iptables allow creation of rules to define packet filtering behavior.
12
votes
3answers
778 views
Can I limit a user (and their apps) to one network interface?
As the title really. I've actually got two scenarios to apply this:
Multiseat Desktop: two network connections both with internet gateways and two accounts doing bandwidth-intensive tasks on each. I ...
9
votes
3answers
864 views
Is there a way to find which iptables rule was responsible for dropping a packet?
I have a system that came with a firewall already in place. The firewall consists of over 1000 iptables rules. One of these rule is dropping packets I don't want dropped. (I know this because I did ...
9
votes
2answers
5k views
Reply on same interface as incoming?
I have a system with two interfaces. Both interfaces are connected to the internet. One of them is set as the default route; a side effect of this is that if a packet comes in on the non-default-route ...
9
votes
2answers
4k views
iptables --set-mark - Route diferent ports through different interfaces
Short story,
3 interfaces, eth0 (LAN), eth1(ADSL), eth2(4G).
eth0 -> eth1: Works
(ports 80, 443, 4070) eth0 -> eth2: Doesn't happen
This is a graphical representation of the idea:
Port 80 & ...
8
votes
4answers
481 views
iptables on tor exit node
I want to run an open Tor router.
My exit policy will be similar to ReducedExitPolicy.
But I also want to make it hard for the tor network to abuse my resources.
Cases I want to prevent clients ...
7
votes
3answers
4k views
Only allow certain outbound traffic on certain interfaces
I have rather an odd issue. I have a server with two network interfaces eth0 and eth1. Each are connected to a different network. Each network has a internet gateway. The server has various outbound ...
7
votes
1answer
870 views
Dual network connection
I have a usb cellular modem and a Home LAN connection on my Ubuntu 10.10 box.
Both work independently.
I want to know how to have both connected at the same time, and be able to specify which ...
7
votes
1answer
599 views
Shaping outgoing traffic with iptables
On my laptop, when I run any downloads, torrents, etc, browsing is crippled.
I read somewhere that you could configure your iptables powered router to prioritize certain network traffic.
Could I do ...
7
votes
1answer
4k views
Why are incoming packets on a TAP interface seen with tcpdump but not with iptables?
A program injects packets on a Linux TAP interface (these packets are coming from a virtual machine). Specifically, these are DHCP requests (so they're UDP). I can see the packets with tcpdump but not ...
6
votes
2answers
292 views
Does Fedora's firewall use iptables?
Fedora has a Firewall Configuration interface:
Does this use iptables underneath to enforce the rules?
6
votes
2answers
1k views
How to restrict internet access for a particular user on the lan using iptables in Linux
Let's say there are two users on the LAN, A and B. How do I restrict user A from internet access using iptables rules and saving the rules so that after reboot, they are still effective. And suppose I ...
6
votes
2answers
5k views
Output traffic on different interfaces based on destination port
My question is basically the same as Only allow certain outbound traffic on certain interfaces.
I have two interfaces eth1 (10.0.0.2) and wlan0 (192.168.0.2).
My default route is for eth1.
Let's say ...
6
votes
4answers
3k views
Fail2ban block with IPtables doesn't work on Debian Lenny. [moved ssh port]
I've recently decided to do some security maintenance. I saw my logs, and there were some tries against my SSH server. At first, I moved away the SSH port from the default 22. After it, I read ...
6
votes
1answer
284 views
iptables will match the following ICMP request packet as ESTABLISHED state after the first reply packet is sent
Test environment: CentOS 6.3 - kernel 2.6.32-279.el6.i686, iptables v1.4.7
Win7 <---> CentOS
Windows is constantly replaying ICMP echo request in 10pkt/sec rate to CentOS.
In iptables, I added the ...
5
votes
4answers
499 views
How can I send spoofed packets in Linux
In order to test a firewall, I want to send malformed packets to its interface, regardless of my routing table.
Is there a way to ask linux "send this exact tcp package, to this MAC address, ...
5
votes
2answers
131 views
Transform an UDP unicast packet into broadcast?
We need to wake-up some computers on our internal LAN, from the Internet.
We have a somewhat closed router. Very few ways to configure it.
I'd like to use netfilter (iptables) to do this because it ...
5
votes
1answer
2k views
Difference between SNAT and Masquerade
I am confused what's the actual difference between SNAT and Masquerade?
