iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

3
votes
2answers
1k views

Open and redirect port

I'm trying to set up SNMP for a router so I can monitor it from an existing Nagios installation on an off-site server. I'm having trouble getting the router to respond to SNMP requests from the WAN, ...
0
votes
1answer
1k views

iptables redirect traffic from VPN interface to next interface

Can you help me with this problem please? I need redirect all traffic from tun0 interface (OpenVPN tunnel) to eth1 interface. eth1 is internal network behind this system which works as special ...
1
vote
1answer
818 views

DROP all for port 22 if not geoip set of US for iptables and xtables

I want to simply block all ssh access from anywhere but with in the US. This is my whole iptables, and I have followed ...
1
vote
1answer
30 views

iptables rule in /etc/rc.local are not loaded

/etc/iptables.conf contains a rule to dump my outgoing packets to 10.199 network as, *filter :INPUT ACCEPT [122:9273] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [73:8165] -A OUTPUT -d 10.199.48.0/24 -j ...
1
vote
1answer
591 views

iptables allow only ssh and vpn traffic

I have dedicated server with ubuntu 14.10 installed. The server should connect to an openvpn server and the traffic should only go through the vpn, except for SSH traffic. My idea is to realize it ...
2
votes
1answer
23 views

traffic routing with DNS

I have 2 gateway machines. 1 debian (main - 192.168.1.1), 1 centos (backup 192.168.1.2). There are 2 networks, 1 LAN and 1 WAN, going through "main" and from there over ISP1 "backup" is on LAN and it ...
1
vote
1answer
11k views

can not telnet to a server connection refuse

I have two server with these specifications: IP address: 192.168.1.94 IP address: 192.168.1.221 I want to telnet to the first one from the second one (to port 5029) but I get this error: ...
1
vote
0answers
14 views

How to drop packet if conntrack entry not present

Is there a way to check if conntrack exists before doing a particular action in iptable chains ? I would like to drop the packet in mangle-postrouting if conntrack entry is not present, dont want it ...
2
votes
1answer
1k views

Need to access port on LAN through IPTABLES firewall on static IP interface

I have a Linux firewall with 3 NIC's. Eth1 is my LAN's default gateway and has IP address 10.1.2.250 and is connected to my LAN with IP range 10.1.2.0/24. Eth2 has IP address of 10.0.0.6 and gateway ...
0
votes
1answer
9 views

CONFIG_NF_CONNTRACK is not set

I am trying to setup iptables on udoo quad but I hit a brick wall and cannot find a fix anywhere: root@udoo:/# uname -a Linux udoo 3.0.35 #10 SMP PREEMPT Wed Jul 30 18:16:10 CEST 2014 armv7l ...
-1
votes
1answer
3k views

/etc/sysconfig/iptables : how to block everything except for port 80 and 22?

My new centos 6.5 cloud server came with this /etc/sysconfig/iptables inside we have: # Generated by iptables-save v1.4.7 on Mon Jun 16 20:04:05 2014 *filter :INPUT ACCEPT [8:607] :FORWARD ACCEPT ...
7
votes
2answers
15k views

Port forward to VPN Client?

I've run into a bit of a puzzle and haven't had much luck finding a solution. Right now I am (sadly) connected to the net via Verizon 3G. They filter all incoming traffic so it is impossible for me to ...
0
votes
1answer
47 views

iptables do not work, very slow to process on Debian 8

I never had issues with Debian 7 using iptables. However, with Debian 8, I cannot get iptables to work at all. Simple script like this takes several minutes to load and can't access my portal page. ...
0
votes
0answers
8 views

PPTP IPs different than LAN ips

in /etv/pptpd.config I have: localip 1.0.0.1 remoteip 10.0.0.100-200 my server real IP is 192.168.1.40 (my LAN is 192.168.1.0) is it OK to do it? how I can route it so the clients with ...
1
vote
1answer
14 views

Using IPTables to Block Ports to Class A Subnets While Allowing Web Ports (80/443)

This is about a cPanel server which, like most servers, is under constant attack from lands afar. Considering that I only host to clients in the US and Canada, there is less of a reason to allow full ...
2
votes
1answer
15 views

route some traffic in subnet to other gateway

I want to route traffic destined for 192.168.5.0/24 to a gateway of 10.1.10.24, but all other traffic to a gateway of 10.1.10.1. I tried: ip route add 192.168.5.0/24 via 10.1.10.24 but it seems to ...
0
votes
1answer
23 views

How to find what custom config is used by iptables?

