iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

3
votes
2answers
475 views

Meaning of log entries from an iptables configuration

My router has Linux as its OS. The system log has a lot of rows about iptable and klogd that I don't understand, could someone explain them to me? The iptables setup: iptables -t nat -A PREROUTING ...
3
votes
3answers
790 views

Can't add large number of rules to iptables

I made a very simple bash script (echo at start, runs commands, echos at end) to add approx 7300 rules to iptables blocking much of China and Russia, however it gets through adding approximately 400 ...
5
votes
1answer
442 views

Creating a NAT from loopback to a remote server

My goal is to redirect connections from the local host to a remote server, and be able to change the remote address on the fly, without any client config changes. I can do this now using a nat on the ...
3
votes
0answers
166 views

iCloud stuff stops working while connected to OpenVPN

I have a fairly simple OpenVPN setup on an OpenVZ VPS with Ubuntu 11.10. Client is the Viscosity client on Mac OS X 10.8.2, and after some testing, we can rule out the client as being part of the ...
6
votes
2answers
4k views

Iptables: matching outgoing traffic with conntrack and owner. Works with strange drops

In my iptables script I have been experimenting with writing as finely grained rules as possible. I limit which users are allowed to use which services, partly for security and partly as a learning ...
5
votes
2answers
7k views

Why do iptables rules disappear when restarting my Debian system?

I add this rule: sudo iptables -t nat -A OUTPUT -d a.b.c.d -p tcp \ --dport 1723 -j DNAT --to-destination a.b.c.d:10000 When restart computer rules are deleted. Why? What I can do to make ...
2
votes
1answer
604 views

How to config iptables for pppoe?

When I create the only rule disabling all input, iptables -P INPUT DROP I can not connect anything. So it looks like I should allow some incoming activity to get PPPoE working correctly. What rules ...
5
votes
1answer
671 views

iptables beginner question about ACCEPT

I'm just reading up on iptables, finally. I'm a little confused because the input chain from the filter table (as installed, fedora 17), looks like this: target prot opt source ...
1
vote
1answer
2k views

Redirect Output with Iptables

Is possible on Debian to change the port of packets that are going to a specific port, using iptables? Example: I want packets going in the outbound direction to a.b.c.d for port 1723 to be ...
3
votes
1answer
2k views

tc don't see marked with -j MARK packets

Server has 2 network interfaces: eth1 with address 13.0.0.254/24 eth0 with address 172.20.203.4/24. It's routing traffic between this two networks. Task is to limit bandwidth between this two ...
1
vote
0answers
748 views

iptables not starting up

I have inherited a custom built Linux kernel 2.6.30.9 and am just upgrading the underlying OS from RHEL 5.4 to 5.8 (kernels 2.6.18.164 and 2.6.18.308 respectively). When booting, the following is ...
5
votes
1answer
2k views

Enable RTSP in iptables

I'd like to receive a RTSP stream via VLC, but when I try to run sudo -u non_root_user cvlc -vvv -I dummy rtsp://ip:port/x.sdp I get: Unable to determine our source address: This computer has an ...
1
vote
1answer
2k views

iptables forwarding and routing

In fact, this question is about openwrt and CoovaAP, but I guess it's the same in other linux distributions. I've two interfaces, a "wan" and a "wlan" interface. Is there by default any filter, ...
1
vote
0answers
136 views

What other rules should I use to allow PPTP outbound connection?

I already allowed outbound connection to TCP/UDP port number 1723, but PPTP connection still fail to establish, If I allow all outbound connection, the tunnel will just go fine.
3
votes
1answer
737 views

Changing firewall settings after installation of CentOS via kickstart

I was trying to install CentOS 6.3 via Windows Deployment Server. And to automate the installation process I used kickstart file in which i provided various details required during installation.Then i ...
1
vote
1answer
502 views

How to provide a “guest LAN” on one ethernet device

I have an always-on machine running Debian/Squeeze with a couple of ethernet ports (it's doing various serverish jobs, including DHCP) and a LAN on each. eth0 is on 192.168.7.* and has access to the ...
5
votes
3answers
4k views

Why can't I use the REJECT policy on my iptables OUTPUT chain?

