iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

9
votes
3answers
18k views

Output traffic on different interfaces based on destination port

My question is basically the same as Only allow certain outbound traffic on certain interfaces. I have two interfaces eth1 (10.0.0.2) and wlan0 (192.168.0.2). My default route is for eth1. Let's say ...
7
votes
2answers
2k views

How to restrict internet access for a particular user on the lan using iptables in Linux

Let's say there are two users on the LAN, A and B. How do I restrict user A from internet access using iptables rules and saving the rules so that after reboot, they are still effective. And suppose I ...
18
votes
4answers
4k views

Block network access of a process?

Is it possible to block the (outgoing) network access of a single process?
12
votes
2answers
4k views

Per process firewall?

I've been reading around but can't seem to find a way to create per-process firewall rules. I know about iptables --uid-owner but that only works for outgoing traffic. I've considered scripting ...
3
votes
1answer
2k views

iptables/pf rule to only allow XY application/user?

I think there is no iptables/pf solution to only allow an XY application on e.g.: outbound tcp port 80, eth0. So if I have a userid: "500" then how could I block any other communications then the ...
8
votes
1answer
1k views

Dual network connection

I have a usb cellular modem and a Home LAN connection on my Ubuntu 10.10 box. Both work independently. I want to know how to have both connected at the same time, and be able to specify which ...
6
votes
6answers
14k views

iptables to block https websites

I wish to block a few websites that also run upon https, like facebook, twitter, and gmail, in my organization. Squid is not supposed to be used here as per the orders from higher management. We can ...
10
votes
3answers
10k views

Only allow certain outbound traffic on certain interfaces

I have rather an odd issue. I have a server with two network interfaces eth0 and eth1. Each are connected to a different network. Each network has a internet gateway. The server has various outbound ...
9
votes
2answers
21k views

iptables --set-mark - Route diferent ports through different interfaces

Short story, 3 interfaces, eth0 (LAN), eth1(ADSL), eth2(4G). eth0 -> eth1: Works (ports 80, 443, 4070) eth0 -> eth2: Doesn't happen This is a graphical representation of the idea: Port 80 & ...
5
votes
4answers
11k views

Set some firewall ports to only accept local network connections?

Basic firewall question: How do I set up the firewall on a system in a LAN so that some ports are only open to connections from the local area network, and not from the outside world? For instance, ...
8
votes
1answer
6k views

What is the difference between -m conntrack --ctstate and -m state --state

I'm reading this howto, and there's something like this: We can allow established sessions to receive traffic: $ sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT ...
5
votes
1answer
4k views

How to understand why the packet was considered INVALID by the `iptables`?

I set up some iptables rules so it logs and drops the packets that are INVALID (--state INVALID). Reading the logs how can I understand why the packet was considered invalid? For example, the ...
5
votes
2answers
5k views

iptables port-mirroring

I need to be able to get a copy of packets received on port 8001 to port 8002. I have tried the following but I get an error that --tee is undefined. sudo iptables -t nat -A PREROUTING -p TCP -s ...
2
votes
2answers
1k views

How can I Forward a subDomain to a specific port?

My apologies if this has been asked before. I haven't found an adequate solution so... yeah. When a specific domain, "example.com" is accessed, I want it to act normally. In other words, it should go ...
3
votes
1answer
2k views

iptables: how to allow traffic from redirected port

I have a web service running on debian 7 and listening on port 8080. I want to redirect 80 to 8080 for inbound connections and allow only port 80. Here is my iptables configuration: root@localhost:~# ...
0
votes
1answer
34 views

viewing firewalld logs via remote login to CentOS 7 server

I have firewalld installed in a remote CentOS server. When I log into the server over the internet as root, I type the following command to access the firewalld logs: journalctl ...
14
votes
2answers
11k views

Reply on same interface as incoming?

