iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

1
vote
1answer
25 views

Will this open up a non-standard port to ssh?

I am following tutorials on iptable and want to allow ssh traffic on my non-standard SSH port = YYY. I think this is how you do it, but want to double check so I don't lock myself out of my server. ...
1
vote
1answer
211 views

iptables forwarding between subnets

I want to forward traffic between two subnets, I'm not very familiar with iptables. The forwarding works except when iptables is enabled. There must be something wrong with the rules, though ...
1
vote
1answer
98 views

Configure port 1935 in iptables for media

On CentOs 6.4 I cannot connect to the media server from port 1935 only 5080. I have read you can edit the iptables files with following. Open flle /etc/sysconfig/iptables: $ sudo vi ...
1
vote
1answer
188 views

Route HTTP traffic thorugh different interface

I have my normal eth0 interface and an setup ppp0 interface, the problem I have is that I want to exclusively route all HTTP/HTTPS traffic through the ppp0 interface and everything else through the ...
1
vote
3answers
1k views

iptables-restore just says “FAILED”

I am not sure what's wrong with my rule in the Iptables. I am actually trying to build a SSH server and following a cyberciti tutorial. My Iptables configuration looks like this: # Firewall ...
1
vote
1answer
231 views

how to investigate Firewall blocked outbound TCP

CentOS webserver with CSF (Config Server Firewall) running. Blocking all outbound / Inbound traffic except listed ports 80 81 22 21 etc. for web, mail & FTP services etc. I'm use to seeing heaps ...
1
vote
1answer
43 views

IPTABLES chain need help for restriction

I have two network cards eth0:- 172.16.91.70 (External Zone) eth1:- 172.16.85.70 (Internal Zone) I have clients in my Internal Zone which can access the external network. The ping goes fine and can ...
1
vote
1answer
169 views

Intercept incoming TCP/IP packets on Linux and perform NAT

I want to make a decision of what computer is behind the firewall sending the packet. Imagine I have 2 PCs behind the firewall and I want to, based on (my algorithm), make a decision at the firewall ...
1
vote
1answer
786 views

Copy/Mirror traffic to WAN interfaces without “iptables tee” support

I want to copy every outgoing packet to other WAN interfaces but my iptables (v1.2.7) doesn't have TEE target support. I wonder if there is another way (maybe using iproute2 or ebtables) to copy every ...
1
vote
1answer
614 views

How to log iptables as of kernel 3.9.0?

What is the right way to log iptables as of kernel 3.9.0? I can no longer append a logging rule such as: # iptables --new-chain droplog # iptables --append droplog --jump LOG --log-level info ...
1
vote
1answer
494 views

How do I route different users over different OpenVPN tunnels in Linux?

The setup: I have multiple, static-key OpenVPN client/server configurations, labeled "client1", "client2", and "client3" with server/client IPs 10.10.1.1/10.10.1.2, 10.10.2.1/10.10.2.2, and ...
1
vote
1answer
160 views

Blocking gzip HTTP content with Iptables or Snort?

I'm looking to drop a connection if a website contains a certain word or phrase. The issue is, the site is typically compressed with gzip. Any ideas?
1
vote
1answer
807 views

Help to understand Iptables Forward chain with DNAT

I have one server where iptables configured with all chains DROP in filter table eth0 :- 10.0.0.2 [ Intranet assume as LAN ] eth2 :- 172.16.0.2 [ External clients assume as WAN ] Now What I am ...
1
vote
1answer
1k views

Redirect Packets from ppp0 interface to ethernet interface in linux

My question is similar to this question, however with some change. I have a PPPoE connection on my Linux Machine (CentOS kernal 2.6.32) as a client, so that when I setup this connection, another ...
1
vote
1answer
145 views

darkstat shown blocked traffic

I've installed Darkstat on a Qemu VM which is connected to a bridge interface on top of main server's interface ( eth0 ) In Darkstat report I can see many hosts in the same IP range of specified VMs ...
1
vote
1answer
273 views

iptables logging prefix gets corrupted

I've been using iptables for some time but recently noticed that the log prefix I'd set had got corrupted. In /etc/iptables/rules.v4` I have: -A LOGNDROP -j LOG --log-prefix "iptables denied: " ...
1
vote
2answers
602 views

How would I direct local(127.0.0.1) MySQL traffic to an external SQL server?

