iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

3
votes
1answer
351 views

How to combine connlimit with IP sets?

connlimit lets me limit the number of connections per client/service. How would I go about to combine such a rule with the IP sets available in more recent versions of the Linux kernel and netfilter?
3
votes
1answer
49 views

Which network services depend on the “accept related input” iptables rule?

Background I am setting up a firewall for a webserver and was wondering if it would be a good security meassure to even reject RELATED input traffic and only except established connections by ...
3
votes
1answer
2k views

How do I route different users over different OpenVPN tunnels in Linux?

The setup: I have multiple, static-key OpenVPN client/server configurations, labeled "client1", "client2", and "client3" with server/client IPs 10.10.1.1/10.10.1.2, 10.10.2.1/10.10.2.2, and ...
3
votes
1answer
2k views

I opened a port with iptables but still doesnt work

I have a CentOS installation as a guest VM with VirtualBox. I have two ethernet interfaces, eth0 with NAT and DHCP, and eth1 with Host-only adaptor and static IP. I have oracle installed in this ...
3
votes
2answers
882 views

iptables routing marked packets from router to PC and routing them back to router

I'm trying to do deep packet inspection on HTTP packets. The purpose of this is to collect HTTP payload data and then create some proxy/cache-independent reports. Following this, the idea is to ...
3
votes
1answer
3k views

tc don't see marked with -j MARK packets

Server has 2 network interfaces: eth1 with address 13.0.0.254/24 eth0 with address 172.20.203.4/24. It's routing traffic between this two networks. Task is to limit bandwidth between this two ...
3
votes
1answer
514 views

User associated with a socket

I use ss -p to see TCP sockets information. But process info are not printed for some sockets. Below: $ ss -p4 State Recv-Q Send-Q Local Address:Port Peer Address:Port ESTAB 0 0 ...
3
votes
1answer
407 views

1000 iptables entries on CentOS?

I just got a new dedicated server with CentOS and I'm trying to debug some network problems. In doing so, I found over one thousand iptables entries. Is this the default on a CentOS system? Is there ...
3
votes
1answer
4k views

Default mark for packets using iptables

I am trying to set up a QOS script on my Tomato-enabled WRT54G router. The script does the basics of what I need (make sure that a particular machine on my network has lower priority than anything ...
3
votes
0answers
27 views

Configuring a Linux Wi-Fi access point to redirect a one-word URL to http://192.168.42.1:8888

've created a Wi-Fi access point on a Linux box (thanks to hostapd). I'm trying to make it easy for clients to access the Freenet service that's running on said box. Ideally, the user would be able ...
3
votes
0answers
23 views

connlimit counters start over after iptables restored

I have a connlimit rule in iptables that allow only 5 connection to port 80. iptables -A FORWARD -p tcp -m tcp --syn --dport 80 -m connlimit --connlimit-above 5 --connlimit-saddr -j DROP This ...
3
votes
1answer
145 views

iptables: change local source address if destination address matches

I have a Linux machine (RHEL 6.7) with 2 IP's configured on a single NIC (eth1). The primary address, and therefore the address that all traffic appears to come from, is 10.0.0.23. The other is ...
3
votes
0answers
189 views

Captive Portal on Raspberry Pi (raspbian) with Bridged Adapter

I am trying to create a captive portal on a Raspberry Pi by following the steps from this GitHub project: https://github.com/thgh/pilon I have 2 network interfaces on the pi. wlan0 TP-Link ...
3
votes
0answers
968 views

Is it possible to throttle upload bandwidth per `IP` basis using `tc`, `htb` and `iptables` ? (Download limitation not required)

Problem I've searched internet like anything but couldn't find much about limiting upload. The solutions given are not limiting IP basis like this one but LAN as a whole. +-----+ ...
3
votes
0answers
175 views

Restrict the maximum number of independent IP connection on specific port at the same time

I set up a server as a socks5 proxy. I'd like restrict the maximum number(1 or 5 or 20) independent IP connection on specific port at the same time. I have searched on google, only see some articles ...
3
votes
0answers
314 views

iptables: using “conntrack” and “recent” modules to block unsolicited packets

When I only allow RELATED and ESTABLISHED packets, and DROP everything else, my firewall rules work perfectly and I have no problems: ### VARIANT A -A INPUT -i wlan0 -m conntrack --ctstate ...
3
votes
0answers
192 views

Is iptables able to filter off UNREPLIED connections?

