iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

4
votes
0answers
274 views

iptables rule no actions on scapy packets

I wrote this rule to change all udp destination IP addresses to 8.8.8.8 when dport is 53: iptables -t nat -A OUTPUT -p udp -m udp --dport 53 -j DNAT --to-destination 8.8.8.8 The rule worked when ...
3
votes
0answers
83 views

Is it possible to throttle upload bandwidth per `IP` basis using `tc`, `htb` and `iptables` ? (Download limitation not required)

Problem I've searched internet like anything but couldn't find much about limiting upload. The solutions given are not limiting IP basis like this one but LAN as a whole. +-----+ ...
3
votes
0answers
105 views

Restrict the maximum number of independent IP connection on specific port at the same time

I set up a server as a socks5 proxy. I'd like restrict the maximum number(1 or 5 or 20) independent IP connection on specific port at the same time. I have searched on google, only see some articles ...
3
votes
0answers
167 views

iptables: using “conntrack” and “recent” modules to block unsolicited packets

When I only allow RELATED and ESTABLISHED packets, and DROP everything else, my firewall rules work perfectly and I have no problems: ### VARIANT A -A INPUT -i wlan0 -m conntrack --ctstate ...
3
votes
0answers
108 views

Is iptables able to filter off UNREPLIED connections?

I am a using dd-wrt router and trying to get some per-user metrics, I was wondering about filtering only ESTABLISHED connections or include NEW and RELATED, I have read a lot about this last two, but ...
3
votes
0answers
125 views

Route VPN traffic through different proxies

I want to setup VPN server and route (based on my routing algorithm) all traffic through different proxy servers. Let's say I have one host, with many users, connected to my VPN. I want to route all ...
3
votes
0answers
254 views

iptables hangs at applying rules

I have a set of rules that are supposed to give me the most protection before things like fail2ban and other things are added to the mix. The issue is that although everything checks out in the test, ...
3
votes
0answers
98 views

Packets do not cross IP tables Postrouting when originating from an external IP

I'm trying to reflect traffic from the internet to an internal device that I only want to have local access. I have a host in my DMZ that I'm trying to DNAT traffic to this internal device, and SNAT ...
3
votes
0answers
192 views

iCloud stuff stops working while connected to OpenVPN

I have a fairly simple OpenVPN setup on an OpenVZ VPS with Ubuntu 11.10. Client is the Viscosity client on Mac OS X 10.8.2, and after some testing, we can rule out the client as being part of the ...
3
votes
0answers
729 views

tunneling FON traffic via Tor

I would like to tunnel the traffic of my FON router through Tor. For that I added a second network card to a local server and connected the FON router to it. Then I set up a DHCP server and configured ...
2
votes
0answers
19 views

Two ISP and redirecting traffic

I have a gateway with two ISP connected to eth0 and eth2. There is also a eth1 with local network. I'm trying to group some services in one interface and some in the second: incoming traffic 1 ...
2
votes
0answers
49 views

How to explain strange kernel messages?

I have a server running on Debian Wheezy 3.2.68-1+deb7u1 x86_64. Lately strange records in /var/log/messages appeared. First messages of this log starts just after server reboot. 6.222.18 LEN=44 ...
2
votes
0answers
35 views

ip rule not acting on fwmark

I'm trying to use iptables to load balance web traffic over multiple DSL lines by marking the packets and routing based on the mark. I'm working with CentOS 6.6, Kernel 2.6.32-504.16.2.el6.x86_64, ...
2
votes
0answers
47 views

Why is traffic matching the public zone instead of the desired zone?

Trying to self-train on firewalld I set up apache and configured the zones as follows: [root@localhost ~]# firewall-cmd --get-active-zones work sources: 192.168.122.1 public interfaces: ens3 ...
2
votes
0answers
130 views

Routing traffic for specific user to specific interface

I have a Linux box with these interfaces: eth0 Link encap:Ethernet HWaddr 14:da:e9:ef:75:7d inet addr:176.9.85.182 Bcast:176.9.85.191 Mask:255.255.255.224 tun0 Link encap:UNSPEC ...
2
votes
0answers
283 views

restrict IP traffic between VLAN sub-interfaces

I have a router/firewall-PC with two VLAN sub-interfaces eth2.100 and eth2.200: I would like to allow communication between networks 192.168.100.0/24 and 192.168.300.0/24(PC3 network). In addition, ...
2
votes
0answers
48 views

