iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

3
votes
2answers
878 views

Block specific IP from accessing gateway

Suppose you are on linux internet gateway/router. What would you do to block a client with specific IP using bash script. I prefer something like ./block_client.sh 192.168.1.123 to block and ./...
3
votes
1answer
321 views

Block all internet connections unless connected to OpenVPN server

I want to block all internet connections unless I'm connected to my OpenVPN. Now of course, I need to allow connection to the VPN server. Can this be done, by allowing out/in traffic to/from the VPN ...
3
votes
1answer
210 views

Using iptables to redirect all traffic to local webserver

I'm trying to redirect all traffic on my wifi router to a local webserver using iptables. I'm not sure I have got the command right and also I want to exclude the router IP (172.16.0.1) from the rule ...
3
votes
3answers
552 views

monitor bandwidth on interface with tc or iptables

I would like to log a warning message to /var/log/messages file if either ingress or egress bandwidth on eth0 interface is over a certain threshold. I could do this with a script which reads the value ...
3
votes
3answers
9k views

How can I make iptables service start automatically after reboot on CenOS/RHEL7?

I am having a few issues with a newly installed home server I am preparing. I have installed CentOS7 on it and I found that port 80 and 443 are off by default. I therefore added them to the iptables ...
3
votes
1answer
365 views

How to combine iptables rulesets

Say there are several iptables scripts (run at boot time), all of which run something like iptables -A ... to add rules. I'm thinking this could be improved, turning all those shell scripts into text ...
3
votes
1answer
272 views

IPTables Port Redirection Should Have Broken Apache But Didn't

I have a Load Balance set up in Apache httpd: <VirtualHost *:80> DocumentRoot /var/www/html ServerName xxx.xxx.xxx.com ProxyRequests Off ...
3
votes
1answer
551 views

Configure iptables on remote server without locking me up

I have a little remote server that I can access only with SSH, and what I want to do, is block all the traffic except port 22 for SSH. The first time, what I did was : iptables -P INPUT DROP And ...
3
votes
2answers
636 views

What network protocols do database servers use?

I have a postgres 9.1 server running on the default port 5432 on an ubuntu 12.04 cloud server. I want to open up the port so I can make remote queries -- but I have to open the port on IP tables, ...
3
votes
2answers
632 views

RELATED,ESTABLISHED state in iptables

What do the words 'RELATED' and 'ESTABLISHED' individually signify in RELATED,ESTABLISHED state in iptables?
3
votes
1answer
848 views

IPtables : Limit number of new ssh connections per minute

I need to ensure on my server that maximum new ssh connections per minute are not more then 5. sudo /sbin/iptables -A INPUT -p tcp --syn --dport 22 -m connlimit --connlimit-above 5 -j REJECT Above ...
3
votes
2answers
920 views

Is it possible to whitelist a specific program in iptables?

Is it possible to allow all traffic for a specific program in iptables? Otherwise using nmap and a strict iptables configuration at the same time seems impossible.
3
votes
1answer
1k views

Changing firewall settings after installation of CentOS via kickstart

I was trying to install CentOS 6.3 via Windows Deployment Server. And to automate the installation process I used kickstart file in which i provided various details required during installation.Then i ...
3
votes
2answers
2k views

How can I Forward a subDomain to a specific port?

My apologies if this has been asked before. I haven't found an adequate solution so... yeah. When a specific domain, "example.com" is accessed, I want it to act normally. In other words, it should go ...
3
votes
1answer
13 views

iptables LOG only once

I noticed that there are data in the iptables log that I don't need, so I was wondering if it's possible to change some configuration so that the log has less information, thus reducing the log's size....
3
votes
1answer
38 views

Using iptables to stop brute force attacks on a Apache https site

I have a TLS site Apache which uses Basic Authentication to protect resources. I'm trying to setup an iptables rule to prevent brute force attacks on port 443, so I've added the following iptables ...
3
votes
1answer
33 views

How to make iptables logs to identify protocols by name and not by number?

