iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

1
vote
1answer
9 views

iptables, differentiate ports based on hostname

Is there a way, using iptables, to ACCEPT traffic from HOSTNAME1, HOSTNAME2, HOSTNAME3 to port 22 and FORWARD traffic from everyone else to a different port and make the rule persistent? ...
0
votes
1answer
21 views

How to unmask an IP with iptables?

Is there a way to unmask an IP using iptables? I know to mask all-in-one is following by: iptables -t nat -A -POSTROUTING -j MASQUERADE Thanks in advanced.
1
vote
1answer
12 views

iptables: route packets to example.com via public proxy

I want to access certain websites via a public proxy and I can't seem to get it right using iptables. Let's say I want to access example.com having ip address 1.2.3.4 via a public proxy at ...
2
votes
2answers
53 views

How to make Raspberry Pi to receive an IP from a router and also pass another IP to another device?

I know that I could achieve the desired result with an Ethernet switch, but I'm curious if I can get this with some cheaper solution. The idea is as follows: Rapsberry Pi has two Ethernet ports - ...
0
votes
1answer
266 views

can not telnet to a server connection refuse

I have two server with these specifications: IP address: 192.168.1.94 IP address: 192.168.1.221 I want to telnet to the first one from the second one (to port 5029) but I get this error: ...
2
votes
0answers
34 views

debugging iptables when tunneling one VPN through another

I seek to tunnel one SSL VPN (F5, running on my debian laptop==client) through another (OpenVPN, running on a debian linode==server), but lose all client networking (including, e.g., ping) after the ...
2
votes
0answers
34 views

How to use both syn proxy and connlimit rules with iptables?

I want to write both syn proxy and connlimit rules. I want to send packets to syn proxy first because of performance issue. Here is rule sample. I use bridge interfaces but I dont think it is ...
3
votes
2answers
590 views

Policy routing with load balanced ppp connections

This my setup using Debian 6.0. 6. It's role is a proxy server and a load balancer using eight 3G modems. Whenever a ppp connection dials it takes over the default gateway which is ok but it also ...
0
votes
1answer
21 views

iptables configuration for Transparent squid proxy

I have to setup a transparent squid proxy server using iptables and squid. Following is the scenario: [INTERNAL NETWORK] -> [Main Switch] -> [Proxy Server] -> [Firewall] -> [EXTERNAL ...
1
vote
0answers
18 views

iptables / VLAN: interface names

I have just started working with VLANs. My memory was VLAN interface names are the interface name plus dot plus the VLAN ID. And that is what vconfig offers. After some (successful) manual tests I ...
1
vote
0answers
37 views

Limit transfer speed rate by Iptables Rule

I have D-Link Router DSL-2730U that support iptables version 1.4.0 and i want to know if that possible that i can limit a PC transfer speed rate (upload & download) by PC MAC Address using ...
1
vote
1answer
403 views

iptables Port Forwarding — no service with the port

I have setup a network as in the image below: Firewall (FW) running CentOS 6 has two physical interfaces with subinterfaces: eth0:2 — 10.100.1.78/25 eth0:3 — 10.100.1.79/25 eth3 — 192.168.0.21/24 ...
0
votes
1answer
16 views

Using IPTables to block all connections but still be able to backup vServer

my vServer / webserver (OS: Debian squeeze) got hacked and compromised. Therefore I want to use rules in IPTable to block all input and output connections except ssh. Afterwards I want to backup at ...
1
vote
1answer
25 views

How to carry a string over from one chain to another in iptables?

Here's what I'd like to do. In my rule file (which I use with iptables-restore) I have (with limits removed): -4 -A LOGDROP -j LOG --log-prefix "ipt:4:drop " -6 -A LOGDROP -j LOG --log-prefix ...
2
votes
3answers
2k views

Iptables GEOIP not working under Debian Squeeze

I've just installed xtables-*, compiled the geoip database, but when I try to use an iptables command it always gives back the following error: Command: iptables -I INPUT -p tcp --dport 80 -m geoip ...
0
votes
3answers
37 views

Unknown cause for redirect on 80 port

I have an Ubuntu 14.04 server with Apache 2.4.7 running there, hosting one site on 80 port. Today I discovered that every request to 80 port redirects to another website with response: HTTP/1.1 301 ...
0
votes
2answers
734 views

