iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

2
votes
0answers
209 views

iptables hangs at applying rules

I have a set of rules that are supposed to give me the most protection before things like fail2ban and other things are added to the mix. The issue is that although everything checks out in the test, ...
2
votes
0answers
76 views

Transparent Proxy

I am setting up attempting to set up a transparent proxy on CentOS using Squid. So far I have managed to filter the content and get it working perfectly. The only issue I am having is getting a form ...
2
votes
0answers
80 views

Defining IPv6 chains in ip6tables-restore/iptables-restore files, is it possible?

The format for the files generated by iptables-save/ip6tables-save and loadable through iptables-restore/ip6tables-restore stipulates that one can prepend -4 or -6 respectively so as to maintain the ...
2
votes
1answer
1k views

How does connlimit in iptables supposed to work?

I wanted to set a limit to the number of concurrent connections allowed on my web server. I tried the following rules on an iptables (v1.4.19.1) kernel 3.14.4-200.fc20.x86_64 with a default DROP ...
2
votes
1answer
53 views

iptables drop length and TTL condition doesn't work

With iptables utility on Linux host need to create mini firewall. I need to drop all incoming connections with package length greater than 722 AND TTL greater than 22. Need exactly AND. Drop only if ...
2
votes
1answer
531 views

Bad built-in chain name with iptables-restore

I saved my iptable settings on a Ubuntu 11.4 system using iptables-save >filename I then replaced the Ubuntu system with CentOS 6.5 and tried to restore iptables using iptables-restore ...
2
votes
0answers
595 views

Corosync & Pacemaker IPTables Rules

When using Corosync with two rings via multi-cast addresses 226.94.1.1 (Port 5405) & 226.94.1.2 (Port 5406) what iptables rules are required to allow two nodes to communicate optimally without ...
2
votes
0answers
252 views

IPtables rule to double NAT [closed]

Let me rephrase it.. I just need an IPtable rule to do double NAT-ting.. Host A - Host B - Host C - Host D Host B should do both source NAT and destination NAT, so that my request from Host A ...
2
votes
1answer
448 views

iptables Port Forwarding — no service with the port

I have setup a network as in the image below: Firewall (FW) running CentOS 6 has two physical interfaces with subinterfaces: eth0:2 — 10.100.1.78/25 eth0:3 — 10.100.1.79/25 eth3 — 192.168.0.21/24 ...
2
votes
0answers
490 views

Route all HTTP traffic through polipo

I've set up polipo on my machine to listen to the default port 8123. To test it, I set the in-memory cache to a ridiculously high 2 GB and downloaded a 50 MB file using wget utilizing the proxy. ...
2
votes
0answers
281 views

iptables REDIRECT in combination with matching on interface vs. IP address

I've successfully set up Tor for transparent proxying using iptables (ie, all outgoing traffic is sent through Tor without the application's knowledge). In doing so, I discovered both an odd problem ...
2
votes
0answers
284 views

SNAT problem in iptables

I am trying to reroute traffic from specific devices in my house over openvpn. For this, I've created an OpenVPN tunnel between my house wifi router and my server. Here is my setup: Wifi router's ...
2
votes
0answers
222 views

IPTables dropping UDP packet stream

I have a configuration where UDP packets containing encapsulated DNS data are sent to a KVM instance for processing. The KVM instance sits behind an IPtables firewall which is also doing NAT. The ...
2
votes
0answers
343 views

Iptables and Port Scanning and Recent module

I'm trying to write an adaptive firewall using iptables, and am not clear on how the recent module is working. For example, see http://blog.zioup.org/2008/iptables_recent/ Snippet from my iptables: ...
2
votes
1answer
198 views

LAMP Hardening, Transparent Proxy with iptables

I'm running a LAMP server with FTP(S) and several users. The users have only access to uploading PHP files and other web content. Some are running Drupal and Wordpress, but also a few home made stuff. ...
2
votes
0answers
382 views

TPROXY for redirecting UDP on arbitrary ports

I want to intercept all UDP traffic leaving tap1. And possibly reply to e.g. DNS-requests. To accomplish this I wrote some python code listening to localhost and use iptables with a rule-set like ...
2
votes
0answers
327 views

