Hot answers tagged

6

For such a large amount of IPs you should use the ipsets module. ipset creates datasets on which iptables can react, it can easily handle 10s of 1000s of entries. Make sure you have the EPEL repo enabled and then install ipset via: yum install ipset An example: ipset -N blockedip iphash creates a set called 'blockedip' in format 'iphash' (there are ...


3

All you need is this single rule: iptables -t nat -I PREROUTING --src 0/0 --dst 172.16.0.2 This will insert into PREROUTING chain (?=-I) of the nat table (-t nat) the rule, that says: Any incomming (-src 0/0) packets with destination address 172.16.0.2 (--dst 172.16.0.2). Things to remember are: To redirect incoming traffic means inserting rules into ...


2

The iptables-save command has a very straightforward output. The varying parts are in square brackets after a rule, or in comments: # Generated by iptables-save v1.4.21 on Sun Jan 10 16:02:30 2016 : INPUT ACCEPT [38:2132] It then becomes an exercise to nullify or even remove such entities, resulting in a completely deterministic output that can still be ...


2

Elasticsearch uses the following port ranges: 9200-9300: Web API connectivity. 9300-9400: Infra / Node communication Between ES Cluster nodes: iptables -A INPUT -p tcp -s <source> --dport 9300-9400 -j ACCEPT Between Master and Kibana (client > server): iptables -A INPUT -p tcp -s <source> --dport 9200 -j ACCEPT Elasticsearch uses by ...


2

I've always had issues with iptables redirections (probably my fault, I'm pretty sure it's doable). But for a case like yours, it's IMO easier to do it in user-land without iptables. Basically, you need to have a daemon in your "default" workspace listening on TCP port 8112 and redirecting all traffic to 10.200.200.2 port 8112. So it's a simple TCP proxy. ...


2

It seems what you want can be done easier than with ebtables (redirect target). If you want all packets with a certain IP target address to be sent to a certain MAC address then you can simply create a static ARP entry for this address: ip neighbour add 1.2.3.4 lladdr 11:22:33:44:55:66 dev eth0 nud permanent


2

Allow first your local connection and your RELATED, ESTABLISHED connections protocols. $ sudo iptables -A INPUT -p tcp -s 127.0.0.1 -j ACCEPT $ sudo iptables -A INPUT -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT $ sudo iptables -A INPUT -p udp -m state --state RELATED,ESTABLISHED -j ACCEPT $ sudo iptables -A INPUT -p icmp -m state --state ...


2

Iptables keep a count (per chain) of packets processed. This two options could be used to change the count: -Z, --zero [chain [rulenum]] Zero the packet and byte counters in all chains, or only the given chain, or only the given rule in a chain. -c, --set-counters packets bytes This enables the administrator to ...


1

If you're talking about 15,000 different IP addresses you really do not want to be using a separate iptables rule for each address. This will slow down your network throughput. Instead you should consider using a single IP Set and putting your 15000 addresses in that. ipset create spambots iphash iptables -A INPUT -m set --match-set spambots src -j DROP ...


1

The -I option to iptables does not append (which is -A), it is used to insert a new rule. The difference is that -A adds new rules at the end of the chain, whereas, by default, -I adds new rules at the beginning of the chain. Since chains are read in-order, it is important that your -j ACCEPT rule is processed before the -j DROP rule. There are several ...


1

First check to make sure that your server is listening on the port you want, not just local host netstat -plnt Should give you an output similar to this: Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 127.0.1.1:53 0.0.0.0:* LISTEN - tcp 0 0 10.0.3.1:53 0.0.0.0:* ...


1

You should try setting port = ssh to the port you really use. (I assume that even with running ssh on a non-standard port, you're not changing the value in /etc/services, and you probably shouldn't do that anyway.)


1

This configuration has to be done in your GW. Setup the FORWARD chain. $ sudo iptables -A FORWARD -i eth1 -j ACCEPT $ sudo iptables -A FORWARD -o eth0 -j ACCEPT Where eth1 = internal interfece eth0 = external interface This will set the inbound & outbound interfaces where the forwarding's gonna be done. Check that the forward option is 1 ...


1

Got solved in the comments - quick summary of the most important points: ncat, and possibly other netcat impletmentations, listens for incoming connection only once, and stops doing so with the first attempt (unless there's a switch in program for that) programs can start listening on a port regardless of what are the current iptables settings


1

A few cautious words up-front: Defending against a DDoS attack is difficult and generally requires the help of your ISP. Iptables alone won't protect you and might even be harmful. I don't think you really want do what you are asking for. DDoS are meant to cause denial of service by overloading your system. Logging packets will increase the load of ...


1

First off I wouldn't suggest iptables to solve all of this, truely an ideal exit Tor node would load balace traffic though a few VPN tunnels to keep ISP's eyes off the packets and true destination and/or utilize caching proxy to keep outbound repeat requests to popular static content to a minimum... while looking into those options here's a band-aid for the ...



Only top voted, non community-wiki answers of a minimum length are eligible