iptables allow creation of rules to define packet filtering behavior.

learn more… | top users | synonyms

29
votes
7answers
7k views

Block network access of a process?

Is it possible to block the (outgoing) network access of a single process?
19
votes
2answers
14k views

Reply on same interface as incoming?

I have a system with two interfaces. Both interfaces are connected to the internet. One of them is set as the default route; a side effect of this is that if a packet comes in on the non-default-route ...
15
votes
1answer
12k views

What is the difference between -m conntrack --ctstate and -m state --state

I'm reading this howto, and there's something like this: We can allow established sessions to receive traffic: $ sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT ...
15
votes
1answer
6k views

Is it better to set -j REJECT or -j DROP in iptables?

There's an example of iptables rules on archlinux wiki: # Generated by iptables-save v1.4.18 on Sun Mar 17 14:21:12 2013 *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [0:0] :TCP - ...
15
votes
3answers
51k views

Iptables to allow incoming FTP

I want to allow incoming FTP traffic. CentOS 5.4: This is my /etc/sysconfig/iptables file. # Generated by iptables-save v1.3.5 on Thu Oct 3 21:23:07 2013 *filter :INPUT ACCEPT [0:0] :FORWARD ...
14
votes
2answers
6k views

What do numbers in INPUT,FORWARD,OUTPUT chains mean in iptables config file?

I came across the following config file: # Generated by iptables-save v1.3.1 on Sun Apr 23 06:19:53 2006 *filter :INPUT ACCEPT [368:102354] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [92952:20764374] -A ...
14
votes
3answers
9k views

Iptables to redirect DNS lookup IP and Port

I have discovered that my ISP (verizon) is intercepting all DNS traffic on port 53. Using iptables, I want to redirect all DNS lookup traffic to a specific IP and Port (5353). Any attempt for my ...
13
votes
3answers
1k views

Can I limit a user (and their apps) to one network interface?

As the title really. I've actually got two scenarios to apply this: Multiseat Desktop: two network connections both with internet gateways and two accounts doing bandwidth-intensive tasks on each. I ...
12
votes
3answers
27k views

How to ensure SSH port is only open to a specific IP address?

This is my /etc/sysconfig/iptables: It has two ports open 80 apache and 22 for ssh. # Firewall configuration written by system-config-firewall # Manual customization of this file is not recommended. ...
12
votes
2answers
9k views

( /etc/sysconfig/iptables ) “Manual customization of this file is not recommended.” Why?

Editing this file directly /etc/sysconfig/iptables can save me so much headaches so much time and so on... and yet on the very top of the file it says.. Manual customization of this file is not ...
12
votes
3answers
28k views

Output traffic on different interfaces based on destination port

My question is basically the same as Only allow certain outbound traffic on certain interfaces. I have two interfaces eth1 (10.0.0.2) and wlan0 (192.168.0.2). My default route is for eth1. Let's say ...
12
votes
1answer
11k views

Difference between SNAT and Masquerade

I am confused what's the actual difference between SNAT and Masquerade? If I want to share my internet connection on local network then whether should I select SNAT or Masquerade?
12
votes
2answers
5k views

Per process firewall?

I've been reading around but can't seem to find a way to create per-process firewall rules. I know about iptables --uid-owner but that only works for outgoing traffic. I've considered scripting ...
11
votes
3answers
7k views

Is there a way to find which iptables rule was responsible for dropping a packet?

I have a system that came with a firewall already in place. The firewall consists of over 1000 iptables rules. One of these rule is dropping packets I don't want dropped. (I know this because I did ...
10
votes
3answers
15k views

Limit max connections per IP address and new connections per second with iptables

We have an Ubuntu 12.04 server with httpd on port 80 and we want to limit: the maximum connections per IP address to httpd to 10 the maximum new connections per second to httpd to 150 How can we ...
10
votes
3answers
13k views

Only allow certain outbound traffic on certain interfaces

I have rather an odd issue. I have a server with two network interfaces eth0 and eth1. Each are connected to a different network. Each network has a internet gateway. The server has various outbound ...
10
votes
2answers
28k views

iptables --set-mark - Route diferent ports through different interfaces

Short story, 3 interfaces, eth0 (LAN), eth1(ADSL), eth2(4G). eth0 -> eth1: Works (ports 80, 443, 4070) eth0 -> eth2: Doesn't happen This is a graphical representation of the idea: Port 80 & ...
9
votes
1answer
6k views

