Tagged Questions

iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

1
vote
1answer
1k views

How do I port-forward 169.254.169.254-bound packets from libvirt/KVM guests to localhost?

This is a followup to What's the best way to have a 169.254.169.254 address local to my laptop?. Short story: 169.254.169.254 is the "well known" address of cloud metadata services for EC2 and for ...
4
votes
2answers
6k views

Where is iptables script stored on DD-WRT filesystem?

I have an ASUS RT-N16 router that I've flashed with the open-source DD-WRT firmware. According to my ssh login, I'm running: DD-WRT v24-sp2 mega (c) 2010 NewMedia-NET GmbH Release: 08/07/10 (SVN ...
1
vote
0answers
81 views

Firewalld SELinux

Is there any way to better explanation firewall-cmd than the one given in Fedora18 wiki. I am trying to convert iptables to FirewallD in cmd line without GUI but cannot find a decent example or ...
2
votes
1answer
756 views

How do I route different users over different OpenVPN tunnels in Linux?

The setup: I have multiple, static-key OpenVPN client/server configurations, labeled "client1", "client2", and "client3" with server/client IPs 10.10.1.1/10.10.1.2, 10.10.2.1/10.10.2.2, and ...
2
votes
1answer
1k views

Local port forwarding automatically configured on boot?

I have software which needs to run as a non-root user, but needs to listen on port 80 and 443. With iptables, this isn't all that difficult: sudo iptables -t nat -A PREROUTING -i eth0 -p tcp ...
1
vote
2answers
233 views

iptables and logs

Suppose I add an IP to iptables blocking for exim, dovecot and FTP and this IP visits my server again. Is there any log of this visit so I can confirm the IP was trying to reach the server again but ...
3
votes
1answer
1k views

I opened a port with iptables but still doesnt work

I have a CentOS installation as a guest VM with VirtualBox. I have two ethernet interfaces, eth0 with NAT and DHCP, and eth1 with Host-only adaptor and static IP. I have oracle installed in this ...
2
votes
2answers
813 views

Iptables port forwarding to qemu vm

Is it possible to create an IPtables rule that forwards all incoming traffic on port 80 on the host to port 80 of the qemu VM? Is such a scenario possible with qemu?
2
votes
1answer
222 views

Explanation of bandwidth management script calling tc

I have some scripts in Linux to manage internet bandwidth, but I do not understand what they do. What is the meaning of the following scripts: tc qdisc add dev $IF root handle 1: htb default 256 tc ...
5
votes
4answers
6k views

iptables rules not reloading on CentOS 6.x

I have one single ipset added to my iptables on a CentOS 6.x box and this rule is lost when the machine reboots. I've found this answer showing how to make a Ubuntu system reload the iptables rules ...
2
votes
1answer
310 views

iptables is not blocking

I have a script running every minute by a crontab. This script scans the system logs and grabs the IPs of every failed attempt to login on the server's dovecot, exim or ssh and add them to an ipset, ...
1
vote
0answers
285 views

Redirect all non-local traffic to a socks proxy

Is it possible to redirect all non-local traffic to a socks proxy? so, for example i have: 4 computers (clients A-D: 10.0.0.1-3 or dhcp) 1 computer with 2 network cards (gateway-server, eth0: ...
3
votes
1answer
762 views

tc on bridge port

I have a 4 port bridge: root@Linux-Switch:~# brctl show bridge name bridge id STP enabled interfaces br0 8000.000024cd2cb0 no eth0 eth1 ...
4
votes
1answer
453 views

NAT with transparent proxy

is there a way to redirect all non local http requests that through my computer to use my transparent proxy, so i can log all websites are they visiting? and if possible all https requests too.. my ...
3
votes
1answer
755 views

iptables: multiple exclusions on port forwarding

I have an existing iptables setup that does port forwarding. In this port forwarding scenario there are some instances where I do not want it to port forward. So, for instance I have this defined: ...
0
votes
1answer
445 views

Can't save / load iptables rules on Arch Linux via rc.d

I can not load my saved iptables rules when the server reboots on Arch Linux. Any ideas? The latest Arch updates are in place. I have followed Arch Linux's tutorial... neither either works. The ...
17
votes
4answers
3k views

Block network access of a process?

