iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

6
votes
0answers
66 views

Setting traffic class on return packets

I have a network topology: Server <-> router1 <-> router2 <-> router3 <-> edgeRouter <-> "internet" All routers are linux based, and support iptables. The server sets ...
3
votes
0answers
37 views

iptables: using “conntrack” and “recent” modules to block unsolicited packets

When I only allow RELATED and ESTABLISHED packets, and DROP everything else, my firewall rules work perfectly and I have no problems: ### VARIANT A -A INPUT -i wlan0 -m conntrack --ctstate ...
3
votes
0answers
58 views

Is iptables able to filter off UNREPLIED connections?

I am a using dd-wrt router and trying to get some per-user metrics, I was wondering about filtering only ESTABLISHED connections or include NEW and RELATED, I have read a lot about this last two, but ...
3
votes
0answers
64 views

Route VPN traffic through different proxies

I want to setup VPN server and route (based on my routing algorithm) all traffic through different proxy servers. Let's say I have one host, with many users, connected to my VPN. I want to route all ...
3
votes
0answers
195 views

iptables rule no actions on scapy packets

I wrote this rule to change all udp destination IP addresses to 8.8.8.8 when dport is 53: iptables -t nat -A OUTPUT -p udp -m udp --dport 53 -j DNAT --to-destination 8.8.8.8 The rule worked when ...
3
votes
0answers
81 views

Packets do not cross IP tables Postrouting when originating from an external IP

I'm trying to reflect traffic from the internet to an internal device that I only want to have local access. I have a host in my DMZ that I'm trying to DNAT traffic to this internal device, and SNAT ...
3
votes
0answers
181 views

iCloud stuff stops working while connected to OpenVPN

I have a fairly simple OpenVPN setup on an OpenVZ VPS with Ubuntu 11.10. Client is the Viscosity client on Mac OS X 10.8.2, and after some testing, we can rule out the client as being part of the ...
3
votes
0answers
703 views

tunneling FON traffic via Tor

I would like to tunnel the traffic of my FON router through Tor. For that I added a second network card to a local server and connected the FON router to it. Then I set up a DHCP server and configured ...
2
votes
0answers
31 views

How to use both syn proxy and connlimit rules with iptables?

I want to write both syn proxy and connlimit rules. I want to send packets to syn proxy first because of performance issue. Here is rule sample. I use bridge interfaces but I dont think it is ...
2
votes
0answers
33 views

debugging iptables when tunneling one VPN through another

I seek to tunnel one SSL VPN (F5, running on my debian laptop==client) through another (OpenVPN, running on a debian linode==server), but lose all client networking (including, e.g., ping) after the ...
2
votes
0answers
31 views

Strange cron behaviour

I have a script that reads a list of IPs from a file, compares with the existing ones in a chain, and adds recently added IPs in the file into that chain. Running the script manually (e.g., ./script) ...
2
votes
0answers
34 views

VPN tunnel to two services on two servers?

I've got 2 CentOS 6.5 servers, each running one service: server A: 10.140.54.1/27 running service MySQL port 3306 server B: 10.140.54.2/27 running service httpd port 443 Server B's httpd service ...
2
votes
0answers
83 views

how to open up socks/SSH on different network interfaces?

iptables -A PREROUTING -i usb0 -t mangle -p tcp --dport 8080 -j MARK --set-mark 1 iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination Chain ...
2
votes
0answers
327 views

How do I route bittorrent through a second interface?

I've managed to configure openvpn on my DD-WRT router such that the tunnel is up and working, but that it doesn't mess with routes at all (the default configuration wants all traffic to go through ...
2
votes
0answers
161 views

iptables rule to transfer UDP through a SSH tunnel

The problem I have two programs that runs on two distant computers and communicate through a specific protocol. All I know is that this protocol only communicates through UDP and uses the ports 1101 ...
2
votes
0answers
26 views

Extra overhead in MASQUERADE target

There's a part in iptables manual concerning SNAT and MASQUERADE targets. I know the key difference between the two, but I don't fully get the following sentence: It is still possible to use the ...
2
votes
0answers
48 views

How can I configure iptables for per application setup?