In my iptables log files (Ubuntu 16-04), all messages from my LAN router and from other hosts in the LAN, related to IGMP have "PROTO=2". Is there a way to change this and get "PROTO=IGMP"?
3
votes
1answer
110 views

PPTP VPN not working with Linux router

ORIGINAL: I've just switched from an old Linux install (Debian squeeze) to a new one (Linux Mint 17.3) for my router (I am using a full desktop PC with a Linux install as my router). The Linux PC ...
3
votes
1answer
33 views

How to manage the source data for iptables -v option?

If I run the command iptables -nvL on my VPS server running Ubuntu I get output like (output is much longer - I have only shown the interesting parts) $ sudo iptables -nvL Chain INPUT (policy DROP ...
3
votes
1answer
145 views

How can Wireshark see packets dropped by iptables?

I recently installed my hard drive in a new computer and after some fiddling around I noticed my iptables rules were dropping DNS responses for some reason, turns out they were configured to allow ...
3
votes
1answer
105 views

How to limit port range in Ubuntu 14.04?

I want to limit source port range in my ubuntu machine upto 20000 , that means no Application should be able to use port higher than that.I have this command in mind iptables -A OUTPUT -p tcp --...
3
votes
1answer
1k views

How to measure iptables load?

I have added about 3500 IP addresses to iptables using ufw on a Debian 7 and I am wondering if this has any impact on the performance of my server. How can I measure that?
3
votes
1answer
3k views

iptables routing incoming IP to another destination IP question

I have a test setup: server1:1.1.1.1 server2:2.2.2.2 client: 3.3.3.3 I'm trying to have client IP 3.3.3.3 do a HTTP request from the 1.1.1.1 server. However I want the 1.1.1.1 server to pass this ...
3
votes
1answer
4k views

Settings when using a bridge

I have a bridge set up between my physical Ethernet interface, eth0, and the virtual interface for OpenVPN, tap0. The bridge has an IP address, and the machine can be contacted on that IP address from ...
3
votes
1answer
548 views

listen to a conversation using port forwarding

I have been able to make a phone calls using the SIP client Pjsua from one Linux computer to another one. In case you have not heard of this user agent, explaining it's functionality is quite easy. It ...
3
votes
1answer
6k views

Set up firwall with iptables to only allow VPN

Im using IPredator VPN with openVPN and I want to make sure that if the connection is dropped, i wont submit data from the internet without the VPN. I heard that I could do that with iptables and a ...
3
votes
1answer
3k views

tc don't see marked with -j MARK packets

Server has 2 network interfaces: eth1 with address 13.0.0.254/24 eth0 with address 172.20.203.4/24. It's routing traffic between this two networks. Task is to limit bandwidth between this two ...
3
votes
1answer
926 views

Routing through iptables

I have this vpn client that touches the routing table and then keeps watching it to exit if it gets touched. It is the kind of setup needed for an endpoint, such as a laptop. I want to use a small ...
3
votes
2answers
861 views

Need help with routing

I have set up a Ubuntu server, that I want to use as a router for my local office. The problem is, that I want to make 2 VPN connections, to remote branches, and then I want to route all traffic to ...
3
votes
2answers
149 views

Ban IP using Iptables/Firewalld

I was DDos Attacked by Chinese Great Firewall twice this year. Now I download zone file from http://www.ipdeny.com/ipblocks/ .I want to do these things: If Someone from Anywhere wants to connect to ...
3
votes
2answers
133 views

How to disable network access for a user?

Trying to disable the network access for the user: [root@notebook ~]# iptables -I OUTPUT -m owner --uid-owner tempuser -j DROP [root@notebook ~]# ip6tables -I OUTPUT -m owner --uid-owner tempuser -j ...
3
votes
1answer
426 views

How to combine connlimit with IP sets?

connlimit lets me limit the number of connections per client/service. How would I go about to combine such a rule with the IP sets available in more recent versions of the Linux kernel and netfilter?
3
votes
1answer
53 views

Which network services depend on the “accept related input” iptables rule?

Background I am setting up a firewall for a webserver and was wondering if it would be a good security meassure to even reject RELATED input traffic and only except established connections by default....
3
votes
1answer
1k views

Open and redirect port

I'm trying to set up SNMP for a router so I can monitor it from an existing Nagios installation on an off-site server. I'm having trouble getting the router to respond to SNMP requests from the WAN, ...
3
votes
1answer
2k views

How do I route different users over different OpenVPN tunnels in Linux?