If I want to share my internet connection on local network than whether should I select SNAT or Masquerade?
Give me some ...
5
votes
1answer
442 views
iptables beginner question about ACCEPT
I'm just reading up on iptables, finally. I'm a little confused because the input chain from the filter table (as installed, fedora 17), looks like this:
target prot opt source ...
5
votes
2answers
2k views
iptables, how to redirect port from loopback?
The main rules are:
OUTIF=eth0
/sbin/iptables --policy INPUT DROP
/sbin/iptables --policy FORWARD DROP
/sbin/iptables --policy OUTPUT ACCEPT
/sbin/iptables -A INPUT -i lo -j ACCEPT
...
5
votes
1answer
6k views
How to reset all iptables settings?
Are there any simpler commands to these? (e.g.: a oneliner? can one command reset iptables/netfilter settings to this?)
IPTABLES="$(which iptables)"
# RESET DEFAULT POLICIES
$IPTABLES -P INPUT ...
5
votes
2answers
2k views
Per process firewall?
I've been reading around but can't seem to find a way to create per-process firewall rules. I know about iptables --uid-owner but that only works for outgoing traffic. I've considered scripting ...
5
votes
1answer
1k views
Terminal commands equivalent to NetworkManager's “Use as Hotspot” option
I'm making a gui application which will control my laptop in order to make it act as a wifi hotspot. I may change distributions so I want to find a solution which will work generally for all ...
4
votes
6answers
4k views
iptables to block https websites
I wish to block a few websites that also run upon https, like facebook, twitter, and gmail, in my organization. Squid is not supposed to be used here as per the orders from higher management. We can ...
4
votes
4answers
3k views
Set some firewall ports to only accept local network connections?
Basic firewall question:
How do I set up the firewall on a system in a LAN so that some ports are only open to connections from the local area network, and not from the outside world?
For instance, ...
4
votes
4answers
1k views
How to share the internet connection?
An ordinally network topology in picture:
In words:
- "server" (e.g.: an Ubuntu 10.04 LTS) is connected to the "internet" through pppoe connection
- "server" is using it's wireless card in AP ...
4
votes
2answers
219 views
Why can I reach a different interface's IP address?
I'm wondering about this, and I can't seem to find an explanation on the internet.
I have a linux gateway which has multiple interfaces:
eth0: external ip
eth1: 172.16.1.1/24
eth2: 172.16.2.1/24
...
4
votes
3answers
1k views
Why can't I use the REJECT policy on my iptables OUTPUT chain?
I currently have my OUTPUT chain set to DROP. I'd like to change it to REJECT, so that I have a clue that it's my firewall stopping me from getting somewhere rather than a problem with whatever ...
4
votes
2answers
2k views
What prevents a machine from responding to pings?
I have a CentOS release 5.4 linux box on Amazon EC2 that I'm trying to set up to be monitored via Nagios. The machine is in the same security group as the nagios server, but it seems to be ...
4
votes
2answers
2k views
Iptables: matching outgoing traffic with conntrack and owner. Works with strange drops
In my iptables script I have been experimenting with writing as finely grained rules as possible. I limit which users are allowed to use which services, partly for security and partly as a learning ...
4
votes
2answers
170 views
Why were tables built into ipchains?
Why are tables built into ipchains? What was the benefit of adding tables to ipchains? Is there a simple scenario that would illustrate how tables are used to increase performance or offer some other ...
4
votes
1answer
1k views
Is it possible to redirect a logging output of the iptables' LOG chain into a separate log file?
I don't want to mix iptables's log output with other system logs. How could I specify a dedicated log file for iptables LOG chains output?
4
votes
1answer
1k views
Have someone ever audited the default OpenWrt firewall rules?
I have an Openwrt 10.03.1 installed from: openwrt-ar71xx-wrt160nl-squashfs-factory.bin (firewall only customized with this: sed 's/REJECT/DROP/g' /etc/config/firewall) - so besides this, IT'S A ...
4
votes
1answer
2k views
iptables port-mirroring
I need to be able to get a copy of packets received on port 8001 to port 8002. I have tried the following but I get an error that --tee is undefined.
sudo iptables -t nat -A PREROUTING -p TCP -s ...
4
votes
1answer
154 views
Creating a NAT from loopback to a remote server
My goal is to redirect connections from the local host to a remote server, and be able to change the remote address on the fly, without any client config changes. I can do this now using a nat on the ...
