iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

2
votes
5answers
161 views

Difficulty setting up iptables

I'm very new to *nix operating systems, and I'm having some trouble which I believe is because of misconfiguration of the iptables firewall. My server has SSH running on port 22, and server software ...
1
vote
2answers
885 views

SSH tunneling through a busybox router

I have a busybox router and I'm able to login to the console using telnet & I also have access to the web interface. My question is, how can I create an ssh tunnel from my local network through ...
1
vote
1answer
740 views

How to log iptables as of kernel 3.9.0?

What is the right way to log iptables as of kernel 3.9.0? I can no longer append a logging rule such as: # iptables --new-chain droplog # iptables --append droplog --jump LOG --log-level info ...
2
votes
2answers
2k views

Why must loopback traffic be authorized using iptables to get web access?

I thought the following was necessary was necessary for outgoing HTTP on a desktop (non-server): iptables -A INPUT -p tcp -m multiport --sports 80,443 -m conntrack --ctstate ESTABLISHED -j ACCEPT ...
2
votes
1answer
459 views

IPTables string match redirection

The issue: I am currently redirecting port 80 requests to another system on port 1000. This is done like so: iptables -t nat -A PREROUTING ! -s 172.20.1.2 -p tcp --dport 80 -j DNAT --to-destination ...
1
vote
1answer
151 views

How to relay packet in a wireless ad hoc network?

I am trying to connect several Linux computers in wireless ad-hoc multicast : -computer C1 (192.168.1.3) -computer C2 (192.168.1.5) -computer C3 (192.168.1.6) C1 can not reach C3 On computer C1, ...
2
votes
1answer
3k views

Log the dropped packets by IPTables only if its DROPPED by a specific rule

I have IPTables rules set on a Linux device. I have a particular rule to drop the packets, and I wish to log the packets only if they're dropped by that specific rule, and not by the other rules. ...
2
votes
0answers
337 views

TPROXY for redirecting UDP on arbitrary ports

I want to intercept all UDP traffic leaving tap1. And possibly reply to e.g. DNS-requests. To accomplish this I wrote some python code listening to localhost and use iptables with a rule-set like ...
4
votes
2answers
193 views

Is it possible to set-up a VPN in such a way that I disconnect from the Internet if it goes down?

How can I set-up a VPN so I loose connection to the Internet if it goes down? I use Ubuntu and have used the network-dialog to use a VPN; but if the VPN goes down, it just switches to the non-VPN ...
1
vote
1answer
107 views

netfilter's configuration to allow openvpn

I've got a debian server at home, that I use to have a VPN access to my home computers. I've redirected the openvpn port on the port 2000 : in my file "server.conf", I've added this : #Server mode ...
3
votes
2answers
878 views

Open and redirect port

I'm trying to set up SNMP for a router so I can monitor it from an existing Nagios installation on an off-site server. I'm having trouble getting the router to respond to SNMP requests from the WAN, ...
0
votes
1answer
149 views

IP Address inaccesible

My Linux machine is inaccessible by the IP address, as in only http://127.0.0.1:8080/projectname or localhost works on the browser, but http://10.1.5.5:8080/projectname doess not (here ...
1
vote
1answer
936 views

How does iptables MASQUERADE work on the incoming side?

I'm still reading the iptables manual page and other documents and digging around questions and their answers. This is the problem which arises. When we setup the NAT we use a POSTROUTING rule such ...
0
votes
5answers
4k views

SSH login attempts per minute per IP

How can i limit SSH login attempts per minute per IP ? I want to disable login attempts during 5 seconds after a failure. Is this possible ? I'm not talking about ban a user after parsing logs like ...
3
votes
1answer
116 views

What are the requierements to sniff UDP packets in a Wireless Ad-Hoc network?

In a wireless Ad-Hoc network, I have two computers which communicates in UDP together from 192.168.1.3 to 192.168.1.5 I have a third computer (192.168.1.6) which wants to listen to the packets which ...
2
votes
1answer
802 views

iptables rules too restrictive; Drupal webserver cannot access repositories, ntp or even websites

This is a Drupal website running Ubuntu 12.04 LTS on Linode. Someone recently changed our iptables rules and a number of problems started. These include: Our Mollom spam protection is not working ...
5
votes
3answers
2k views

Transform an UDP unicast packet into broadcast?

