iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

10
votes
2answers
6k views

( /etc/sysconfig/iptables ) “Manual customization of this file is not recommended.” Why?

Editing this file directly /etc/sysconfig/iptables can save me so much headaches so much time and so on... and yet on the very top of the file it says.. Manual customization of this file is not ...
0
votes
1answer
129 views

Is it OK to copy /etc/sysconfig/iptables to another machine?

This is my original server with very loose security given that it does not block all ports via iptables. /etc/sysconfig/iptables contents: # Generated by iptables-save v1.4.7 on Mon Jun 16 ...
-1
votes
1answer
2k views

/etc/sysconfig/iptables : how to block everything except for port 80 and 22?

My new centos 6.5 cloud server came with this /etc/sysconfig/iptables inside we have: # Generated by iptables-save v1.4.7 on Mon Jun 16 20:04:05 2014 *filter :INPUT ACCEPT [8:607] :FORWARD ACCEPT ...
1
vote
1answer
11k views

How to modify iptables rules via editing a file rather than interacting via command line?

In the history, i would simply edit a file and then reboot the whole server. i would clone the line that had port 22 open change it to 80 and then save the file.. and reboot the whole system so ...
2
votes
1answer
425 views

In iptables, what is the difference between targets DNAT and REDIRECT?

More specifically, is -A PREROUTING -i $INT -p $PROTO --dport $PORT -j REDIRECT --to-ports $NEWPORT equivalent to one or both of these? -A PREROUTING -i $INT -p $PROTO --dport $PORT -j DNAT ...
13
votes
3answers
6k views

Iptables to redirect DNS lookup IP and Port

I have discovered that my ISP (verizon) is intercepting all DNS traffic on port 53. Using iptables, I want to redirect all DNS lookup traffic to a specific IP and Port (5353). Any attempt for my ...
3
votes
2answers
114 views

Iptables not forward traffic

I need to redirect all traffic incoming on port 9750 (the port chat server) to another machine on the same subnet. Ports clients - dynamic. iptables -t nat -A PREROUTING -p tcp -d x.x.x.a --dport ...
1
vote
2answers
104 views

Reject ssh connections made from proxies

I was seeing this question which was concerned with blocking access to the users who do not belong to a particular region. I am sure that blocking is possible but I see there is a workaround to this. ...
1
vote
1answer
664 views

DROP all for port 22 if not geoip set of US for iptables and xtables

I want to simply block all ssh access from anywhere but with in the US. This is my whole iptables, and I have followed ...
0
votes
0answers
120 views

iptables blocking email from my wordpress site

I cant seem to send email from my Wordpress site. Here is what my iptables script looks like. Ports 25 and 110 are commented but even uncommented the send email does not work. #!/bin/bash # A Linux ...
2
votes
3answers
276 views

What iptables command do I need to allow web server traffic?

I have a hard time understanding iptables rules. I am running a centos 6.5 VM on my laptop (vmware hypervisor) and it looks like it comes with this setup for iptables: # iptables -L Chain INPUT ...
2
votes
0answers
77 views

Transparent Proxy

I am setting up attempting to set up a transparent proxy on CentOS using Squid. So far I have managed to filter the content and get it working perfectly. The only issue I am having is getting a form ...
1
vote
0answers
221 views

Open ports for local samba server with iptables

I can't seem to connect from Windows 7 to my network share on Ubuntu (Samba). Why won't this work? Heres a bit of information, that would perhaps be useful. user1@computer:/etc$ sudo iptables -L ...
6
votes
1answer
693 views

forward outgoing traffic port using iptables

I am trying to forward all outgoing traffic from port 80 to port 8080 using iptables and I tried the following rule, though it did not work: iptables -t nat -A OUTPUT -p tcp --dport 80 -j REDIRECT ...
1
vote
1answer
213 views

forwarding not working in iptables from 8006 to 443

My dedicated server was bridged to vmbr0 and it has 2 Ethernet cards eth0 and eth1 its bridged. I have enabled forwarding with net.ipv4.ip_forward=1. I want to redirect the Port 8006 to 443. Now ...
0
votes
2answers
251 views

iptables and securing an smtp

I am trying to block all SMTP out of my network, that is not from my internal mail server address. So i would just like to know if there could be anything i am missing or perhaps anything i could ...
8
votes
6answers
349 views

iptables rule adviser script

There is a server without any iptables defense: ACCEPT all.. There could be custom applications on this server. If we should need to harden this server (so deny all, and only let what is needed by ...
-1
votes
2answers
1k views

