iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

2
votes
1answer
106 views

Is there a way to redirect requests from foo.com to a VM on that server?

I saw a tutorial about redirecting client requests to a specific port to a VM inside the server using IPTables. Is there a way to redirect client requests for foo.com to a VM using only IPTables? or ...
2
votes
2answers
2k views

TOR Transparent Proxy - How does to the TCP redirecting work

I used an iptables ruleset based on the sample ruleset from https://trac.torproject.org/projects/tor/wiki/doc/TransparentProxy, Section Linux, Local Redirection Through Tor, to set up Tor as a ...
2
votes
1answer
636 views

iptables rule for limiting bandwidth in given time

Under Linux/iptables how can I limit the bandwidth in given time? ex.: don't limit the connection speed from 22h to 06h, but limit it from 06h to 22h, ex.: the max speed would be only 1Mbit/second! ...
2
votes
1answer
1k views

tun0+ iptables rule

I'm trying to figure out what that + sign means in a rule such as this: -A FORWARD -i tun0+ -j ACCEPT I'm pretty positive it relates to vpn. I noticed a /dev/net/tun interface and a tun0 in ...
2
votes
0answers
25 views

Two ISP and redirecting traffic

I have a gateway with two ISP connected to eth0 and eth2. There is also a eth1 with local network. I'm trying to group some services in one interface and some in the second: incoming traffic 1 ...
2
votes
1answer
44 views

NAT box with multiple internal and external interfaces

Similar questions have been asked before but my setup is a little different and the solutions to those questions are not working. A have a CentOS 6 server running iptables with 5 interfaces: eth0: ...
2
votes
0answers
50 views

How to explain strange kernel messages?

I have a server running on Debian Wheezy 3.2.68-1+deb7u1 x86_64. Lately strange records in /var/log/messages appeared. First messages of this log starts just after server reboot. 6.222.18 LEN=44 ...
2
votes
0answers
36 views

ip rule not acting on fwmark

I'm trying to use iptables to load balance web traffic over multiple DSL lines by marking the packets and routing based on the mark. I'm working with CentOS 6.6, Kernel 2.6.32-504.16.2.el6.x86_64, ...
2
votes
1answer
31 views

package from IP arrives at certain port => open portrange to IP for x seconds

I have been toiling with an issue on iptables: I am trying to make a portrange open to a specific IP for x seconds/minutes as a result of a single packet being sent to a specific port. Not exactly ...
2
votes
1answer
56 views

On a router, what decides if a packet should be forwarded or directed into the router itself?

I'm trying to learn how packet routing works on a linux-based router (OpenWRT in my case) a bit better for setting up a few projects/just-learning. Referencing the below chart, I'll break this into ...
2
votes
0answers
48 views

Why is traffic matching the public zone instead of the desired zone?

Trying to self-train on firewalld I set up apache and configured the zones as follows: [root@localhost ~]# firewall-cmd --get-active-zones work sources: 192.168.122.1 public interfaces: ens3 ...
2
votes
0answers
133 views

Routing traffic for specific user to specific interface

I have a Linux box with these interfaces: eth0 Link encap:Ethernet HWaddr 14:da:e9:ef:75:7d inet addr:176.9.85.182 Bcast:176.9.85.191 Mask:255.255.255.224 tun0 Link encap:UNSPEC ...
2
votes
0answers
294 views

restrict IP traffic between VLAN sub-interfaces

I have a router/firewall-PC with two VLAN sub-interfaces eth2.100 and eth2.200: I would like to allow communication between networks 192.168.100.0/24 and 192.168.300.0/24(PC3 network). In addition, ...
2
votes
0answers
49 views

Dropping packets before mangle POSTROUTING

In iptables on Linux 3.10, why do packets which have been DROPed by the FORWARD chain of the standard table still appear in the POSTROUTING chain of the mangle table? -- I'm trying to use the standard ...
2
votes
1answer
205 views

How to use both syn proxy and connlimit rules with iptables?