I currently have my OUTPUT chain set to DROP. I'd like to change it to REJECT, so that I have a clue that it's my firewall stopping me from getting somewhere rather than a problem with whatever ...
2
votes
1answer
2k views

system wide SOCKS5 Proxy

I connect to my Server on the internet using ssh -D 3128 user@rootserver.com. If I am right I thereby open a SOCKS v5 Proxy to my Server. Using firefox and FoxyProxy I can now add this to my proxys ...
6
votes
3answers
8k views

What prevents a machine from responding to pings?

I have a CentOS release 5.4 linux box on Amazon EC2 that I'm trying to set up to be monitored via Nagios. The machine is in the same security group as the nagios server, but it seems to be ...
1
vote
1answer
997 views

Losing wifi connection to access point after a few minutes (hostapd, dnsmasq, iptables)

I'm using a laptop as a wifi access point. Since this laptop has the proper hardware, I was able to use hostapd. I wanted to use DHCP and iptables/NAT forwarding instead of a bridge to have more ...
1
vote
1answer
2k views

Redirect http using iptables for an ip range

I have a range of ip addresses (10.13.13.10-19) that I want to redirect all outgoing http traffic to an internal webserver. So if someone in that range tried to access any site, the html from my ...
1
vote
1answer
290 views

iptables logging prefix gets corrupted

I've been using iptables for some time but recently noticed that the log prefix I'd set had got corrupted. In /etc/iptables/rules.v4` I have: -A LOGNDROP -j LOG --log-prefix "iptables denied: " ...
2
votes
2answers
1k views

What is a solid iptables configuration for my desktop?

On my desktop, I want to configure iptables pretty strictly. I see no reason why I need to allow anything except for internet traffic that I initiated. And maybe even that could be limited to only a ...
3
votes
2answers
277 views

What tool to execute a command on repeated syslog entries?

Occasionally, one VPS under my control gets bombarded with POP3 login attempts. They all fail, but the huge number of spawned processes and active connections pretty much amount to a DoS attack. When ...
3
votes
1answer
595 views

Routing through iptables

I have this vpn client that touches the routing table and then keeps watching it to exit if it gets touched. It is the kind of setup needed for an endpoint, such as a laptop. I want to use a small ...
6
votes
1answer
2k views

Terminal commands equivalent to NetworkManager's “Use as Hotspot” option

I'm making a gui application which will control my laptop in order to make it act as a wifi hotspot. I may change distributions so I want to find a solution which will work generally for all ...
1
vote
1answer
2k views

Why can't I add any iptables rule?

Why can't I add any iptables rule? root@ROUTER:~# iptables -L INPUT -v Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 6934 685K ACCEPT 0 -- any ...
0
votes
1answer
3k views

IPtables string match

I'm trying to write iptables string match rule To block http://domain.com:8888 and https://domain.com:8888 when it matches the supplied string in the rule. And another rule to redirect the ports also ...
2
votes
1answer
101 views

Is there a way to redirect requests from foo.com to a VM on that server?

I saw a tutorial about redirecting client requests to a specific port to a VM inside the server using IPTables. Is there a way to redirect client requests for foo.com to a VM using only IPTables? or ...
6
votes
1answer
3k views

NAT (Internet connection sharing) switching between multiple public interfaces

My Ubuntu 12.04 (precise) laptop has three network interfaces: eth0: wired interface sometimes connected to the Internet wlan0: wireless interface sometimes connected to the Internet vboxnet0: wired ...
0
votes
2answers
185 views

How To See Which Ports Are Open On A Particular Firewall

Using the terminal I was wondering if it would be possible to see a list of all the active firewalls on a particular system that I have shelled into. I want to be able to see which ports are active ...
3
votes
2answers
1k views

How do I build the iptables kernel module for a loaded kernel?

I've built a kernel with loadable module support for various reasons, one of them the possibility to compile modules and load them without rebooting. This is supposed to be useful when I need a module ...
4
votes
2answers
1k views

Having Linux port remap to itself

I have a scenario: I have 4 server and 3 web inbound requests that I have to allow through a modem/router. the ports are https(ssl)443 ssh22 and http80. All 4 servers want them. I had set up the ...
2
votes
2answers
1k views

TOR Transparent Proxy - How does to the TCP redirecting work

I used an iptables ruleset based on the sample ruleset from https://trac.torproject.org/projects/tor/wiki/doc/TransparentProxy, Section Linux, Local Redirection Through Tor, to set up Tor as a ...
1
vote
1answer
425 views

How do I shut down ports remotely without shutting myself out?