I need to open custom iptables config, and change old IP adrees to new. How i can find what custom config is used by iptables?
-1
votes
1answer
37 views

Centos 7 - firewalld - passthrough traffic with firewall-cmd

How can I allow traffic from some hosts network A (behind eth0 interface) through my centos 7 box to network B (some hosts behind eth1). network A: 1.1.1.0/24 network B: 2.2.2.0/24 Firewall ...
1
vote
2answers
44 views

iptables -I FORWARD -j DROP does not cut existing connections

Have a router with openwrt. Want to temporarily cut all transit traffic without changing router's configuration. Do: iptables -I FORWARD -j DROP New connections cannot be established now, but ...
0
votes
0answers
34 views

CentOS 6.6 iptables hit count maximum value

I'm working on CentOS 6.6. I'm trying to change the default value of iptables 'hitcount'. But I'm not sure how to change it. I referred to this link for reference. Two problems I see here: I ...
2
votes
0answers
10 views

How to unwrap a tunneled packet in iptables/netfilter and process the tunneled packet

I have a specific question regarding the Linux netfilter/iptables interaction. Let's say I have an IP packet P1 inside of another IP packet P2 (that is, P1 is tunneled). Now, the question is as ...
0
votes
0answers
35 views

enable/disable domain redirection

My router can be joined by clientes. enable // I'd like to redirect all trafic to an IP (13.37.42.1), I mean any IP and any domain. disable // Then I d like to be able to disable it. Then clients ...
1
vote
1answer
593 views

Bridged TAP interface to virtualbox

I need bridged TAP interface on client side of my VPN to virtual machine. I use VirtualBox 4.3.12. But in Adapter Network options in Attached to: Bridged adapter I do not see my TUN adapter. I have ...
3
votes
2answers
644 views

Policy routing with load balanced ppp connections

This my setup using Debian 6.0. 6. It's role is a proxy server and a load balancer using eight 3G modems. Whenever a ppp connection dials it takes over the default gateway which is ok but it also ...
0
votes
0answers
53 views

How to stop default iptables rules being added after reboot in fedora?

I changed from the default firewall (firewalld) back to iptables in the latest release of fedora. This is because iptables is what I use in Debian and I have already learned how to use it, whereas i ...
0
votes
2answers
26 views

Using IPtables to block outgoing traffic to a TAP interface from a LAN IP address or subnet

How can I configure IPtables to block outgoing traffic to a TAP interface from an IP or subnet?
5
votes
1answer
736 views

What are the definitions of addrtype in iptables?

I am keen to use addrtype in combination with -src as a rule in one of my filter chain like so to drop some bogon ips: -A INPUT -p tcp --dport 80 -m addrtype --src-type UNICAST ! -s 127.0.0.0/8 -j ...
3
votes
1answer
150 views

Route VPN traffic through different proxies

I want to setup VPN server and route (based on my routing algorithm) all traffic through different proxy servers. Let's say I have one host, with many users, connected to my VPN. I want to route all ...
1
vote
1answer
33 views

Redirect outbound traffic on LAN going to port 443 to port 80 or 8080 instead

How would I achieve this, I've tried using iptables a bit but have had no success at all. Any help at all would be appreciated. I basically just want it so that whenever a user on my LAN attempts to ...
2
votes
3answers
60 views

Is there a command to deny an IP

Looking at the access log I found excessive access from an IP address. I then edit either .htaccess or .conf files to deny access from that IP. I wonder if there is a command or a oneliner that can do ...
0
votes
1answer
88 views

ubuntu lts and cgroup support in iptables [closed]

I don't understand why Ubuntu community built iptables without cgroup support and what I don't understand if community didn't make it? Maybe Ubuntu use another some way (iptables without cgroup etc)? ...
4
votes
3answers
1k views

Port fowarding and load balancer in ubuntu server 12.04

I am looking to create a load balancing server. Essentially here is what I want to do: I have a public IP address, lets say 1.1.1.1 I have a second public IP address, lets say 2.2.2.2. I have a ...
1
vote
0answers
13 views

What do the fields in /proc/net/ipt_hashlimit/FILE mean?