Basically, I have two EC2 instances on Amazon Web Services. They are both running Ubuntu 11.10 x64. They both have a private and a public (Elastic) IP addresses. I'm having trouble setting up iptables ...
1
vote
1answer
976 views

IPTABLES to block all outgoing connections except selected networks

There is a firewall/gateway machine with eth0 Public and eth1 Private network (192.168.1.0). I would like to block all OUTPUT connections for private users (eth1) except couple of networks like: ...
1
vote
1answer
417 views

portsentry and IPTables on constant reboot, but not sure why

I have been doing some hardening on a new server [ centos 5.7 final ] i also have logwatch and seem to be getting these strange logs Commands Run: User root: /sbin/service portsentry restart ...
1
vote
1answer
593 views

Allow Windows file share through a Linux Firewall

I'm struggling to enable NTFS share between two Windows (XP and 7) hosts through a Linux firewall. Here's my setup: [XPMachine-LAN1]---------->[LINUX FIREWALL]---------->[Win7-LAN2] What I ...
1
vote
2answers
1k views

Checking the type of NAT

I have read that there are many types of NATs available like symmetric NAT, full-cone NAT, etc. If I am behind a NAT, is there any way to find out the type of NAT behind which I am currently working ...
1
vote
1answer
936 views

Why am I getting a “Listing remote folder failed” error when I try to connect with SFTP?

I set up SFTP, but I have a problem regarding iptables. Here are my rules: A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT A RH-Firewall-1-INPUT -m state --state NEW -m ...
1
vote
4answers
10k views

iptables drop all incoming ICMP requests except from one IP

Currently, I have something like: iptables -A INPUT -p ICMP --icmp-type 8 -j DROP iptables -A INPUT -s x.x.x.x -p ICMP --icmp-type 8 -j ACCEPT However, when I run the second command, it ...
1
vote
1answer
478 views

How would I go about getting UPnP working on a Slackware server/firewall?

I'm a long time fan of Slackware and I've always had a machine serving as my main server/firewall with the latest version installed. I have it now but I'm struggling to find information on how to ...
1
vote
0answers
14 views

Open ports for local samba server with iptables

I can't seem to connect from Windows 7 to my network share on Ubuntu (Samba). Why won't this work? Heres a bit of information, that would perhaps be useful. user1@computer:/etc$ sudo iptables -L ...
1
vote
0answers
38 views

Error: iptables: No chain/target/match by that name

I am trying to configure proxy server on RHEL Server 6.5 using Squid and iptables. Below is the command I executed and the error message it displayed: vzlptest01 root [root] > iptables -A INPUT -i ...
1
vote
1answer
20 views

Bridged TAP interface to virtualbox

I need bridged TAP interface on client side of my VPN to virtual machine. I use VirtualBox 4.3.12. But in Adapter Network options in Attached to: Bridged adapter I do not see my TUN adapter. I have ...
1
vote
0answers
22 views

Packets sent through TUN interface not routed

I have a C program attached to a TUN interface. In my C program, I'm building packets and writing them to the TUN interface. Now to check if packets are really sent from my TUN interface I use ...
1
vote
1answer
51 views

Setting up a gateway between two subnets on the same physical network

I need to configure a DHCP-enabled network (192.168.2.) on a physical layer where resides an already existing network (192.168.1.) with static IPs. I have a Debian 7 server with two interfaces (server ...
1
vote
0answers
38 views

How do I control ip routing in the new firewalld?

I have the following scenario: Our fedora server is connected to the internet on eth0 and has a second nic, wlan0 acting as an access point. The purpose of the access point is to provide a connection ...
1
vote
1answer
41 views

Iptables not forwarding. Input instead

I have set up iptables on my ubuntu headless server: iptables -S -P INPUT ACCEPT -P FORWARD DROP -P OUTPUT ACCEPT -A INPUT -s 10.1.3.90/32 -i eth0 -j LOG --log-prefix "INPUT: " -A INPUT -i eth1 -j ...
1
vote
1answer
32 views

IPTables DNAT rule to local web server doesn't work with localhost?

I have linux box functioning as Wireless Access Point. Wireless clients connect and then browse the web. I am only allowing port 80. There are certain sites I'd like to block, but not by dropping the ...
1
vote
0answers
37 views

Local Client/Server communication using TUN interfaces

I want to establish a local communication between a client and a server using TUN interfaces. The client program will be attached to interface TUN1 and we suppose that it has IP address @IP1. The ...
1
vote
1answer
45 views

How do you route to secondary interface on the same physical port?