Is it possible to block the (outgoing) network access of a single process?
4
votes
3answers
12k views

How can I redirect ports 80 and 443 to 8080 and 8443 with iptables?

I'm looking at the documentation for a Tomcat 6 webapp called DSpace, specifically in regardds to running Running DSpace on Standard Ports (80 for http:// and 443 for https://) I am trying to use ...
2
votes
1answer
344 views

IPtables command shows libipt_random.so missing

When I run a command, it shows error. I searched on net, but no one give me the correct answer. Googling shows only wrong answers for this questions. So please help me to overcome this problem. ...
2
votes
0answers
251 views

Port Forwarding Between 2 Internet Machines

Here's my scenario: Setup There are 3 machines: A: on the internet : has ip (a.a.a.a), has port pa open B: my server / gateway : has ip (b.b.b.b), has port pb open C: on the internet : has ip ...
2
votes
1answer
239 views

Allow application specific access in iptables using guid

I would like to get Skype working with iptables and don't want to allow a huge range of ports thus I thought a solution might be iptables -A OUTPUT -m owner --gid-owner skypeGrp -j ACCEPT iptables ...
0
votes
1answer
297 views

IP set to block access to exim and dovecot

I have created a ipset with a bunch of IPs that I want to block access to dovecot and exim. The ipset is called "bannedIPs" and have been added to iptables using this iptables -A INPUT -p tcp ...
1
vote
1answer
175 views

Blocking gzip HTTP content with Iptables or Snort?

I'm looking to drop a connection if a website contains a certain word or phrase. The issue is, the site is typically compressed with gzip. Any ideas?
3
votes
2answers
470 views

Is it possible to whitelist a specific program in iptables?

Is it possible to allow all traffic for a specific program in iptables? Otherwise using nmap and a strict iptables configuration at the same time seems impossible.
3
votes
3answers
2k views

What does this firewall record mean?

Running iptables -L -n gives me the following info: Chain IN_ZONE_work_allow (1 references) target prot opt source destination ACCEPT tcp -- 0.0.0.0/0 ...
1
vote
1answer
1k views

Help to understand Iptables Forward chain with DNAT

I have one server where iptables configured with all chains DROP in filter table eth0 :- 10.0.0.2 [ Intranet assume as LAN ] eth2 :- 172.16.0.2 [ External clients assume as WAN ] Now What I am ...
0
votes
1answer
223 views

ipset not executing from crontab

I have this txt files that contains IPs, one per line of file, that I want to block using ipset. I have this bash script that essentially reads from the plain txt file and constructs an array. Then ...
1
vote
3answers
1k views

hosts.allow: Not required when using iptables?

I am trying to configure the box I am using as a gateway/proxy/firewall to allow IP masquerading and finally switch over from using a proxy. It's a debian squeeze system. Currently, my hosts.allow ...
0
votes
1answer
543 views

Allowing access to NetBIOS port in Fedora 18?

I've recently installed Fedora 18 on one of the machines in my office, and I've installed Samba so I can browse the file system on my Windows machine. However, I'm having some trouble opening port ...
2
votes
1answer
116 views

Using iptables to block for specific services

I am using ipset in conjunction with iptables to create a list of IPs I want to block. I did this: ipset -N blocking iphash ipset -A blocking 124.205.11.230 // and repeated this line for all IPs I ...
2
votes
1answer
217 views

Linux nat/iptables configuration for a chain of peer-to-peer links

I have an experimental setup, of 4 Linux (CentOS) machines: All 4 machines are internally connected using different networks and can ping eachother directly connected interfaces. However only PC4 ...
3
votes
1answer
5k views

How to re-enable iptables on Fedora 18?

FirewallD is the default firewall in Fedora 18. I have been using iptables for quite some time and have a custom configuration which I need for logging of ip traffic. I am not used to the new ...
1
vote
2answers
3k views

iptables blocking from internet side on eth1?

