iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

1
vote
2answers
620 views

SSH tunneling through a busybox router

I have a busybox router and I'm able to login to the console using telnet & I also have access to the web interface. My question is, how can I create an ssh tunnel from my local network through ...
1
vote
1answer
91 views

netfilter's configuration to allow openvpn

I've got a debian server at home, that I use to have a VPN access to my home computers. I've redirected the openvpn port on the port 2000 : in my file "server.conf", I've added this : #Server mode ...
1
vote
1answer
939 views

How do I port-forward 169.254.169.254-bound packets from libvirt/KVM guests to localhost?

This is a followup to What's the best way to have a 169.254.169.254 address local to my laptop?. Short story: 169.254.169.254 is the "well known" address of cloud metadata services for EC2 and for ...
1
vote
1answer
2k views

iptables forwarding and routing

In fact, this question is about openwrt and CoovaAP, but I guess it's the same in other linux distributions. I've two interfaces, a "wan" and a "wlan" interface. Is there by default any filter, ...
1
vote
1answer
494 views

How to provide a “guest LAN” on one ethernet device

I have an always-on machine running Debian/Squeeze with a couple of ethernet ports (it's doing various serverish jobs, including DHCP) and a LAN on each. eth0 is on 192.168.7.* and has access to the ...
1
vote
1answer
986 views

Losing wifi connection to access point after a few minutes (hostapd, dnsmasq, iptables)

I'm using a laptop as a wifi access point. Since this laptop has the proper hardware, I was able to use hostapd. I wanted to use DHCP and iptables/NAT forwarding instead of a bridge to have more ...
1
vote
1answer
186 views

iptable rule to redirect only https handshake?

I was reading this interesting article today: http://www.moserware.com/2009/06/first-few-milliseconds-of-https.html A crazy thought came to mind...Is it possible to write an iptable rule that only ...
1
vote
2answers
1k views

How can I Forward a subDomain to a specific port?

My apologies if this has been asked before. I haven't found an adequate solution so... yeah. When a specific domain, "example.com" is accessed, I want it to act normally. In other words, it should go ...
1
vote
2answers
195 views

How can I use the same IP from the Internet and intranet?

I have an Ubuntu firewall box (Alma), at the office, with a web server on it. It looks like this: [Internet] <-> [DSL Router] <-> [Alma] | ...
1
vote
1answer
510 views

How can I move firewall settings from one Debian Squeeze web server to another?

I configured a Debian Squeeze virtual machine in VMWare on my laptop. I configured it with a very restrictive set of firewall rules using Firestarter. I then uploaded a copy of its disk image to use ...
1
vote
2answers
682 views

How to Optimize an IPTABLES script?

If I could list that which iptables rule has how many matched packets, then I could create a better/faster iptables script that's faster. That rule would be at top/first that has the more packets ...
1
vote
1answer
437 views

List iptables rules as append command

A while back I was watching over the shoulder of a Linux guru and he issued a command that listed all the iptables rules in the format of the append commands you would need to issue in order to build ...
1
vote
1answer
827 views

Sharing bandwidth between IPs

There are 200 users in my network, and these users are in two AD groups and cannot set specific IP ranges for each group. I want to set, for each group, the amount of bandwidth that can be shared ...
1
vote
1answer
60 views

Curious about strange ICMP type 3 code 10 traffic to my IP address

My firewall (iptables) logs some strange ICMP type 3 code 10 traffic that I am curious to understand (specifically how or if this could be an exploit of some sort). Type 3 = Destination ...
1
vote
1answer
69 views

forwarding not working in iptables from 8006 to 443

My dedicated server was bridged to vmbr0 and it has 2 Ethernet cards eth0 and eth1 its bridged. I have enabled forwarding with net.ipv4.ip_forward=1. I want to redirect the Port 8006 to 443. Now ...
1
vote
1answer
50 views

CentOS Traffic Filter

I am trying to use Squid to filter the traffic flowing through the network. I am also trying to make this system transparent. My network setup is like so: Router -> CentOS Machine -> The rest ...
1
vote
1answer
335 views

iptables based redirect captive portal style

What is a iptables set of rules that will force hosts connected to a access point, that try to access any website (port 80 of any ip or hostname) to be redirected to another device on the network ...
1
vote
1answer
30 views

