iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

0
votes
1answer
50 views

iptables selectable tunnel

I have this configuration script: I OPENVPN TUNNELS openvpn --config serverx.ovpn > /dev/null 2>&1 & openvpn --config servery.ovpn > /dev/null 2>&1 & TEST ON MY ...
1
vote
1answer
313 views

On Centos7 firewalld overwrite iptables modules [duplicate]

Simple question: i want to load two modules /usr/sbin/modprobe ip_nat_ftp /usr/sbin/modprobe ip_conntrack_ftp I can put those lines in rc.local or use /etc/sysconfig/iptables-config But at reboot ...
0
votes
1answer
38 views

How to customize Shorewall firewall logs

I am using Fedora 13 machine with shorewall installed. shorewall 4.6.6-RC1 iptables v1.4.7 Below is log format by shorewall: Oct 23 05:28:17 localhost kernel: shorewall:LAN-LAN:ACCEPT:IN= OUT=lo SRC=...
1
vote
0answers
43 views

cups: connection timed out

Per title I'm showing connection timed out in the /var/log/cups/error_log. D [29/Oct/2015:17:43:32 -0400] cupsdSetBusyState: Printing jobs D [29/Oct/2015:17:44:04 -0400] [Job 11441] Connection ...
1
vote
1answer
75 views

iptables DNAT+SNAT: unwanted multiplication of the same udp datagram (and malfunction)

trying to figure out my mistake in the following very simple scenario: |peerA|(Aip:Aport) <--> (Bdev:Bip:Bport)|NatNode|(Cdev:Cip:Cport) <--> (Dip:Dport)| peerD (peer A emits datagrams ...
0
votes
1answer
493 views

route on specific interface based on port

I have a php / bash application on top of a Linux machine with 1 physical interface connecting to e.g., outbound webserver 123.123.123.123 :80. I do this via several openvpn providers. I have both tun ...
0
votes
1answer
27 views

Packet forwarding under Linux shakey compared to Windows, why?

I was previously using Windows 7 to to share wireless internet to a device without wireless capability over Ethernet, and it worked perfectly. I've now switched to a Linux machine and am trying to do ...
1
vote
2answers
60 views

How to fail fast with iptables?

Inspired by the Pi-hole I set up my own one. What it does: The Pi-hole is configured as a dedicated IP in my local net on a virtual adapter of Raspberry Pi. Get list of known spam / phishing / ad ...
1
vote
0answers
58 views

Counter MAC spoofing

I use a public wifi. (connect with id/password on an open network) The network is unstable (download stream 500ko/s then drop 0ko/s and stream stop, if a click a later in the stream it's working ...
0
votes
1answer
41 views

iptables logging for all except ICMP

I have iptables firewalls and its logging for all DROP packets or Deny. I want to tell it to no LOG any packet for ICMP protocol. How do i tell that *filter :INPUT DROP [0:0] :FORWARD ACCEPT [0:0] :...
1
vote
1answer
21 views

Why are traffic from hosted VMs classified as iptables OUTPUT?

On the machine serving as the firewall for a network, I've installed a VM to bridge to a remote VPN. Since then, I've noticed none of the devices connected to the said VPN had their connections ...
1
vote
1answer
168 views

iptables mangle table with custom chain

I create a new chain in mangle table: $IPTABLES -N newchain -t mangle After that all the 80's port packets I put to that new chain: $IPTABLES -t mangle -A PREROUTING -i eth1 -p tcp --dport 80 -j ...
1
vote
1answer
105 views

iptables LOG only once

I run the following iptables commands to detect and log a port scan: iptables -A INPUT -p tcp -i eth0 -m state --state NEW -m recent --set iptables -A INPUT -p tcp -i eth0 -m state --state NEW -m ...
0
votes
1answer
72 views

Automatically initiate an outbound SSH connection on a server when a client connects

How can I automatically initiate an outbound SSH connection on a server when an internal client connects to that server on a specific port, for any given service, from a given IP range? Note that the ...
0
votes
1answer
45 views

Configure linux PC as a Router

I want to configure my Rasberry Pi as a router. I have two network interfaces eth0 and eth1 connected to two networks. eth0 is connected to a private network and eth1 is connected to a public network (...
0
votes
1answer
340 views

Have iptables run command/script on new connection attempt [duplicate]