I have an Ubuntu 11.04 server in a remote location on another continent, so I have no physical access to it. I only interact with it by ssh (and scp), and intend to only ever interact with it that ...
2
votes
2answers
547 views

Having trouble with packets not making it into Fedora 16 Apache

Background: I haven't done anything with iptables in a few years... I have Fedora 16 running in a VM on VMWare, with my firewall (TomatoUSB) port forwarding to the VM. VM is at 192.168.1.155. I know ...
-1
votes
1answer
134 views

need to my server's ip changes when it needs to connect port 'x' on ip 'y'

simple question: "need a way to proxify a port" I have a linux server and have a proxy server on another machine. My linux server needs connect to port 'x' on ip 'y' Is it possible to create ...
3
votes
1answer
387 views

User associated with a socket

I use ss -p to see TCP sockets information. But process info are not printed for some sockets. Below: $ ss -p4 State Recv-Q Send-Q Local Address:Port Peer Address:Port ESTAB 0 0 ...
1
vote
2answers
666 views

How would I direct local(127.0.0.1) MySQL traffic to an external SQL server?

Basically, I have two EC2 instances on Amazon Web Services. They are both running Ubuntu 11.10 x64. They both have a private and a public (Elastic) IP addresses. I'm having trouble setting up iptables ...
1
vote
1answer
1k views

IPTABLES to block all outgoing connections except selected networks

There is a firewall/gateway machine with eth0 Public and eth1 Private network (192.168.1.0). I would like to block all OUTPUT connections for private users (eth1) except couple of networks like: ...
2
votes
2answers
529 views

Is xinetd still the best method to let non root daemons listen on privileged ports?

When I need to use SNMP monitoring for java applications, there is the need to that application (usually ran as daemon user) to listen on snmp port. If there is no other alternative, of course I can ...
1
vote
1answer
187 views

iptable rule to redirect only https handshake?

I was reading this interesting article today: http://www.moserware.com/2009/06/first-few-milliseconds-of-https.html A crazy thought came to mind...Is it possible to write an iptable rule that only ...
2
votes
0answers
548 views

Iptables - modprobe: FATAL - Fail2ban random restarts

I have been running fail2ban on my server for a while without any problems but have recently seen fail2ban restart randomly. After some looking in my logs I noticed that the restarts occur when ever ...
8
votes
4answers
764 views

iptables on tor exit node

I want to run an open Tor router. My exit policy will be similar to ReducedExitPolicy. But I also want to make it hard for the tor network to abuse my resources. Cases I want to prevent clients ...
2
votes
1answer
616 views

Port Mirroring in Fedora?

I have set up an application that listens constantly to a port for network packets, and I would like to create another one that receives the same network packets ( for use as a test bed). Getting the ...
2
votes
2answers
2k views

Remote SSH login not working

I have a PC behind a router with port forwarding setup Port 22 for SSH which works perfectly - I can login and everything. What I am trying to do is let this PC connect to a VPN and only allow ...
3
votes
3answers
5k views

Restrict bandwidth with DD-WRT

I have DD-WRT installed on my router and I would like to be able to restrict the bandwidth both up and down on a certain IP or Mac address. I am happy to get my hands dirty and use console. I am sure ...
12
votes
2answers
4k views

Per process firewall?

I've been reading around but can't seem to find a way to create per-process firewall rules. I know about iptables --uid-owner but that only works for outgoing traffic. I've considered scripting ...
1
vote
2answers
1k views

How can I Forward a subDomain to a specific port?

My apologies if this has been asked before. I haven't found an adequate solution so... yeah. When a specific domain, "example.com" is accessed, I want it to act normally. In other words, it should go ...
6
votes
2answers
5k views

iptables, how to redirect port from loopback?

The main rules are: OUTIF=eth0 /sbin/iptables --policy INPUT DROP /sbin/iptables --policy FORWARD DROP /sbin/iptables --policy OUTPUT ACCEPT /sbin/iptables -A INPUT -i lo -j ACCEPT ...