I have a system with two interfaces. Both interfaces are connected to the internet. One of them is set as the default route; a side effect of this is that if a packet comes in on the non-default-route ...
5
votes
1answer
9k views

IPTables - Port to another ip & port (from the inside)

I currently have a NAS box running under port 80. To access the NAS from the outside, I mapped the port 8080 to port 80 on the NAS as follow: iptables -t nat -A PREROUTING -p tcp --dport 8080 -j DNAT ...
13
votes
3answers
1k views

Can I limit a user (and their apps) to one network interface?

As the title really. I've actually got two scenarios to apply this: Multiseat Desktop: two network connections both with internet gateways and two accounts doing bandwidth-intensive tasks on each. I ...
11
votes
3answers
26k views

Iptables to allow incoming FTP

i want to allow incoming FTP traffic. CentOS 5.4: This is my /etc/sysconfig/iptables file. # Generated by iptables-save v1.3.5 on Thu Oct 3 21:23:07 2013 *filter :INPUT ACCEPT [0:0] :FORWARD ...
7
votes
3answers
4k views

Limit max connections per IP address and new connections per second with iptables

We have an Ubuntu 12.04 server with httpd on port 80 and we want to limit: the maximum connections per IP address to httpd to 10 the maximum new connections per second to httpd to 150 How can we ...
7
votes
2answers
16k views

iptables: allow certain ips and block all other connection

How do I allow certain ips and block all other connection in iptables?
7
votes
1answer
3k views

Why doesn't my iptables rule work?

I have two interfaces on my VPS: eth0 and eth0:0. I want to block incoming packets on port 80 on eth0:0 using iptables. I tried this, but it doesn't work: iptables -A INPUT -i "eth0:0" -p tcp ...
4
votes
3answers
13k views

How can I redirect ports 80 and 443 to 8080 and 8443 with iptables?

I'm looking at the documentation for a Tomcat 6 webapp called DSpace, specifically in regardds to running Running DSpace on Standard Ports (80 for http:// and 443 for https://) I am trying to use ...
9
votes
2answers
3k views

( /etc/sysconfig/iptables ) “Manual customization of this file is not recommended.” Why?

Editing this file directly /etc/sysconfig/iptables can save me so much headaches so much time and so on... and yet on the very top of the file it says.. Manual customization of this file is not ...
6
votes
2answers
4k views

Iptables: matching outgoing traffic with conntrack and owner. Works with strange drops

In my iptables script I have been experimenting with writing as finely grained rules as possible. I limit which users are allowed to use which services, partly for security and partly as a learning ...
4
votes
1answer
8k views

How can I configure syslog.conf file, to log iptables messages in a separate file?

How can I configure /etc/syslog.conf file in order to save log information about iptables in a specific file. I want to save these information separately, so I can extract what I want easily and ...
4
votes
1answer
2k views

multigateway routing for specific src port

I have two gateway to access internet, somehow I want to load balancing it, so far its working, but some connection or service need persistent gateway IP to be used, so the client should never change ...
2
votes
1answer
2k views

system wide SOCKS5 Proxy

I connect to my Server on the internet using ssh -D 3128 user@rootserver.com. If I am right I thereby open a SOCKS v5 Proxy to my Server. Using firefox and FoxyProxy I can now add this to my proxys ...
7
votes
1answer
7k views

Why are incoming packets on a TAP interface seen with tcpdump but not with iptables?

A program injects packets on a Linux TAP interface (these packets are coming from a virtual machine). Specifically, these are DHCP requests (so they're UDP). I can see the packets with tcpdump but not ...
6
votes
3answers
9k views

What prevents a machine from responding to pings?