How can iptables run a command or script on a new connection attempt? Requirement: External packet to (server interface eth0) ---> (Server interface eth0) input table detects new packet received on ...
1
vote
1answer
47 views

iptables inside bridge

if i have: eth0 (no address) wlan0 (no address, providing wifi-hotspot by 'hostapd') br0 (local IP, bridging eth0+wlan0) eth1 (public IP, providing internet to above by net.ipv4.ip_forward=1) ...
0
votes
0answers
63 views

iptables - ignore logging a single rule

Currently my iptables log all dropped packets. I have the log rule at the bottom. The problem is, I have a noisy neighbor who is flooding the subnet with UDP 17500 packets. I'm assuming its Dropbox ...
0
votes
1answer
94 views

Problem adding iptables rule

I just installed OMSA and need to open up port 1311 to access the web tool. Here's iptables before: [root@mybox ~]# iptables -nvL --line-numbers Chain INPUT (policy ACCEPT 0 packets, 0 bytes) num ...
0
votes
1answer
87 views

iptables resolved addresses differs from nslookup

To block personal emails on a corporate network, I've blocked FORWARD to mail.google.com and mail.live.com. The following is how iptables resolved those addresses: $ sudo iptables -L Chain FORWARD (...
2
votes
0answers
143 views

Can I add iptables rule from the inside of a C Linux program only with capabilities or do I need necessarily root?

I need to add an iptables rule from the inside of a C Linux program. How should I do? Do I need root privilege or can I just grant some capabilities? I tried granting CAP_NET_RAW+iep and using popen(...
1
vote
1answer
220 views

Can I setup a local transparent proxy to forward requests to another another web proxy

I would like to set up a local Linux system to tunnel all http/https requests transparently through a corporate proxy. Many scripts honor http_proxy environment variables but some don't and it is a ...
3
votes
0answers
318 views

Captive Portal on Raspberry Pi (raspbian) with Bridged Adapter

I am trying to create a captive portal on a Raspberry Pi by following the steps from this GitHub project: https://github.com/thgh/pilon I have 2 network interfaces on the pi. wlan0 TP-Link TL-...
2
votes
0answers
43 views

iptables not working on mobile broadband

I access the internet using a VPN. With the help of iptables rules all out-going traffic from my machine to the internet is dropped instantly when my VPN connection is abruptly terminated. The ...
0
votes
0answers
34 views

help with iptables configuration

I want to run two vpns on local host. I want all traffic to be sent first to the first vpn, and then to the second vpn, and no other outside leaks. Could you help me please to realize this? the ...
1
vote
0answers
119 views

Sniff on SWITCH(lan) traffic openWRT

Is it possible to sniff (with tcpdump) or mirror LAN traffic that doesn't get routed to WAN using openWRT? Say I have two PCs connected to LAN ports and I want to sniff on traffic one PC is sending ...
2
votes
0answers
125 views

How to restrict openvpn clients to communicate with other vpn clients

I have this Openvpn scenario.. I have Lot of openvpn clients connected to my server, All i want is to restrict client to client communication. for eg. i have (10.20.0.2,10.20.0.3,10.20.0.4,10.20.0....
1
vote
0answers
39 views

Filtering bridged packets by IP address

I am using a small Ubuntu 12.04 box as a Wi-Fi Access Point. The box has two interfaces which are bridged together as follows: brctl addbr br0 brctl stp br0 off brctl addif br0 wlan0 brctl addif br0 ...
1
vote
1answer
94 views

iptables forward from host to guest interferes with vm-vm communication

My iptables -L: Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT udp -- anywhere anywhere udp dpt:domain ACCEPT tcp -...
1
vote
0answers
30 views

Forward public network around current network

For the purposes of this discussion, I have a very current always-on linux machine with two nics: wifi0 eth0 A very crude diagram of my desired configuration looks like this: ...
0
votes
1answer
86 views

Access my web server publicly

On my Debian server I have a eth0 interface (192.168.10.x) and I just added eth1 (176.31.36.x). I would like to set up a public access for ssh, web, ..etc. allow-hotplug eth1 iface eth1 inet static ...
1
vote
1answer
481 views

Conditional Check for IPTables

I am trying to check whether specific rules in IPTables exists or not. #!/bin/bash if iptables -L -n | grep -- "ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:8880"; then ...
1
vote
0answers
184 views

How to replace udp packets on the fly

I've used iptables to reroute traffic to netsed like this, but it seems to route the traffic to another location. I've used hexinject like this: hexinject -s -i eth0 -c 1 -f 'arp' | replace '06 04 ...
1
vote
1answer
307 views

