iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

2
votes
2answers
221 views

Temporary redirect ports

I need a temporary redirection of some ports to another machine. I've tried: iptables -t nat -A PREROUTING -p tcp --dport 4321 -j DNAT --to-destination 192.168.121.4:80 But shorewall blocks all ...
2
votes
1answer
102 views

Remove an IPTable Rule

I'm having troubles removing this ipables rule in Ubuntu: $ iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 3128 I've tried using the -D attribute but with no success. How can ...
2
votes
1answer
313 views

What does lo in iptables mean exactly?

I have seen countless examples of this rule in iptables: -A INPUT -i lo -j ACCEPT I thought lo means localhost (a.k.a. 127.0.0.1), but when I commented it out, I can't access the server using its ...
2
votes
1answer
8k views

iptables forward all traffic to interface

I have two interfaces eth1 and eth0. I want all traffic on eth0to be forwarded to eth1. I created an iptable rule like this: iptables -A FORWARD -s 0/0 -i eth0 -p tcp -o eth1 -j ACCEPT But this ...
2
votes
2answers
4k views

FTP and iptables. Connection fails but ports are open

I installed proftp on my machine. With iptables disabled I can connect to the machine, using ftp-client or telnet. With iptables connection fails - telnet says "Connection failed" # works telnet ...
2
votes
1answer
203 views

Lost connectivity after iptables change

I attempted to add a couple web ports to iptables and in doing so lost the ability to resolve any external address. I have a working SSH session open and can get to the box easily if needed. Here's ...
2
votes
1answer
870 views

Why iptables does not fetch information from /etc/sysconfig/iptables on centOs?

I'm new in Linux and encountered with problem with iptables. Here is content of /etc/sysconfig/iptables file # Generated by iptables-save v1.4.7 on Tue Nov 27 21:41:04 2012 *filter :INPUT ACCEPT ...
2
votes
1answer
1k views

How does iptables MASQUERADE work on the incoming side?

I'm still reading the iptables manual page and other documents and digging around questions and their answers. This is the problem which arises. When we setup the NAT we use a POSTROUTING rule such ...
2
votes
2answers
1k views

Iptables port forwarding to qemu vm

Is it possible to create an IPtables rule that forwards all incoming traffic on port 80 on the host to port 80 of the qemu VM? Is such a scenario possible with qemu?
2
votes
1answer
3k views

system wide SOCKS5 Proxy

I connect to my Server on the internet using ssh -D 3128 user@rootserver.com. If I am right I thereby open a SOCKS v5 Proxy to my Server. Using firefox and FoxyProxy I can now add this to my proxys ...
2
votes
2answers
9k views

Problems setting up TigerVNC and firewall

I have a box running a fresh install of Fedora 15. I've installed TigerVNC server on it and client on my Windows machine. I've added -A INPUT -m state --state NET -m tcp -p tcp --dport 5900 -j ACCEPT ...
2
votes
2answers
46 views

What does this iptables rule mean?

Reading this article on how to configure OpenVPN, I see the following paragraph: Raspbian has a firewall to protect your Raspberry Pi from unknown and unexpected Internet sources. We still want ...
2
votes
2answers
218 views

Is there a specific reason why iptables would return an exit code of 3 (instead of 1?) when executed without sufficient privileges?

I simply forgot to use sudo: usr@arch ~[0] $ iptables -L iptables v1.4.21: can't initialize iptables table `filter': Permission denied (you must be root) Perhaps iptables or your kernel needs to be ...
2
votes
2answers
679 views

Bonding two broadband connections to serve LAN as a gateway

I need to increase the connectivity and speed of the Internet to my LAN users. These are the things I have in my hand to do so. PC with 3 NICs 1 for LAN and 2 for routers 2 broadband connections ...
2
votes
1answer
101 views

Do I have to swap IP sets, or can I add/remove on the fly?

