iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

2
votes
1answer
309 views

No internet even with iptables ACCEPT all

I was trying to setup the firewall settings, and probably did something wrong. I don't have internet now unless I stop iptables service I tried flushing,and accepting everything sudo iptables -F ...
3
votes
2answers
2k views

iptables: The “script” way or the “*filter, rules, COMMIT” way?

I'm trying to figure out how NAT and iptables work. While I'm in the trial-and-error phase of learning about it, I found two somewhat conflicting howtos. One howto uses a script to call iptables ...
1
vote
2answers
217 views

How is the loopback device traffic allowed?

How can I allow the traffic to be sent on the loopback device (lo)? What is the iptables command for it?
0
votes
1answer
596 views

iptables couldn't load target allow

I am using the command below to allow all traffic from hosts on my internal network but it says "iptables v1.4.18: Couldn't load target `ALLOW':No such file or directory". What is the problem here? ...
1
vote
1answer
427 views

Archlinux not configured with iptables

I have been trying to set up iptables on my archlinux server, however when I run iptables -nvL I receive the error iptables v1.4.20: can't initialize iptables table 'filter': Table does not exist ...
2
votes
0answers
452 views

Route all HTTP traffic through polipo

I've set up polipo on my machine to listen to the default port 8123. To test it, I set the in-memory cache to a ridiculously high 2 GB and downloaded a 50 MB file using wget utilizing the proxy. ...
0
votes
2answers
731 views

Route wlan0 to openVPN tunnel and rest to eth0

I'm having problems to create route/iptables rules for following configuration: I have an openVPN server (tun type) running on my raspberry machine at home At work i have company pc (behind proxy) ...
4
votes
1answer
145 views

How do you do NAT port redirection with PF?

In Linux, you can do NAT port redirection with a command like this: iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8000 What is the equivalent with BSD's PF?
0
votes
1answer
269 views

iptables - why the stun, turn ports are not working to allow end points to access the server?

I have this iptables where all working except tcp/udp port 3478 and 5349. $ cat /etc/sysconfig/iptables # Generated by iptables-save v1.4.7 on Thu Nov 21 10:21:41 2013 *filter :FORWARD ACCEPT [0:0] ...
2
votes
1answer
103 views

Port forwarding using iptables on Linux

I want to forward a local port to a remote port (8041) to a port (8042) on a remote machine (10.0.0.42). I can do this via ssh -L 10.0.0.41:8041:10.0.0.42:8042 user@localhost where 10.0.0.41 is ...
1
vote
1answer
304 views

Session limit for OpenSSH server on Ubuntu Desktop 7.10

I need restrict session limit on my OpenSSH server only for one session (one connection). I use Ubuntu Desktop 7.10. Of course Version is old, but I need it for experimental purposes. I tried modify ...
5
votes
3answers
4k views

route traffic out different gateway by destination network

I have several gateways and would like to route some traffic out of different gateways based on its destination. I'm guessing I'd need to use a combination of iproute2 and iptables rules, but am not ...
2
votes
0answers
260 views

iptables REDIRECT in combination with matching on interface vs. IP address

I've successfully set up Tor for transparent proxying using iptables (ie, all outgoing traffic is sent through Tor without the application's knowledge). In doing so, I discovered both an odd problem ...
2
votes
2answers
4k views

iptables: rules for tftp server

I have a tftp server which listens on standard UDP port 69. I have added following rule to my iptables to block everything except UDP 69. -A INPUT -i eth0 -s 192.168.1.0/24 -p udp -m udp --dport 69 ...
0
votes
2answers
117 views

Modifying one line in Iptables

How would one modify the following line in iptables file (debian)? ACCEPT all -- XXX.XXX.XX.X anywhere PHYSDEV match --physdev-in vif3.1 TO ACCEPT all -- ...
1
vote
1answer
225 views

Bandwidth throttling per user group

I am wondering if it is possible to create a bandwidth shaping/throttling script that shapes traffic based on user group. That is, if user1, user2, are in user group group1, they will have 1mb/s ...
0
votes
1answer
650 views

iptables rules for iscsi initiator

I need to configure iptables on my client (iscsi-initiator). From tcpdump, I can see that the server (iscsi target) sends tcp from port 3260. So I have added following iptables rule on my client ...
1
vote
0answers
310 views

destination IP mangle table

I have machine with 2 interfaces: eth1 connected to internet (ip xx.xx.xx.xx) eth0 connected to my laptop (ip yy.yy.yy.yy) I add those lines to the firewall file in order to manage the bandwidth ...
4
votes
2answers
566 views

fail2ban log parsing too slow on Raspberry Pi - options?

