iptables allow creation of rules to define packet filtering behavior.
3
votes
1answer
139 views
Using source routing (LSRR) - any ideas?
What I want to do is conceptually very simple, but I can't find any information or help about how to go about doing this.
Basically, I want to configure my networking to use source routing (LSRR). ...
2
votes
1answer
40 views
Can iptables be used to convert a single-homed host into a NAT server?
Given: I have a machine (HostA) with only one NIC which has Internet connectivity. I have another machine (HostB) with one NIC on the same switch. HostB is not configured for Internet access yet. ...
3
votes
1answer
34 views
IPTables - Port to another ip & port (from the inside)
I currently have a NAS box running under port 80. To access the NAS from the outside, I mapped the port 8080 to port 80 on the NAS as follow:
iptables -t nat -A PREROUTING -p tcp --dport 8080 -j DNAT ...
3
votes
1answer
26 views
iptables: recent module
I am using the "recent" module to prevent port scanning, such as:
-A INPUT -i eth0 -m recent --name PORTSCAN --update --seconds 60 -j DROP
-A INPUT -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT ...
1
vote
1answer
26 views
How do I port-forward 169.254.169.254-bound packets from libvirt/KVM guests to localhost?
This is a followup to What's the best way to have a 169.254.169.254 address local to my laptop?. Short story: 169.254.169.254 is the "well known" address of cloud metadata services for EC2 and for ...
1
vote
2answers
51 views
Where is iptables script stored on DD-WRT filesystem?
I have an ASUS RT-N16 router that I've flashed with the open-source DD-WRT firmware. According to my ssh login, I'm running:
DD-WRT v24-sp2 mega (c) 2010 NewMedia-NET GmbH
Release: 08/07/10 (SVN ...
0
votes
1answer
80 views
darkstat shown blocked traffic
I've installed Darkstat on a Qemu VM which is connected to a bridge interface on top of main server's interface ( eth0 )
In Darkstat report I can see many hosts in the same IP range of specified VMs ...
1
vote
1answer
108 views
Blocking gzip HTTP content with Iptables or Snort?
I'm looking to drop a connection if a website contains a certain word or phrase. The issue is, the site is typically compressed with gzip. Any ideas?
-2
votes
0answers
28 views
Iptables (easyfwgen) script issues. No internet access
I used the easyfwgen iptables script generator to create a firewall script for my new Mint install. I think all the scripts are in the right place, but I have issues with the rules in the script. I ...
1
vote
1answer
432 views
Port Mirroring in Fedora?
I have set up an application that listens constantly to a port for network packets, and I would like to create another one that receives the same network packets ( for use as a test bed). Getting the ...
1
vote
2answers
591 views
Iptables GEOIP not working under Debian Squeeze
I've just installed xtables-*, compiled the geoip database, but when I try to use an iptables command it always gives back the following error:
Command:
iptables -I INPUT -p tcp --dport 80 -m geoip ...
2
votes
2answers
284 views
policy routing problem with load balanced ppp connections
This my setup using Debian 6.0.6. It's role is a proxy server and a load balancer using eight 3G modems.
First and foremost:
Whenever a ppp connection dials it takes over the default gateway which ...
0
votes
0answers
17 views
Firewalld SELinux
Is there any way to better explanation firewall-cmd than the one given in Fedora18 wiki.
I am trying to convert iptables to FirewallD in cmd line without GUI but cannot find a decent example or ...
7
votes
1answer
3k views
Why are incoming packets on a TAP interface seen with tcpdump but not with iptables?
A program injects packets on a Linux TAP interface (these packets are coming from a virtual machine). Specifically, these are DHCP requests (so they're UDP). I can see the packets with tcpdump but not ...
1
vote
1answer
152 views
Why is a echo-request ping packet 84 bytes in the log of iptables?
When I log the length of a echo-request packet,
iptables -A OUTPUT -p icmp -m icmp --icmp-type 8 -j LOG
I saw the length was LEN=84, but in wireshark, the captured packet size was 0x60, why does it ...
2
votes
6answers
327 views
Recommend a reading for learning Linux firewalls configuration for beginner?
I am using Linux at home and want to be able to configure firewall. I would like to understand what I am doing not just copy paste some rules from internet :).