Route wlan0 to openVPN tunnel and rest to eth0

I'm having problems to create route/iptables rules for following configuration: I have an openVPN server (tun type) running on my raspberry machine at home At work i have company pc (behind proxy) ...
0
votes
0answers
32 views

No problem connected by filezilla, but cannot get list when connected by linux CLI client

I built FTP server by VSFTPD, on Raspberry pi, and Inside NAT. Surely set port-forwarding and, it perfectly functional when I connected by filezilla. But, I can't execute LIST(dir) when I connected ...
0
votes
0answers
23 views

DNAT forwarding for FTP: No route to host

I have a single public IP for multiple VM, i need forward multiple ports for FTP service, i write these lines: iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 20:21 -j DNAT ...
1
vote
2answers
662 views

ping: unknown host with iptables enabled

I can't ping www.google.com. However I can ping the IP address: ping 74.125.237.142 At first, I thought it is a problem with my DNS settings. But I checked my resolv.conf, hosts, and hostname ...
1
vote
0answers
13 views

netfilter rules to forward all traffic to a local website by default, and making exceptions to that rule by macaddr

This is for raspbian acting as a gateway. computers -> [eth1] raspberry pi (dhcp) [eth0] -> modem/router -> internet I made an ip forwarding rule which redirects all traffic coming from eth1 ...
14
votes
2answers
11k views

Reply on same interface as incoming?

I have a system with two interfaces. Both interfaces are connected to the internet. One of them is set as the default route; a side effect of this is that if a packet comes in on the non-default-route ...
3
votes
1answer
27 views

How to combine connlimit with IP sets?

connlimit lets me limit the number of connections per client/service. How would I go about to combine such a rule with the IP sets available in more recent versions of the Linux kernel and netfilter?
1
vote
1answer
16 views

Virtulisation IPTables Rules

I haven't been able to find a solution this as of yet. I'm not very experienced in IPTables so any support you can provide will be appreciated. I have a server with a few VMs on there. The main node ...
1
vote
1answer
49 views

What considerations would I need when configuring iptables?

Synopsis I am looking at learning more about Server Administration. I have been running my own web server for a few years although many things were set-up by my friend and now I wish to learn more ...
1
vote
1answer
32 views

Iptables rules for remote mysql server

I have a local mysql database on a centos server which causes a lot of load because there are a lot of queries made towards it. I want it hosted on its own server but i dont want every single ...
4
votes
2answers
10k views

How can I configure syslog.conf file, to log iptables messages in a separate file?

How can I configure /etc/syslog.conf file in order to save log information about iptables in a specific file. I want to save these information separately, so I can extract what I want easily and ...
5
votes
1answer
393 views

What are the definitions of addrtype in iptables?

I am keen to use addrtype in combination with -src as a rule in one of my filter chain like so to drop some bogon ips: -A INPUT -p tcp --dport 80 -m addrtype --src-type UNICAST ! -s 127.0.0.0/8 -j ...
1
vote
1answer
378 views

port forwarding to internal lan server

I've ppp0 --> eth1 and eth0 (internal lan). I need forwarding externel 10022 port to port 8999 of the server 192.168.1.254 iptables -t nat -A PREROUTING -p tcp -i ppp0 --dport 10022 -j DNAT --to ...
3
votes
2answers
937 views

Open and redirect port

I'm trying to set up SNMP for a router so I can monitor it from an existing Nagios installation on an off-site server. I'm having trouble getting the router to respond to SNMP requests from the WAN, ...
4
votes
2answers
1k views

Port fowarding and load balancer in ubuntu server 12.04

I am looking to create a load balancing server. Essentially here is what I want to do: I have a public IP address, lets say 1.1.1.1 I have a second public IP address, lets say 2.2.2.2. I have a ...
0
votes
1answer
26 views

Connection lost to VPS While using iptables by default policy as DROP for INPUT, OUTPUT, FORWARD

I'am using iptables in many server's but now stuck with this issue while using default Policy as DROP. Here is my rules which i have used in VPS, Tried many time's everything seems fine but VPS ...
1
vote
1answer
450 views

DROP all for port 22 if not geoip set of US for iptables and xtables

I want to simply block all ssh access from anywhere but with in the US. This is my whole iptables, and I have followed ...
0
votes
1answer
596 views

iptables redirect traffic from VPN interface to next interface

Can you help me with this problem please? I need redirect all traffic from tun0 interface (OpenVPN tunnel) to eth1 interface. eth1 is internal network behind this system which works as special ...
2
votes
4answers
60 views

How can I lock myself out of a linux box with iptables?

