iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

4
votes
1answer
343 views

Using source routing (LSRR) - any ideas?

What I want to do is conceptually very simple, but I can't find any information or help about how to go about doing this. Basically, I want to configure my networking to use source routing (LSRR). ...
1
vote
0answers
12 views

UFW before rules for VPN forwarding

I'm trying to setup an OpenVPN server on Debian 7, following this guide: How to install and set-up OpenVPN in Debian 7 (Wheezy) In step 15 I have to setup forwarding and IPtables rules. I prefer to ...
3
votes
2answers
536 views

Policy routing with load balanced ppp connections

This my setup using Debian 6.0. 6. It's role is a proxy server and a load balancer using eight 3G modems. Whenever a ppp connection dials it takes over the default gateway which is ok but it also ...
0
votes
0answers
22 views

IPTABLES comment: No chain/target/match by that name

Facid with error when adding new rule with 'comment': # iptables -I INPUT 1 --source 66.***.***.78 -j REJECT -m comment --comment "Some" iptables: No chain/target/match by that name. Without ...
0
votes
0answers
25 views

Routing incoming source IP traffic to a loopback IP issue

I'm wanting to accomplish the following: I have a BIND DNS server setup where it is listening on ANY address and also listening in a BIND config ACL on 127.0.1.1. If there is another way where you ...
0
votes
1answer
29 views

IPtables don't block IP

I'm running Postfix SMTP server. Some hosts trying to connect with wrong passwords. warning: s15393678.onlinehome-server.com[74.208.17.126]: SASL LOGIN authentication failed: I'm adding iptables ...
0
votes
1answer
49 views

CentOS 7 iptables problems and doubts?

I have a CentOS 7 image on VM VirtualBox (bridged Ethernet with static IP) I was trying to set iptables filter table but I have the following problems: Whatever I did to open Apache on port 80 ...
0
votes
0answers
7 views

iptables/netfilter behavior if DNAT changes mid-connection

I'm planning to leverage iptables to act as a 'poor-man's active/passive load balancer'. The plan is to have a pair of these rules: -t nat -A PREROUTING -d 10.1.2.3/32 -m condition --condition ...
1
vote
3answers
1k views

Iptables GEOIP not working under Debian Squeeze

I've just installed xtables-*, compiled the geoip database, but when I try to use an iptables command it always gives back the following error: Command: iptables -I INPUT -p tcp --dport 80 -m geoip ...
0
votes
1answer
1k views

Fedora 20, startup script with network settings work correctly but without real effect

First, I love Fedora 20. :) I'm newcomers from Debian/Ubuntu/Suse, but I real like this clean distro. But I found some problems, and can't move forward with this little things. I have 2 PC in home ...
1
vote
1answer
486 views

Understanding the iptables rules created by FirewallD [on hold]

I am having a hard time trying to figure out what the iptables rules generated by FirewallD say. Focusing on the "public" input zone, I have the following rules: *filter :INPUT ACCEPT [0:0] :FORWARD ...
3
votes
0answers
14 views

Which tool is used to create firewall rules on Fedora 20? [closed]

What is a recommended way to set up firewall rules on Fedora 20/Centos 7/RHEL 7 currently? I know about relatively new replacement of itpables service by firewalld service. Which command-line user ...
1
vote
1answer
18 views

How to measure iptables load?

I have added about 3500 IP addresses to iptables using ufw on a Debian 7 and I am wondering if this has any impact on the performance of my server. How can I measure that?
1
vote
1answer
315 views

Webserver establishing new outgoing connections from port 443

I've been trying to configure the firewall on a webserver running Apache using iptables commands. I took the approach of blocking all outgoing connections, except for those that are required. ...
4
votes
4answers
5k views

Restrict bandwidth with DD-WRT

I have DD-WRT installed on my router and I would like to be able to restrict the bandwidth both up and down on a certain IP or Mac address. I am happy to get my hands dirty and use console. I am sure ...
3
votes
1answer
641 views

Port Mirroring in Fedora?