I am a using dd-wrt router and trying to get some per-user metrics, I was wondering about filtering only ESTABLISHED connections or include NEW and RELATED, I have read a lot about this last two, but ...
3
votes
1answer
202 views

Route VPN traffic through different proxies

I want to setup VPN server and route (based on my routing algorithm) all traffic through different proxy servers. Let's say I have one host, with many users, connected to my VPN. I want to route all ...
3
votes
1answer
149 views

Why are these connections not classified as “established” under conntrack?

I have the following rule for iptables: -A OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT such that outgoing connections not classified as established will be logged. Occasionally, the ...
3
votes
0answers
53 views

Which tool is used to create firewall rules on Fedora 20? [closed]

What is a recommended way to set up firewall rules on Fedora 20/Centos 7/RHEL 7 currently? I know about relatively new replacement of itpables service by firewalld service. Which command-line user ...
3
votes
1answer
297 views

IP rule table look up does not seem to work

I have a sytem with three network interfaces. Below is the configuration that I'm trying to set up. wlan0 (its actually an WiFi AP interface) - other devices connects via this interface. net1 - ...
3
votes
0answers
465 views

iptables hangs at applying rules

I have a set of rules that are supposed to give me the most protection before things like fail2ban and other things are added to the mix. The issue is that although everything checks out in the test, ...
3
votes
2answers
214 views

Iptables not forward traffic

I need to redirect all traffic incoming on port 9750 (the port chat server) to another machine on the same subnet. Ports clients - dynamic. iptables -t nat -A PREROUTING -p tcp -d x.x.x.a --dport ...
3
votes
0answers
135 views

Packets do not cross IP tables Postrouting when originating from an external IP

I'm trying to reflect traffic from the internet to an internal device that I only want to have local access. I have a host in my DMZ that I'm trying to DNAT traffic to this internal device, and SNAT ...
3
votes
1answer
201 views

iptables: refuse immediately when blocking particular domain from visiting by browser

I need to block particular domain "megafonpro.ru" and all subdomains from visiting by browser. Here's rule that I wrote: sudo iptables -I OUTPUT -p tcp --dport 80 -m string --string "megafonpro.ru" ...
3
votes
1answer
140 views

What are the requierements to sniff UDP packets in a Wireless Ad-Hoc network?

In a wireless Ad-Hoc network, I have two computers which communicates in UDP together from 192.168.1.3 to 192.168.1.5 I have a third computer (192.168.1.6) which wants to listen to the packets which ...
3
votes
0answers
200 views

iCloud stuff stops working while connected to OpenVPN

I have a fairly simple OpenVPN setup on an OpenVZ VPS with Ubuntu 11.10. Client is the Viscosity client on Mac OS X 10.8.2, and after some testing, we can rule out the client as being part of the ...
3
votes
0answers
749 views

tunneling FON traffic via Tor

I would like to tunnel the traffic of my FON router through Tor. For that I added a second network card to a local server and connected the FON router to it. Then I set up a DHCP server and configured ...
3
votes
2answers
1k views

Open and redirect port

I'm trying to set up SNMP for a router so I can monitor it from an existing Nagios installation on an off-site server. I'm having trouble getting the router to respond to SNMP requests from the WAN, ...
3
votes
1answer
718 views

Port Mirroring in Fedora? [closed]

I have set up an application that listens constantly to a port for network packets, and I would like to create another one that receives the same network packets ( for use as a test bed). Getting the ...
2
votes
1answer
395 views

Why does iptables accept packets on a given port, when it is closed?