Redirect packets and save the content to disk

I want to reroute a connection just like rinetd does but save the client and server messages. Is there any tool like this out there ? I'm using Debian.
1
vote
1answer
78 views

Absolutely cannot get FTP access after adding many rules to iptables in CentOS5

I'm a complete noob and am just having the worst time trying to get FTP access to the server. I want to keep the firewall enabled. Edit: Updated the iptables information. I have the following ...
1
vote
1answer
298 views

Create a iptables rule if the rule does not all ready exist

Hi I've created a script to setup Nagios on my remote servers. My Script checks iptables to see if a firewall rule all ready exists and then is supposed to add the rule if it's not all ready there. ...
1
vote
2answers
70 views

Does IP tables need to be configured or is a stand alone firewall sufficient?

I have two desktops and a laptop running Arch Linux. I have not setup any iptable rules on any of the machines, and I am curious if I should. One desktop is only used in my home network and is ...
1
vote
1answer
217 views

rtorrent: 'Tracker Timeout' caused by IPtables

I'm trying to secure my rtorrent-running-homeserver with IPtables. With the aim to allow only incoming connections to the rtorrent port 6890 and 5292 for ftp (both are forwarded by the router), I ...
1
vote
1answer
112 views

Masquerade not working sometimes

I have an issue with private network traffic not being masqueraded in very specific circumstances. The network is a group of VMware guests using the 10.1.0.0/18 network. The problematic host is ...
1
vote
1answer
81 views

FTP download problems with iptables — Port 21 connection is allowed but “Network is unreachable”

I'm trying to connect to an FTP site but with, e.g., wget: Logging in as anonymous ... Logged in! ==> SYST ... done. ==> PWD ... done. ==> TYPE I ... done. ==> CWD (1) /gcrypt/gnutls ...
1
vote
1answer
195 views

High performance routing with high churn ruleset. What approach is most likely to scale to C10K and beyond?

I've been asked to create a high throughput router using PC / server hardware. I'm modestly familiar with pf, iptables, and tc, but I've never had such high churn and so many rules. I hope you can ...
1
vote
1answer
26 views

Will this open up a non-standard port to ssh?

I am following tutorials on iptable and want to allow ssh traffic on my non-standard SSH port = YYY. I think this is how you do it, but want to double check so I don't lock myself out of my server. ...
1
vote
1answer
258 views

iptables forwarding between subnets

I want to forward traffic between two subnets, I'm not very familiar with iptables. The forwarding works except when iptables is enabled. There must be something wrong with the rules, though ...
1
vote
1answer
148 views

Configure port 1935 in iptables for media

On CentOs 6.4 I cannot connect to the media server from port 1935 only 5080. I have read you can edit the iptables files with following. Open flle /etc/sysconfig/iptables: $ sudo vi ...
1
vote
1answer
319 views

Route HTTP traffic thorugh different interface

I have my normal eth0 interface and an setup ppp0 interface, the problem I have is that I want to exclusively route all HTTP/HTTPS traffic through the ppp0 interface and everything else through the ...
1
vote
3answers
2k views

iptables-restore just says “FAILED”

I am not sure what's wrong with my rule in the Iptables. I am actually trying to build a SSH server and following a cyberciti tutorial. My Iptables configuration looks like this: # Firewall ...
1
vote
1answer
251 views

how to investigate Firewall blocked outbound TCP

CentOS webserver with CSF (Config Server Firewall) running. Blocking all outbound / Inbound traffic except listed ports 80 81 22 21 etc. for web, mail & FTP services etc. I'm use to seeing heaps ...
1
vote
1answer
45 views

IPTABLES chain need help for restriction

I have two network cards eth0:- 172.16.91.70 (External Zone) eth1:- 172.16.85.70 (Internal Zone) I have clients in my Internal Zone which can access the external network. The ping goes fine and can ...
1
vote
1answer
191 views

Intercept incoming TCP/IP packets on Linux and perform NAT

I want to make a decision of what computer is behind the firewall sending the packet. Imagine I have 2 PCs behind the firewall and I want to, based on (my algorithm), make a decision at the firewall ...
1
vote
1answer
843 views

Copy/Mirror traffic to WAN interfaces without “iptables tee” support

I want to copy every outgoing packet to other WAN interfaces but my iptables (v1.2.7) doesn't have TEE target support. I wonder if there is another way (maybe using iproute2 or ebtables) to copy every ...
1
vote
1answer
647 views

How to log iptables as of kernel 3.9.0?