I am working on a project where we are building lots of micro-services. Each service is neatly packaged as an RPM. Ideally I'd like for us to have iptables enabled on all of our machines and it would ...
2
votes
0answers
180 views

iptables hangs at applying rules

I have a set of rules that are supposed to give me the most protection before things like fail2ban and other things are added to the mix. The issue is that although everything checks out in the test, ...
2
votes
0answers
72 views

Transparent Proxy

I am setting up attempting to set up a transparent proxy on CentOS using Squid. So far I have managed to filter the content and get it working perfectly. The only issue I am having is getting a form ...
2
votes
0answers
72 views

Defining IPv6 chains in ip6tables-restore/iptables-restore files, is it possible?

The format for the files generated by iptables-save/ip6tables-save and loadable through iptables-restore/ip6tables-restore stipulates that one can prepend -4 or -6 respectively so as to maintain the ...
2
votes
0answers
512 views

Corosync & Pacemaker IPTables Rules

When using Corosync with two rings via multi-cast addresses 226.94.1.1 (Port 5405) & 226.94.1.2 (Port 5406) what iptables rules are required to allow two nodes to communicate optimally without ...
2
votes
0answers
452 views

Route all HTTP traffic through polipo

I've set up polipo on my machine to listen to the default port 8123. To test it, I set the in-memory cache to a ridiculously high 2 GB and downloaded a 50 MB file using wget utilizing the proxy. ...
2
votes
0answers
260 views

iptables REDIRECT in combination with matching on interface vs. IP address

I've successfully set up Tor for transparent proxying using iptables (ie, all outgoing traffic is sent through Tor without the application's knowledge). In doing so, I discovered both an odd problem ...
2
votes
0answers
271 views

SNAT problem in iptables

I am trying to reroute traffic from specific devices in my house over openvpn. For this, I've created an OpenVPN tunnel between my house wifi router and my server. Here is my setup: Wifi router's ...
2
votes
0answers
205 views

IPTables dropping UDP packet stream

I have a configuration where UDP packets containing encapsulated DNS data are sent to a KVM instance for processing. The KVM instance sits behind an IPtables firewall which is also doing NAT. The ...
2
votes
0answers
321 views

Iptables and Port Scanning and Recent module

I'm trying to write an adaptive firewall using iptables, and am not clear on how the recent module is working. For example, see http://blog.zioup.org/2008/iptables_recent/ Snippet from my iptables: ...
2
votes
0answers
351 views

TPROXY for redirecting UDP on arbitrary ports

I want to intercept all UDP traffic leaving tap1. And possibly reply to e.g. DNS-requests. To accomplish this I wrote some python code listening to localhost and use iptables with a rule-set like ...
2
votes
0answers
261 views

Port Forwarding Between 2 Internet Machines

Here's my scenario: Setup There are 3 machines: A: on the internet : has ip (a.a.a.a), has port pa open B: my server / gateway : has ip (b.b.b.b), has port pb open C: on the internet : has ip ...
2
votes
0answers
573 views

Iptables - modprobe: FATAL - Fail2ban random restarts

I have been running fail2ban on my server for a while without any problems but have recently seen fail2ban restart randomly. After some looking in my logs I noticed that the restarts occur when ever ...
1
vote
0answers
6 views

iptables: route packets to example.com via public proxy

I want to access certain websites via a public proxy and I can't seem to get it right using iptables. Let's say I want to access example.com having ip address 1.2.3.4 via a public proxy at ...
1
vote
0answers
16 views

iptables / VLAN: interface names

I have just started working with VLANs. My memory was VLAN interface names are the interface name plus dot plus the VLAN ID. And that is what vconfig offers. After some (successful) manual tests I ...
1
vote
0answers
36 views

Limit transfer speed rate by Iptables Rule

I have D-Link Router DSL-2730U that support iptables version 1.4.0 and i want to know if that possible that i can limit a PC transfer speed rate (upload & download) by PC MAC Address using ...
1
vote
0answers
12 views

netfilter rules to forward all traffic to a local website by default, and making exceptions to that rule by macaddr

This is for raspbian acting as a gateway. computers -> [eth1] raspberry pi (dhcp) [eth0] -> modem/router -> internet I made an ip forwarding rule which redirects all traffic coming from eth1 ...
1
vote
0answers
43 views