I'm running fail2ban on a Raspberry Pi at 950MHz which I cannot overclock further. The Pi is occasionally subject to SYN floods on particular ports. I've set up iptables to throttle the rate of SYNs ...
2
votes
1answer
2k views

Linux Fedora 19 - iptables failed to start

I've been trying to start the iptables firewall service, but it keeps failing. What's going wrong? # systemctl status iptables.service iptables.service - IPv4 firewall with iptables Loaded: loaded ...
1
vote
1answer
361 views

How do I allow only certain IPSet set's to access a certain port with iptables?

I'm using IPSet to build IP ranges for different countries as follows : # Canada ipset -F ca.zone ipset -N ca.zone nethash for IP in $(wget -O - http://www.ipdeny.com/ipblocks/data/countries/ca.zone) ...
1
vote
1answer
154 views

Managing iptables for home lan routing

I have a LAN at home. One Netgear router - 192.168.0.1 connected to the internet. One Macbook - 192.168.0.10 (connected to Netgear router) One PC with Kali Linux - 192.168.0.20 (connected to ...
3
votes
2answers
714 views

How do I fix iptables in ChromeOS?

Using the shell in chrosh in ChromeOS I followed some (apparently terrible) advice to flush my IP tables. using the command sudo iptables -F I am now unable to connect to the internet at all. All ...
2
votes
2answers
96 views

ipset accounting information

I know that iptables keeps accounting information for ip traffic blocked or passed. However, it appears that when using ipsets with iptables, the accounting information is aggregated for the entire ...
3
votes
1answer
3k views

What is the difference between OUTPUT and FORWARD chains in iptables?

CentOS 6.0 I'm studying iptables and am getting confused on the difference between FORWARD and OUTPUT chains. In my training documentation, it states: If you're appending to (-A) or deleting ...
4
votes
2answers
10k views

How can I configure syslog.conf file, to log iptables messages in a separate file?

How can I configure /etc/syslog.conf file in order to save log information about iptables in a specific file. I want to save these information separately, so I can extract what I want easily and ...
0
votes
1answer
189 views

Squid not forwarding my packets proxied from iptables on router

I am trying to make openwrt's iptables from my router to direct to my squid proxy on my machine (since there is no enough space in router's flash memory) but even if I have my squid config ok ( ...
1
vote
0answers
26 views

Configure syslog.conf file [duplicate]

How can I configure /etc/syslog.conf file in order to save log information about iptables in a specific file. I want to save these information separately, so I can extract what I want easily and ...
1
vote
1answer
121 views

Where does Iptables store blocked IPs

I need to set up a shell to block DDOS attacks , but in that script, it's reading some Blocked IPs from /etc/sysconfig/iptables. The problem is that I don't have this directory, So I'm wondering ...
0
votes
1answer
3k views

How to redirect to my squid proxy using iptables since DNAT target: only valid in nat table

I want to redirect the traffic in my lan network through squid proxy but I am having some problems with iptables rules. When I use the following rule: # iptables -I FORWARD -s ...
8
votes
4answers
940 views

Failing to block brute force ssh with iptables

I'm trying to block (slow down) brute force attacks on my sshd server. I'm following this guide http://www.rackaid.com/resources/how-to-block-ssh-brute-force-attacks/ which basically says I need to ...
0
votes
3answers
174 views

Search in iptables.log file takes a long time

I have used iptables to save information about connections by modifying the /etc/syslog.conf file to save information in /var/log/iptables.log. So, every X hours, I need to extract information from ...
0
votes
2answers
632 views

CentOS restore firewall after `service iptables panic`

My friend and I were doing some firewall configurations and in the meanwhile he thought it was a good idea to type service iptables panic. Now we cannot put the firewall back on the original state ...
4
votes
1answer
650 views

Why is my computer trying to send ICMP type 3 to OpenDNS?

