iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

3
votes
4answers
116 views

Viewing all iptables rules

I just wanted to ask if there's a way to view iptables rules in a bit more detail I recently added masquerade to a range of ips iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE ...
1
vote
1answer
726 views

DROP all for port 22 if not geoip set of US for iptables and xtables

I want to simply block all ssh access from anywhere but with in the US. This is my whole iptables, and I have followed ...
0
votes
1answer
36 views

to allow certain ips and block all other connections on AMAZON EC2 ubuntu 12.04

How do I allow certain IPs and block all other connection in iptables on AMAZON EC2?
0
votes
1answer
14 views

FTP passive mode, fails

Hi I am trying to setup iptables to allow FTP. When I connect with FTP, i get the following message in my filezilla. Status: Connected Status: Retrieving directory listing... Command: PWD ...
2
votes
2answers
60 views

How can I allow SSH and SMTP only using IPTables?

I've got a raspberry pi set up to send me periodic emails. As it's connected to the internet 24/7, I need IPTables set up properly. I want to allow incoming SSH and allow emails to send out on port ...
6
votes
2answers
12k views

IPTables - Port to another ip & port (from the inside)

I currently have a NAS box running under port 80. To access the NAS from the outside, I mapped the port 8080 to port 80 on the NAS as follow: iptables -t nat -A PREROUTING -p tcp --dport 8080 -j DNAT ...
0
votes
1answer
25 views

Unable to setup iptables for ftp passive mode [duplicate]

I tried the following rules to allow FTP: # The following two rules allow the inbound FTP connection iptables -A INPUT -p tcp --sport 21 -m state --state ESTABLISHED -j ACCEPT iptables -A OUTPUT -p ...
15
votes
3answers
44k views

Iptables to allow incoming FTP

I want to allow incoming FTP traffic. CentOS 5.4: This is my /etc/sysconfig/iptables file. # Generated by iptables-save v1.3.5 on Thu Oct 3 21:23:07 2013 *filter :INPUT ACCEPT [0:0] :FORWARD ...
0
votes
0answers
10 views

Measure data submited to a blocked ip adress in iptables

With: sudo iptables -A INPUT -p all -d $ip -j DROP One can drop all packets submitted to an ip adress (or a range of ip adresses). This method is useful if you want to prevent applications from ...
0
votes
1answer
29 views

How to redirect all HTTP request to a local web server

How to redirect all HTTP request to a local web server, supposing we don't have an internet connections Exemple Web server with @IP 192.168.1.1, running apache Client with @IP 192.168.1.X making a ...
-1
votes
0answers
42 views

Interfaces, IPTables, Connections, Local Connection - Confused :/

I configured my iptables today and ran into some questions i could not resolve yet. So it would be nice, if someone could verify or answer the following to clarify: Each interface can be configured ...
4
votes
2answers
1k views

Port fowarding and load balancer in ubuntu server 12.04

I am looking to create a load balancing server. Essentially here is what I want to do: I have a public IP address, lets say 1.1.1.1 I have a second public IP address, lets say 2.2.2.2. I have a ...
1
vote
1answer
22 views

Linux IPTables - Ignore Range of IPAddresses

I am currently modifying some of my IPtables rules on a public server and have run into a bit of a dilemma. The goal is to do the following: Rate limit the amount of SSH connections that can be made ...
1
vote
0answers
12 views

equivalent of iptables rule in ip6tables

I m newbie in the iptables. I have the following iptables rules in the source code of a project iptables -t mangle -I PREROUTING ! -i br0 -p TCP --dport 45 -j MARK --set-mark 0x1000 iptables -t nat ...
0
votes
1answer
20 views

Route a port through a network interface

I'm using OpenVPN on Ubuntu Server to connect to my VPN. That network interface is tun0. All traffic currently goes through the VPN. I'd like to exclude traffic that goes over a specific port, and ...
1
vote
0answers
36 views

Block all tor traffic from my server

I'm trying to prevent all traffic from Tor exit nodes from hitting my website. I've searched and have attempted a few of the solutions, this is what I've done. I curled the ...
0
votes
1answer
1k views

iptables redirect traffic from VPN interface to next interface

Can you help me with this problem please? I need redirect all traffic from tun0 interface (OpenVPN tunnel) to eth1 interface. eth1 is internal network behind this system which works as special ...
1
vote
0answers
40 views

