iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

2
votes
1answer
3k views

Unable to make outbound SNMP connections when IPTables is enabled

I have a bunch of windows servers configured with the windows SNMP agent. Each server has four IP addresses and SNMP listens on all of them. There is something very odd with my monitoring server ...
2
votes
1answer
48 views

Shorewall to protect interfaces that are not yet defined

I am planning to use Shorewall to filter traffic that originates from a virtual interface created by OpenVPN (lets call it tap0). If OpenVPN did not successfully create this interface before ...
2
votes
1answer
55 views

Don't allow docker internet access

I'm looking for a simple way to limit my docker containers so they only have local access and not internet access. I've tried using IPtables to do this and the following works: iptables -I FORWARD ...
2
votes
1answer
36 views

How do you block a port on your loopback?

I am doing some testing and want to be able to test situations where my database goes down. Its running on the same box as my tests, and it appears that things like the following are not doing the ...
2
votes
2answers
61 views

Traffic of specific program through vpn [duplicate]

is it possible to only let the traffic of Deluge through a VPN (OpenVPN) and the other traffic not with iptables? Kind regards
2
votes
1answer
20 views

Firewall that allows to tag or comment rules for easy filtering

I am going to use iptables for port forwarding to listen on requests from my LAN on port 8080 and answer with container at port 80 , like this: iptables -t nat -A PREROUTING -p tcp -d 192.168.1.15 ...
2
votes
2answers
96 views

Best practises: Applying iptables firewall rules for SSH

I need to add some firewall rules in our QA environment using iptables. I have to do the changes remotely . Some of the changes also include disabling SSH for few Networks . What are best practices ...
2
votes
1answer
233 views

Rewrite source IP in TCP replies using iptables

I'd like to rewrite the source IP on TCP/514 traffic leaving a redhat machine, for connections that weren't initiated from the machine. The machine receives TCP/514 traffic on an interface, for ...
2
votes
1answer
425 views

Local port is not accessible with public IP address

I have a linux server which has public IP and Private IP. So, when ever I login with public IP, the terminal directly shows private IP. example: $ ssh root@55.27.XX.XX root's password: ...
2
votes
1answer
275 views

iptables rule in /etc/rc.local are not loaded

/etc/iptables.conf contains a rule to dump my outgoing packets to 10.199 network as, *filter :INPUT ACCEPT [122:9273] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [73:8165] -A OUTPUT -d 10.199.48.0/24 -j ...
2
votes
1answer
36 views

Use two SSH ports, but open only one?

My iptables.conf looks roughly like this: -A INPUT -p tcp --dport 65000 -j ACCEPT -A INPUT -j DROP My sshd_config looks like this: Port 22 Port 65000 #AddressFamily any #ListenAddress 0.0.0.0 ...
2
votes
2answers
169 views

IPTABLES to allow ssh, ftp, pop, etc from one static IP address with HTTP/SSL open to public

This is my setting in /etc/sysconfig/iptables: #start of my iptables # Generated by iptables-save v1.2.11 on Wed May 27 00:31:22 2015 *mangle :PREROUTING ACCEPT [130933577:29488298585] :INPUT ...
2
votes
1answer
3k views

how to block only certain outgoing ip connection with iptables

(Centos 5.5) to block xxx.xxx.xxx.xxx: # iptables -A OUTPUT -j DROP -d xxx.xxx.xxx.xxx then verify by: # iptables -L OUTPUT --line-numbers Chain OUTPUT (policy DROP) num target prot opt ...
2
votes
1answer
519 views

iptables ruleset causes server to stop answering

I'm trying to configure my proxmox server's firewal and redirections. The aim is to block everything, open the necessary ports for basic services to work and, finally, redirect some ports to virtual ...
2
votes
1answer
31k views

can not telnet to a server connection refuse

I have two server with these specifications: IP address: 192.168.1.94 IP address: 192.168.1.221 I want to telnet to the first one from the second one (to port 5029) but I get this error: ...
2
votes
3answers
158 views

Bridge/Router with custom logic

I've a Linux box with 3 network adapaters, which I'd like to configure as follow: Adapter A is connected to computer A Adapter B is connected to computer B Adapter C is connected to the Internet. ...
2
votes
1answer
2k views

