iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

0
votes
0answers
2 views

SSL Strip Attack: Confusion with “echo 1 > /proc/sys/net/ipv4/ip_forward”

In the SSLStrip attack, one has to enable IP-forwarding using the command "echo 1 > /proc/sys/net/ipv4/ip_forward" I understand this command enables the host to work as a router forwarding packets ...
1
vote
1answer
25 views

tcp tunnel inside local network with iptables and bridge involved

I want to configure outside and inside forwarding rules to behave the same way, and simplified problem that i have with 'inside part' is like this: if i have compA - eth0 192.168.0.1 compB - br0 ...
2
votes
1answer
19 views

Using iptables to stop brute force attacks on a Apache https site

I have a TLS site Apache which uses Basic Authentication to protect resources. I'm trying to setup an iptables rule to prevent brute force attacks on port 443, so I've added the following iptables ...
0
votes
0answers
10 views

Troubleshoot routing in rewrite/virtual host

I don't want a solution as much as a way to find the problem. I am learning networking mostly because it interests me and I set up something in my uncles restaurant. It looks like this. A soft AP ...
2
votes
0answers
31 views

privoxy or any proxy server on Linux forward requests to multiple different proxy servers

I'm a stack exchange Virgin. Is it possible to forward data to the parent proxy based on the listen-address port in was recieved For example my firefox browser is set to use proxy 90.91.92.93:8118 ...
9
votes
1answer
278 views

Linux iptables ssh port forwarding (martian rejection)

I have a Linux gateway performing NAT for my home network. I have another network which I'd like to transparently forward packets to, but only to/from specific IP/ports (ie. not a VPN). Here's some ...
1
vote
2answers
2k views

iptables - Redirect web traffic to LAN Server

I have a webserver which is running on ip address 192.168.11.100 How can i use iptables to redirect all web traffic (http and https) to my webserver on LAN? After that i want to add except list mac ...
2
votes
1answer
967 views

Corosync & Pacemaker IPTables Rules

When using Corosync with two rings via multi-cast addresses 226.94.1.1 (Port 5405) & 226.94.1.2 (Port 5406) what iptables rules are required to allow two nodes to communicate optimally without ...
1
vote
0answers
43 views

How to do iptables nat loopback?

I have a linux server behind the ISP's cablemodem-router combo. With some hacking I was able to make the port forwarding work, and the DHCP exceptions in the udhcpd. But I wasn't able to do the NAT ...
3
votes
2answers
162 views

Why doesn't iptables receive the marked packet?

I was learning the ping command options. In that I found the -m option to set the mark for a packet. The below command sends the packet with marking of 10 to the 192.168.2.65. ping -m 10 ...
0
votes
1answer
18 views

How does this work in firewalld? iptables accept all [closed]

On Ubuntu with plain iptables, filter table, INPUT chain: Chain INPUT (policy ACCEPT) num target prot opt source destination 1 ACCEPT all -- anywhere anywhere ctstate ...
2
votes
1answer
569 views

How would I go about getting UPnP working on a Slackware server/firewall?

I'm a long time fan of Slackware and I've always had a machine serving as my main server/firewall with the latest version installed. I have it now but I'm struggling to find information on how to ...
1
vote
1answer
2k views

iptables allow only ssh and vpn traffic

I have dedicated server with ubuntu 14.10 installed. The server should connect to an openvpn server and the traffic should only go through the vpn, except for SSH traffic. My idea is to realize it ...
0
votes
0answers
13 views

iptables traffic redirecting going wrong - UDP forwarding from proxy

good evening! I have a proxy running HAProxy and iptables in my network (and that proxy is behind another firewall and NAT). So far, I've been doing only TCP redirects to servers using HAProxy, and ...
0
votes
2answers
77 views

iptables forward traffic to vpn tunnel if open

I've used the following guide to set up my raspberry pi as an access point: Raspberry Pi 3 as wifi access point I'm forwarding wlan0 to eth0 and NATing all my traffic. Works great! sudo iptables -t ...
1
vote
0answers
44 views

Is an SSH connection timeout expected when iptables is set to REJECT?

