iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

2
votes
1answer
743 views

iptables is not blocking

I have a script running every minute by a crontab. This script scans the system logs and grabs the IPs of every failed attempt to login on the server's dovecot, exim or ssh and add them to an ipset, ...
2
votes
1answer
674 views

IPtables command shows libipt_random.so missing

When I run a command, it shows error. I searched on net, but no one give me the correct answer. Googling shows only wrong answers for this questions. So please help me to overcome this problem. ...
2
votes
1answer
2k views

Allow incoming connections from Google Translate only

I have a small web server running on port 80, and I'd like to allow only Google Translate to have access to it. First I tried running dig translate.google.com and dig translate.googleusercontent.com ...
2
votes
2answers
841 views

Is xinetd still the best method to let non root daemons listen on privileged ports?

When I need to use SNMP monitoring for java applications, there is the need to that application (usually ran as daemon user) to listen on snmp port. If there is no other alternative, of course I can ...
2
votes
1answer
3k views

Port Mirroring using iptables - copy all traffic among nginx on :80 and apache on :8080

I have nginx running on port 80 and apache running on port 8080 I want to transfer all the traffic to both nginx and apache asynchronously i.e the performance of one server wont be dependent on the ...
2
votes
1answer
10k views

Fedora 16 - Iptables installed, but no iptables service available

I'm trying to open ports on my fedora OS. In the past, this was as easy as adding an rule like -A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT I went to restart my iptables ...
2
votes
1answer
1k views

What does this iptables entry mean?

iptables-save output: *filter :INPUT DROP [2929:172650] :FORWARD DROP [0:0] :OUTPUT ACCEPT [74596344:6265371965] These are the opening lines of the iptables-save command. What do the numbers in the ...
2
votes
1answer
3k views

Unable to make outbound SNMP connections when IPTables is enabled

I have a bunch of windows servers configured with the windows SNMP agent. Each server has four IP addresses and SNMP listens on all of them. There is something very odd with my monitoring server ...
2
votes
2answers
28 views

Debian 8 - IPTables reverts to state on every packet

Problem: iptables cannot be changed. On my computer, I can run iptables -F. iptables -L shows it is flushed. When any packets come into or out of the machine, all rules are back! The same behaviour ...
2
votes
1answer
56 views

How to add marks together in iptables (targets MARK and CONNMARK)

When you want to mark a packet in iptables, you would generally add the following line to your firewall script: iptables -t mangle -A POSTROUTING -p tcp -m multiport --dports 80,443 -j MARK ...
2
votes
1answer
24 views

Can you send a TCP packet with RST flag set using IPTABLES as a way to trick NMAP into thinking a port is closed?

I am learning Nmap and a thought occurred to me with regards to a SYN scan... A SYN scan sends an empty TCP packet with the SYN flag set to illicit a response from the target of either RST, ...
2
votes
1answer
51 views

Shorewall to protect interfaces that are not yet defined

I am planning to use Shorewall to filter traffic that originates from a virtual interface created by OpenVPN (lets call it tap0). If OpenVPN did not successfully create this interface before ...
2
votes
1answer
81 views

Don't allow docker internet access

I'm looking for a simple way to limit my docker containers so they only have local access and not internet access. I've tried using IPtables to do this and the following works: iptables -I FORWARD ...
2
votes
1answer
38 views

How do you block a port on your loopback?

I am doing some testing and want to be able to test situations where my database goes down. Its running on the same box as my tests, and it appears that things like the following are not doing the ...
2
votes
2answers
97 views

Traffic of specific program through vpn [duplicate]

is it possible to only let the traffic of Deluge through a VPN (OpenVPN) and the other traffic not with iptables? Kind regards
2
votes
1answer
20 views

Firewall that allows to tag or comment rules for easy filtering

I am going to use iptables for port forwarding to listen on requests from my LAN on port 8080 and answer with container at port 80 , like this: iptables -t nat -A PREROUTING -p tcp -d 192.168.1.15 ...
2
votes
2answers
99 views

Best practises: Applying iptables firewall rules for SSH

I need to add some firewall rules in our QA environment using iptables. I have to do the changes remotely . Some of the changes also include disabling SSH for few Networks . What are best practices ...
2
votes
1answer
249 views

Rewrite source IP in TCP replies using iptables

I'd like to rewrite the source IP on TCP/514 traffic leaving a redhat machine, for connections that weren't initiated from the machine. The machine receives TCP/514 traffic on an interface, for ...
2
votes
1answer
444 views

Local port is not accessible with public IP address

I have a linux server which has public IP and Private IP. So, when ever I login with public IP, the terminal directly shows private IP. example: $ ssh root@55.27.XX.XX root's password: ...
2
votes
1answer
294 views

iptables rule in /etc/rc.local are not loaded

/etc/iptables.conf contains a rule to dump my outgoing packets to 10.199 network as, *filter :INPUT ACCEPT [122:9273] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [73:8165] -A OUTPUT -d 10.199.48.0/24 -j ...
2
votes
1answer
37 views

Use two SSH ports, but open only one?