The setup: I have multiple, static-key OpenVPN client/server configurations, labeled "client1", "client2", and "client3" with server/client IPs 10.10.1.1/10.10.1.2, 10.10.2.1/10.10.2.2, and 10.10.3.1/...
3
votes
2answers
953 views

iptables routing marked packets from router to PC and routing them back to router

I'm trying to do deep packet inspection on HTTP packets. The purpose of this is to collect HTTP payload data and then create some proxy/cache-independent reports. Following this, the idea is to ...
3
votes
1answer
554 views

User associated with a socket

I use ss -p to see TCP sockets information. But process info are not printed for some sockets. Below: $ ss -p4 State Recv-Q Send-Q Local Address:Port Peer Address:Port ESTAB 0 0 10....
3
votes
1answer
409 views

1000 iptables entries on CentOS?

I just got a new dedicated server with CentOS and I'm trying to debug some network problems. In doing so, I found over one thousand iptables entries. Is this the default on a CentOS system? Is there ...
3
votes
1answer
4k views

Default mark for packets using iptables

I am trying to set up a QOS script on my Tomato-enabled WRT54G router. The script does the basics of what I need (make sure that a particular machine on my network has lower priority than anything ...
3
votes
1answer
40 views

Forward ICMP Ping Packets to Interface

I've got a script that listens for ICMP ping packets (containing data payload) and while this works if you run it from command line, it doesn't work in a Docker container because ICMP ping packets are ...
3
votes
0answers
41 views

Why “echo f” in the case of clearing conntrack table doesn't work on debian?

Many people don't clear the conntrack table when they want to reload their firewall rules. When you have some ESTABLISHED connections, all the sessions won't be affected when you add a rule that ...
3
votes
0answers
31 views

No “unreachable” response for an outgoing TCP connection when using fwmark and policy routing

I would like to route locally-generated traffic: to a TCP port "A" of host "H" via the interface "A", to a TCP port "B" of host "H" via the interface "B". Interface "B" is sometimes unavailable. ...
3
votes
0answers
39 views

Configuring a Linux Wi-Fi access point to redirect a one-word URL to http://192.168.42.1:8888

've created a Wi-Fi access point on a Linux box (thanks to hostapd). I'm trying to make it easy for clients to access the Freenet service that's running on said box. Ideally, the user would be able ...
3
votes
1answer
311 views

iptables: change local source address if destination address matches

I have a Linux machine (RHEL 6.7) with 2 IP's configured on a single NIC (eth1). The primary address, and therefore the address that all traffic appears to come from, is 10.0.0.23. The other is 10.0.0....
3
votes
0answers
316 views

Captive Portal on Raspberry Pi (raspbian) with Bridged Adapter

I am trying to create a captive portal on a Raspberry Pi by following the steps from this GitHub project: https://github.com/thgh/pilon I have 2 network interfaces on the pi. wlan0 TP-Link TL-...
3
votes
0answers
1k views

Is it possible to throttle upload bandwidth per `IP` basis using `tc`, `htb` and `iptables` ? (Download limitation not required)

Problem I've searched internet like anything but couldn't find much about limiting upload. The solutions given are not limiting IP basis like this one but LAN as a whole. +-----+ +------...
3
votes
0answers
199 views

Restrict the maximum number of independent IP connection on specific port at the same time

I set up a server as a socks5 proxy. I'd like restrict the maximum number(1 or 5 or 20) independent IP connection on specific port at the same time. I have searched on google, only see some articles ...
3
votes
0answers
475 views

Routing traffic for specific user to specific interface

I have a Linux box with these interfaces: eth0 Link encap:Ethernet HWaddr 14:da:e9:ef:75:7d inet addr:176.9.85.182 Bcast:176.9.85.191 Mask:255.255.255.224 tun0 Link encap:UNSPEC ...
3
votes
1answer
171 views

Why are these connections not classified as “established” under conntrack?

I have the following rule for iptables: -A OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT such that outgoing connections not classified as established will be logged. Occasionally, the ...
3
votes
0answers
57 views

Which tool is used to create firewall rules on Fedora 20? [closed]

What is a recommended way to set up firewall rules on Fedora 20/Centos 7/RHEL 7 currently? I know about relatively new replacement of itpables service by firewalld service. Which command-line user ...