a tutorial about redirecting client requests to a specific port to a VM inside the server using IPTables. Is there a way to redirect client requests for foo.com to a VM using only IPTables? or ...
2
votes
2answers
1k views

TOR Transparent Proxy - How does to the TCP redirecting work

I used an iptables ruleset based on the sample ruleset from https://trac.torproject.org/projects/tor/wiki/doc/TransparentProxy, Section Linux, Local Redirection Through Tor, to set up Tor as a ...
2
votes
1answer
535 views

iptables rule for limiting bandwidth in given time

Under Linux/iptables how can I limit the bandwidth in given time? ex.: don't limit the connection speed from 22h to 06h, but limit it from 06h to 22h, ex.: the max speed would be only 1Mbit/second! ...
2
votes
0answers
90 views

iptables rule to transfer UDP through a SSH tunnel

The problem I have two programs that runs on two distant computers and communicate through a specific protocol. All I know is that this protocol only communicates through UDP and uses the ports 1101 ...
2
votes
0answers
13 views

Extra overhead in MASQUERADE target

There's a part in iptables manual concerning SNAT and MASQUERADE targets. I know the key difference between the two, but I don't fully get the following sentence: It is still possible to use the ...
2
votes
0answers
39 views

How can I configure iptables for per application setup?

I am working on a project where we are building lots of micro-services. Each service is neatly packaged as an RPM. Ideally I'd like for us to have iptables enabled on all of our machines and it would ...
2
votes
0answers
70 views

iptables hangs at applying rules

I have a set of rules that are supposed to give me the most protection before things like fail2ban and other things are added to the mix. The issue is that although everything checks out in the test, ...
2
votes
2answers
42 views

Iptables not forward traffic

I need to redirect all traffic incoming on port 9750 (the port chat server) to another machine on the same subnet. Ports clients - dynamic. iptables -t nat -A PREROUTING -p tcp -d x.x.x.a --dport ...
2
votes
0answers
45 views

Transparent Proxy

I am setting up attempting to set up a transparent proxy on CentOS using Squid. So far I have managed to filter the content and get it working perfectly. The only issue I am having is getting a form ...
2
votes
0answers
38 views

Defining IPv6 chains in ip6tables-restore/iptables-restore files, is it possible?

The format for the files generated by iptables-save/ip6tables-save and loadable through iptables-restore/ip6tables-restore stipulates that one can prepend -4 or -6 respectively so as to maintain the ...
2
votes
1answer
319 views

How does connlimit in iptables supposed to work?

I wanted to set a limit to the number of concurrent connections allowed on my web server. I tried the following rules on an iptables (v1.4.19.1) kernel 3.14.4-200.fc20.x86_64 with a default DROP ...