We’re setting up a firewall for a machine that should allow: incoming SSH connections from particular IP addresses; ICMP, except for redirect. We’ve opted to use REJECT over DROP, at least until ...
12
votes
3answers
42k views

iptables: allow certain ips and block all other connection

How do I allow certain ips and block all other connection in iptables?
2
votes
1answer
2k views

forward packets from one interface to another interface using iptables

I have an embeded system with 2 interfaces e0 and m0, whose ips are 10.0.0.20 and 192.168.0.20, respectively. Incoming packets into e0 have an ip of 10.0.0.10 and should be forwarded to m0 interface ...
0
votes
1answer
30 views

iptables redirect via url to localhost vhost

I'm trying to set up a test environment for a mobile app. I have a machine acting as a gateway and providing dhcp on 192.168.10.0/24, and serving pages from apache. How would I set up iptables rules ...
2
votes
2answers
30 views

Debian 8 - IPTables reverts to state on every packet

Problem: iptables cannot be changed. On my computer, I can run iptables -F. iptables -L shows it is flushed. When any packets come into or out of the machine, all rules are back! The same behaviour ...
2
votes
1answer
80 views

How can I mark a flow with iptables?

I read this tutorial, however I am considering a method to load balancing for Internet connection by applying iptables rule on 2 interfaces. The following is my iptables rule. #!/bin/sh ...
0
votes
0answers
24 views

ubuntu 14.04 create route to multicast stream server and have access udp://239.255.0.169:5500

My server is ubuntu 14.04 server edition and I am trying to re stream existed multicast stream by my server : Multicast stream server is using udp://239.255.0.169:5500 destination ip. On my side I ...
2
votes
1answer
59 views

How to add marks together in iptables (targets MARK and CONNMARK)

When you want to mark a packet in iptables, you would generally add the following line to your firewall script: iptables -t mangle -A POSTROUTING -p tcp -m multiport --dports 80,443 -j MARK ...
2
votes
1answer
91 views

What is the meaning of UNCLEAN state in iptables

What is the meaning of UNCLEAN state in iptables? Example: iptables -A INPUT -m conntrack --ctstate UNCLEAN -j DROP This actually gives me an error, but there should exist an unclean state. ...
4
votes
2answers
2k views

Iptables GEOIP not working under Debian Squeeze

I've just installed xtables-*, compiled the geoip database, but when I try to use an iptables command it always gives back the following error: Command iptables -I INPUT -p tcp --dport 80 -m geoip ...
0
votes
1answer
24 views

iptables connection mark not balance

The following is my network topology: + + | | | | | | | ...
0
votes
1answer
13 views

Does 'multiport' make a difference in terms of efficiency?

Can any one can say definitively that using the --multiport extension with iptables rules: Is faster than creating a rule per port? Is slower than creating a rule per port? Makes no difference? If ...
0
votes
1answer
25 views

How to do Masquerading with NFTables

How would I implement a masquerading rule like this iptables one in NFTables: iptables -t nat -A POSTROUTING -s 10.5.6.0/24 -o eth0 -j MASQUERADE I've looked for it, but couldn't find out how to ...
3
votes
2answers
2k views

How can I Forward a subDomain to a specific port?

My apologies if this has been asked before. I haven't found an adequate solution so... yeah. When a specific domain, "example.com" is accessed, I want it to act normally. In other words, it should go ...
0
votes
1answer
92 views

how to find out which chain in iptables in listing

Suppose I have the following two entries line of iptables: iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE iptables -A INPUT -s 192.168.1.0/24 -j DROP So, I have POSTROUTING and INPUT chains. ...
1
vote
0answers
16 views

NFTables NAT not caolled

I have tried to switch from IPTables to NFTables. Everything worked fine, except of NATting. This configuration does nothing when I try to run it, the NAT chains are not called: table ip vms { ...
5
votes
0answers
63 views

Simulate ethernet cable unplugged on a remote machine while staying connected

I am working from home on remote embedded Linux machine "X" via ssh. It has one physical network card. I need to simulate Ethernet cable unplugged condition on the same remote machine "X" , while ...
1
vote
1answer
93 views

iptables rule explanation

I was looking to update iptables in our webserver which would prevent DoS attack to an extent. 1) Related to web traffic, below are the iptables rules i found. iptables -I INPUT -p tcp --dport 80 ...
0
votes
1answer
17 views

secure my servers with iptables

I have 2 vps servers (debian 7 & 8) with a public IP address and I would like to protect them. I would like to have access only to SSH (public/private keys), openVPN, services that are requested ...
3
votes
0answers
29 views