1
vote
1answer
64 views
NAT with transparent proxy
is there a way to redirect all non local http requests that through my computer to use my transparent proxy, so i can log all websites are they visiting?
and if possible all https requests too..
my ...
1
vote
1answer
70 views
How do I route different users over different OpenVPN tunnels in Linux?
The setup:
I have multiple, static-key OpenVPN client/server configurations, labeled "client1", "client2", and "client3" with server/client IPs 10.10.1.1/10.10.1.2, 10.10.2.1/10.10.2.2, and ...
1
vote
1answer
433 views
Having trouble with packets not making it into Fedora 16 Apache
Background: I haven't done anything with iptables in a few years... I have Fedora 16 running in a VM on VMWare, with my firewall (TomatoUSB) port forwarding to the VM.
VM is at 192.168.1.155. I know ...
2
votes
1answer
42 views
Local port forwarding automatically configured on boot?
I have software which needs to run as a non-root user, but needs to listen on port 80 and 443.
With iptables, this isn't all that difficult:
sudo iptables -t nat -A PREROUTING -i eth0 -p tcp ...
1
vote
2answers
34 views
iptables and logs
Suppose I add an IP to iptables blocking for exim, dovecot and FTP and this IP visits my server again.
Is there any log of this visit so I can confirm the IP was trying to reach the server again but ...
3
votes
0answers
102 views
I opened a port with iptables but still doesnt work
I have a CentOS installation as a guest VM with VirtualBox. I have two ethernet interfaces, eth0 with NAT and DHCP, and eth1 with Host-only adaptor and static IP.
I have oracle installed in this ...
1
vote
2answers
68 views
Iptables port forwarding to qemu vm
Is it possible to create an IPtables rule that forwards all incoming traffic on port 80 on the host to port 80 of the qemu VM?
Is such a scenario possible with qemu?
2
votes
1answer
57 views
Explanation of bandwidth management script calling tc
I have some scripts in Linux to manage internet bandwidth, but I do not understand what they do.
What is the meaning of the following scripts:
tc qdisc add dev $IF root handle 1: htb default 256
tc ...
2
votes
1answer
89 views
iptables rules not realoading on CentOS 6.x
I have one single ipset addded to my iptables on a CentOS 6.x box and this rule is lost when the machine reboots.
I have found this answer showing how to make a Ubuntu system reload the iptables ...
1
vote
1answer
55 views
iptables is not blocking
I have a script running every minute by a crontab.
This script scans the system logs and grabs the IPs of every failed attempt to login on the server's dovecot, exim or ssh and add them to an ipset, ...
1
vote
0answers
83 views
Redirect all non-local traffic to a socks proxy
Is it possible to redirect all non-local traffic to a socks proxy?
so, for example i have:
4 computers (clients A-D: 10.0.0.1-3 or dhcp)
1 computer with 2 network cards (gateway-server, eth0: ...
3
votes
1answer
60 views
tc on bridge port
I have a 4 port bridge:
root@Linux-Switch:~# brctl show
bridge name bridge id STP enabled interfaces
br0 8000.000024cd2cb0 no eth0
eth1
...
3
votes
1answer
62 views
iptables: multiple exclusions on port forwarding
I have an existing iptables setup that does port forwarding. In this port forwarding scenario there are some instances where I do not want it to port forward. So, for instance I have this defined:
...
1
vote
3answers
125 views
Block network access of a process?
Is it possible to block the (outgoing) network access of a single process?
0
votes
1answer
100 views
Can't save / load iptables rules on Arch Linux via rc.d
I can not load my saved iptables rules when the server reboots on Arch Linux. Any ideas?
The latest Arch updates are in place.
I have followed Arch Linux's tutorial... neither either works. The ...
2
votes
1answer
111 views
Allow application specific access in iptables using guid
I would like to get Skype working with iptables and don't want to allow a huge range of ports thus I thought a solution might be
iptables -A OUTPUT -m owner --gid-owner skypeGrp -j ACCEPT
iptables ...
0
votes
3answers
424 views
How can I redirect ports 80 and 443 to 8080 and 8443 with iptables?
I'm looking at the documentation for a Tomcat 6 webapp called DSpace, specifically in regardds to running Running DSpace on Standard Ports (80 for http:// and 443 for https://)
I am trying to use ...