Forwarding packets from loopback interface with policy-based routing

I have the following iptables rule: iptables -t mangle -A PREROUTING -p udp -m udp --dport 10000 -j MARK --set-xmark 0x4/0xffffffff which sets fwmark 4 on all udp packets with destination port ...
2
votes
1answer
3k views

iptables routing incoming IP to another destination IP question

I have a test setup: server1:1.1.1.1 server2:2.2.2.2 client: 3.3.3.3 I'm trying to have client IP 3.3.3.3 do a HTTP request from the 1.1.1.1 server. However I want the 1.1.1.1 server to pass this ...
2
votes
1answer
230 views

psad: do not block access to HTTP

I want to block intruders via psad, but HTTP and HTTPS should not be blocked. For example, if someone is scanning my dedicated server via nmap, psad should block him for 2 hours, but he should still ...
2
votes
1answer
365 views

How is whonix blocking UDP traffic (except udp-dns related traffic)?

I want to know how whonix manages to block unwanted UDP-Traffic i.e. all UDP-traffic but DNS related udp traffic. I looked at the iptable rules both in the Workstation and Gateway. There are no ...
2
votes
1answer
1k views

Unable to access website hosted on virtual machine

I'm on a mac (osx 10.9.3) running CentOS7 in virtualbox. I would like to access the website hosted on the virtual machine. Browsing to the Guest IP returns webpage not available. I'm able to ping and ...
2
votes
1answer
1k views

In iptables, what is the difference between targets DNAT and REDIRECT?

More specifically, is -A PREROUTING -i $INT -p $PROTO --dport $PORT -j REDIRECT --to-ports $NEWPORT equivalent to one or both of these? -A PREROUTING -i $INT -p $PROTO --dport $PORT -j DNAT ...
2
votes
1answer
203 views

How do I enable IPv6 inbound traffic to get forwarded to my machine?

It seems that IPv6 traffic on my router is being dropped. How do I configure ip6tables appropriately, so that traffic is forwarded/accepted to my machine? Here's the syslog for my IPv6 traffic: Jun ...
2
votes
1answer
51 views

My iptables works the opposite from what I wanted

I have this set of iptables rules ... $ sudo iptables -n -L Chain INPUT (policy ACCEPT) target prot opt source destination LOG all -- 0.0.0.0/0 0.0.0.0/0 ...
2
votes
1answer
830 views

iptables - add rule for interface before it comes up

Right now I'm using /etc/rc.local to add some iptables rules on my Linux router on boot however some of the rules aren't added. I assume this is because the interface hasn't come up yet. This is what ...
2
votes
1answer
430 views

Masquerade not working sometimes

I have an issue with private network traffic not being masqueraded in very specific circumstances. The network is a group of VMware guests using the 10.1.0.0/18 network. The problematic host is ...
2
votes
1answer
260 views

Forward a host's network traffic to another host with the exception of SSH traffic

I am trying to redirect all the network traffic received in a old host to a different host. For that I created two new rules with iptables on the old host: echo 1 > /proc/sys/net/ipv4/ip_forward ...
2
votes
1answer
298 views

Randomizing the source port for new connections

Generally whenever source port is selected by a network application, it is selected in a sequential manner among the free ports like 32000, 32001 and so on. I want to randomize the source port ...
2
votes
1answer
208 views

Internet sharing with iptables: choosing which connection to share

I have a computer with two network devices (eth0 and wlan0), both connected to the internet (two different connections/isp). I'm trying to share the connection of wlan0 to another computer connected ...
2
votes
1answer
3k views

Linux Fedora 19 - iptables failed to start

I've been trying to start the iptables firewall service, but it keeps failing. What's going wrong? # systemctl status iptables.service iptables.service - IPv4 firewall with iptables Loaded: loaded ...
2
votes
1answer
334 views

What are the pros and cons to editing iptables configuration file vs adding rules via the iptables command

I am working with a product on CentOS that occasionally needs to automatically add and remove rules from the iptables configuration. For example, during an update, we want to explicitly refuse ...
2
votes
2answers
6k views

Open a port in my CentOS

I'm trying top open a port on my CentOS machine: I edit the /etc/sysconfig/iptables file and add my rule: -A INPUT -p TCP -m state --state NEW -m tcp --dport 143 -j ACCEPT Then I restart the ...
2
votes
1answer
2k views

Local port forwarding automatically configured on boot?