Redirect all non-local traffic to a socks proxy

Is it possible to redirect all non-local traffic to a socks proxy? so, for example i have: 4 computers (clients A-D: 10.0.0.1-4 or dhcp) 1 computer with 2 network cards (gateway-server, eth0: ...
2
votes
0answers
274 views

Port Forwarding Between 2 Internet Machines

Here's my scenario: Setup There are 3 machines: A: on the internet : has ip (a.a.a.a), has port pa open B: my server / gateway : has ip (b.b.b.b), has port pb open C: on the internet : has ip ...
2
votes
1answer
361 views

iptables doesn't forward from WAN to virtual machines

I have a machine working like gateway and have two network interfaces: eth0 LAN : 192.168.1.0/24 eth1 WAN : XXX.XXX.XXX.XXX (my public ip) This machine has 3 VM guest over virtualbox. All have ...
2
votes
2answers
612 views

Having trouble with packets not making it into Fedora 16 Apache [closed]

Background: I haven't done anything with iptables in a few years... I have Fedora 16 running in a VM on VMWare, with my firewall (TomatoUSB) port forwarding to the VM. VM is at 192.168.1.155. I know ...
2
votes
0answers
582 views

Iptables - modprobe: FATAL - Fail2ban random restarts

I have been running fail2ban on my server for a while without any problems but have recently seen fail2ban restart randomly. After some looking in my logs I noticed that the restarts occur when ever ...
2
votes
1answer
703 views

Will the Firewall GUI in CentOS overwrite changes implemented by IPTABLES manual edits?

I would like to restrict access to the SSH port of a new CentOS 6.2 server to select IP addresses but the Firewall GUI utility seems to be an all-or-nothing scenario. Either the port is firewalled or ...
2
votes
0answers
449 views

Why are packets not moving forward? [closed]

I have a server with forwarding turned on. I placed an iptables LOG target in the PREROUTING, INPUT, and FORWARD chains of the mangle table. I can see the LOG messages from PREROUTING, but not INPUT ...
2
votes
1answer
340 views

pptpd dead but subsys locked? on cent os

i install point to point tunnel (PPTP) in my VPS. (Cent OS 6 64 Bit) everything fine after reboot the PPTP not worked client side. the pptpd status shows " pptpd dead but subsys locked ". how to ...
2
votes
3answers
2k views

Iptables GEOIP not working under Debian Squeeze

I've just installed xtables-*, compiled the geoip database, but when I try to use an iptables command it always gives back the following error: Command: iptables -I INPUT -p tcp --dport 80 -m geoip ...
1
vote
3answers
2k views

hosts.allow: Not required when using iptables?

I am trying to configure the box I am using as a gateway/proxy/firewall to allow IP masquerading and finally switch over from using a proxy. It's a debian squeeze system. Currently, my hosts.allow ...
1
vote
1answer
932 views

Control bandwidth with iptables

How can I control bandwidth in RHEL 5 using iptables?
1
vote
2answers
541 views

Saving an iptables configuration permanently

How can I save this configuration permanently? sudo iptables -t nat -A POSTROUTING -s 10.10.0.0/16 -o eth0 -j MASQUERADE
1
vote
1answer
126 views

Undoing specific iptables ip/port restriction

Say I add the following iptables rules: iptables -A INPUT -p tcp -s localhost --dport 4444 -j ACCEPT iptables -A INPUT -p tcp --dport 4444 -j DROP This allows localhost to access port 4444 then ...
1
vote
1answer
171 views

IPv6 firewall rules seem to impede all connections

After deciding that my small server needed a firewall, I used ferm to configure iptables and ip6tables for me (this question should be tagged ferm, but I cannot create the tag). I am using the same ...
1
vote
2answers
256 views

How is the loopback device traffic allowed?

How can I allow the traffic to be sent on the loopback device (lo)? What is the iptables command for it?
1
vote
2answers
298 views

iptables and logs

Suppose I add an IP to iptables blocking for exim, dovecot and FTP and this IP visits my server again. Is there any log of this visit so I can confirm the IP was trying to reach the server again but ...
1
vote
1answer
8k views

How to modify iptables rules via editing a file rather than interacting via command line?