Linux as router with multiple internet providers

Linux as router: I have 3 Internet providers, each with its own modem. Provider1, which is gateway address 192.168.1.1 Connected to linux router eth1/192.168.1.2 Provider2, gateway address ...
9
votes
2answers
3k views

How to restrict internet access for a particular user on the lan using iptables in Linux

Let's say there are two users on the LAN, A and B. How do I restrict user A from internet access using iptables rules and saving the rules so that after reboot, they are still effective. And suppose I ...
8
votes
2answers
13k views

Why are some ports reported by nmap filtered and not the others?

I'm scanning a server which should have a pretty simple firewall using iptables: by default everything is DROPped besides RELATED and ESTABLISHED packets. The only type of NEW packets allowed are TCP ...
8
votes
1answer
885 views

How does a transparent SOCKS proxy know which destination IP to use?

There are two SOCKS proxies that I know about that support transparent proxying for any outgoing TCP connection: Tor and redsocks. Unlike HTTP proxies, these SOCKS proxies can transparently proxy any ...
8
votes
1answer
1k views

Dual network connection

I have a usb cellular modem and a Home LAN connection on my Ubuntu 10.10 box. Both work independently. I want to know how to have both connected at the same time, and be able to specify which ...
8
votes
6answers
410 views

iptables rule adviser script

There is a server without any iptables defense: ACCEPT all.. There could be custom applications on this server. If we should need to harden this server (so deny all, and only let what is needed by ...
8
votes
1answer
185 views

What is the difference between -j DROP and -j STEAL?

I often see that people set STEAL target in iptables rules. It's possible to get this target by installing (on debian) xtables-addons-common and xtables-addons-dkms. I was curious why people prefer ...
8
votes
4answers
1k views

Failing to block brute force ssh with iptables

I'm trying to block (slow down) brute force attacks on my sshd server. I'm following this guide http://www.rackaid.com/resources/how-to-block-ssh-brute-force-attacks/ which basically says I need to ...
8
votes
4answers
907 views

iptables on tor exit node

I want to run an open Tor router. My exit policy will be similar to ReducedExitPolicy. But I also want to make it hard for the tor network to abuse my resources. Cases I want to prevent clients ...
7
votes
6answers
19k views

iptables to block https websites

I wish to block a few websites that also run upon https, like facebook, twitter, and gmail, in my organization. Squid is not supposed to be used here as per the orders from higher management. We can ...
7
votes
2answers
12k views

Why do iptables rules disappear when restarting my Debian system?

I add this rule: sudo iptables -t nat -A OUTPUT -d a.b.c.d -p tcp \ --dport 1723 -j DNAT --to-destination a.b.c.d:10000 When restart computer rules are deleted. Why? What I can do to make ...
7
votes
2answers
11k views

incoming ACCEPT all iptables rule still appearing

I'm following this guide here: http://isalazyadmin.net/2009/07/02/configuring-a-basic-firewall-for-debian-linux/ And I have the iptables listed shown, but my server still appears to be accepting all ...
7
votes
3answers
14k views

iptables redirect outside requests to 127.0.0.1

I have a service running on 127.0.0.1 with port 2222. I need to forward all requests to 192.168.2.2:2222 (outside IP) only from subnet 192.168.1.0/24 to 127.0.0.1:2222. I'm trying to use this, but ...
7
votes
2answers
15k views

Port forward to VPN Client?

I've run into a bit of a puzzle and haven't had much luck finding a solution. Right now I am (sadly) connected to the net via Verizon 3G. They filter all incoming traffic so it is impossible for me to ...
7
votes
2answers
24k views

iptables: allow certain ips and block all other connection

How do I allow certain ips and block all other connection in iptables?
7
votes
1answer
1k views

Shaping outgoing traffic with iptables

On my laptop, when I run any downloads, torrents, etc, browsing is crippled. I read somewhere that you could configure your iptables powered router to prioritize certain network traffic. Could I do ...
7
votes
4answers
10k views

Fail2ban block with IPtables doesn't work on Debian Lenny. [moved ssh port]

I've recently decided to do some security maintenance. I saw my logs, and there were some tries against my SSH server. At first, I moved away the SSH port from the default 22. After it, I read ...
7
votes
1answer
4k views

Why doesn't my iptables rule work?