What is the right way to log iptables as of kernel 3.9.0? I can no longer append a logging rule such as: # iptables --new-chain droplog # iptables --append droplog --jump LOG --log-level info ...
1
vote
1answer
609 views

How do I route different users over different OpenVPN tunnels in Linux?

The setup: I have multiple, static-key OpenVPN client/server configurations, labeled "client1", "client2", and "client3" with server/client IPs 10.10.1.1/10.10.1.2, 10.10.2.1/10.10.2.2, and ...
1
vote
1answer
170 views

Blocking gzip HTTP content with Iptables or Snort?

I'm looking to drop a connection if a website contains a certain word or phrase. The issue is, the site is typically compressed with gzip. Any ideas?
1
vote
1answer
911 views

Help to understand Iptables Forward chain with DNAT

I have one server where iptables configured with all chains DROP in filter table eth0 :- 10.0.0.2 [ Intranet assume as LAN ] eth2 :- 172.16.0.2 [ External clients assume as WAN ] Now What I am ...
1
vote
1answer
2k views

Redirect Packets from ppp0 interface to ethernet interface in linux

My question is similar to this question, however with some change. I have a PPPoE connection on my Linux Machine (CentOS kernal 2.6.32) as a client, so that when I setup this connection, another ...
1
vote
1answer
147 views

darkstat shown blocked traffic

I've installed Darkstat on a Qemu VM which is connected to a bridge interface on top of main server's interface ( eth0 ) In Darkstat report I can see many hosts in the same IP range of specified VMs ...
1
vote
1answer
284 views

iptables logging prefix gets corrupted

I've been using iptables for some time but recently noticed that the log prefix I'd set had got corrupted. In /etc/iptables/rules.v4` I have: -A LOGNDROP -j LOG --log-prefix "iptables denied: " ...
1
vote
2answers
654 views

How would I direct local(127.0.0.1) MySQL traffic to an external SQL server?

Basically, I have two EC2 instances on Amazon Web Services. They are both running Ubuntu 11.10 x64. They both have a private and a public (Elastic) IP addresses. I'm having trouble setting up iptables ...
1
vote
1answer
1k views

IPTABLES to block all outgoing connections except selected networks

There is a firewall/gateway machine with eth0 Public and eth1 Private network (192.168.1.0). I would like to block all OUTPUT connections for private users (eth1) except couple of networks like: ...
1
vote
1answer
442 views

portsentry and IPTables on constant reboot, but not sure why

I have been doing some hardening on a new server [ centos 5.7 final ] i also have logwatch and seem to be getting these strange logs Commands Run: User root: /sbin/service portsentry restart ...
1
vote
1answer
631 views

Allow Windows file share through a Linux Firewall

I'm struggling to enable NTFS share between two Windows (XP and 7) hosts through a Linux firewall. Here's my setup: [XPMachine-LAN1]---------->[LINUX FIREWALL]---------->[Win7-LAN2] What I ...
1
vote
2answers
1k views

Checking the type of NAT

I have read that there are many types of NATs available like symmetric NAT, full-cone NAT, etc. If I am behind a NAT, is there any way to find out the type of NAT behind which I am currently working ...
1
vote
1answer
962 views

Why am I getting a “Listing remote folder failed” error when I try to connect with SFTP?

I set up SFTP, but I have a problem regarding iptables. Here are my rules: A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT A RH-Firewall-1-INPUT -m state --state NEW -m ...
1
vote
4answers
10k views

iptables drop all incoming ICMP requests except from one IP

Currently, I have something like: iptables -A INPUT -p ICMP --icmp-type 8 -j DROP iptables -A INPUT -s x.x.x.x -p ICMP --icmp-type 8 -j ACCEPT However, when I run the second command, it ...
1
vote
1answer
489 views

How would I go about getting UPnP working on a Slackware server/firewall?

I'm a long time fan of Slackware and I've always had a machine serving as my main server/firewall with the latest version installed. I have it now but I'm struggling to find information on how to ...
1
vote
0answers
29 views

How do I route bittorrent through a second interface?

I've managed to configure openvpn on my DD-WRT router such that the tunnel is up and working, but that it doesn't mess with routes at all (the default configuration wants all traffic to go through ...