Redirecting all non-local traffic from specific ip to external proxy

I currently have a squid proxy running on an external server (outside the LAN, with a public IP). I would like to route all non-local traffic from a specific device through it. That is, any requests ...
1
vote
0answers
30 views

Internet sharing disappears when either eth0 or wlan0 gets disconnected

I just got a RasPi B+ and I'm looking to replace the Windows PC that's doing the routing job. What I'm trying to do with the Pi is making it share the connection (wlan0) with another wifi router (via ...
1
vote
0answers
31 views

route gateway proxy traffic through different interface with identical upstream gateways

My question is similar to the below with a small caveat not answered by any of these threads: Output traffic on different interfaces based on destination port ...
1
vote
0answers
17 views

Initial iptable rule and knockd operation in vps

Today I launched a vps with Debian 7 x64 and started playing around with it. I installed xampp as well as knock daemon to get my hands dirty. So, all I wanted to do was to actually block all requests ...
1
vote
0answers
42 views

I Need Find A Mac Address from a client connected to my Teamspeak

I have a dedicated server and from it I am running a teamspeak 3 server. In teamspeak server there is a client who need to be banned. I have banned him from teamspeak but if you change your windows ...
1
vote
0answers
22 views

iptables rules to issue with tftp

My requirement is to add iptables rules in such a to allow tftp traffic(as a client) and drop everything else. And in fact using the iptc library programmatically using C code. To start with I tried ...
1
vote
0answers
63 views

Using a VPN client as a VPN gateway

I would like host 1 to use host 2 as a gateway to the remote host 3. I have scoured the web looking for a solution, but it doesn't seem to work for me. VPN client software is ike (shrewSoft VPN) is ...
1
vote
0answers
30 views

Set user-wide network proxy settings on Ubuntu (without restart)

Is there any reliable way to set proxy settings user-wide for all traffic on Ubuntu? As far I'm using {http|https|ftp}_proxy variables in /home/$USER/.bashrc which is nice but there's some issues: ...
1
vote
0answers
53 views

iptables: can't open tcp port

I'm running a Raspberry PI B+: Linux pi 3.12.28+ #709 PREEMPT Mon Sep 8 15:28:00 BST 2014 armv6l GNU/Linux The Raspberry is connect via lan (dhcp. ip: 192.168.78.29) to the local network. I'm trying ...
1
vote
0answers
41 views

Transparent proxy to other IP of thousand ports

I was bought a service that only allow a IP, the IP that i say, only one, but I need use this from more IP's. I think that I can install in this computer a system to do a transparent proxy for ...
1
vote
0answers
15 views

iptables packet header capture and compare

We are using multicast program to listen up multicast data from our provider, there are couple cases where the multicast having issue: 1. their server hang, hence no multicast data received from our ...
1
vote
0answers
71 views

How to route pakets from an aliased interface towards a gateway?

I'm having trouble setting up the following: Router IP: 192.168.1.1 PC Eth0 - 192.168.1.104 Eth0:1 - 10.0.0.1 (must be an alias) Besides ip_forward enabled, what should I add to iptables rules, so ...
1
vote
0answers
50 views

Forwarding DNS traffic for specific domain

I'm trying to control which IP address I use for DNS based on the domain string. I'm on Fedora with firewalld and have tried the command: firewall-cmd --direct --add-rule ipv4 filter PREROUTING 0 -t ...
1
vote
0answers
17 views

Making sense of this iptables http proxy config

I've never touched iptables before and I'm trying to understand exactly what these three lines do. I have ip_forward switched on and I know the end effect is that all traffic on eth0 is forwarded ...
1
vote
0answers
40 views

Only allow http and SSH traffic

I ran the below. What I expected was to be able to browse websites without issues. No sites work and I have no idea what. When I executed iptables -P OUTPUT ACCEPT it works so I'm assuming I missed an ...
1
vote
0answers
47 views

IPTable rules for transparent outbound proxy

I've recently installed MITMProxy (similar to Squid) which I'm currently using to route outbound HTTP requests from my Ubuntu machine to another server (adding a header along the way). When I use ...
1
vote
0answers
108 views

Setting up a 802.11s mesh network for mobile devices to communicate with a wired server

I'm in the process of developing an android app that maintains a device's connectivity to a linux-based WiFi mesh network, and periodically sends status information (GPS, battery life, etc.) to a ...