My Centos Server cannot resolve the DNS host name [closed]

My Server OS: Centos 6.3 x64. The server iptables is: *filter :INPUT DROP [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT -A INPUT -p tcp -m tcp --dport ...
0
votes
1answer
282 views

Linux iptables DNAT 53306 to 127.0.0.1 3306

mysql real port is 3306。 I want public network using 53306 to visit mysql, and 3306 is not allowed access from public network. How to write the iptables rules DNAT 53306 to 127.0.0.1 3306?
1
vote
0answers
4k views

set rules for openvpn by iptables in firewall CentOS 6.2

Firewall (FW), three leg: eth0: 172.16.1.101 eth1: 192.168.99.99 (LAN) eth2: 10.0.0.1 (DMZ) I installed openvpn in FW by tunnel mode, already ok: tun0: 192.168.10.0/24. If I use shorewall and ...
1
vote
0answers
3k views

Error: iptables: No chain/target/match by that name

I am trying to configure proxy server on RHEL Server 6.5 using Squid and iptables. Below is the command I executed and the error message it displayed: vzlptest01 root [root] > iptables -A INPUT -i ...
1
vote
1answer
456 views

Bridged TAP interface to virtualbox

I need bridged TAP interface on client side of my VPN to virtual machine. I use VirtualBox 4.3.12. But in Adapter Network options in Attached to: Bridged adapter I do not see my TUN adapter. I have ...
2
votes
1answer
111 views

How do I enable IPv6 inbound traffic to get forwarded to my machine?

It seems that IPv6 traffic on my router is being dropped. How do I configure ip6tables appropriately, so that traffic is forwarded/accepted to my machine? Here's the syslog for my IPv6 traffic: Jun ...
1
vote
0answers
209 views

Packets sent through TUN interface not routed

I have a C program attached to a TUN interface. In my C program, I'm building packets and writing them to the TUN interface. Now to check if packets are really sent from my TUN interface I use ...
7
votes
3answers
10k views

Limit max connections per IP address and new connections per second with iptables

We have an Ubuntu 12.04 server with httpd on port 80 and we want to limit: the maximum connections per IP address to httpd to 10 the maximum new connections per second to httpd to 150 How can we ...
2
votes
1answer
38 views

My iptables works the opposite from what I wanted

I have this set of iptables rules ... $ sudo iptables -n -L Chain INPUT (policy ACCEPT) target prot opt source destination LOG all -- 0.0.0.0/0 0.0.0.0/0 ...
1
vote
1answer
462 views

Setting up a gateway between two subnets on the same physical network

I need to configure a DHCP-enabled network (192.168.2.) on a physical layer where resides an already existing network (192.168.1.) with static IPs. I have a Debian 7 server with two interfaces (server ...
2
votes
2answers
224 views

Temporary redirect ports

I need a temporary redirection of some ports to another machine. I've tried: iptables -t nat -A PREROUTING -p tcp --dport 4321 -j DNAT --to-destination 192.168.121.4:80 But shorewall blocks all ...
3
votes
0answers
90 views

Packets do not cross IP tables Postrouting when originating from an external IP

I'm trying to reflect traffic from the internet to an internal device that I only want to have local access. I have a host in my DMZ that I'm trying to DNAT traffic to this internal device, and SNAT ...
1
vote
0answers
116 views

How do I control ip routing in the new firewalld?

I have the following scenario: Our fedora server is connected to the internet on eth0 and has a second nic, wlan0 acting as an access point. The purpose of the access point is to provide a connection ...
1
vote
1answer
208 views

Iptables not forwarding. Input instead

I have set up iptables on my ubuntu headless server: iptables -S -P INPUT ACCEPT -P FORWARD DROP -P OUTPUT ACCEPT -A INPUT -s 10.1.3.90/32 -i eth0 -j LOG --log-prefix "INPUT: " -A INPUT -i eth1 -j ...
4
votes
1answer
1k views

What's the difference between ULOG and NFLog?

Various places suggest to use ULOG or NFLOG instead of LOG for getting dedicated netfilter logging (see for example here or here). From looking at man iptables those two look quite alike. Except that ...
1
vote
1answer
88 views

CentOS Traffic Filter

I am trying to use Squid to filter the traffic flowing through the network. I am also trying to make this system transparent. My network setup is like so: Router -> CentOS Machine -> The rest ...
0
votes
2answers
48 views

Is there a need for repeating rule parameters in iptables?

