Tagged Questions

iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

0
votes
1answer
216 views

ipset not executing from crontab

I have this txt files that contains IPs, one per line of file, that I want to block using ipset. I have this bash script that essentially reads from the plain txt file and constructs an array. Then ...
1
vote
3answers
1k views

hosts.allow: Not required when using iptables?

I am trying to configure the box I am using as a gateway/proxy/firewall to allow IP masquerading and finally switch over from using a proxy. It's a debian squeeze system. Currently, my hosts.allow ...
0
votes
1answer
527 views

Allowing access to NetBIOS port in Fedora 18?

I've recently installed Fedora 18 on one of the machines in my office, and I've installed Samba so I can browse the file system on my Windows machine. However, I'm having some trouble opening port ...
2
votes
1answer
115 views

Using iptables to block for specific services

I am using ipset in conjunction with iptables to create a list of IPs I want to block. I did this: ipset -N blocking iphash ipset -A blocking 124.205.11.230 // and repeated this line for all IPs I ...
2
votes
1answer
215 views

Linux nat/iptables configuration for a chain of peer-to-peer links

I have an experimental setup, of 4 Linux (CentOS) machines: All 4 machines are internally connected using different networks and can ping eachother directly connected interfaces. However only PC4 ...
3
votes
1answer
5k views

How to re-enable iptables on Fedora 18?

FirewallD is the default firewall in Fedora 18. I have been using iptables for quite some time and have a custom configuration which I need for logging of ip traffic. I am not used to the new ...
1
vote
2answers
3k views

iptables blocking from internet side on eth1?

How to use iptables to deal with two Ethernet ports? eth0 port for LAN use (192.168.1.50 Private IP). eth1 port is connected to the internet via cable modem (80.0.xxx.xxx public IP). ifconfig ...
1
vote
0answers
120 views

Deny/allow a user's access to a port dynamically

I have stumbled upon this little tech dilemma yesterday, and know that there is a solution to it (IRC BNC resellers have it implemented already). However, the exact details and implementation elude ...
0
votes
1answer
151 views

Fedora Firewall no option as of yet

I need a firewall because I was decade long user of internet security suites on windows. I am not a professional of networks or anything but a student who just needs to block unblock running ...
1
vote
0answers
242 views

Asterisk server problems with firewall settings [closed]

I replaced an IVR machine for incoming call after going down. It is running asterisk 1.4.23 on ubunutu 10.04 I decided to put the server behind iptables because my server was under brute force attack. ...
1
vote
1answer
2k views

Redirect Packets from ppp0 interface to ethernet interface in linux

My question is similar to this question, however with some change. I have a PPPoE connection on my Linux Machine (CentOS kernal 2.6.32) as a client, so that when I setup this connection, another ...
4
votes
2answers
9k views

Does iptables -F permanently delete all iptables rules?

In a RHEL training document, the author says: ...run the following command to disable the firewall on the current system: iptables -F He explicitly uses the word "disable" which to me suggests ...
4
votes
2answers
484 views

Why can I reach a different interface's IP address?

I'm wondering about this, and I can't seem to find an explanation on the internet. I have a linux gateway which has multiple interfaces: eth0: external ip eth1: 172.16.1.1/24 eth2: 172.16.2.1/24 ...
4
votes
2answers
8k views

incoming ACCEPT all iptables rule still appearing

I'm following this guide here: http://isalazyadmin.net/2009/07/02/configuring-a-basic-firewall-for-debian-linux/ And I have the iptables listed shown, but my server still appears to be accepting all ...
3
votes
2answers
500 views

iptables routing marked packets from router to PC and routing them back to router

I'm trying to do deep packet inspection on HTTP packets. The purpose of this is to collect HTTP payload data and then create some proxy/cache-independent reports. Following this, the idea is to ...
2
votes
1answer
488 views

Why is a echo-request ping packet 84 bytes in the log of iptables?

When I log the length of a echo-request packet, iptables -A OUTPUT -p icmp -m icmp --icmp-type 8 -j LOG I saw the length was LEN=84, but in wireshark, the captured packet size was 0x60, why does it ...
1
vote
1answer
482 views

Allow user to see how many iptables rules are loaded, but not actual contents?