We need to wake-up some computers on our internal LAN, from the Internet. We have a somewhat closed router. Very few ways to configure it. I'd like to use netfilter (iptables) to do this because it ...
0
votes
1answer
159 views

Iptable rule to ssh over the internet

I've a server abc.example.com and a remote desktop zzz.example.com. I'm using SSH over a custom port, say, 6789. Whenever my firewall is off, I'm able to connect to the server successfully. But, as ...
5
votes
1answer
9k views

IPTables - Port to another ip & port (from the inside)

I currently have a NAS box running under port 80. To access the NAS from the outside, I mapped the port 8080 to port 80 on the NAS as follow: iptables -t nat -A PREROUTING -p tcp --dport 8080 -j DNAT ...
2
votes
1answer
337 views

Can iptables be used to convert a single-homed host into a NAT server?

Given: I have a machine (HostA) with only one NIC which has Internet connectivity. I have another machine (HostB) with one NIC on the same switch. HostB is not configured for Internet access yet. ...
4
votes
1answer
3k views

iptables: recent module

I am using the "recent" module to prevent port scanning, such as: -A INPUT -i eth0 -m recent --name PORTSCAN --update --seconds 60 -j DROP -A INPUT -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT -A INPUT ...
1
vote
1answer
1k views

How do I port-forward 169.254.169.254-bound packets from libvirt/KVM guests to localhost?

This is a followup to What's the best way to have a 169.254.169.254 address local to my laptop?. Short story: 169.254.169.254 is the "well known" address of cloud metadata services for EC2 and for ...
4
votes
2answers
7k views

Where is iptables script stored on DD-WRT filesystem?

I have an ASUS RT-N16 router that I've flashed with the open-source DD-WRT firmware. According to my ssh login, I'm running: DD-WRT v24-sp2 mega (c) 2010 NewMedia-NET GmbH Release: 08/07/10 (SVN ...
1
vote
0answers
90 views

Firewalld SELinux

Is there any way to better explanation firewall-cmd than the one given in Fedora18 wiki. I am trying to convert iptables to FirewallD in cmd line without GUI but cannot find a decent example or ...
2
votes
1answer
821 views

How do I route different users over different OpenVPN tunnels in Linux?

The setup: I have multiple, static-key OpenVPN client/server configurations, labeled "client1", "client2", and "client3" with server/client IPs 10.10.1.1/10.10.1.2, 10.10.2.1/10.10.2.2, and ...
2
votes
1answer
1k views

Local port forwarding automatically configured on boot?

I have software which needs to run as a non-root user, but needs to listen on port 80 and 443. With iptables, this isn't all that difficult: sudo iptables -t nat -A PREROUTING -i eth0 -p tcp ...
1
vote
2answers
254 views

iptables and logs

Suppose I add an IP to iptables blocking for exim, dovecot and FTP and this IP visits my server again. Is there any log of this visit so I can confirm the IP was trying to reach the server again but ...
3
votes
1answer
1k views

I opened a port with iptables but still doesnt work

I have a CentOS installation as a guest VM with VirtualBox. I have two ethernet interfaces, eth0 with NAT and DHCP, and eth1 with Host-only adaptor and static IP. I have oracle installed in this ...
2
votes
2answers
889 views

Iptables port forwarding to qemu vm

Is it possible to create an IPtables rule that forwards all incoming traffic on port 80 on the host to port 80 of the qemu VM? Is such a scenario possible with qemu?
2
votes
1answer
225 views

Explanation of bandwidth management script calling tc

I have some scripts in Linux to manage internet bandwidth, but I do not understand what they do. What is the meaning of the following scripts: tc qdisc add dev $IF root handle 1: htb default 256 tc ...
5
votes
4answers
7k views

iptables rules not reloading on CentOS 6.x

I have one single ipset added to my iptables on a CentOS 6.x box and this rule is lost when the machine reboots. I've found this answer showing how to make a Ubuntu system reload the iptables rules ...
2
votes
1answer
325 views

iptables is not blocking

I have a script running every minute by a crontab. This script scans the system logs and grabs the IPs of every failed attempt to login on the server's dovecot, exim or ssh and add them to an ipset, ...
1
vote
0answers
292 views