I want to write both syn proxy and connlimit rules. I want to send packets to syn proxy first because of performance issue. Here is rule sample. I use bridge interfaces but I dont think it is ...
2
votes
0answers
57 views

debugging iptables when tunneling one VPN through another

I seek to tunnel one SSL VPN (F5, running on my debian laptop==client) through another (OpenVPN, running on a debian linode==server), but lose all client networking (including, e.g., ping) after the ...
2
votes
0answers
43 views

Strange cron behaviour

I have a script that reads a list of IPs from a file, compares with the existing ones in a chain, and adds recently added IPs in the file into that chain. Running the script manually (e.g., ./script) ...
2
votes
1answer
46 views

(S/D)NAT over NF hooks

Could someone help on explaining the advantage of iptables NAT over the netfilter hooks. Say suppose, instead of using NAT if we create custom kernel module to bind handler with netfilter for PRE/POST ...
2
votes
1answer
26 views

Make a request through vpn interface

I want to be able to make request through a specific network interface, like this: ping -I eth0.1 google.be ping -I eth0.2 google.be This example works on my multihomed OpenWRT router. I now want ...
2
votes
0answers
44 views

VPN tunnel to two services on two servers?

I've got 2 CentOS 6.5 servers, each running one service: server A: 10.140.54.1/27 running service MySQL port 3306 server B: 10.140.54.2/27 running service httpd port 443 Server B's httpd service ...
2
votes
0answers
223 views

how to open up socks/SSH on different network interfaces?

iptables -A PREROUTING -i usb0 -t mangle -p tcp --dport 8080 -j MARK --set-mark 1 iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination Chain ...
2
votes
0answers
297 views

Forward multicast between two LAN segments (Chromecast)

I've found some rules but most are inconclusive. Chromecast uses DIAL and discovers via multicast from what I've understood.. I have an Ethernet-connected computer which I would like to route via my ...
2
votes
0answers
694 views

How do I route bittorrent through a second interface?

I've managed to configure openvpn on my DD-WRT router such that the tunnel is up and working, but that it doesn't mess with routes at all (the default configuration wants all traffic to go through ...
2
votes
0answers
187 views

iptables rule to transfer UDP through a SSH tunnel

The problem I have two programs that runs on two distant computers and communicate through a specific protocol. All I know is that this protocol only communicates through UDP and uses the ports 1101 ...
2
votes
0answers
37 views

Extra overhead in MASQUERADE target

There's a part in iptables manual concerning SNAT and MASQUERADE targets. I know the key difference between the two, but I don't fully get the following sentence: It is still possible to use the ...
2
votes
0answers
50 views

How can I configure iptables for per application setup?

I am working on a project where we are building lots of micro-services. Each service is neatly packaged as an RPM. Ideally I'd like for us to have iptables enabled on all of our machines and it would ...
2
votes
0answers
86 views

Transparent Proxy

I am setting up attempting to set up a transparent proxy on CentOS using Squid. So far I have managed to filter the content and get it working perfectly. The only issue I am having is getting a form ...
2
votes
0answers
120 views

Defining IPv6 chains in ip6tables-restore/iptables-restore files, is it possible?

The format for the files generated by iptables-save/ip6tables-save and loadable through iptables-restore/ip6tables-restore stipulates that one can prepend -4 or -6 respectively so as to maintain the ...
2
votes
1answer
1k views

How does connlimit in iptables supposed to work?

I wanted to set a limit to the number of concurrent connections allowed on my web server. I tried the following rules on an iptables (v1.4.19.1) kernel 3.14.4-200.fc20.x86_64 with a default DROP ...
2
votes
1answer
59 views

iptables drop length and TTL condition doesn't work

With iptables utility on Linux host need to create mini firewall. I need to drop all incoming connections with package length greater than 722 AND TTL greater than 22. Need exactly AND. Drop only if ...
2
votes
1answer
638 views

Bad built-in chain name with iptables-restore

I saved my iptable settings on a Ubuntu 11.4 system using iptables-save >filename I then replaced the Ubuntu system with CentOS 6.5 and tried to restore iptables using iptables-restore ...
2
votes
0answers
705 views

Corosync & Pacemaker IPTables Rules

When using Corosync with two rings via multi-cast addresses 226.94.1.1 (Port 5405) & 226.94.1.2 (Port 5406) what iptables rules are required to allow two nodes to communicate optimally without ...
2
votes
0answers
304 views

IPtables rule to double NAT [closed]

Let me rephrase it.. I just need an IPtable rule to do double NAT-ting.. Host A - Host B - Host C - Host D Host B should do both source NAT and destination NAT, so that my request from Host A ...
2
votes
1answer
496 views

iptables Port Forwarding — no service with the port

I have setup a network as in the image below: Firewall (FW) running CentOS 6 has two physical interfaces with subinterfaces: eth0:2 — 10.100.1.78/25 eth0:3 — 10.100.1.79/25 eth3 — 192.168.0.21/24 ...
2
votes
0answers
583 views