How to route traffic through different proxy servers based on destination

Background I work on a corporate network that is behind a proxy server. I also work with some remote sites that I am able to access via a bastion / jump host ssh proxy. In my ~/.ssh/config I have a ...
2
votes
2answers
111 views

Best practises: Applying iptables firewall rules for SSH

I need to add some firewall rules in our QA environment using iptables. I have to do the changes remotely . Some of the changes also include disabling SSH for few Networks . What are best practices ...
0
votes
0answers
66 views

Incoming internet SSH traffic to eth0 and outgoing internet traffic to wlan0

I have this setup: kali linux on raspberry PI connected to eth0 and wlan0. eth0 has internet access and public ip with port 22 open. wlan0 has internet access. I want to be able to connect to my ...
1
vote
1answer
56 views

Iptables dropping HTTP 302 packages contain suspicious domain string

The HTTP 302 packages I want to block have: Header HTTP/1.1 302 Found Location: http://www.yxjiaodai.com/ad/?id=1023&url=http%3A//a1819.oadz.com/link/C/1819/3081547/dtMdon4l79FwsIo2JXEHqtdp5eQ_/...
0
votes
1answer
120 views

Open port on one IP

I have spent all day looking this up with no luck. So, I own the IP range xxx.xxx.xxx.xxx/27 and I want to open port 22 on IP xxx.xxx.xxx.66 yet close port 22 on all others, then open port 80/443/...
1
vote
1answer
288 views

What order are mangle dscp rules applied with iptables?

I'm using iptables mangle to mark traffic with different DSCP values. I'd like to confirm the order in which overlapping rules will be applied. I assumed that the logic would be the same as with ...
2
votes
1answer
429 views

Why does iptables accept packets on a given port, when it is closed?

Here is my situation. I have a public address on my router and have manually forwarded a given port for torrenting, so not via UPnP, that is disabled both in the router and the application. It works ...
-1
votes
1answer
291 views

iptables: command not found - CentOS 5.5

I am using CentOS 5.5. I want to add new IP in my iptables. But I cannot do it. Tried everything with 'iptables'. The latest version of 'iptables' is at sbin. I'm in 'sbin' directory. But it says "...
6
votes
2answers
177 views

How can I silently drop some outgoing packets?

I'm doing some testing of an application I am working on, and I need to be able to silently drop outgoing UDP packets for a short period of time to replicate a possible failure mode. Is there any way ...
0
votes
1answer
86 views

iptables nat not work for sctp

i have a server in internal network and i want to access it from external. the network is like this: Server A (132.196.28.229) is in external network Server B (10.35.202.24) can access both network ...
0
votes
1answer
278 views

IPTABLES - Bad IP Address

I am trying to turn my Raspberry Pi into a VPN server. To do this I am following this tutorial. The only issue is when it tells to to run this command iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o ...
2
votes
0answers
50 views

Detect which program is blocked by firewall

The linux firewall can show a lot of information in the LOG target, for example via --log-uid. How can the executable doing the network call be logged, too? I did not find anything in the FAQ, the ...
0
votes
0answers
154 views

Raspberry Pi OpenVPN SSH problem

I followed this tutorial to configure OpenVPN and it and runs very well: http://blog.frd.mn/raspberry-pi-vpn-gateway/ Now I want to access my Raspberry Pi via SSH. OpenVPN is most of the time ...
0
votes
1answer
228 views

How to set up a clear SuSE-Firewall?

I’m doing some rules in a machine with the firewall disabled, but when I run rcSuSEfirewall2 a lot of rules and policies are applyed by default: iptables -L Chain INPUT (policy DROP) target prot ...
0
votes
1answer
361 views

ufw won't allow connections to port 5432

I've installed Postgresql 9.4 on Ubuntu Trusty from the PGDG ppa. I've created a database and set it listen-addresses to '*'. I've made an entry in the pg_hba.conf file. I can connect locally with no ...
0
votes
0answers
303 views

Use iptables to redirect **all* requests, even DNS-unsolved domain?

Context: With iptables, I redirect all the traffic - incoming at port 80 - to a distant server IP (X.X.X.X). I aim that anywhat you write in the urlbar of browser, you get X.X.X.X. IP That works a ...
4
votes
1answer
669 views

forward all mysql traffic to a ssh tunnel

I have a local application that needs to connect to a remote mysql server at 40.40.40.40:3306 The main firewall blocks all connections but ssh, I can set up a ssh tunnel and connect to the server ...