My iptables.conf looks roughly like this: -A INPUT -p tcp --dport 65000 -j ACCEPT -A INPUT -j DROP My sshd_config looks like this: Port 22 Port 65000 #AddressFamily any #ListenAddress 0.0.0.0 ...
2
votes
2answers
179 views

IPTABLES to allow ssh, ftp, pop, etc from one static IP address with HTTP/SSL open to public

This is my setting in /etc/sysconfig/iptables: #start of my iptables # Generated by iptables-save v1.2.11 on Wed May 27 00:31:22 2015 *mangle :PREROUTING ACCEPT [130933577:29488298585] :INPUT ...
2
votes
1answer
3k views

how to block only certain outgoing ip connection with iptables

(Centos 5.5) to block xxx.xxx.xxx.xxx: # iptables -A OUTPUT -j DROP -d xxx.xxx.xxx.xxx then verify by: # iptables -L OUTPUT --line-numbers Chain OUTPUT (policy DROP) num target prot opt ...
2
votes
1answer
538 views

iptables ruleset causes server to stop answering

I'm trying to configure my proxmox server's firewal and redirections. The aim is to block everything, open the necessary ports for basic services to work and, finally, redirect some ports to virtual ...
2
votes
1answer
32k views

can not telnet to a server connection refuse

I have two server with these specifications: IP address: 192.168.1.94 IP address: 192.168.1.221 I want to telnet to the first one from the second one (to port 5029) but I get this error: ...
2
votes
3answers
158 views

Bridge/Router with custom logic

I've a Linux box with 3 network adapaters, which I'd like to configure as follow: Adapter A is connected to computer A Adapter B is connected to computer B Adapter C is connected to the Internet. ...
2
votes
1answer
2k views

Forwarding packets from loopback interface with policy-based routing

I have the following iptables rule: iptables -t mangle -A PREROUTING -p udp -m udp --dport 10000 -j MARK --set-xmark 0x4/0xffffffff which sets fwmark 4 on all udp packets with destination port ...
2
votes
1answer
3k views

iptables routing incoming IP to another destination IP question

I have a test setup: server1:1.1.1.1 server2:2.2.2.2 client: 3.3.3.3 I'm trying to have client IP 3.3.3.3 do a HTTP request from the 1.1.1.1 server. However I want the 1.1.1.1 server to pass this ...
2
votes
1answer
234 views

psad: do not block access to HTTP

I want to block intruders via psad, but HTTP and HTTPS should not be blocked. For example, if someone is scanning my dedicated server via nmap, psad should block him for 2 hours, but he should still ...
2
votes
1answer
373 views

How is whonix blocking UDP traffic (except udp-dns related traffic)?

I want to know how whonix manages to block unwanted UDP-Traffic i.e. all UDP-traffic but DNS related udp traffic. I looked at the iptable rules both in the Workstation and Gateway. There are no ...
2
votes
1answer
1k views

Unable to access website hosted on virtual machine

I'm on a mac (osx 10.9.3) running CentOS7 in virtualbox. I would like to access the website hosted on the virtual machine. Browsing to the Guest IP returns webpage not available. I'm able to ping and ...
2
votes
1answer
1k views

In iptables, what is the difference between targets DNAT and REDIRECT?

More specifically, is -A PREROUTING -i $INT -p $PROTO --dport $PORT -j REDIRECT --to-ports $NEWPORT equivalent to one or both of these? -A PREROUTING -i $INT -p $PROTO --dport $PORT -j DNAT ...
2
votes
1answer
204 views

How do I enable IPv6 inbound traffic to get forwarded to my machine?