Here is my situation. I have a public address on my router and have manually forwarded a given port for torrenting, so not via UPnP, that is disabled both in the router and the application. It works ...
2
votes
6answers
475 views

Recommend a reading for learning Linux firewalls configuration for beginner? [closed]

I am using Linux at home and want to be able to configure firewall. I would like to understand what I am doing not just copy paste some rules from internet :).
2
votes
2answers
248 views

Block all IPs from accessing anything on the server

I want to block all IPs except for my own home IP from doing anything on my server. How can I do this with iptables? For the example lets say my home IP is 1.2.3.4 My server still needs to be able ...
2
votes
2answers
200 views

Are there ways to break into a machine if iptables drops all traffic?

Say I install Linux on an blank computer (no other OS, disk is formatted for installation), and I configure this in iptables: iptables -F iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P ...
2
votes
1answer
427 views

No internet even with iptables ACCEPT all

I was trying to setup the firewall settings, and probably did something wrong. I don't have internet now unless I stop iptables service I tried flushing,and accepting everything sudo iptables -F ...
2
votes
4answers
638 views

What does this iptables command do?

Does iptables -I INPUT -j ACCEPT open all ports?
2
votes
1answer
391 views

IPv6 firewall rules seem to impede all connections

After deciding that my small server needed a firewall, I used ferm to configure iptables and ip6tables for me (this question should be tagged ferm, but I cannot create the tag). I am using the same ...
2
votes
3answers
5k views

How to change user agent on all http requests made from my machine with Squid intercepting proxy?

I'd like to change the user agent on all HTTP requests made from this machine. It's easy enough to change the user agent in each browser, but other apps also make http requests. It's vital I catch ...
2
votes
1answer
4k views

Why does iptables still block my samba?

I'm currently fighting with iptables and samba. I read that samba needs ports 137-139 and 445 open on both tcp and udp. Here is the relevant part of my iptables config ... # forward valid incoming ...
2
votes
2answers
196 views

How can I allow SSH and SMTP only using IPTables?

I've got a raspberry pi set up to send me periodic emails. As it's connected to the internet 24/7, I need IPTables set up properly. I want to allow incoming SSH and allow emails to send out on port ...
2
votes
4answers
173 views

How can I lock myself out of a linux box with iptables?

In the Securing Debian Howto I read (about iptables): The tools can easily be misused, causing enormous amounts of grief by completely crippling network access to a system. It is not terribly ...
2
votes
1answer
303 views

View blocked address from sshguard

How can I view all the addresses that sshguard has blocked to iptables?
2
votes
1answer
955 views

Bad argument `127.0.0.1' in iptables

-A OUTPUT --destination ! '127.0.0.1' -m state --state NEW -j LOG --log-prefix "new_connection " --log-level 7 gives me Bad argument `127.0.0.1' What am I doing wrong? I used this docs : ...
2
votes
1answer
4k views

system wide SOCKS5 Proxy

I connect to my Server on the internet using ssh -D 3128 user@rootserver.com. If I am right I thereby open a SOCKS v5 Proxy to my Server. Using firefox and FoxyProxy I can now add this to my proxys ...
2
votes
2answers
3k views

Remote SSH login not working

I have a PC behind a router with port forwarding setup Port 22 for SSH which works perfectly - I can login and everything. What I am trying to do is let this PC connect to a VPN and only allow ...
2
votes
2answers
989 views

List iptables rules as append command

A while back I was watching over the shoulder of a Linux guru and he issued a command that listed all the iptables rules in the format of the append commands you would need to issue in order to build ...
2
votes
3answers
65 views

Is there a command to deny an IP

Looking at the access log I found excessive access from an IP address. I then edit either .htaccess or .conf files to deny access from that IP. I wonder if there is a command or a oneliner that can do ...
2
votes
1answer
111 views

iptables to block all websites

I have Debian 7, and I want to block all websites in my computer, unless my email, using IPTABLES or others firewall. How can I block all website, include http and https too. How can I do this?
2
votes
2answers
189 views

Is it possible to have multiple virtual machines with the same (guest) ip on the same host?

What I try to achieve: Multiple virtual machines (virtualbox) on a Debian host which communicate with another server (not with each other or the host). All VMs need to have the same static network ...
2
votes
1answer
1k views

iptables and RETURN target

I don't understand what the RETURN target does in a iptables command. The doubt comes from this guide where it says: A chain is a set of rules that a packet is checked against sequentially. When ...