iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

1
vote
1answer
43 views

Curious about strange ICMP type 3 code 10 traffic to my IP address

My firewall (iptables) logs some strange ICMP type 3 code 10 traffic that I am curious to understand (specifically how or if this could be an exploit of some sort). Type 3 = Destination ...
1
vote
1answer
46 views

forwarding not working in iptables from 8006 to 443

My dedicated server was bridged to vmbr0 and it has 2 Ethernet cards eth0 and eth1 its bridged. I have enabled forwarding with net.ipv4.ip_forward=1. I want to redirect the Port 8006 to 443. Now ...
1
vote
1answer
45 views

CentOS Traffic Filter

I am trying to use Squid to filter the traffic flowing through the network. I am also trying to make this system transparent. My network setup is like so: Router -> CentOS Machine -> The rest ...
1
vote
1answer
179 views

iptables based redirect captive portal style

What is a iptables set of rules that will force hosts connected to a access point, that try to access any website (port 80 of any ip or hostname) to be redirected to another device on the network ...
1
vote
1answer
26 views

Redirect packets and save the content to disk

I want to reroute a connection just like rinetd does but save the client and server messages. Is there any tool like this out there ? I'm using Debian.
1
vote
1answer
67 views

Absolutely cannot get FTP access after adding many rules to iptables in CentOS5

I'm a complete noob and am just having the worst time trying to get FTP access to the server. I want to keep the firewall enabled. Edit: Updated the iptables information. I have the following ...
1
vote
1answer
192 views

Create a iptables rule if the rule does not all ready exist

Hi I've created a script to setup Nagios on my remote servers. My Script checks iptables to see if a firewall rule all ready exists and then is supposed to add the rule if it's not all ready there. ...
1
vote
2answers
60 views

Does IP tables need to be configured or is a stand alone firewall sufficient?

I have two desktops and a laptop running Arch Linux. I have not setup any iptable rules on any of the machines, and I am curious if I should. One desktop is only used in my home network and is ...
1
vote
1answer
141 views

rtorrent: 'Tracker Timeout' caused by IPtables

I'm trying to secure my rtorrent-running-homeserver with IPtables. With the aim to allow only incoming connections to the rtorrent port 6890 and 5292 for ftp (both are forwarded by the router), I ...
1
vote
1answer
104 views

Masquerade not working sometimes

I have an issue with private network traffic not being masqueraded in very specific circumstances. The network is a group of VMware guests using the 10.1.0.0/18 network. The problematic host is ...
1
vote
1answer
66 views

FTP download problems with iptables — Port 21 connection is allowed but “Network is unreachable”

I'm trying to connect to an FTP site but with, e.g., wget: Logging in as anonymous ... Logged in! ==> SYST ... done. ==> PWD ... done. ==> TYPE I ... done. ==> CWD (1) /gcrypt/gnutls ...
1
vote
1answer
191 views

High performance routing with high churn ruleset. What approach is most likely to scale to C10K and beyond?

I've been asked to create a high throughput router using PC / server hardware. I'm modestly familiar with pf, iptables, and tc, but I've never had such high churn and so many rules. I hope you can ...
1
vote
1answer
26 views

Will this open up a non-standard port to ssh?

I am following tutorials on iptable and want to allow ssh traffic on my non-standard SSH port = YYY. I think this is how you do it, but want to double check so I don't lock myself out of my server. ...
1
vote
1answer
223 views

iptables forwarding between subnets

I want to forward traffic between two subnets, I'm not very familiar with iptables. The forwarding works except when iptables is enabled. There must be something wrong with the rules, though ...
1
vote
1answer
116 views

Configure port 1935 in iptables for media

On CentOs 6.4 I cannot connect to the media server from port 1935 only 5080. I have read you can edit the iptables files with following. Open flle /etc/sysconfig/iptables: $ sudo vi ...
1
vote
1answer
233 views

Route HTTP traffic thorugh different interface

I have my normal eth0 interface and an setup ppp0 interface, the problem I have is that I want to exclusively route all HTTP/HTTPS traffic through the ppp0 interface and everything else through the ...
1
vote
3answers
2k views

iptables-restore just says “FAILED”

I am not sure what's wrong with my rule in the Iptables. I am actually trying to build a SSH server and following a cyberciti tutorial. My Iptables configuration looks like this: # Firewall ...
1
vote
1answer
239 views

how to investigate Firewall blocked outbound TCP

CentOS webserver with CSF (Config Server Firewall) running. Blocking all outbound / Inbound traffic except listed ports 80 81 22 21 etc. for web, mail & FTP services etc. I'm use to seeing heaps ...
1
vote
1answer
43 views