No “unreachable” response for an outgoing TCP connection when using fwmark and policy routing

I would like to route locally-generated traffic: to a TCP port "A" of host "H" via the interface "A", to a TCP port "B" of host "H" via the interface "B". Interface "B" is sometimes unavailable. ...
1
vote
1answer
28 views

Searching for a solution to set up a reverse proxy for game servers

I run a game server on my dedicated box in country A, which runs Linux and communicates with its clients using UDP. The server has players from both inside and outside Country A. Players within ...
0
votes
0answers
11 views

VLAN sub-interfaces and Netfilter

Is it correct to think that from Netfilter point of view there are no separate packet flows for physical interface(for example eth0) and VLAN-interface associated with the physical NIC(for example ...
7
votes
3answers
86k views

Open port 80 in CentOS 6.5

I'm trying to open the Port 80 in my CentOS 6.5, on my virtual machine, so I can access the apache from my desktop's browser. If you take a look at the screenshot above.... I've added the line ...
0
votes
0answers
25 views

Unable to access http server when ufw is running, on Raspbian?

I have a Raspberry Pi running Raspbian, with Apache2 for the web server. Some recent change seems to have broken my ability to access my web server, when ufw is running. The server simply doesn't ...
3
votes
0answers
43 views

TC (Traffic Control) to control bandwidth

I'm having an issue with a bandwidth script that I've been using for a while to limit the outgoing bandwidth on a port. It worked fine at the beginning until I wanted to change the outgoing port ...
0
votes
2answers
1k views

Route wlan0 to openVPN tunnel and rest to eth0

I'm having problems to create route/iptables rules for following configuration: I have an openVPN server (tun type) running on my raspberry machine at home At work i have company pc (behind proxy) ...
1
vote
2answers
47 views

IP tables for home use

I've been trying to set up rules for a desktop I have in my home network and even though at first this configuration worked, I changed something somewhere and now it won't pass any kind of connection. ...
0
votes
0answers
12 views

iptables for tomato to block all non-vpn traffic

I have been combing through a few forums of many VPNs that have iptables for the tomato router. Most don't work. The one from VPN.ac recommends adding under Administration > Scripts > Firewall ...
2
votes
1answer
25 views

Can you send a TCP packet with RST flag set using IPTABLES as a way to trick NMAP into thinking a port is closed?

I am learning Nmap and a thought occurred to me with regards to a SYN scan... A SYN scan sends an empty TCP packet with the SYN flag set to illicit a response from the target of either RST, ...
4
votes
1answer
90 views

Identifying source of audit messages in kern.log

I recently installed the auditd package on my Debian machine. I did some testing with auditctl, creating a single rule to watch a directory, proved something, and then removed and purged auditd. ...
0
votes
1answer
23 views

Understanding Iptables rules to prevent DDoS

Following IPTables rules exist on my system as some preventive measures against DDoS attacks -A INPUT -s 255.0.0.0/8 -j LOG --log-prefix "Spoofed source IP" -A INPUT -s 255.0.0.0/8 -j DROP -A INPUT ...
3
votes
2answers
2k views

How does iptables MASQUERADE work on the incoming side?

I'm still reading the iptables manual page and other documents and digging around questions and their answers. This is the problem which arises. When we setup the NAT we use a POSTROUTING rule such ...
1
vote
2answers
71 views

How does NAT reflection (NAT loopback) work?

I use the auto generated rules that come from OpenWRT as an example of NAT reflection (NAT loopback). So let's pretend there's a network 192.168.1.0/24 with two hosts (+ router): 192.168.1.100 and ...
0
votes
1answer
19 views

iptables connection refused in VLAN network when iptables configured NAT and port forwarding

I have a static IP X.X.X.X. I configured a Linux server as a router by using iptables. The following figures as my network topology: ppp0 +-------------+ +----------+ ...
0
votes
1answer
36 views

understand chains and tables in netfilter/iptables

As I understand, Linux kernel has five hook points for IPv4 packet flow defined in netfilter_ipv4.h file: /* IP Hooks */ /* After promisc drops, checksum checks. */ #define NF_IP_PRE_ROUTING 0 /* ...