I want to allow user to check how many rules are present in filter table, but not able to view actual rules, is that possible? literally I mean iptables -L | wc -l (I know it's faulty), but sudo ...
7
votes
1answer
511 views

iptables will match the following ICMP request packet as ESTABLISHED state after the first reply packet is sent

Test environment: CentOS 6.3 - kernel 2.6.32-279.el6.i686, iptables v1.4.7 Win7 <---> CentOS Windows is constantly replaying ICMP echo request in 10pkt/sec rate to CentOS. In iptables, I added the ...
2
votes
1answer
229 views

PPTP server with NIC aliases

I have set up a VPN on a VPS Server using PPTP. I have one NIC with two aliases. eth0 eth0:1 eth0:2 The 3 interfaces have public addresses. eth0 is a French IP, eth0:1 is UK, and eth0:2 is ...
9
votes
2answers
20k views

iptables --set-mark - Route diferent ports through different interfaces

Short story, 3 interfaces, eth0 (LAN), eth1(ADSL), eth2(4G). eth0 -> eth1: Works (ports 80, 443, 4070) eth0 -> eth2: Doesn't happen This is a graphical representation of the idea: Port 80 & ...
3
votes
3answers
757 views

Undo iptables modification

I ran the following iptables commands to create a blacklist rule but used the wrong port: iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH iptables -A INPUT -p tcp ...
4
votes
1answer
4k views

How to understand why the packet was considered INVALID by the `iptables`?

I set up some iptables rules so it logs and drops the packets that are INVALID (--state INVALID). Reading the logs how can I understand why the packet was considered invalid? For example, the ...
4
votes
2answers
1k views

Port fowarding and load balancer in ubuntu server 12.04

I am looking to create a load balancing server. Essentially here is what I want to do: I have a public IP address, lets say 1.1.1.1 I have a second public IP address, lets say 2.2.2.2. I have a ...
2
votes
1answer
320 views

iptables doesn't forward from WAN to virtual machines

I have a machine working like gateway and have two network interfaces: eth0 LAN : 192.168.1.0/24 eth1 WAN : XXX.XXX.XXX.XXX (my public ip) This machine has 3 VM guest over virtualbox. All have ...
0
votes
3answers
2k views

How to make sense of an iptables chain configuration

This is about how to make sense of the chains found in the iptables default configuration on a typical home router running OpenWrt (a stripped down Linux for router devices), but which ultimately may ...
2
votes
1answer
911 views

Allow IP packet forwarding from LAN to modem via router

In short: I'd like to be able to telnet to my modem from my PC via my router. There is a simple home router on 192.168.33.1. It is running OpenWrt. It has the following interfaces defined: br-lan ...
1
vote
1answer
325 views

Firewall/routing rule in Centos for this setup

I have two ethernet interfaces, namely eth0 and eth1. I want to implement an advanced routing rule but I am totally new to firewall/routing rules in CentOS. Here is what I am trying to do: Both my ...
5
votes
1answer
5k views

Have someone ever audited the default OpenWrt firewall rules?

I have an Openwrt 10.03.1 installed from: openwrt-ar71xx-wrt160nl-squashfs-factory.bin (firewall only customized with this: sed 's/REJECT/DROP/g' /etc/config/firewall) - so besides this, IT'S A ...
4
votes
2answers
8k views

Port forward to VPN Client?

I've run into a bit of a puzzle and haven't had much luck finding a solution. Right now I am (sadly) connected to the net via Verizon 3G. They filter all incoming traffic so it is impossible for me to ...
1
vote
1answer
149 views

darkstat shown blocked traffic

I've installed Darkstat on a Qemu VM which is connected to a bridge interface on top of main server's interface ( eth0 ) In Darkstat report I can see many hosts in the same IP range of specified VMs ...
0
votes
1answer
648 views

Allow incoming connections from Google Translate only

I have a small web server running on port 80, and I'd like to allow only Google Translate to have access to it. First I tried running dig translate.google.com and dig translate.googleusercontent.com ...
4
votes
1answer
345 views

Using source routing (LSRR) - any ideas?