In my firewall logs I see lots of entries like this. IN= OUT=eth0 SRC=192.168.1.105 DST=208.67.220.220 LEN=148 TOS=0x00 PREC=0xC0 TTL=64 ID=55705 PROTO=ICMP TYPE=3 CODE=3 [SRC=208.67.220.220 ...
11
votes
3answers
30k views

Iptables to allow incoming FTP

i want to allow incoming FTP traffic. CentOS 5.4: This is my /etc/sysconfig/iptables file. # Generated by iptables-save v1.3.5 on Thu Oct 3 21:23:07 2013 *filter :INPUT ACCEPT [0:0] :FORWARD ...
1
vote
1answer
2k views

iptables redirect FORWARD http traffic to privorxy port

Ideally i m trying to use my laptop and a 3Gphone as a WiFi router to redirect FORWARD HTTP but not HTTPS Traffic to privoxy which then forwards the traffic via a SSH tunnel to a ziproxy VPS. for the ...
4
votes
1answer
67 views

Is there any difference between these two configuration options?

Is there any actual difference between iptables -P FORWARD DROP and net.ipv4.ip_forward = 0 ? I know that one is a firewall command while the other one is a kernel option. But: I don't know ...
1
vote
0answers
159 views

Firewall config prevents hibernate connecting to postgres in CentOS6.3

I have an operating environment in CentOS 6.3 that has tomcat7 and postgres9.2 installed. There is just one web application deployed in tomcat that tries to establish a connection from localhost to ...
2
votes
1answer
179 views

What are the pros and cons to editing iptables configuration file vs adding rules via the iptables command

I am working with a product on CentOS that occasionally needs to automatically add and remove rules from the iptables configuration. For example, during an update, we want to explicitly refuse ...
1
vote
1answer
376 views

how to investigate Firewall blocked outbound TCP

CentOS webserver with CSF (Config Server Firewall) running. Blocking all outbound / Inbound traffic except listed ports 80 81 22 21 etc. for web, mail & FTP services etc. I'm use to seeing heaps ...
2
votes
1answer
171 views

Lost connectivity after iptables change

I attempted to add a couple web ports to iptables and in doing so lost the ability to resolve any external address. I have a working SSH session open and can get to the box easily if needed. Here's ...
2
votes
2answers
3k views

Open a port in my CentOS

I'm trying top open a port on my CentOS machine: I edit the /etc/sysconfig/iptables file and add my rule: -A INPUT -p TCP -m state --state NEW -m tcp --dport 143 -j ACCEPT Then I restart the ...
1
vote
0answers
359 views

iptables one IP through another network interface

This question is very similar to what I am trying to do: iptables --set-mark - Route diferent ports through different interfaces However I attempted to follow the answer but I was unable to make it ...
2
votes
1answer
162 views

Mark packets between machines (client and router)?

Can I mark a packet on the client's OUTPUT chain and add an iproute policy on the router to route them via a specific gateway? This what I tried to do, but it isn't working. My client's mangle table ...
4
votes
2answers
3k views

iptables port forwarding

I have a CentOS server with Java/J2EE(Tomcat) installed on TCP port 8080. I have two interfaces, eth0 and lo. I need to forward all incoming connection on TCP port 80 to 8080. I tried doing the ...
0
votes
2answers
339 views

Isolate a hosts networking with iptables

I want to isolate a host on my home intranet using iptables on my linux router. So say for instance, I have a host that has the IP of 10.0.1.50 and I want it to be able to talk to the rest of the ...
2
votes
1answer
55 views

How would I go about making this IPTABLE rule for every ip and not just one?

iptables -I PREROUTING -t nat -p udp -s 192.168.0.62 --dport 53 -j DNAT --to-destination 23.21.182.24 Instead of 192.168.0.62 I'd like to set that as a global rule, EVERY ip that needs dns should ...
4
votes
1answer
3k views

How can I redirect all traffic except local through external proxy with iptables in dd-wrt?

I have a router with dd-wrt. I have a firewall running to direct all traffic through an external proxy. It works great except that it also redirects local Ips and my proxy does not allow Ips, so I can ...
4
votes
1answer
96 views

iptables change log

Somehow an iptables rule was added to one of my systems. Does (or can) iptables keep a log about when and (maybe) who made a rule change? If iptables itself can't, is there a wrapper that might do ...
2
votes
0answers
270 views

SNAT problem in iptables

I am trying to reroute traffic from specific devices in my house over openvpn. For this, I've created an OpenVPN tunnel between my house wifi router and my server. Here is my setup: Wifi router's ...