Valid iptables Firewall on DD-WRT to access Internet on a Virtual Access Point

Device: Linksys WRT54G v5.1 Firmware: DD-WRT v24-sp2 (07/22/09) micro - build 12548M NEWD Eko I use this router as an AP with 2 SSIDs (Private wl0 + Guest wl0.1) and I connect it to a switch ...
3
votes
2answers
618 views

Policy routing with load balanced ppp connections

This my setup using Debian 6.0. 6. It's role is a proxy server and a load balancer using eight 3G modems. Whenever a ppp connection dials it takes over the default gateway which is ok but it also ...
0
votes
2answers
45 views

Routing Configuration sending some traffic over VPN

I have a DD-WRT router with an OpenVPN service configured. I'd like to send only certain source IP's over the vpn connection. I believe my current routing table (as seen with netstat -rn) sends all ...
5
votes
1answer
618 views

What are the definitions of addrtype in iptables?

I am keen to use addrtype in combination with -src as a rule in one of my filter chain like so to drop some bogon ips: -A INPUT -p tcp --dport 80 -m addrtype --src-type UNICAST ! -s 127.0.0.0/8 -j ...
0
votes
3answers
60 views

How does the iptables work with IPv6?

I would like to set up a firewall on Linux Debian for IPv6. It is important to use iptables for me. I have tried to change the ipv4 folder to ipv6. How can I set up iptables for IPv6?
0
votes
1answer
31 views

Forward traffic coming into dummy interface on to another interface(?)

Can I forward traffic coming into a dummy interface on to another interface? Or is it not a real interface at all even? Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot ...
1
vote
1answer
17 views

Unexpected netstat output in DNAT conditions

So, here I have a basic setup with SOCKS5 proxy listening on, oh, say 8123 I redirect TCP to the proxy via iptables From iptables perspective everything looks peachy, iptables -t nat -v -L shows ...
2
votes
1answer
26 views

package from IP arrives at certain port => open portrange to IP for x seconds

I have been toiling with an issue on iptables: I am trying to make a portrange open to a specific IP for x seconds/minutes as a result of a single packet being sent to a specific port. Not exactly ...
0
votes
1answer
30 views

Change iptables log format

Is it possible to change the log format of iptables ? I want to add the ssh_client in the log. I have already made an iptables rule for outgoing ssh iptables -I OUTPUT -p tcp --dport 22 -j LOG ...
1
vote
2answers
1k views

ping: unknown host with iptables enabled

I can't ping www.google.com. However I can ping the IP address: ping 74.125.237.142 At first, I thought it is a problem with my DNS settings. But I checked my resolv.conf, hosts, and hostname ...
28
votes
5answers
5k views

Block network access of a process?

Is it possible to block the (outgoing) network access of a single process?
0
votes
0answers
16 views

“VPN connection failed” when ufw is on even if there are no rules in ufw interface

Ubuntu 14.04 After update related with ufw and switching nvidia drivers back and forth, suddenly, I can't establish VPN connection to internet. I've deleted all rules and reseted profile in ufw ui but ...
0
votes
0answers
33 views

ubuntu lts and cgroup support in iptables

I don't understand why Ubuntu community built iptables without cgroup support and what I don't understand if community didn't make it? Maybe Ubuntu use another some way (iptables without cgroup etc)? ...
1
vote
0answers
24 views

How to match properly against an IP set of type 'hash:ip,port'?

My current setup is that I have a server with several IPv4 addresses. Let's ignore the IPv6 part for now, as the symptoms are identical there. In the firewall rules I'd like to match against HTTP ...
1
vote
1answer
504 views

Bridged TAP interface to virtualbox

I need bridged TAP interface on client side of my VPN to virtual machine. I use VirtualBox 4.3.12. But in Adapter Network options in Attached to: Bridged adapter I do not see my TUN adapter. I have ...
2
votes
2answers
1k views