What I want to do is conceptually very simple, but I can't find any information or help about how to go about doing this. Basically, I want to configure my networking to use source routing (LSRR). ...
3
votes
2answers
542 views

Policy routing with load balanced ppp connections

This my setup using Debian 6.0. 6. It's role is a proxy server and a load balancer using eight 3G modems. Whenever a ppp connection dials it takes over the default gateway which is ok but it also ...
3
votes
2answers
495 views

Meaning of log entries from an iptables configuration

My router has Linux as its OS. The system log has a lot of rows about iptable and klogd that I don't understand, could someone explain them to me? The iptables setup: iptables -t nat -A PREROUTING ...
3
votes
3answers
874 views

Can't add large number of rules to iptables

I made a very simple bash script (echo at start, runs commands, echos at end) to add approx 7300 rules to iptables blocking much of China and Russia, however it gets through adding approximately 400 ...
5
votes
1answer
466 views

Creating a NAT from loopback to a remote server

My goal is to redirect connections from the local host to a remote server, and be able to change the remote address on the fly, without any client config changes. I can do this now using a nat on the ...
3
votes
0answers
174 views

iCloud stuff stops working while connected to OpenVPN

I have a fairly simple OpenVPN setup on an OpenVZ VPS with Ubuntu 11.10. Client is the Viscosity client on Mac OS X 10.8.2, and after some testing, we can rule out the client as being part of the ...
6
votes
2answers
4k views

Iptables: matching outgoing traffic with conntrack and owner. Works with strange drops

In my iptables script I have been experimenting with writing as finely grained rules as possible. I limit which users are allowed to use which services, partly for security and partly as a learning ...
5
votes
2answers
8k views

Why do iptables rules disappear when restarting my Debian system?

I add this rule: sudo iptables -t nat -A OUTPUT -d a.b.c.d -p tcp \ --dport 1723 -j DNAT --to-destination a.b.c.d:10000 When restart computer rules are deleted. Why? What I can do to make ...
2
votes
1answer
636 views

How to config iptables for pppoe?

When I create the only rule disabling all input, iptables -P INPUT DROP I can not connect anything. So it looks like I should allow some incoming activity to get PPPoE working correctly. What rules ...
5
votes
1answer
692 views

iptables beginner question about ACCEPT

I'm just reading up on iptables, finally. I'm a little confused because the input chain from the filter table (as installed, fedora 17), looks like this: target prot opt source ...
1
vote
1answer
2k views

Redirect Output with Iptables

Is possible on Debian to change the port of packets that are going to a specific port, using iptables? Example: I want packets going in the outbound direction to a.b.c.d for port 1723 to be ...
3
votes
1answer
2k views

tc don't see marked with -j MARK packets

Server has 2 network interfaces: eth1 with address 13.0.0.254/24 eth0 with address 172.20.203.4/24. It's routing traffic between this two networks. Task is to limit bandwidth between this two ...
1
vote
0answers
773 views

iptables not starting up

I have inherited a custom built Linux kernel 2.6.30.9 and am just upgrading the underlying OS from RHEL 5.4 to 5.8 (kernels 2.6.18.164 and 2.6.18.308 respectively). When booting, the following is ...
5
votes
1answer
3k views

Enable RTSP in iptables

I'd like to receive a RTSP stream via VLC, but when I try to run sudo -u non_root_user cvlc -vvv -I dummy rtsp://ip:port/x.sdp I get: Unable to determine our source address: This computer has an ...
1
vote
1answer
2k views

iptables forwarding and routing

In fact, this question is about openwrt and CoovaAP, but I guess it's the same in other linux distributions. I've two interfaces, a "wan" and a "wlan" interface. Is there by default any filter, ...
1
vote
0answers
136 views

What other rules should I use to allow PPTP outbound connection?

I already allowed outbound connection to TCP/UDP port number 1723, but PPTP connection still fail to establish, If I allow all outbound connection, the tunnel will just go fine.
3
votes
1answer
758 views

Changing firewall settings after installation of CentOS via kickstart

I was trying to install CentOS 6.3 via Windows Deployment Server. And to automate the installation process I used kickstart file in which i provided various details required during installation.Then i ...
1
vote
1answer
529 views

How to provide a “guest LAN” on one ethernet device

I have an always-on machine running Debian/Squeeze with a couple of ethernet ports (it's doing various serverish jobs, including DHCP) and a LAN on each. eth0 is on 192.168.7.* and has access to the ...
5
votes
3answers
4k views

Why can't I use the REJECT policy on my iptables OUTPUT chain?

I currently have my OUTPUT chain set to DROP. I'd like to change it to REJECT, so that I have a clue that it's my firewall stopping me from getting somewhere rather than a problem with whatever ...