How to use iptables to deal with two Ethernet ports? eth0 port for LAN use (192.168.1.50 Private IP). eth1 port is connected to the internet via cable modem (80.0.xxx.xxx public IP). ifconfig ...
1
vote
0answers
120 views

Deny/allow a user's access to a port dynamically

I have stumbled upon this little tech dilemma yesterday, and know that there is a solution to it (IRC BNC resellers have it implemented already). However, the exact details and implementation elude ...
0
votes
1answer
154 views

Fedora Firewall no option as of yet

I need a firewall because I was decade long user of internet security suites on windows. I am not a professional of networks or anything but a student who just needs to block unblock running ...
1
vote
0answers
251 views

Asterisk server problems with firewall settings [closed]

I replaced an IVR machine for incoming call after going down. It is running asterisk 1.4.23 on ubunutu 10.04 I decided to put the server behind iptables because my server was under brute force attack. ...
1
vote
1answer
2k views

Redirect Packets from ppp0 interface to ethernet interface in linux

My question is similar to this question, however with some change. I have a PPPoE connection on my Linux Machine (CentOS kernal 2.6.32) as a client, so that when I setup this connection, another ...
5
votes
2answers
10k views

Does iptables -F permanently delete all iptables rules?

In a RHEL training document, the author says: ...run the following command to disable the firewall on the current system: iptables -F He explicitly uses the word "disable" which to me suggests ...
4
votes
2answers
498 views

Why can I reach a different interface's IP address?

I'm wondering about this, and I can't seem to find an explanation on the internet. I have a linux gateway which has multiple interfaces: eth0: external ip eth1: 172.16.1.1/24 eth2: 172.16.2.1/24 ...
4
votes
2answers
8k views

incoming ACCEPT all iptables rule still appearing

I'm following this guide here: http://isalazyadmin.net/2009/07/02/configuring-a-basic-firewall-for-debian-linux/ And I have the iptables listed shown, but my server still appears to be accepting all ...
3
votes
2answers
526 views

iptables routing marked packets from router to PC and routing them back to router

I'm trying to do deep packet inspection on HTTP packets. The purpose of this is to collect HTTP payload data and then create some proxy/cache-independent reports. Following this, the idea is to ...
2
votes
1answer
509 views

Why is a echo-request ping packet 84 bytes in the log of iptables?

When I log the length of a echo-request packet, iptables -A OUTPUT -p icmp -m icmp --icmp-type 8 -j LOG I saw the length was LEN=84, but in wireshark, the captured packet size was 0x60, why does it ...
1
vote
1answer
500 views

Allow user to see how many iptables rules are loaded, but not actual contents?

I want to allow user to check how many rules are present in filter table, but not able to view actual rules, is that possible? literally I mean iptables -L | wc -l (I know it's faulty), but sudo ...
7
votes
1answer
528 views

iptables will match the following ICMP request packet as ESTABLISHED state after the first reply packet is sent

Test environment: CentOS 6.3 - kernel 2.6.32-279.el6.i686, iptables v1.4.7 Win7 <---> CentOS Windows is constantly replaying ICMP echo request in 10pkt/sec rate to CentOS. In iptables, I added the ...
2
votes
1answer
238 views

PPTP server with NIC aliases

I have set up a VPN on a VPS Server using PPTP. I have one NIC with two aliases. eth0 eth0:1 eth0:2 The 3 interfaces have public addresses. eth0 is a French IP, eth0:1 is UK, and eth0:2 is ...
9
votes
2answers
21k views

iptables --set-mark - Route diferent ports through different interfaces

Short story, 3 interfaces, eth0 (LAN), eth1(ADSL), eth2(4G). eth0 -> eth1: Works (ports 80, 443, 4070) eth0 -> eth2: Doesn't happen This is a graphical representation of the idea: Port 80 & ...
3
votes
3answers
821 views

Undo iptables modification

I ran the following iptables commands to create a blacklist rule but used the wrong port: iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH iptables -A INPUT -p tcp ...
4
votes
1answer
4k views

How to understand why the packet was considered INVALID by the `iptables`?

I set up some iptables rules so it logs and drops the packets that are INVALID (--state INVALID). Reading the logs how can I understand why the packet was considered invalid? For example, the ...
4
votes
2answers
1k views

Port fowarding and load balancer in ubuntu server 12.04

I am looking to create a load balancing server. Essentially here is what I want to do: I have a public IP address, lets say 1.1.1.1 I have a second public IP address, lets say 2.2.2.2. I have a ...
2
votes
1answer
324 views

iptables doesn't forward from WAN to virtual machines

I have a machine working like gateway and have two network interfaces: eth0 LAN : 192.168.1.0/24 eth1 WAN : XXX.XXX.XXX.XXX (my public ip) This machine has 3 VM guest over virtualbox. All have ...