I have set up an application that listens constantly to a port for network packets, and I would like to create another one that receives the same network packets ( for use as a test bed). Getting the ...
1
vote
1answer
61 views

Whitelist IP's in CentOS 7

I want to setup CentOS 7 firewall such that, all the incoming requests will be blocked except from the originating IP's that I whitelist. And for the Whitelist IP's all the ports should be accessible. ...
4
votes
2answers
1k views

Port fowarding and load balancer in ubuntu server 12.04

I am looking to create a load balancing server. Essentially here is what I want to do: I have a public IP address, lets say 1.1.1.1 I have a second public IP address, lets say 2.2.2.2. I have a ...
1
vote
1answer
181 views

DROP all for port 22 if not geoip set of US for iptables and xtables

I want to simply block all ssh access from anywhere but with in the US. This is my whole iptables, and I have followed ...
0
votes
2answers
527 views

Route wlan0 to openVPN tunnel and rest to eth0

I'm having problems to create route/iptables rules for following configuration: I have an openVPN server (tun type) running on my raspberry machine at home At work i have company pc (behind proxy) ...
0
votes
1answer
28 views

Allowing web server communication in Linux firewall

I have a unique situation. Let's say my webserver ( e.g. 10.0.0.2) is connected to eth0 of my firewall (gw 10.0.0.1). A local network (192.168.0.0/24) is also connected to eth1 (192.168.0.1/24) of my ...
0
votes
0answers
26 views

How to bridge the eth0 (ethernet) and eth1 (WiFi_Ap)?

I am in the WiFi test embedded board. The ethernet port eth0 is connected to the Internet. The interface eth1 is caused due to the WiFi chip. The Access Point can be used as a WiFi eth1 is. We use the ...
1
vote
0answers
17 views

What is the point of the second route lookup after OUTPUT?

According to the packet path diagram, and its description: Table 6-2. Source local host (our own machine) [...] Routing decision, since the previous mangle and nat changes may have ...
0
votes
0answers
23 views

bridge or iptables or route?

iptables vs bridge-utils vs route I have two network cards in a Linux server and don't know how to make them communicate. After searching a lot I still don't know which method is the one that should ...
2
votes
1answer
573 views

tun0+ iptables rule

I'm trying to figure out what that + sign means in a rule such as this: -A FORWARD -i tun0+ -j ACCEPT I'm pretty positive it relates to vpn. I noticed a /dev/net/tun interface and a tun0 in ...
0
votes
0answers
16 views

Set source address for incoming packets on a server

I'm developing a UDP reverse proxy for a game server, and so far, everything has gone fine except for one thing - getting the backend server to submit requests to the master server list (run by a 3rd ...
0
votes
1answer
15 views

How to set up a stateful firewall on an am335x Starter Kit board?

In the past, I have used the following script to set up a stateful firewall (on a normal x64 Ubuntu machine) without issue: iptables -P INPUT DROP iptables -P FORWARD DROP iptables -N TCP iptables -N ...
1
vote
0answers
20 views

SNAT with firewall-cmd?

I have an interface with multiple IP Addresses (on CentOS 7), which is in zone "external" (with masquerade on). I want to specify that, if a connectiona attempt to a specific address goes out, to use ...
2
votes
1answer
82 views

Forwarding packets from loopback interface with policy-based routing

I have the following iptables rule: iptables -t mangle -A PREROUTING -p udp -m udp --dport 10000 -j MARK --set-xmark 0x4/0xffffffff which sets fwmark 4 on all udp packets with destination port ...
1
vote
2answers
74 views

ping: unknown host with iptables enabled

I can't ping www.google.com. However I can ping the IP address: ping 74.125.237.142 At first, I thought it is a problem with my DNS settings. But I checked my resolv.conf, hosts, and hostname ...
0
votes
1answer
64 views

Route OpenVPN clients to another different OpenVPN server

I have this scenario.. Server(Primary) with a multiple OpenVPN connections (so server is connected as a client to multiple OpenVPN servers.. lets say secondary servers) This server runs OpenVPN ...
2
votes
2answers
124 views

Tunnel yum traffic through another server via ssh

I am running a Fedora desktop behind a corporate proxy that is blocking yum traffic (specifically *.gz and *.bz2). I have access to a separate RedHat machine via ssh which can download anything it ...
1
vote
2answers
89 views

What network protocols do database servers use?

I have a postgres 9.1 server running on the default port 5432 on an ubuntu 12.04 cloud server. I want to open up the port so I can make remote queries -- but I have to open the port on IP tables, ...
1
vote
0answers
37 views

Iptables and --tcp-flags

If I have the following rule in the nat-table in the prerouting chain: 0 0 REDIRECT tcp -- eth5 any anywhere anywhere tcp flags:FIN,SYN,RST,ACK/SYN redir ports ...
1
vote
0answers
55 views

Forward multicast between two LAN segments (Chromecast)

I've found some rules but most are inconclusive. Chromecast uses DIAL and discovers via multicast from what I've understood.. I have an Ethernet-connected computer which I would like to route via my ...
0
votes
1answer
35 views

How to map IP by iptables ?