Dropping packets before mangle POSTROUTING

In iptables on Linux 3.10, why do packets which have been DROPed by the FORWARD chain of the standard table still appear in the POSTROUTING chain of the mangle table? -- I'm trying to use the standard ...
2
votes
0answers
57 views

debugging iptables when tunneling one VPN through another

I seek to tunnel one SSL VPN (F5, running on my debian laptop==client) through another (OpenVPN, running on a debian linode==server), but lose all client networking (including, e.g., ping) after the ...
2
votes
0answers
43 views

Strange cron behaviour

I have a script that reads a list of IPs from a file, compares with the existing ones in a chain, and adds recently added IPs in the file into that chain. Running the script manually (e.g., ./script) ...
2
votes
0answers
44 views

VPN tunnel to two services on two servers?

I've got 2 CentOS 6.5 servers, each running one service: server A: 10.140.54.1/27 running service MySQL port 3306 server B: 10.140.54.2/27 running service httpd port 443 Server B's httpd service ...
2
votes
0answers
222 views

how to open up socks/SSH on different network interfaces?

iptables -A PREROUTING -i usb0 -t mangle -p tcp --dport 8080 -j MARK --set-mark 1 iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination Chain ...
2
votes
0answers
292 views

Forward multicast between two LAN segments (Chromecast)

I've found some rules but most are inconclusive. Chromecast uses DIAL and discovers via multicast from what I've understood.. I have an Ethernet-connected computer which I would like to route via my ...
2
votes
0answers
689 views

How do I route bittorrent through a second interface?

I've managed to configure openvpn on my DD-WRT router such that the tunnel is up and working, but that it doesn't mess with routes at all (the default configuration wants all traffic to go through ...
2
votes
0answers
187 views

iptables rule to transfer UDP through a SSH tunnel

The problem I have two programs that runs on two distant computers and communicate through a specific protocol. All I know is that this protocol only communicates through UDP and uses the ports 1101 ...
2
votes
0answers
37 views

Extra overhead in MASQUERADE target

There's a part in iptables manual concerning SNAT and MASQUERADE targets. I know the key difference between the two, but I don't fully get the following sentence: It is still possible to use the ...
2
votes
0answers
50 views

How can I configure iptables for per application setup?

I am working on a project where we are building lots of micro-services. Each service is neatly packaged as an RPM. Ideally I'd like for us to have iptables enabled on all of our machines and it would ...
2
votes
0answers
84 views

Transparent Proxy

I am setting up attempting to set up a transparent proxy on CentOS using Squid. So far I have managed to filter the content and get it working perfectly. The only issue I am having is getting a form ...
2
votes
0answers
119 views

Defining IPv6 chains in ip6tables-restore/iptables-restore files, is it possible?

The format for the files generated by iptables-save/ip6tables-save and loadable through iptables-restore/ip6tables-restore stipulates that one can prepend -4 or -6 respectively so as to maintain the ...
2
votes
0answers
700 views

Corosync & Pacemaker IPTables Rules

When using Corosync with two rings via multi-cast addresses 226.94.1.1 (Port 5405) & 226.94.1.2 (Port 5406) what iptables rules are required to allow two nodes to communicate optimally without ...
2
votes
0answers
573 views

Route all HTTP traffic through polipo

I've set up polipo on my machine to listen to the default port 8123. To test it, I set the in-memory cache to a ridiculously high 2 GB and downloaded a 50 MB file using wget utilizing the proxy. ...
2
votes
0answers
307 views

iptables REDIRECT in combination with matching on interface vs. IP address

I've successfully set up Tor for transparent proxying using iptables (ie, all outgoing traffic is sent through Tor without the application's knowledge). In doing so, I discovered both an odd problem ...
2
votes
0answers
307 views

SNAT problem in iptables

I am trying to reroute traffic from specific devices in my house over openvpn. For this, I've created an OpenVPN tunnel between my house wifi router and my server. Here is my setup: Wifi router's ...
2
votes
0answers
267 views

IPTables dropping UDP packet stream

I have a configuration where UDP packets containing encapsulated DNS data are sent to a KVM instance for processing. The KVM instance sits behind an IPtables firewall which is also doing NAT. The ...
2
votes
0answers
363 views

Iptables and Port Scanning and Recent module

I'm trying to write an adaptive firewall using iptables, and am not clear on how the recent module is working. For example, see http://blog.zioup.org/2008/iptables_recent/ Snippet from my iptables: ...
2
votes
0answers
465 views