IPTABLES chain need help for restriction

I have two network cards eth0:- 172.16.91.70 (External Zone) eth1:- 172.16.85.70 (Internal Zone) I have clients in my Internal Zone which can access the external network. The ping goes fine and can ...
1
vote
1answer
175 views

Intercept incoming TCP/IP packets on Linux and perform NAT

I want to make a decision of what computer is behind the firewall sending the packet. Imagine I have 2 PCs behind the firewall and I want to, based on (my algorithm), make a decision at the firewall ...
1
vote
1answer
804 views

Copy/Mirror traffic to WAN interfaces without “iptables tee” support

I want to copy every outgoing packet to other WAN interfaces but my iptables (v1.2.7) doesn't have TEE target support. I wonder if there is another way (maybe using iproute2 or ebtables) to copy every ...
1
vote
1answer
622 views

How to log iptables as of kernel 3.9.0?

What is the right way to log iptables as of kernel 3.9.0? I can no longer append a logging rule such as: # iptables --new-chain droplog # iptables --append droplog --jump LOG --log-level info ...
1
vote
1answer
520 views

How do I route different users over different OpenVPN tunnels in Linux?

The setup: I have multiple, static-key OpenVPN client/server configurations, labeled "client1", "client2", and "client3" with server/client IPs 10.10.1.1/10.10.1.2, 10.10.2.1/10.10.2.2, and ...
1
vote
1answer
166 views

Blocking gzip HTTP content with Iptables or Snort?

I'm looking to drop a connection if a website contains a certain word or phrase. The issue is, the site is typically compressed with gzip. Any ideas?
1
vote
1answer
841 views

Help to understand Iptables Forward chain with DNAT

I have one server where iptables configured with all chains DROP in filter table eth0 :- 10.0.0.2 [ Intranet assume as LAN ] eth2 :- 172.16.0.2 [ External clients assume as WAN ] Now What I am ...
1
vote
1answer
1k views

Redirect Packets from ppp0 interface to ethernet interface in linux

My question is similar to this question, however with some change. I have a PPPoE connection on my Linux Machine (CentOS kernal 2.6.32) as a client, so that when I setup this connection, another ...
1
vote
1answer
147 views

darkstat shown blocked traffic

I've installed Darkstat on a Qemu VM which is connected to a bridge interface on top of main server's interface ( eth0 ) In Darkstat report I can see many hosts in the same IP range of specified VMs ...
1
vote
1answer
276 views

iptables logging prefix gets corrupted

I've been using iptables for some time but recently noticed that the log prefix I'd set had got corrupted. In /etc/iptables/rules.v4` I have: -A LOGNDROP -j LOG --log-prefix "iptables denied: " ...
1
vote
2answers
616 views

How would I direct local(127.0.0.1) MySQL traffic to an external SQL server?

Basically, I have two EC2 instances on Amazon Web Services. They are both running Ubuntu 11.10 x64. They both have a private and a public (Elastic) IP addresses. I'm having trouble setting up iptables ...
1
vote
1answer
990 views

IPTABLES to block all outgoing connections except selected networks

There is a firewall/gateway machine with eth0 Public and eth1 Private network (192.168.1.0). I would like to block all OUTPUT connections for private users (eth1) except couple of networks like: ...
1
vote
1answer
424 views

portsentry and IPTables on constant reboot, but not sure why

I have been doing some hardening on a new server [ centos 5.7 final ] i also have logwatch and seem to be getting these strange logs Commands Run: User root: /sbin/service portsentry restart ...
1
vote
1answer
601 views

Allow Windows file share through a Linux Firewall

I'm struggling to enable NTFS share between two Windows (XP and 7) hosts through a Linux firewall. Here's my setup: [XPMachine-LAN1]---------->[LINUX FIREWALL]---------->[Win7-LAN2] What I ...
1
vote
2answers
1k views

Checking the type of NAT

I have read that there are many types of NATs available like symmetric NAT, full-cone NAT, etc. If I am behind a NAT, is there any way to find out the type of NAT behind which I am currently working ...
1
vote
1answer
945 views

Why am I getting a “Listing remote folder failed” error when I try to connect with SFTP?