I was wondering about the semantics of ipset(8). Is it possible to add a rule matching a set to iptables and then manipulate the set, or can I only create a set and swap it for an older set in order ...
2
votes
1answer
81 views

Should IP tables rules affect a serial port on Linux

I'm trying to setup some iptables rules on my embedded Debian Linux system, using a serial console I entered this: root@ts7600-47aad3:~# iptables -F root@ts7600-47aad3:~# iptables -P INPUT DROP ...
2
votes
2answers
295 views

RELATED,ESTABLISHED state in iptables

What do the words 'RELATED' and 'ESTABLISHED' individually signify in RELATED,ESTABLISHED state in iptables?
2
votes
1answer
113 views

Port forwarding using iptables on Linux

I want to forward a local port to a remote port (8041) to a port (8042) on a remote machine (10.0.0.42). I can do this via ssh -L 10.0.0.41:8041:10.0.0.42:8042 user@localhost where 10.0.0.41 is ...
2
votes
1answer
56 views

How would I go about making this IPTABLE rule for every ip and not just one?

iptables -I PREROUTING -t nat -p udp -s 192.168.0.62 --dport 53 -j DNAT --to-destination 23.21.182.24 Instead of 192.168.0.62 I'd like to set that as a global rule, EVERY ip that needs dns should ...
2
votes
5answers
166 views

Difficulty setting up iptables

I'm very new to *nix operating systems, and I'm having some trouble which I believe is because of misconfiguration of the iptables firewall. My server has SSH running on port 22, and server software ...
2
votes
2answers
3k views

Why must loopback traffic be authorized using iptables to get web access?

I thought the following was necessary was necessary for outgoing HTTP on a desktop (non-server): iptables -A INPUT -p tcp -m multiport --sports 80,443 -m conntrack --ctstate ESTABLISHED -j ACCEPT ...
2
votes
1answer
534 views

IPTables string match redirection

The issue: I am currently redirecting port 80 requests to another system on port 1000. This is done like so: iptables -t nat -A PREROUTING ! -s 172.20.1.2 -p tcp --dport 80 -j DNAT --to-destination ...
2
votes
1answer
910 views

iptables rules too restrictive; Drupal webserver cannot access repositories, ntp or even websites

This is a Drupal website running Ubuntu 12.04 LTS on Linode. Someone recently changed our iptables rules and a number of problems started. These include: Our Mollom spam protection is not working ...
2
votes
1answer
404 views

Can iptables be used to convert a single-homed host into a NAT server?

Given: I have a machine (HostA) with only one NIC which has Internet connectivity. I have another machine (HostB) with one NIC on the same switch. HostB is not configured for Internet access yet. ...
2
votes
1answer
261 views

Explanation of bandwidth management script calling tc

I have some scripts in Linux to manage internet bandwidth, but I do not understand what they do. What is the meaning of the following scripts: tc qdisc add dev $IF root handle 1: htb default 256 tc ...
2
votes
1answer
395 views

iptables is not blocking

I have a script running every minute by a crontab. This script scans the system logs and grabs the IPs of every failed attempt to login on the server's dovecot, exim or ssh and add them to an ipset, ...
2
votes
1answer
453 views

IPtables command shows libipt_random.so missing

When I run a command, it shows error. I searched on net, but no one give me the correct answer. Googling shows only wrong answers for this questions. So please help me to overcome this problem. ...
2
votes
2answers
635 views

Is xinetd still the best method to let non root daemons listen on privileged ports?

When I need to use SNMP monitoring for java applications, there is the need to that application (usually ran as daemon user) to listen on snmp port. If there is no other alternative, of course I can ...
2
votes
2answers
1k views

How can I Forward a subDomain to a specific port?

My apologies if this has been asked before. I haven't found an adequate solution so... yeah. When a specific domain, "example.com" is accessed, I want it to act normally. In other words, it should go ...
2
votes
1answer
3k views

Port Mirroring using iptables - copy all traffic among nginx on :80 and apache on :8080

I have nginx running on port 80 and apache running on port 8080 I want to transfer all the traffic to both nginx and apache asynchronously i.e the performance of one server wont be dependent on the ...
2
votes
1answer
9k views

Fedora 16 - Iptables installed, but no iptables service available

I'm trying to open ports on my fedora OS. In the past, this was as easy as adding an rule like -A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT I went to restart my iptables ...
2
votes
1answer
1k views

What does this iptables entry mean?

iptables-save output: *filter :INPUT DROP [2929:172650] :FORWARD DROP [0:0] :OUTPUT ACCEPT [74596344:6265371965] These are the opening lines of the iptables-save command. What do the numbers in the ...
2
votes
1answer
2k views

Unable to make outbound SNMP connections when IPTables is enabled

I have a bunch of windows servers configured with the windows SNMP agent. Each server has four IP addresses and SNMP listens on all of them. There is something very odd with my monitoring server ...
2
votes
1answer
140 views

iptables ruleset causes server to stop answering

I'm trying to configure my proxmox server's firewal and redirections. The aim is to block everything, open the necessary ports for basic services to work and, finally, redirect some ports to virtual ...
2
votes
3answers
119 views