I have a CentOS release 5.4 linux box on Amazon EC2 that I'm trying to set up to be monitored via Nagios. The machine is in the same security group as the nagios server, but it seems to be ...
5
votes
4answers
5k views

Help configuring a custom log file for iptables

I'm trying to log dropped packages to a custom file instead of /var/log/messages. To achieve this, I have added these two lines at the end of my configuration file: -A INPUT -m limit --limit ...
4
votes
2answers
64 views

set connection limit via iptables

I want to limit the IP traffic of an application (AceStream Player). The problem is that I get disconnected, if too many IP connections are established. Does anyone know, how to use iptables to limit ...
4
votes
1answer
3k views

iptables: recent module

I am using the "recent" module to prevent port scanning, such as: -A INPUT -i eth0 -m recent --name PORTSCAN --update --seconds 60 -j DROP -A INPUT -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT -A INPUT ...
3
votes
1answer
502 views

Settings when using a bridge

I have a bridge set up between my physical Ethernet interface, eth0, and the virtual interface for OpenVPN, tap0. The bridge has an IP address, and the machine can be contacted on that IP address from ...
2
votes
2answers
173 views

set packet rate limit via iptables

I have a packet rate limit (max. 10 per seconds) which is set by my internet provider. This is a problem if I want to use the AceStream player, because if I exceed the limit I get disconnected. How ...
1
vote
1answer
308 views

DROP all for port 22 if not geoip set of US for iptables and xtables

I want to simply block all ssh access from anywhere but with in the US. This is my whole iptables, and I have followed ...
6
votes
2answers
2k views

Is it possible to redirect a logging output of the iptables' LOG chain into a separate log file?

I don't want to mix iptables's log output with other system logs. How could I specify a dedicated log file for iptables LOG chains output?
5
votes
1answer
444 views

forward outgoing traffic port using iptables

I am trying to forward all outgoing traffic from port 80 to port 8080 using iptables and I tried the following rule, though it did not work: iptables -t nat -A OUTPUT -p tcp --dport 80 -j REDIRECT ...
5
votes
2answers
3k views

How to redirect kernel messages having the unique id substring into separate log file (using `rsyslog`)?

I am using iptables's logging feature to debug my network activity. I use certain prefix with --log-prefix parameter to uniquely identify messages in kernel log belonging to iptables output, for ...
3
votes
3answers
624 views

dmesg flooded with firewall logs

In my iptables, I have a rule which logs dropped packets: -A INPUT -i eth0 -j LOG --log-prefix "FW: " --log-level 7 -A INPUT -i eth0 -j DROP And in /etc/rsyslog.conf, I have ...
3
votes
1answer
205 views

Is there a standard way to configure what policy iptables loads on startup under Debian?

I've just started playing with Debian 6.0 (Squeeze) in a VPS environment, as a way to learn more about system administration. One thing I'd like to configure is a default packet filtering policy. ...
2
votes
2answers
506 views

Tunnel yum traffic through another server via ssh

I am running a Fedora desktop behind a corporate proxy that is blocking yum traffic (specifically *.gz and *.bz2). I have access to a separate RedHat machine via ssh which can download anything it ...
2
votes
1answer
619 views

Why iptables does not fetch information from /etc/sysconfig/iptables on centOs?

I'm new in Linux and encountered with problem with iptables. Here is content of /etc/sysconfig/iptables file # Generated by iptables-save v1.4.7 on Tue Nov 27 21:41:04 2012 *filter :INPUT ACCEPT ...
2
votes
1answer
802 views

iptables rules too restrictive; Drupal webserver cannot access repositories, ntp or even websites

This is a Drupal website running Ubuntu 12.04 LTS on Linode. Someone recently changed our iptables rules and a number of problems started. These include: Our Mollom spam protection is not working ...
2
votes
1answer
2k views

iptables rule to allow access to internet

I made default policy of my machine- iptables -A INPUT -j REJECT #DROP ALL PACKETS TO INPUT CHANNEL INPUT channel has been blocked. Now I want to allow only some specific services like I should be ...
1
vote
1answer
2k views

Redirect http using iptables for an ip range

I have a range of ip addresses (10.13.13.10-19) that I want to redirect all outgoing http traffic to an internal webserver. So if someone in that range tried to access any site, the html from my ...
1
vote
1answer
877 views

Control bandwidth with iptables

How can I control bandwidth in RHEL 5 using iptables?
0
votes
3answers
2k views

How to make sense of an iptables chain configuration

This is about how to make sense of the chains found in the iptables default configuration on a typical home router running OpenWrt (a stripped down Linux for router devices), but which ultimately may ...