Iptables GEOIP not working under Debian Squeeze

I've just installed xtables-*, compiled the geoip database, but when I try to use an iptables command it always gives back the following error: Command: iptables -I INPUT -p tcp --dport 80 -m geoip ...
4
votes
0answers
256 views

iptables rule no actions on scapy packets

I wrote this rule to change all udp destination IP addresses to 8.8.8.8 when dport is 53: iptables -t nat -A OUTPUT -p udp -m udp --dport 53 -j DNAT --to-destination 8.8.8.8 The rule worked when ...
2
votes
1answer
481 views

iptables Port Forwarding — no service with the port

I have setup a network as in the image below: Firewall (FW) running CentOS 6 has two physical interfaces with subinterfaces: eth0:2 — 10.100.1.78/25 eth0:3 — 10.100.1.79/25 eth3 — 192.168.0.21/24 ...
0
votes
2answers
914 views

Route wlan0 to openVPN tunnel and rest to eth0

I'm having problems to create route/iptables rules for following configuration: I have an openVPN server (tun type) running on my raspberry machine at home At work i have company pc (behind proxy) ...
14
votes
1answer
5k views

Is it better to set -j REJECT or -j DROP in iptables?

There's an example of iptables rules on archlinux wiki: # Generated by iptables-save v1.4.18 on Sun Mar 17 14:21:12 2013 *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [0:0] :TCP - ...
4
votes
3answers
4k views

Whitelist IP's in CentOS 7

I want to setup CentOS 7 firewall such that, all the incoming requests will be blocked except from the originating IP's that I whitelist. And for the Whitelist IP's all the ports should be accessible. ...
3
votes
2answers
1k views

Open and redirect port

I'm trying to set up SNMP for a router so I can monitor it from an existing Nagios installation on an off-site server. I'm having trouble getting the router to respond to SNMP requests from the WAN, ...
0
votes
1answer
30 views

Access to webapp from a different machine

So i have three virtual machines (virtual box). One is the router/firewall. It's running snort + snortsam . This machines runs a webapp in tomcat From this machine I'm trynig to access the webapp i ...
1
vote
0answers
117 views

Port forwarding with iptables and PIA VPN for single user

I've gotten a Private Internet Access VPN setup on a Mythbuntu 14.04 machine and I am at wits end trying to get port forwarding working with rTorrent (and ruTorrent). My setup is rTorrent running ...
1
vote
1answer
475 views

port forwarding to internal lan server

I've ppp0 --> eth1 and eth0 (internal lan). I need forwarding externel 10022 port to port 8999 of the server 192.168.1.254 iptables -t nat -A PREROUTING -p tcp -i ppp0 --dport 10022 -j DNAT --to ...
0
votes
0answers
20 views

“iptables -L” isn't showing a rule I just added

I have issue with iptables it's not listing any newly added IPs. I tried both: iptables -A INPUT -s 188.143.232.15 -j DROP and iptables -I INPUT -s 188.143.232.15 -j DROP and service iptables ...
1
vote
1answer
25 views

Allow ftp out through iptables

I have been having difficulty allowing ftp through iptables. Right now my ftp looks like this. Chain INPUT (policy DROP) target prot opt source destination ACCEPT tcp ...
1
vote
1answer
621 views

Randomize external port when doing NAT with iptables

I want to configure a NAT behavior different from the default one implemented by iptables. In this example: iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to-source 193.49.142.107:2000-400 The ...
2
votes
3answers
3k views

How to change user agent on all http requests made from my machine with Squid intercepting proxy?

I'd like to change the user agent on all HTTP requests made from this machine. It's easy enough to change the user agent in each browser, but other apps also make http requests. It's vital I catch ...
1
vote
1answer
44 views

What is blocking: Firewall and tcpwrapper?

Is it possible to find whether firewall(Iptable) or tcpwrapper is blocking a connection without accessing the remote server? (tcpdump?) Thank you,
4
votes
2answers
109 views

Did this tutorial block pings to my server?

I am a programmer teaching myself linux admin stuff. I followed this tutorial to setup a firewall on a VPS. As a part of that tutorial, I block all traffic except for web traffic and SSH traffic. I ...
0
votes
0answers
242 views

Fedora 21 Port Forwarding with firewalld (firewall-cmd); how does it REALLY work? Or, does it?

Fedora's ability to forward ports using the apparently "native" networking software, firewalld, appears to continue to be broken beyond credulity. Please note that it hasn't really worked since at ...
1
vote
0answers
55 views

Redirect all ARP traffic from eth0 to eth1

I would like to redirect ARP traffic, but I'm struggling with arptables and ebtables. I have 2 interfaces: eth0 10.10.10.25 eth1 10.10.10.20 Both in 10.10.10.0/24 I want to redirect the ARP ...