Redirect all non-local traffic to a socks proxy

Is it possible to redirect all non-local traffic to a socks proxy? so, for example i have: 4 computers (clients A-D: 10.0.0.1-3 or dhcp) 1 computer with 2 network cards (gateway-server, eth0: ...
3
votes
1answer
791 views

tc on bridge port

I have a 4 port bridge: root@Linux-Switch:~# brctl show bridge name bridge id STP enabled interfaces br0 8000.000024cd2cb0 no eth0 eth1 ...
4
votes
1answer
463 views

NAT with transparent proxy

is there a way to redirect all non local http requests that through my computer to use my transparent proxy, so i can log all websites are they visiting? and if possible all https requests too.. my ...
3
votes
1answer
773 views

iptables: multiple exclusions on port forwarding

I have an existing iptables setup that does port forwarding. In this port forwarding scenario there are some instances where I do not want it to port forward. So, for instance I have this defined: ...
0
votes
1answer
459 views

Can't save / load iptables rules on Arch Linux via rc.d

I can not load my saved iptables rules when the server reboots on Arch Linux. Any ideas? The latest Arch updates are in place. I have followed Arch Linux's tutorial... neither either works. The ...
18
votes
4answers
4k views

Block network access of a process?

Is it possible to block the (outgoing) network access of a single process?
4
votes
3answers
13k views

How can I redirect ports 80 and 443 to 8080 and 8443 with iptables?

I'm looking at the documentation for a Tomcat 6 webapp called DSpace, specifically in regardds to running Running DSpace on Standard Ports (80 for http:// and 443 for https://) I am trying to use ...
2
votes
1answer
354 views

IPtables command shows libipt_random.so missing

When I run a command, it shows error. I searched on net, but no one give me the correct answer. Googling shows only wrong answers for this questions. So please help me to overcome this problem. ...
2
votes
0answers
256 views

Port Forwarding Between 2 Internet Machines

Here's my scenario: Setup There are 3 machines: A: on the internet : has ip (a.a.a.a), has port pa open B: my server / gateway : has ip (b.b.b.b), has port pb open C: on the internet : has ip ...
2
votes
1answer
247 views

Allow application specific access in iptables using guid

I would like to get Skype working with iptables and don't want to allow a huge range of ports thus I thought a solution might be iptables -A OUTPUT -m owner --gid-owner skypeGrp -j ACCEPT iptables ...
0
votes
1answer
306 views

IP set to block access to exim and dovecot

I have created a ipset with a bunch of IPs that I want to block access to dovecot and exim. The ipset is called "bannedIPs" and have been added to iptables using this iptables -A INPUT -p tcp ...
1
vote
1answer
177 views

Blocking gzip HTTP content with Iptables or Snort?

I'm looking to drop a connection if a website contains a certain word or phrase. The issue is, the site is typically compressed with gzip. Any ideas?
3
votes
2answers
500 views

Is it possible to whitelist a specific program in iptables?

Is it possible to allow all traffic for a specific program in iptables? Otherwise using nmap and a strict iptables configuration at the same time seems impossible.
3
votes
3answers
2k views

What does this firewall record mean?

Running iptables -L -n gives me the following info: Chain IN_ZONE_work_allow (1 references) target prot opt source destination ACCEPT tcp -- 0.0.0.0/0 ...
1
vote
1answer
1k views

Help to understand Iptables Forward chain with DNAT

I have one server where iptables configured with all chains DROP in filter table eth0 :- 10.0.0.2 [ Intranet assume as LAN ] eth2 :- 172.16.0.2 [ External clients assume as WAN ] Now What I am ...
0
votes
1answer
229 views

ipset not executing from crontab

I have this txt files that contains IPs, one per line of file, that I want to block using ipset. I have this bash script that essentially reads from the plain txt file and constructs an array. Then ...
1
vote
3answers
1k views

hosts.allow: Not required when using iptables?

I am trying to configure the box I am using as a gateway/proxy/firewall to allow IP masquerading and finally switch over from using a proxy. It's a debian squeeze system. Currently, my hosts.allow ...
0
votes
1answer
554 views

Allowing access to NetBIOS port in Fedora 18?

I've recently installed Fedora 18 on one of the machines in my office, and I've installed Samba so I can browse the file system on my Windows machine. However, I'm having some trouble opening port ...