In the history, i would simply edit a file and then reboot the whole server. i would clone the line that had port 22 open change it to 80 and then save the file.. and reboot the whole system so ...
1
vote
2answers
100 views

Reject ssh connections made from proxies

I was seeing this question which was concerned with blocking access to the users who do not belong to a particular region. I am sure that blocking is possible but I see there is a workaround to this. ...
1
vote
1answer
182 views

How to log incoming icmp traffic?

I am watching my ip6table and observing an icmp packet arriving and getting dropped at the rate of 1 per second. I am trying to find out what that message is about. I tried using tcpdump (it is ...
1
vote
1answer
7k views

iptables forward all traffic to interface

I have two interfaces eth1 and eth0. I want all traffic on eth0to be forwarded to eth1. I created an iptable rule like this: iptables -A FORWARD -s 0/0 -i eth0 -p tcp -o eth1 -j ACCEPT But this ...
1
vote
1answer
115 views

Is this what it looks like in the terminal on the client side when you are blocked out via fail2ban?

I am a new server admin. I just setup fail2ban on an ubuntu 12.04 VPS. I used this tutorial. Then I tried to login to the system via ssh from a friend's machine. It is showing "operation timed out." ...
1
vote
1answer
4k views

How to redirect to my squid proxy using iptables since DNAT target: only valid in nat table

I want to redirect the traffic in my lan network through squid proxy but I am having some problems with iptables rules. When I use the following rule: # iptables -I FORWARD -s ...
1
vote
3answers
3k views

How to change user agent on all http requests made from my machine with Squid intercepting proxy?

I'd like to change the user agent on all HTTP requests made from this machine. It's easy enough to change the user agent in each browser, but other apps also make http requests. It's vital I catch ...
1
vote
1answer
495 views

How do I shut down ports remotely without shutting myself out?

I have an Ubuntu 11.04 server in a remote location on another continent, so I have no physical access to it. I only interact with it by ssh (and scp), and intend to only ever interact with it that ...
1
vote
1answer
19 views

iptables and RETURN target

I don't understand what the RETURN target does in a iptables command. The doubt comes from this guide where it says: A chain is a set of rules that a packet is checked against sequentially. When ...
1
vote
2answers
264 views

Drop TCP packets and prevent TCP retransmission

I have an application that sends TCP data to a server. My server is made to intentionally drop the packets sent by the application, and as a result the client retransmits the packets. I need to ...
1
vote
1answer
48 views

Confused by different output from iptables -L

I keep following this tutorial using a bash shell on ubuntu 12.04 as I open more and more ports on my server. I usually open up ports like this sudo iptables -A INPUT -p tcp --dport PortNumberToOpen ...
1
vote
1answer
90 views

View blocked address from sshguard

How can I view all the addresses that sshguard has blocked to iptables?
1
vote
2answers
175 views

What network protocols do database servers use?

I have a postgres 9.1 server running on the default port 5432 on an ubuntu 12.04 cloud server. I want to open up the port so I can make remote queries -- but I have to open the port on IP tables, ...
1
vote
1answer
157 views

Redirecting all IP over USB traffic to a fixed address

I'ma bit of a network newbie, so apologies for the inaccurate vocabulary. Say I have a device connected by IP over USB to my computer (running Ubuntu), that connects to 10.0.0.1. I configured my ...
1
vote
2answers
710 views

iptables: what the difference between filter and mangle

I am using iptables to to mark the package and want to route based on the marks. First I added the ip rule: sudo ip rule add fwmark 1 prohibit (The "prohibit" is just for test, I will change it ...
1
vote
2answers
1k views

Missing iptables file on directory /etc/init.d/ (Fedora 17)

Is the iptables file in Fedora 17 moved from /etc/init.d/ to /etc/sysconfig/? I need do some patching to the iptables file to solve the firewall problem (Setting chains to policy ACCEPT: security raw ...
1
vote
1answer
428 views

What does the route Dest: 123.123.123.123, GW: 0.0.0.0 mean?

I have a route table: Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 123.123.123.123 0.0.0.0 255.255.255.255 UH 0 0 0 ...
1
vote
1answer
593 views

Allow user to see how many iptables rules are loaded, but not actual contents?

I want to allow user to check how many rules are present in filter table, but not able to view actual rules, is that possible? literally I mean iptables -L | wc -l (I know it's faulty), but sudo ...