I set up SFTP, but I have a problem regarding iptables. Here are my rules: A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT A RH-Firewall-1-INPUT -m state --state NEW -m ...
1
vote
4answers
10k views

iptables drop all incoming ICMP requests except from one IP

Currently, I have something like: iptables -A INPUT -p ICMP --icmp-type 8 -j DROP iptables -A INPUT -s x.x.x.x -p ICMP --icmp-type 8 -j ACCEPT However, when I run the second command, it ...
1
vote
1answer
482 views

How would I go about getting UPnP working on a Slackware server/firewall?

I'm a long time fan of Slackware and I've always had a machine serving as my main server/firewall with the latest version installed. I have it now but I'm struggling to find information on how to ...
1
vote
0answers
28 views

Redirect shared internet to tor/privoxy [on hold]

I have shared my internet and set my client gateway to my IP, every thing works. I need to client goes through tor. I configured privoxy to use tor and with this iptable command I defined a rule: ...
1
vote
0answers
18 views

ISC DHCP Server - A Client's Uplink Is Not Working

Running a DHCP server, client(s) does not have up-link (0Mbps) and has a downlink (50Mbps.) I am setting up a gateway/router on a PC running Debian Wheezy with ISC-DHCP. I have 1 WAN (eth0) and 2 LAN ...
1
vote
0answers
40 views

DROP all for port 22 if not geoip set of US for iptables and xtables

I want to simply block all ssh access from anywhere but with in the US. This is my whole iptables, and I have followed ...
1
vote
0answers
24 views

Open ports for local samba server with iptables

I can't seem to connect from Windows 7 to my network share on Ubuntu (Samba). Why won't this work? Heres a bit of information, that would perhaps be useful. user1@computer:/etc$ sudo iptables -L ...
1
vote
0answers
78 views

Error: iptables: No chain/target/match by that name

I am trying to configure proxy server on RHEL Server 6.5 using Squid and iptables. Below is the command I executed and the error message it displayed: vzlptest01 root [root] > iptables -A INPUT -i ...
1
vote
1answer
35 views

Bridged TAP interface to virtualbox

I need bridged TAP interface on client side of my VPN to virtual machine. I use VirtualBox 4.3.12. But in Adapter Network options in Attached to: Bridged adapter I do not see my TUN adapter. I have ...
1
vote
0answers
26 views

Packets sent through TUN interface not routed

I have a C program attached to a TUN interface. In my C program, I'm building packets and writing them to the TUN interface. Now to check if packets are really sent from my TUN interface I use ...
1
vote
1answer
59 views

Setting up a gateway between two subnets on the same physical network

I need to configure a DHCP-enabled network (192.168.2.) on a physical layer where resides an already existing network (192.168.1.) with static IPs. I have a Debian 7 server with two interfaces (server ...
1
vote
0answers
47 views

How do I control ip routing in the new firewalld?

I have the following scenario: Our fedora server is connected to the internet on eth0 and has a second nic, wlan0 acting as an access point. The purpose of the access point is to provide a connection ...
1
vote
1answer
44 views

Iptables not forwarding. Input instead

I have set up iptables on my ubuntu headless server: iptables -S -P INPUT ACCEPT -P FORWARD DROP -P OUTPUT ACCEPT -A INPUT -s 10.1.3.90/32 -i eth0 -j LOG --log-prefix "INPUT: " -A INPUT -i eth1 -j ...
1
vote
1answer
50 views

IPTables DNAT rule to local web server doesn't work with localhost?

I have linux box functioning as Wireless Access Point. Wireless clients connect and then browse the web. I am only allowing port 80. There are certain sites I'd like to block, but not by dropping the ...
1
vote
0answers
43 views

Local Client/Server communication using TUN interfaces

I want to establish a local communication between a client and a server using TUN interfaces. The client program will be attached to interface TUN1 and we suppose that it has IP address @IP1. The ...
1
vote
1answer
48 views

How do you route to secondary interface on the same physical port?

INTERNET<->(wan)BRIDGED_DEVICE(lan)<->ETH_ROUTER<->LAN Problem: Need to access web server on BRIDGED_DEVICE's LAN from INTERNET via ROUTER (BRIDGED_DEVICE web server cannot be accessed form ...
1
vote
0answers
157 views

Why does this iptables rule doesn't get configured after a reboot once in a while? [closed]

On my Android network device, iptables firewall rules service script is started by the init.rc scripts during boot time. One of the firewall INPUT chain rules doesn't get configured in the iptables ...