I create a network namespace In this namespace, I open a nginx So for now, I can visit web server by 172.17.0.2 What I want to do is mapping this IP to 127.0.0.1 Lets say if I visit 127.0.0.1, I ...
1
vote
0answers
21 views

Is iptables -p proto -m proto redundant?

I keep seeing "-p tcp -m tcp" all over the place, but it looks redundant. Why the '-m' if the '-p' already matches the protocol?
-1
votes
0answers
19 views

iptables forward too many interface

Can I build a FORWARD rule which gives both an in/out and SRC/DST IP host? I need to create a rule that does the following: PC -> switch (non-mgmt) -> Linux Router (VLAN) -> world: block ICMP $ ...
5
votes
4answers
4k views

Help configuring a custom log file for iptables

I'm trying to log dropped packages to a custom file instead of /var/log/messages. To achieve this, I have added these two lines at the end of my configuration file: -A INPUT -m limit --limit ...
0
votes
0answers
49 views

Iptables and Ip6tables redirect traffic

I want to deny all the network traffic and just allow a few ports and redirect them through tor or the socket I have set in /etc/tor/torrc, where tor binds to. And I am currently setting up these ...
1
vote
0answers
32 views

How do I write the rule that has an edge server forward a clients request to an internal network server and back?

I have a network situation as follows: -server1:1.1.1.1 -server2:2.2.2.2 -tunnel 10.8.0.0/24 -client: 3.3.3.3 I'm trying to have client IP 3.3.3.3 do an HTTP request from the 1.1.1.1 server. ...
0
votes
1answer
318 views

iptables Port Forwarding — no service with the port

I have setup a network as in the image below: Firewall (FW) running CentOS 6 has two physical interfaces with subinterfaces: eth0:2 — 10.100.1.78/25 eth0:3 — 10.100.1.79/25 eth3 — 192.168.0.21/24 ...
2
votes
2answers
555 views

Having trouble with packets not making it into Fedora 16 Apache

Background: I haven't done anything with iptables in a few years... I have Fedora 16 running in a VM on VMWare, with my firewall (TomatoUSB) port forwarding to the VM. VM is at 192.168.1.155. I know ...
2
votes
1answer
37 views

iptables routing incoming IP to another destination IP question

I have a test setup: server1:1.1.1.1 server2:2.2.2.2 client: 3.3.3.3 I'm trying to have client IP 3.3.3.3 do a HTTP request from the 1.1.1.1 server. However I want the 1.1.1.1 server to pass this ...
1
vote
1answer
23 views

Does -o and -i make sense when the target host is already connected to the interface specified?

iptables -A FORWARD -s 192.168.20.7 -d 10.10.48.3 -p tcp --dport 25 -o eth1 -j ACCEPT iptables -A FORWARD -s 10.10.48.3 -d 192.168.20.7 -p tcp --sport 25 -i eth1 -j ACCEPT Tuning the firewall of my ...
3
votes
2answers
793 views

Open and redirect port

I'm trying to set up SNMP for a router so I can monitor it from an existing Nagios installation on an off-site server. I'm having trouble getting the router to respond to SNMP requests from the WAN, ...
4
votes
0answers
32 views

Setting traffic class on return packets

I have a network topology: Server <-> router1 <-> router2 <-> router3 <-> edgeRouter <-> "internet" All routers are linux based, and support iptables. The server sets ...
3
votes
1answer
1k views

I opened a port with iptables but still doesnt work

I have a CentOS installation as a guest VM with VirtualBox. I have two ethernet interfaces, eth0 with NAT and DHCP, and eth1 with Host-only adaptor and static IP. I have oracle installed in this ...
10
votes
2answers
1k views

How to ensure SSH port is only open to a specific IP address?

This is my /etc/sysconfig/iptables: It has two ports open 80 apache and 22 for ssh. # Firewall configuration written by system-config-firewall # Manual customization of this file is not recommended. ...
0
votes
0answers
23 views

Sabayon: UFW blocking all incoming connections, although default policies are set to “Allow”

I have the following problem with ufw/iptables: When I start/reboot my computer, ufw fails to load: # ufw status Status: inactive I did enable it: # systemctl enable ufw Still I do have many ...