It seems that IPv6 traffic on my router is being dropped. How do I configure ip6tables appropriately, so that traffic is forwarded/accepted to my machine? Here's the syslog for my IPv6 traffic: Jun ...
2
votes
1answer
52 views

My iptables works the opposite from what I wanted

I have this set of iptables rules ... $ sudo iptables -n -L Chain INPUT (policy ACCEPT) target prot opt source destination LOG all -- 0.0.0.0/0 0.0.0.0/0 ...
2
votes
1answer
860 views

iptables - add rule for interface before it comes up

Right now I'm using /etc/rc.local to add some iptables rules on my Linux router on boot however some of the rules aren't added. I assume this is because the interface hasn't come up yet. This is what ...
2
votes
1answer
1k views

rtorrent: 'Tracker Timeout' caused by IPtables

I'm trying to secure my rtorrent-running-homeserver with IPtables. With the aim to allow only incoming connections to the rtorrent port 6890 and 5292 for ftp (both are forwarded by the router), I ...
2
votes
1answer
440 views

Masquerade not working sometimes

I have an issue with private network traffic not being masqueraded in very specific circumstances. The network is a group of VMware guests using the 10.1.0.0/18 network. The problematic host is ...
2
votes
1answer
272 views

Forward a host's network traffic to another host with the exception of SSH traffic

I am trying to redirect all the network traffic received in a old host to a different host. For that I created two new rules with iptables on the old host: echo 1 > /proc/sys/net/ipv4/ip_forward ...
2
votes
1answer
304 views

Randomizing the source port for new connections

Generally whenever source port is selected by a network application, it is selected in a sequential manner among the free ports like 32000, 32001 and so on. I want to randomize the source port ...
2
votes
1answer
209 views

Internet sharing with iptables: choosing which connection to share

I have a computer with two network devices (eth0 and wlan0), both connected to the internet (two different connections/isp). I'm trying to share the connection of wlan0 to another computer connected ...
2
votes
1answer
3k views

Linux Fedora 19 - iptables failed to start

I've been trying to start the iptables firewall service, but it keeps failing. What's going wrong? # systemctl status iptables.service iptables.service - IPv4 firewall with iptables Loaded: loaded ...
2
votes
1answer
350 views

What are the pros and cons to editing iptables configuration file vs adding rules via the iptables command

I am working with a product on CentOS that occasionally needs to automatically add and remove rules from the iptables configuration. For example, during an update, we want to explicitly refuse ...
2
votes
2answers
6k views

Open a port in my CentOS

I'm trying top open a port on my CentOS machine: I edit the /etc/sysconfig/iptables file and add my rule: -A INPUT -p TCP -m state --state NEW -m tcp --dport 143 -j ACCEPT Then I restart the ...
2
votes
1answer
2k views

Local port forwarding automatically configured on boot?

I have software which needs to run as a non-root user, but needs to listen on port 80 and 443. With iptables, this isn't all that difficult: sudo iptables -t nat -A PREROUTING -i eth0 -p tcp ...
2
votes
1answer
406 views

Allow application specific access in iptables using guid

I would like to get Skype working with iptables and don't want to allow a huge range of ports thus I thought a solution might be iptables -A OUTPUT -m owner --gid-owner skypeGrp -j ACCEPT iptables ...
2
votes
1answer
146 views

Using iptables to block for specific services

I am using ipset in conjunction with iptables to create a list of IPs I want to block. I did this: ipset -N blocking iphash ipset -A blocking 124.205.11.230 // and repeated this line for all IPs I ...
2
votes
1answer
312 views

Linux nat/iptables configuration for a chain of peer-to-peer links

I have an experimental setup, of 4 Linux (CentOS) machines: All 4 machines are internally connected using different networks and can ping eachother directly connected interfaces. However only PC4 ...
2
votes
1answer
332 views

PPTP server with NIC aliases

I have set up a VPN on a VPS Server using PPTP. I have one NIC with two aliases. eth0 eth0:1 eth0:2 The 3 interfaces have public addresses. eth0 is a French IP, eth0:1 is UK, and eth0:2 is ...
2
votes
1answer
1k views

Need to access port on LAN through IPTABLES firewall on static IP interface

I have a Linux firewall with 3 NIC's. Eth1 is my LAN's default gateway and has IP address 10.1.2.250 and is connected to my LAN with IP range 10.1.2.0/24. Eth2 has IP address of 10.0.0.6 and gateway ...
2
votes
2answers
2k views

Checking the type of NAT

I have read that there are many types of NATs available like symmetric NAT, full-cone NAT, etc. If I am behind a NAT, is there any way to find out the type of NAT behind which I am currently working ...