Bridge/Router with custom logic

I've a Linux box with 3 network adapaters, which I'd like to configure as follow: Adapter A is connected to computer A Adapter B is connected to computer B Adapter C is connected to the Internet. ...
2
votes
1answer
561 views

Forwarding packets from loopback interface with policy-based routing

I have the following iptables rule: iptables -t mangle -A PREROUTING -p udp -m udp --dport 10000 -j MARK --set-xmark 0x4/0xffffffff which sets fwmark 4 on all udp packets with destination port ...
2
votes
1answer
241 views

iptables routing incoming IP to another destination IP question

I have a test setup: server1:1.1.1.1 server2:2.2.2.2 client: 3.3.3.3 I'm trying to have client IP 3.3.3.3 do a HTTP request from the 1.1.1.1 server. However I want the 1.1.1.1 server to pass this ...
2
votes
1answer
103 views

psad: do not block access to HTTP

I want to block intruders via psad, but HTTP and HTTPS should not be blocked. For example, if someone is scanning my dedicated server via nmap, psad should block him for 2 hours, but he should still ...
2
votes
1answer
170 views

How is whonix blocking UDP traffic (except udp-dns related traffic)?

I want to know how whonix manages to block unwanted UDP-Traffic i.e. all UDP-traffic but DNS related udp traffic. I looked at the iptable rules both in the Workstation and Gateway. There are no ...
2
votes
1answer
763 views

Unable to access website hosted on virtual machine

I'm on a mac (osx 10.9.3) running CentOS7 in virtualbox. I would like to access the website hosted on the virtual machine. Browsing to the Guest IP returns webpage not available. I'm able to ping and ...
2
votes
1answer
409 views

In iptables, what is the difference between targets DNAT and REDIRECT?

More specifically, is -A PREROUTING -i $INT -p $PROTO --dport $PORT -j REDIRECT --to-ports $NEWPORT equivalent to one or both of these? -A PREROUTING -i $INT -p $PROTO --dport $PORT -j DNAT ...
2
votes
1answer
110 views

How do I enable IPv6 inbound traffic to get forwarded to my machine?

It seems that IPv6 traffic on my router is being dropped. How do I configure ip6tables appropriately, so that traffic is forwarded/accepted to my machine? Here's the syslog for my IPv6 traffic: Jun ...
2
votes
1answer
38 views

My iptables works the opposite from what I wanted

I have this set of iptables rules ... $ sudo iptables -n -L Chain INPUT (policy ACCEPT) target prot opt source destination LOG all -- 0.0.0.0/0 0.0.0.0/0 ...
2
votes
1answer
380 views

iptables - add rule for interface before it comes up

Right now I'm using /etc/rc.local to add some iptables rules on my Linux router on boot however some of the rules aren't added. I assume this is because the interface hasn't come up yet. This is what ...
2
votes
1answer
188 views

IPTables Port Redirection Should Have Broken Apache But Didn't

I have a Load Balance set up in Apache httpd: <VirtualHost *:80> DocumentRoot /var/www/html ServerName xxx.xxx.xxx.com ProxyRequests Off ...
2
votes
1answer
619 views

Problem setting up iptables (LDAP traffic blocked)

My application server is on a network protected by a organization wide firewall, and my server is also using fail2ban. That said, I'd like to set up an additional layer of protection with iptables. ...
2
votes
1answer
118 views

Forward a host's network traffic to another host with the exception of SSH traffic

I am trying to redirect all the network traffic received in a old host to a different host. For that I created two new rules with iptables on the old host: echo 1 > /proc/sys/net/ipv4/ip_forward ...
2
votes
1answer
168 views

Randomizing the source port for new connections

Generally whenever source port is selected by a network application, it is selected in a sequential manner among the free ports like 32000, 32001 and so on. I want to randomize the source port ...
2
votes
1answer
125 views

Internet sharing with iptables: choosing which connection to share

I have a computer with two network devices (eth0 and wlan0), both connected to the internet (two different connections/isp). I'm trying to share the connection of wlan0 to another computer connected ...
2
votes
1answer
2k views

Linux Fedora 19 - iptables failed to start

I've been trying to start the iptables firewall service, but it keeps failing. What's going wrong? # systemctl status iptables.service iptables.service - IPv4 firewall with iptables Loaded: loaded ...