I have two interfaces on my VPS: eth0 and eth0:0. I want to block incoming packets on port 80 on eth0:0 using iptables. I tried this, but it doesn't work: iptables -A INPUT -i "eth0:0" -p tcp ...
7
votes
1answer
741 views

iptables will match the following ICMP request packet as ESTABLISHED state after the first reply packet is sent

Test environment: CentOS 6.3 - kernel 2.6.32-279.el6.i686, iptables v1.4.7 Win7 <---> CentOS Windows is constantly replaying ICMP echo request in 10pkt/sec rate to CentOS. In iptables, I added the ...
7
votes
1answer
8k views

Why are incoming packets on a TAP interface seen with tcpdump but not with iptables?

A program injects packets on a Linux TAP interface (these packets are coming from a virtual machine). Specifically, these are DHCP requests (so they're UDP). I can see the packets with tcpdump but not ...
6
votes
2answers
14k views

Does iptables -F permanently delete all iptables rules?

In a RHEL training document, the author says: ...run the following command to disable the firewall on the current system: iptables -F He explicitly uses the word "disable" which to me suggests ...
6
votes
3answers
6k views

Blocking outgoing connects with iptables

I have a (non production) machine where external supporters have shell-access (non-root). I want to prevent them from going further on into our network from that machine using iptables. The "normal" ...
6
votes
4answers
18k views

Set some firewall ports to only accept local network connections?

Basic firewall question: How do I set up the firewall on a system in a LAN so that some ports are only open to connections from the local area network, and not from the outside world? For instance, ...
6
votes
1answer
4k views

Configuring OpenVPN to use Firewalld instead of iptables on Centos 7

I need some help configuring OpenVPN on Centos 7 using firewalld. I used iptables on Centos 6.5 and only had to add the following lines to /etc/sysconfig/iptables: -A POSTROUTING -s "10.0.0.0/24" ...
6
votes
2answers
5k views

Iptables: matching outgoing traffic with conntrack and owner. Works with strange drops

In my iptables script I have been experimenting with writing as finely grained rules as possible. I limit which users are allowed to use which services, partly for security and partly as a learning ...
6
votes
1answer
12k views

What -A INPUT -j REJECT --reject-with icmp-host-prohibited Iptables line does exactly?

What do the following lines do? I have been reading redhat iptables documentation but can't figure it out. ... -j REJECT --reject-with icmp-host-prohibited ... -j REJECT --reject-with ...
6
votes
3answers
9k views

Is it better to set rules in ip6tables or disable ipv6?

I have the following network configuration: # ifconfig -a eth0 Link encap:Ethernet HWaddr 00:e0:1c:73:02:09 inet addr:10.1.4.41 Bcast:10.1.255.255 Mask:255.255.0.0 inet6 ...
6
votes
2answers
14k views

How can I redirect outbound traffic to port 80 using iptables locally?

I'm trying to locally redirect ports on my Ubuntu machine using iptables. Similar to transparent proxying. I want to catch anything trying to leave my system on port 80 and redirect it to a remote ...
6
votes
1answer
776 views

Why are packages being rejected even through there's a rule that accepts them all before hand?

I'm just reading up on iptables, finally. I'm a little confused because the input chain from the filter table (as installed, fedora 17), looks like this: target prot opt source ...
6
votes
1answer
14k views

How to Allow Outgoing SMTP on iptables Debian Linux

If I choose to allow all traffic on the OUTPUT chain (iptables -P OUTPUT ACCEPT) mail sends fine. As soon as I lock down my server with these rules, outgoing mail stops working. All else works though, ...
6
votes
3answers
13k views

What prevents a machine from responding to pings?

I have a CentOS release 5.4 linux box on Amazon EC2 that I'm trying to set up to be monitored via Nagios. The machine is in the same security group as the nagios server, but it seems to be ...
6
votes
2answers
6k views

iptables port-mirroring

I need to be able to get a copy of packets received on port 8001 to port 8002. I have tried the following but I get an error that --tee is undefined. sudo iptables -t nat -A PREROUTING -p TCP -s ...
6
votes
4answers
7k views

Help configuring a custom log file for iptables

I'm trying to log dropped packages to a custom file instead of /var/log/messages. To achieve this, I have added these two lines at the end of my configuration file: -A INPUT -m limit --limit ...