I have software which needs to run as a non-root user, but needs to listen on port 80 and 443. With iptables, this isn't all that difficult: sudo iptables -t nat -A PREROUTING -i eth0 -p tcp ...
2
votes
1answer
405 views

Allow application specific access in iptables using guid

I would like to get Skype working with iptables and don't want to allow a huge range of ports thus I thought a solution might be iptables -A OUTPUT -m owner --gid-owner skypeGrp -j ACCEPT iptables ...
2
votes
1answer
145 views

Using iptables to block for specific services

I am using ipset in conjunction with iptables to create a list of IPs I want to block. I did this: ipset -N blocking iphash ipset -A blocking 124.205.11.230 // and repeated this line for all IPs I ...
2
votes
1answer
308 views

Linux nat/iptables configuration for a chain of peer-to-peer links

I have an experimental setup, of 4 Linux (CentOS) machines: All 4 machines are internally connected using different networks and can ping eachother directly connected interfaces. However only PC4 ...
2
votes
1answer
331 views

PPTP server with NIC aliases

I have set up a VPN on a VPS Server using PPTP. I have one NIC with two aliases. eth0 eth0:1 eth0:2 The 3 interfaces have public addresses. eth0 is a French IP, eth0:1 is UK, and eth0:2 is ...
2
votes
1answer
1k views

Need to access port on LAN through IPTABLES firewall on static IP interface

I have a Linux firewall with 3 NIC's. Eth1 is my LAN's default gateway and has IP address 10.1.2.250 and is connected to my LAN with IP range 10.1.2.0/24. Eth2 has IP address of 10.0.0.6 and gateway ...
2
votes
2answers
2k views

Checking the type of NAT

I have read that there are many types of NATs available like symmetric NAT, full-cone NAT, etc. If I am behind a NAT, is there any way to find out the type of NAT behind which I am currently working ...
2
votes
2answers
1k views

use iptables to allow incoming connections to some computer on port XYZ?

This is what I have: iptables -i em1 -A INPUT -j ACCEPT -p tcp --dport 9001 -v. If I want to accept incoming connections on port 9001 at this (127.0.0.1, or on the network 192.168.1.143) address, ...
2
votes
1answer
2k views

Limit the max connections per IP using OpenWRT?

Would the following iptables command on an OpenWRT router assure that no one client has more than 50 active connections? $ iptables -I FORWARD -m connlimit --connlimit-above 50 -j REJECT ...
2
votes
1answer
237 views

Bash script and Database

I have an iptables firewall in Linux bridge (RHEL5). I want to extract information like IP address, port number, port type, date and time, etc. from log messages using a Bash script, and then want to ...
2
votes
1answer
65 views

What is the purpose of -m, --match in an Iptables rule?

Many Iptables rules contain this -m or --match option, for example -I INPUT -p tcp -m state --state NEW -m limit --limit 30/minute --limit-burst 5 -j ACCEPT -A INPUT -p udp -m conntrack --ctstate NEW ...
2
votes
2answers
116 views

traffic routing with DNS

I have 2 gateway machines. 1 debian (main - 192.168.1.1), 1 centos (backup 192.168.1.2). There are 2 networks, 1 LAN and 1 WAN, going through "main" and from there over ISP1 "backup" is on LAN and it ...
2
votes
1answer
123 views

route some traffic in subnet to other gateway

I want to route traffic destined for 192.168.5.0/24 to a gateway of 10.1.10.24, but all other traffic to a gateway of 10.1.10.1. I tried: ip route add 192.168.5.0/24 via 10.1.10.24 but it seems to ...
2
votes
1answer
234 views

Routing problem from internal eth1 interface to an external ppp0 interface

I'm trying to connect two LANs using a ppp link. I had a basic network topology diagram but it didn't come out well. This can be seen here. Routing Problem ================ 172.20.0.0/16 ...
2
votes
2answers
850 views

how to check if iptable rule is working

I am new to iptables and networking in general, so I am experimenting with it. I am learning how to close ports; in particular I am trying to close a specific port on the host machine, so another ...
2
votes
1answer
132 views

On a router, what decides if a packet should be forwarded or directed into the router itself?

I'm trying to learn how packet routing works on a linux-based router (OpenWRT in my case) a bit better for setting up a few projects/just-learning. Referencing the below chart, I'll break this into ...
2
votes
1answer
494 views

Iptables can't forward from/to internal LAN with proxmox

I have an host with proxmox with single public ip and some virtual machine installed whit webservers and multiple doimains, the first VM is a proxy with haproxy that forward the request to other VM ...
2
votes
1answer
345 views

How do I apply iptables SNAT to packets bound for localhost (INPUT chain)?

I'm setting up a host that has two routes to the public internet: one via my run-of-the-mill home gateway router, the other via a gateway router on a semi-private network (AMPRNet on 44.0.0.0/8). Most ...