Let's say we need some ssh rules in iptables. But we also want to specify another chain for all the rules. We could use something like this: iptables -t filter -N ssh iptables -t filter -N tcp ...
1
vote
1answer
383 views

IPTables DNAT rule to local web server doesn't work with localhost?

I have linux box functioning as Wireless Access Point. Wireless clients connect and then browse the web. I am only allowing port 80. There are certain sites I'd like to block, but not by dropping the ...
1
vote
1answer
231 views

Configure NAT filtring behavior with iptables

I'm using this rule to configure SNAT: iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to-source 193.49.142.107:4000 I want to specify a rule to filter out packets not destined to the internal ...
1
vote
1answer
523 views

Randomize external port when doing NAT with iptables

I want to configure a NAT behavior different from the default one implemented by iptables. In this example: iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to-source 193.49.142.107:2000-400 The ...
4
votes
1answer
3k views

Why does my firewall (iptables) interfere in my bridge (brctl)?

I set up a bridge br0 "attached" to two interfaces: eth0, my physical interface connected to the real LAN, vnet0, a KVM virtual interface (connected to a Windows VM). And I have this single ...
1
vote
0answers
112 views

Local Client/Server communication using TUN interfaces

I want to establish a local communication between a client and a server using TUN interfaces. The client program will be attached to interface TUN1 and we suppose that it has IP address @IP1. The ...
8
votes
2answers
9k views

Why are some ports reported by nmap filtered and not the others?

I'm scanning a server which should have a pretty simple firewall using iptables: by default everything is DROPped besides RELATED and ESTABLISHED packets. The only type of NEW packets allowed are TCP ...
2
votes
2answers
9k views

IPTables rule to allow incoming SSH connections

The aim of this script is to only allow traffic over the VPN, except for localhost<->localhost and incoming SSH traffic. But when I run the script over SSH I am disconnected and forced to restart ...
0
votes
0answers
249 views

Port forwarding only works for first packet sent

I'm trying to configure port forwarding (80 and 443) on my new router. The router is a Xiaomi Mi Wi-fi, that establishes a PPPOE session with a VDSL2 modem/router (BBox2). The Xiaomi router runs a ...
1
vote
1answer
252 views

How do you route to secondary interface on the same physical port?

INTERNET<->(wan)BRIDGED_DEVICE(lan)<->ETH_ROUTER<->LAN Problem: Need to access web server on BRIDGED_DEVICE's LAN from INTERNET via ROUTER (BRIDGED_DEVICE web server cannot be accessed form ...
3
votes
1answer
146 views

How to combine iptables rulesets

Say there are several iptables scripts (run at boot time), all of which run something like iptables -A ... to add rules. I'm thinking this could be improved, turning all those shell scripts into text ...
2
votes
1answer
387 views

iptables - add rule for interface before it comes up

Right now I'm using /etc/rc.local to add some iptables rules on my Linux router on boot however some of the rules aren't added. I assume this is because the interface hasn't come up yet. This is what ...
1
vote
0answers
368 views

Why does this iptables rule doesn't get configured after a reboot once in a while? [closed]

On my Android network device, iptables firewall rules service script is started by the init.rc scripts during boot time. One of the firewall INPUT chain rules doesn't get configured in the iptables ...
0
votes
0answers
48 views

DNAT in iptables

Help me set rules in IPTABLES! I used rules in firewall - shorewall as below: DNAT net dmz:10.10.10.200 tcp 21,80,3306 DNAT net local:192.168.1.99 tcp 502,8008 Where: IP firewall: ...
5
votes
1answer
278 views

Is there a way to match an inet and inet6 IP set in a single rule?

Is it possible to have one IPv4 and one IPv6 IP set (ipset(8)) within the same rule? I have several rules that depend on one set of IPv4 addresses and another set of IPv6 addresses respectively, but ...
1
vote
0answers
13 views

List of netfilter modules for which I can leave out the -m option and other implied information

Rules in iptables/ip6tables can sometimes become a bit verbose to read. I am looking for a list of information that I can skip from iptables/ip6tables that I write. Examples: if you say -s 1.2.3.4 ...
1
vote
1answer
141 views

iptables - masqueraded NAT has delayed first hop in traceroute

I'm just in the process of setting up my Linux (Debian-based) router with a PPPoE connection via an ADSL/PPPoA -> PPPoE bridge. The connection works perfectly on the router itself but a traceroute ...