Route all HTTP traffic through polipo

I've set up polipo on my machine to listen to the default port 8123. To test it, I set the in-memory cache to a ridiculously high 2 GB and downloaded a 50 MB file using wget utilizing the proxy. ...
2
votes
0answers
309 views

iptables REDIRECT in combination with matching on interface vs. IP address

I've successfully set up Tor for transparent proxying using iptables (ie, all outgoing traffic is sent through Tor without the application's knowledge). In doing so, I discovered both an odd problem ...
2
votes
0answers
307 views

SNAT problem in iptables

I am trying to reroute traffic from specific devices in my house over openvpn. For this, I've created an OpenVPN tunnel between my house wifi router and my server. Here is my setup: Wifi router's ...
2
votes
0answers
270 views

IPTables dropping UDP packet stream

I have a configuration where UDP packets containing encapsulated DNS data are sent to a KVM instance for processing. The KVM instance sits behind an IPtables firewall which is also doing NAT. The ...
2
votes
0answers
366 views

Iptables and Port Scanning and Recent module

I'm trying to write an adaptive firewall using iptables, and am not clear on how the recent module is working. For example, see http://blog.zioup.org/2008/iptables_recent/ Snippet from my iptables: ...
2
votes
1answer
218 views

LAMP Hardening, Transparent Proxy with iptables

I'm running a LAMP server with FTP(S) and several users. The users have only access to uploading PHP files and other web content. Some are running Drupal and Wordpress, but also a few home made stuff. ...
2
votes
0answers
467 views

TPROXY for redirecting UDP on arbitrary ports

I want to intercept all UDP traffic leaving tap1. And possibly reply to e.g. DNS-requests. To accomplish this I wrote some python code listening to localhost and use iptables with a rule-set like ...
2
votes
0answers
367 views

Redirect all non-local traffic to a socks proxy

Is it possible to redirect all non-local traffic to a socks proxy? so, for example i have: 4 computers (clients A-D: 10.0.0.1-4 or dhcp) 1 computer with 2 network cards (gateway-server, eth0: ...
2
votes
0answers
280 views

Port Forwarding Between 2 Internet Machines

Here's my scenario: Setup There are 3 machines: A: on the internet : has ip (a.a.a.a), has port pa open B: my server / gateway : has ip (b.b.b.b), has port pb open C: on the internet : has ip ...
2
votes
1answer
375 views

iptables doesn't forward from WAN to virtual machines

I have a machine working like gateway and have two network interfaces: eth0 LAN : 192.168.1.0/24 eth1 WAN : XXX.XXX.XXX.XXX (my public ip) This machine has 3 VM guest over virtualbox. All have ...
2
votes
2answers
643 views

Having trouble with packets not making it into Fedora 16 Apache [closed]

Background: I haven't done anything with iptables in a few years... I have Fedora 16 running in a VM on VMWare, with my firewall (TomatoUSB) port forwarding to the VM. VM is at 192.168.1.155. I know ...
2
votes
0answers
598 views

Iptables - modprobe: FATAL - Fail2ban random restarts

I have been running fail2ban on my server for a while without any problems but have recently seen fail2ban restart randomly. After some looking in my logs I noticed that the restarts occur when ever ...
2
votes
1answer
726 views

Will the Firewall GUI in CentOS overwrite changes implemented by IPTABLES manual edits?

I would like to restrict access to the SSH port of a new CentOS 6.2 server to select IP addresses but the Firewall GUI utility seems to be an all-or-nothing scenario. Either the port is firewalled or ...
2
votes
0answers
474 views

Why are packets not moving forward? [closed]

I have a server with forwarding turned on. I placed an iptables LOG target in the PREROUTING, INPUT, and FORWARD chains of the mangle table. I can see the LOG messages from PREROUTING, but not INPUT ...
2
votes
1answer
460 views

pptpd dead but subsys locked? on cent os

i install point to point tunnel (PPTP) in my VPS. (Cent OS 6 64 Bit) everything fine after reboot the PPTP not worked client side. the pptpd status shows " pptpd dead but subsys locked ". how to ...
2
votes
2answers
2k views

Iptables GEOIP not working under Debian Squeeze

I've just installed xtables-*, compiled the geoip database, but when I try to use an iptables command it always gives back the following error: Command: iptables -I INPUT -p tcp --dport 80 -m geoip ...