INTERNET<->(wan)BRIDGED_DEVICE(lan)<->ETH_ROUTER<->LAN Problem: Need to access web server on BRIDGED_DEVICE's LAN from INTERNET via ROUTER (BRIDGED_DEVICE web server cannot be accessed form ...
1
vote
0answers
133 views

Why does this iptables rule doesn't get configured after a reboot once in a while? [closed]

On my Android network device, iptables firewall rules service script is started by the init.rc scripts during boot time. One of the firewall INPUT chain rules doesn't get configured in the iptables ...
1
vote
0answers
7 views

List of netfilter modules for which I can leave out the -m option and other implied information

Rules in iptables/ip6tables can sometimes become a bit verbose to read. I am looking for a list of information that I can skip from iptables/ip6tables that I write. Examples: if you say -s 1.2.3.4 ...
1
vote
1answer
33 views

iptables - masqueraded NAT has delayed first hop in traceroute

I'm just in the process of setting up my Linux (Debian-based) router with a PPPoE connection via an ADSL/PPPoA -> PPPoE bridge. The connection works perfectly on the router itself but a traceroute ...
1
vote
1answer
35 views

Creating a virtual interface to always access a DHCPed interface with the same ip

I have an interface that on connect always gets a new IP. So I want to create a virtual interface with a static IP that "relays" everything over the physical interface. This would be useful to bind ...
1
vote
0answers
40 views

CPU usage by kernel modules, routing and forwarding rules

I have a system with a loopback kernel module installed. Through a bunch of routing and iptable rules, packets coming out of the loopback interface are sent over an ipsec tunnel. I am seeing that ...
1
vote
1answer
34 views

Routing packets between networks with iptables

I'm trying to create a proxy of sorts using just iptables. The linux computer (my proxy) has two ports: p2p1 is connected to the Internet. em1 is connected to a local network. There are two ...
1
vote
0answers
52 views

IPTables 1.4.7 dropped allowed packet

When looking in the /var/log/messages file I found this line: May 23 10:56:02 localhost kernel: IP4T Invalid TCP flags IN=eth0 OUT= MAC=70:5a:b6:ec:95:6b:00:23:48:ad:b0:a4:08:00 SRC=A.B.C.D ...
1
vote
0answers
81 views

Running a Transparent Proxy for LAN and Webserver for WAN

I am running a LAMP stack on an Arch Linux server in my home, and my router firewall port 80 is open to the world. Recently, I've decided to set up a dansguardian transparent proxy to do some web ...
1
vote
0answers
33 views

How do I route traffic between eth0:0 and eth0 [duplicate]

I have been trying to convert my linux box which is running Mint into a router. eth0 has a public IP address of 71.xx.xx.xx. I created an eth0:0 and gave it an IP address of 10.0.0.100. I started a ...
1
vote
1answer
19 views

Unable to access external content with this IPTABLES ruleset

My application server is on a network protected by a organization wide firewall, and my server is also using fail2ban. That said, I'd like to set up an additional layer of protection with iptables. ...
1
vote
0answers
130 views

Port redirection on loopback with IP other than 127.0.0.1

I want to redirect port 80 on the loopback network interface so that accesses to that port actually go to port 8080. I tried using the following command, but it only works if the application is ...
1
vote
0answers
76 views

iptables server behind NAT accessible from outside as well as inside the nat

I have 2 machines with a KVM running on each machine - so two kvms with the below networking Host 1: 192.168.10.100 (eth2) 10.10.100.1 (virbr1) KVM 1 (NAT with Host 1): 10.10.100.128 (eth0 ...
1
vote
1answer
78 views

RHEL 6.5 won't boot after loading APF firewall

We have an RHEL 6.5 system which boots to the point of loading APF firewall and then just hangs indefinitely. The console shows the following: ... Loading autofs4: [OK] Starting automount: [OK] ...
1
vote
1answer
74 views

configure exim for system email forwarding (outside) , on a server with dynamic ip, behind a DNS router

Trying to configure exim to deleaver email to the outside world. I/We need to send email outside just for centralize certain admin notifications. Working on an already configured debian webserver, ...
1
vote
1answer
31 views

What is the meaning “MAC MISSMATCH”? [closed]

I have every day in the log the few lines start with: MAC MISSMATCH:IN=vlanXX OUT= MAC=ff:ff:ff:ff:ff:ff:bc:ae:c5:da:70:a6:08:00:45:00:00:4e SRC=xx.xx.xx.xx DST=xx.xx.255.255 LEN=78 TOS=0x00 ...
1
vote
0answers
23 views

How can I use iptables to block certain processes from accessing the network? [duplicate]

I can set the processes to run under special uid's and use the technique from this SF answer: -A OUTPUT -m owner --uid-owner 400 -j DROP ...But are there any other ways to blacklist based on the ...