In the Securing Debian Howto I read (about iptables): The tools can easily be misused, causing enormous amounts of grief by completely crippling network access to a system. It is not terribly ...
2
votes
1answer
49 views

iptables drop length and TTL condition doesn't work

With iptables utility on Linux host need to create mini firewall. I need to drop all incoming connections with package length greater than 722 AND TTL greater than 22. Need exactly AND. Drop only if ...
3
votes
0answers
37 views

iptables: using “conntrack” and “recent” modules to block unsolicited packets

When I only allow RELATED and ESTABLISHED packets, and DROP everything else, my firewall rules work perfectly and I have no problems: ### VARIANT A -A INPUT -i wlan0 -m conntrack --ctstate ...
1
vote
1answer
34 views

Observing ping replies under DNAT

I'm confused while trying to understand the DNAT mechanism under below circumstance. My understanding: DNAT = Destination Network Address Translation: Functionality which translates the destination ...
2
votes
1answer
42 views

How do I apply iptables SNAT to packets bound for localhost (INPUT chain)?

I'm setting up a host that has two routes to the public internet: one via my run-of-the-mill home gateway router, the other via a gateway router on a semi-private network (AMPRNet on 44.0.0.0/8). Most ...
0
votes
1answer
47 views

BIND/DNSMASQ query hanging on ubuntu server 14.04.1

I'm testing out a BIND and DNSMASQ configuration on my VPS. When I run a program which submits a bunch of queries (around 10-20 per second) my DNS replies stop coming back for a random amount of time. ...
0
votes
1answer
24 views

iptables rules for machine running as openvpn server

I set up an older laptop as an OpenVPN server for my home network (and a dwarffortress server, but that's beside the point). This is the first time I've set something like this up - I wanted a secure ...
-1
votes
1answer
29 views

iptables routing through firewall

I have a httpd service running on server machine, I have a firewall and internet browser on desktop machine. On server I have a rule that only firewall can access to server: -A INPUT -m state ...
1
vote
2answers
43 views

Redirect outcomming traffic to local server

I have a Apache web server set which listens on port 4000 and I want to use this (local) server as a kind of proxy. The idea is to redirect all the local outcomming HTTP traffic (port 80) to my ...
1
vote
0answers
46 views

Redirecting all non-local traffic from specific ip to external proxy

I currently have a squid proxy running on an external server (outside the LAN, with a public IP). I would like to route all non-local traffic from a specific device through it. That is, any requests ...
2
votes
0answers
32 views

Strange cron behaviour

I have a script that reads a list of IPs from a file, compares with the existing ones in a chain, and adds recently added IPs in the file into that chain. Running the script manually (e.g., ./script) ...
2
votes
1answer
45 views

iptables ruleset causes server to stop answering

I'm trying to configure my proxmox server's firewal and redirections. The aim is to block everything, open the necessary ports for basic services to work and, finally, redirect some ports to virtual ...
1
vote
1answer
62 views

record contents of packets dropped in iptables

I'm trying to find a way to record the entire contents of packets (possibly with tcpdump) that have been dropped according to rules in iptables. At present, I have a rule to log these packets (with a ...
8
votes
4answers
838 views

iptables on tor exit node

I want to run an open Tor router. My exit policy will be similar to ReducedExitPolicy. But I also want to make it hard for the tor network to abuse my resources. Cases I want to prevent clients ...
1
vote
0answers
32 views

Internet sharing disappears when either eth0 or wlan0 gets disconnected

I just got a RasPi B+ and I'm looking to replace the Windows PC that's doing the routing job. What I'm trying to do with the Pi is making it share the connection (wlan0) with another wifi router (via ...
0
votes
1answer
20 views

Does iptables protect from kernel vulnerabilities? [closed]

I read a lot of kernel vulnerabilities which are beyond my understanding. I would like to reduce the risk of an issue related to one. If I block everything other than SSH on a server, will this help ...