4
votes
2answers
872 views
Having Linux port remap to itself
I have a scenario: I have 4 server and 3 web inbound requests that I have to allow through a modem/router. the ports are https(ssl)443 ssh22 and http80. All 4 servers want them.
I had set up the ...
4
votes
1answer
640 views
Force VPN using IPtables?
I want to force the use of VPN using iptables, therefore while VPN is disabled no outgoing traffic shall be allowed (except maybe some DHCP stuff...). Now i guess I could just block everything not ...
4
votes
3answers
1k views
IPTables and transparent proxies
I have set up a local, transparent TCP proxy on localhost. I want to redirect ALL TCP traffic to this proxy, so it can handle it and nothing "leaks out," circumventing the proxy. I need to use ...
4
votes
1answer
1k views
Enable RTSP in iptables
I'd like to receive a RTSP stream via VLC, but when I try to run
sudo -u non_root_user cvlc -vvv -I dummy rtsp://ip:port/x.sdp
I get:
Unable to determine our source address: This computer has an ...
4
votes
1answer
2k views
NAT (Internet connection sharing) switching between multiple public interfaces
My Ubuntu 12.04 (precise) laptop has three network interfaces:
eth0: wired interface sometimes connected to the Internet
wlan0: wireless interface sometimes connected to the Internet
vboxnet0: wired ...
4
votes
1answer
1k views
Why doesn't my iptables rule work?
I have two interfaces on my VPS: eth0 and eth0:0. I want to block incoming packets on port 80 on eth0:0 using iptables. I tried this, but it doesn't work:
iptables -A INPUT -i "eth0:0" -p tcp ...
4
votes
2answers
736 views
Screen session running as root? (it shouldn't be) node.js
cd /serv
screen -R node
{in the screen}
node test.js
C^a d
initially,
ls -l /dev/pts
total 0
crw--w---- 1 tick-tock tty 136, 0 2011-04-19 16:41 0
crw--w---- 1 tick-tock tty 136, ...
4
votes
1answer
903 views
multigateway routing for specific src port
I have two gateway to access internet, somehow I want to load balancing it, so far its working, but some connection or service need persistent gateway IP to be used, so the client should never change ...
4
votes
2answers
41 views
Is it possible to set-up a VPN in such a way that I disconnect from the Internet if it goes down?
How can I set-up a VPN so I loose connection to the Internet if it goes down? I use Ubuntu and have used the network-dialog to use a VPN; but if the VPN goes down, it just switches to the non-VPN ...
3
votes
2answers
442 views
Does iptables -F permanently delete all iptables rules?
In a RHEL training document, the author says:
...run the following command to disable the firewall on the current system: iptables -F
He explicitly uses the word "disable" which to me suggests ...
3
votes
1answer
337 views
How to understand why the packet was considered INVALID by the `iptables`?
I set up some iptables rules so it logs and drops the packets that are INVALID (--state INVALID). Reading the logs how can I understand why the packet was considered invalid? For example, the ...
3
votes
2answers
258 views
Meaning of log entries from an iptables configuration
My router has Linux as its OS. The system log has a lot of rows about iptable and klogd that I don't understand, could someone explain them to me?
The iptables setup:
iptables -t nat -A PREROUTING ...
3
votes
1answer
2k views
How to re-enable iptables on Fedora 18?
FirewallD is the default firewall in Fedora 18. I have been using iptables for quite some time and have a custom configuration which I need for logging of ip traffic. I am not used to the new ...
3
votes
2answers
2k views
Why do iptables rules disappear when restarting my Debian system?
I add this rule:
sudo iptables -t nat -A OUTPUT -d a.b.c.d -p tcp \
--dport 1723 -j DNAT --to-destination a.b.c.d:10000
When restart computer rules are deleted. Why?
What I can do to make ...
3
votes
1answer
187 views
iptables infographic
Is there an infographic somewhere that describes the logical flow of iptables? Specifically, I'm looking for something that diagrams which point in the process ip_conntrack applies.
3
votes
1answer
160 views
Linux App that monitors log and add rules to iptables
I used to use a linux software that monitors logs like http, ssh, etc and if it detects that someone is trying to use brute force, it blocks that ip by adding a rule to iptables. I forgot what that ...