0
votes
3answers
415 views
How to make sense of an iptables chain configuration
This is about how to make sense of the chains found in the iptables default configuration on a typical home router running OpenWrt (a stripped down Linux for router devices), but which ultimately may ...
2
votes
1answer
73 views
IPtables command shows libipt_random.so missing
When I run a command, it shows error. I searched on net, but no one give me the correct answer. Googling shows only wrong answers for this questions.
So please help me to overcome this problem.
...
2
votes
0answers
91 views
Port Forwarding Between 2 Internet Machines
Here's my scenario:
Setup
There are 3 machines:
A: on the internet : has ip (a.a.a.a), has port pa open
B: my server / gateway : has ip (b.b.b.b), has port pb open
C: on the internet : has ip ...
0
votes
1answer
99 views
IP set to block access to exim and dovecot
I have created a ipset with a bunch of IPs that I want to block access to dovecot and exim.
The ipset is called "bannedIPs" and have been added to iptables using this
iptables -A INPUT -p tcp ...
1
vote
2answers
83 views
Is it possible to whitelist a specific program in iptables?
Is it possible to allow all traffic for a specific program in iptables? Otherwise using nmap and a strict iptables configuration at the same time seems impossible.
2
votes
3answers
131 views
What does this firewall record mean?
Running iptables -L -n gives me the following info:
Chain IN_ZONE_work_allow (1 references)
target prot opt source destination
ACCEPT tcp -- 0.0.0.0/0 ...
4
votes
6answers
4k views
iptables to block https websites
I wish to block a few websites that also run upon https, like facebook, twitter, and gmail, in my organization. Squid is not supposed to be used here as per the orders from higher management. We can ...
0
votes
1answer
281 views
Allowing access to NetBIOS port in Fedora 18?
I've recently installed Fedora 18 on one of the machines in my office, and I've installed Samba so I can browse the file system on my Windows machine.
However, I'm having some trouble opening port ...
1
vote
1answer
295 views
Help to understand Iptables Forward chain with DNAT
I have one server where iptables configured with all chains DROP in filter table
eth0 :- 10.0.0.2 [ Intranet assume as LAN ]
eth2 :- 172.16.0.2 [ External clients assume as WAN ]
Now What I am ...
1
vote
3answers
208 views
hosts.allow: Not required when using iptables?
I am trying to configure the box I am using as a gateway/proxy/firewall to allow IP masquerading and finally switch over from using a proxy. It's a debian squeeze system.
Currently, my hosts.allow ...
0
votes
1answer
119 views
ipset not executing from crontab
I have this txt files that contains IPs, one per line of file, that I want to block using ipset.
I have this bash script that essentially reads from the plain txt file and constructs an array. Then ...
6
votes
1answer
272 views
iptables will match the following ICMP request packet as ESTABLISHED state after the first reply packet is sent
Test environment: CentOS 6.3 - kernel 2.6.32-279.el6.i686, iptables v1.4.7
Win7 <---> CentOS
Windows is constantly replaying ICMP echo request in 10pkt/sec rate to CentOS.
In iptables, I added the ...
2
votes
0answers
113 views
Inject a packet to a different NFQUEUE
I have an NFQUEUE, for IPv6 packets hooked to PREROUTING chain of mangle table in ip6tables.
Once I receive a packet in user application, I modified the header. Infact, modified the header from IPv4 ...
1
vote
1answer
47 views
Using iptables to block for specific services
I am using ipset in conjunction with iptables to create a list of IPs I want to block. I did this:
ipset -N blocking iphash
ipset -A blocking 124.205.11.230
// and repeated this line for all IPs I ...
2
votes
1answer
95 views
Linux nat/iptables configuration for a chain of peer-to-peer links
I have an experimental setup, of 4 Linux (CentOS) machines:
All 4 machines are internally connected using different networks and can ping eachother directly connected interfaces. However only PC4 ...
3
votes
1answer
2k views
How to re-enable iptables on Fedora 18?
FirewallD is the default firewall in Fedora 18. I have been using iptables for quite some time and have a custom configuration which I need for logging of ip traffic. I am not used to the new ...
1
vote
1answer
507 views
Redirect Packets from ppp0 interface to ethernet interface in linux
My question is similar to this question, however with some change.
I have a PPPoE connection on my Linux Machine (CentOS kernal 2.6.32) as a client, so that when I setup this connection, another ...
