iptables allow creation of rules to define packet filtering behavior.
6
votes
2answers
5k views
Output traffic on different interfaces based on destination port
My question is basically the same as Only allow certain outbound traffic on certain interfaces.
I have two interfaces eth1 (10.0.0.2) and wlan0 (192.168.0.2).
My default route is for eth1.
Let's say ...
5
votes
2answers
980 views
How to restrict internet access for a particular user on the lan using iptables in Linux
Let's say there are two users on the LAN, A and B. How do I restrict user A from internet access using iptables rules and saving the rules so that after reboot, they are still effective. And suppose I ...
2
votes
1answer
1k views
iptables/pf rule to only allow XY application/user?
I think there is no iptables/pf solution to only allow an XY application on e.g.: outbound tcp port 80, eth0. So if I have a userid: "500" then how could I block any other communications then the ...
7
votes
3answers
4k views
Only allow certain outbound traffic on certain interfaces
I have rather an odd issue. I have a server with two network interfaces eth0 and eth1. Each are connected to a different network. Each network has a internet gateway. The server has various outbound ...
7
votes
1answer
842 views
Dual network connection
I have a usb cellular modem and a Home LAN connection on my Ubuntu 10.10 box.
Both work independently.
I want to know how to have both connected at the same time, and be able to specify which ...
5
votes
2answers
2k views
Per process firewall?
I've been reading around but can't seem to find a way to create per-process firewall rules. I know about iptables --uid-owner but that only works for outgoing traffic. I've considered scripting ...
4
votes
1answer
2k views
iptables port-mirroring
I need to be able to get a copy of packets received on port 8001 to port 8002. I have tried the following but I get an error that --tee is undefined.
sudo iptables -t nat -A PREROUTING -p TCP -s ...
4
votes
6answers
4k views
iptables to block https websites
I wish to block a few websites that also run upon https, like facebook, twitter, and gmail, in my organization. Squid is not supposed to be used here as per the orders from higher management. We can ...
12
votes
3answers
762 views
Can I limit a user (and their apps) to one network interface?
As the title really. I've actually got two scenarios to apply this:
Multiseat Desktop: two network connections both with internet gateways and two accounts doing bandwidth-intensive tasks on each. I ...
9
votes
2answers
4k views
Reply on same interface as incoming?
I have a system with two interfaces. Both interfaces are connected to the internet. One of them is set as the default route; a side effect of this is that if a packet comes in on the non-default-route ...
2
votes
2answers
3k views
iptables: allow certain ips and block all other connection
How do I allow certain ips and block all other connection in iptables?
7
votes
1answer
3k views
Why are incoming packets on a TAP interface seen with tcpdump but not with iptables?
A program injects packets on a Linux TAP interface (these packets are coming from a virtual machine). Specifically, these are DHCP requests (so they're UDP). I can see the packets with tcpdump but not ...
4
votes
2answers
2k views
Iptables: matching outgoing traffic with conntrack and owner. Works with strange drops
In my iptables script I have been experimenting with writing as finely grained rules as possible. I limit which users are allowed to use which services, partly for security and partly as a learning ...
4
votes
2answers
2k views
What prevents a machine from responding to pings?
I have a CentOS release 5.4 linux box on Amazon EC2 that I'm trying to set up to be monitored via Nagios. The machine is in the same security group as the nagios server, but it seems to be ...
4
votes
4answers
3k views
Set some firewall ports to only accept local network connections?
Basic firewall question:
How do I set up the firewall on a system in a LAN so that some ports are only open to connections from the local area network, and not from the outside world?
For instance, ...
4
votes
1answer
1k views
Is it possible to redirect a logging output of the iptables' LOG chain into a separate log file?
I don't want to mix iptables's log output with other system logs. How could I specify a dedicated log file for iptables LOG chains output?
3
votes
1answer
176 views
Is there a standard way to configure what policy iptables loads on startup under Debian?
I've just started playing with Debian 6.0 (Squeeze) in a VPS environment, as a way to learn more about system administration.
One thing I'd like to configure is a default packet filtering policy. ...
2
votes
1answer
588 views
system wide SOCKS5 Proxy
I connect to my Server on the internet using ssh -D 3128 user@rootserver.com. If I am right I thereby open a SOCKS v5 Proxy to my Server. Using firefox and FoxyProxy I can now add this to my proxys ...
2
votes
1answer
765 views
iptables rule to allow access to internet
I made default policy of my machine-
iptables -A INPUT -j REJECT #DROP ALL PACKETS TO INPUT CHANNEL
INPUT channel has been blocked. Now I want to allow only some specific services like I should be ...
2
votes
2answers
2k views
How to redirect kernel messages having the unique id substring into separate log file (using `rsyslog`)?
I am using iptables's logging feature to debug my network activity. I use certain prefix with --log-prefix parameter to uniquely identify messages in kernel log belonging to iptables output, for ...
1
vote
1answer
599 views
0
votes
3answers
408 views
How to make sense of an iptables chain configuration
This is about how to make sense of the chains found in the iptables default configuration on a typical home router running OpenWrt (a stripped down Linux for router devices), but which ultimately may ...