TPROXY for redirecting UDP on arbitrary ports

I want to intercept all UDP traffic leaving tap1. And possibly reply to e.g. DNS-requests. To accomplish this I wrote some python code listening to localhost and use iptables with a rule-set like ...
2
votes
0answers
366 views

Redirect all non-local traffic to a socks proxy

Is it possible to redirect all non-local traffic to a socks proxy? so, for example i have: 4 computers (clients A-D: 10.0.0.1-4 or dhcp) 1 computer with 2 network cards (gateway-server, eth0: ...
2
votes
0answers
279 views

Port Forwarding Between 2 Internet Machines

Here's my scenario: Setup There are 3 machines: A: on the internet : has ip (a.a.a.a), has port pa open B: my server / gateway : has ip (b.b.b.b), has port pb open C: on the internet : has ip ...
2
votes
0answers
598 views

Iptables - modprobe: FATAL - Fail2ban random restarts

I have been running fail2ban on my server for a while without any problems but have recently seen fail2ban restart randomly. After some looking in my logs I noticed that the restarts occur when ever ...
1
vote
0answers
11 views

Why does a broken mount point break netfilter-persistent using systemd?

I have a relatively clean Debian Jessie install. I'm running into two related problems: 1) I have a cifs mount that shows me an error on boot. The error says to run systemctl status ...
1
vote
0answers
32 views

Iptables - Limit SMTP output traffic

I'd like to limit the output smtp traffic of my server (Debian). For example : only 10 mails per seconds. I want to use Iptables for this purpose. I tried : iptables -A OUTPUT -p tcp --syn --dport ...
1
vote
0answers
24 views

Privoxy - Annoying Error Used IPTables

I'm running privoxy off a machine that also has hostapd installed, I am trying to run all http traffic from hostapd through privoxy i have already tried this: iptables -t nat -A PREROUTING -p tcp ...
1
vote
0answers
18 views

equivalent of iptables rule in ip6tables

I m newbie in the iptables. I have the following iptables rules in the source code of a project iptables -t mangle -I PREROUTING ! -i br0 -p TCP --dport 45 -j MARK --set-mark 0x1000 iptables -t nat ...
1
vote
0answers
64 views

Block all tor traffic from my server

I'm trying to prevent all traffic from Tor exit nodes from hitting my website. I've searched and have attempted a few of the solutions, this is what I've done. I curled the ...
1
vote
0answers
45 views

How to match properly against an IP set of type 'hash:ip,port'?

My current setup is that I have a server with several IPv4 addresses. Let's ignore the IPv6 part for now, as the symptoms are identical there. In the firewall rules I'd like to match against HTTP ...
1
vote
0answers
64 views

Valid iptables Firewall on DD-WRT to access Internet on a Virtual Access Point

Device: Linksys WRT54G v5.1 Firmware: DD-WRT v24-sp2 (07/22/09) micro - build 12548M NEWD Eko I use this router as an AP with 2 SSIDs (Private wl0 + Guest wl0.1) and I connect it to a switch ...
1
vote
0answers
173 views

Port forwarding with iptables and PIA VPN for single user

I've gotten a Private Internet Access VPN setup on a Mythbuntu 14.04 machine and I am at wits end trying to get port forwarding working with rTorrent (and ruTorrent). My setup is rTorrent running ...
1
vote
0answers
51 views

Linux - iptables - get YouTube streaming bytes usage

How do I get bytes usage using iptables for a particular IP, including YouTube streaming videos? Currently, I am using the following IP tables rules to get data usage by IP address: sudo iptables -I ...
1
vote
0answers
50 views

Route wireless LAN through OpenVPN

I am trying to set up my home server to act as an OpenVPN gateway so I can connect to my VPN from any device without installing special software of them. My server is running Ubuntu 14.04. The host ...
1
vote
0answers
41 views

How to route vpn traffic over hostapd-raspberry pi

I have a raspberry pi running hostapd and I am able to connect my laptop as a wifi client to the raspberry bi wifi router. The problem is with the vpn traffic, I cant connect to my office vpn with ...
1
vote
0answers
37 views

iptables not getting saved ? centos

I am trying to save the iptables, when I run command #service iptables save it says [ok] but when I again open the iptables the rules get revert to default. Can anyone help me to understand this ...