What do the fields in /proc/net/ipt_hashlimit/FILE mean? These files are created upon iptables -A CHAIN -m hashlimit--hashlimit-name FILE [...] [...] 9 198.51.100.23:0->0.0.0.0:0 80000 80000 160 ...
1
vote
0answers
25 views

iptables blocking incoming FTP traffic 2/3 minutes after being reset

On CentOS 6.6- At first, iptables was blocking access to my FTP server at all while it was on. After some research I added the lines to /etc/sysconfig/iptables that are suggested in the question ...
5
votes
1answer
47 views

IPtables - new vs new, established, related

I'm «pretty» new to IPtables, or I have used IPtables a few years, but never with advanced features. I understand the concept of stateful IPtables rules, but recently I discovered that some people ...
1
vote
0answers
38 views

Change timeout of an entry of ipset with iptables rule

I'm trying to create a set with ipset and using it in some iptables rules. ipset has timeout option to set a countdown timeout to an entry of a set to automatically remove it after a period of time. ...
2
votes
2answers
2k views

Iptables GEOIP not working under Debian Squeeze

I've just installed xtables-*, compiled the geoip database, but when I try to use an iptables command it always gives back the following error: Command: iptables -I INPUT -p tcp --dport 80 -m geoip ...
1
vote
2answers
53 views

Iptables exception for specific port

I'm new to iptables but configured a simple natting today on my raspian: # Always accept loopback traffic /sbin/iptables -A INPUT -i lo -j ACCEPT # Allow established connections, and those not ...
0
votes
0answers
31 views

Redirect external ip to localhost on ubuntu

I have an application running on an EC2 ubuntu instance. I have mongo db running on the same instance. I have ElasticMapReduce which gets data from MySQL and puts it in the mongo db on the application ...
1
vote
2answers
1k views

ping: unknown host with iptables enabled

I can't ping www.google.com. However I can ping the IP address: ping 74.125.237.142 At first, I thought it is a problem with my DNS settings. But I checked my resolv.conf, hosts, and hostname ...
1
vote
0answers
45 views

Howto configure linux router to allow clients to use maximum bandwidth?

The problem is that I'm always limited on the final client machine to about 1/3 (one third,about 200/300kb) of the internet hotspot bandwidth when testing download speed with wget. I have configured ...
0
votes
2answers
95 views

How to let the Firewall of RHEL7 the SNMP connection passing?

How to let the Firewall of RHEL7 the SNMP connection passing? When I did this command on the computer: systemctl stop firewalld All the SNMP packet are passing well. When I restarted firewalld ...
8
votes
2answers
13k views

Why are some ports reported by nmap filtered and not the others?

I'm scanning a server which should have a pretty simple firewall using iptables: by default everything is DROPped besides RELATED and ESTABLISHED packets. The only type of NEW packets allowed are TCP ...
0
votes
2answers
308 views

ipset not executing from crontab

I have this txt files that contains IPs, one per line of file, that I want to block using ipset. I have this bash script that essentially reads from the plain txt file and constructs an array. Then ...
1
vote
0answers
58 views

GUI for NFTables, like fwbuilder

We have several clients where we use linux based (iptable) firewalls. To manage the rulesets we currently use fwbuilder to manage the firewalls and the relations between the different firewalls. So ...
1
vote
0answers
20 views

How can I monitor iptables classification applied by OpenWRT QoS, preferably live?

I set up a bunch of quality of service rules in OpenWRT, which then are translated to iptables rules. For debugging purposes, I'd love to see how the different connections are binned into, which would ...
0
votes
2answers
1k views

Route wlan0 to openVPN tunnel and rest to eth0

I'm having problems to create route/iptables rules for following configuration: I have an openVPN server (tun type) running on my raspberry machine at home At work i have company pc (behind proxy) ...
0
votes
1answer
60 views

Bridge and iptables postrouting

I have a Linux 3.14 PC with three NICs and a bridge between two of the NICs (eth1 and eth2). My Question Why is there no traffic passing through the POSTROUTING rule? FYI, traffic is passing ...
0
votes
1answer
43 views

Effect of limiting tcp connections through iptables to limit ssh sessions

I have limited no. of tcp connections through iptables to limit total number of ssh connections. Now when i am adding a rule with maximum limit of tcp connections lesser than currently opened ssh ...
0
votes
1answer
22 views

Docker: personal ip but another network

Recently i found this for give to docker a "personal" ip ip addr del 10.1.1.133/24 dev eth0 ip link add link eth0 dev eth0m type macvlan mode bridge ip link set eth0m up ip addr add 10.1.1.133/24 dev ...