Hot answers tagged

6

That mark is internal and not included anywhere in the packet or any of its headers. That means it gets lost when doing the actual outbound connection, and wouldn't be visible in the INPUT table of the target server, but you would see it in the OUTPUT table of the initiating machine. The point of supporting a mark in ping is to allow outbound routing ...


3

@Julie Pelletier's answer is 100% correct, but probably not very understandable to you. First, as mentioned several times in the comments, the mark is not put into the ethernet packet on the wire. So if you ping server B from server A, server B will not ever be able to detect the mark. If you want to do anything, you'll have to use server A alone. So, ...


3

For a NAT to work properly both the packets from client to server and the packets from server to client must pass through the NAT. Note that the NAT table in iptables is only used for the first packet of a connection. Later packets related to the connection are processed using the internal mapping tables established when the first packet was translated. ...


3

In addition to the other answers, iptables -v -L lists the counts of packets and bytes that traverse a given rule, so you can see how much traffic you're dropping, and I wouldn't be too hard to write a tool that parses and reports that info.


2

You'll need to set up a logging chain for your dropped packets. There is a good tutorial on doing that at http://www.thegeekstuff.com/2012/08/iptables-log-packets/ which boils down to adding something similar to the following to your current ruleset: iptables -N LOGGING iptables -A INPUT -j LOGGING iptables -A LOGGING -m limit --limit 2/min -j LOG ...


2

You need to explicitly log the packets, using the LOG target. You'd add a rule in your chains with the same criteria as the DROP rule for the abusive IP, but using -j LOG instead of -j DROP. In addition you can specify the log prefix using --log-prefix, and a log level using --log-level. It's also common to specify rate limits to avoid flooding the logs... ...


2

The key is that tables are grouping things by design intention. All your rules intended for filtering are in this place, all your NAT rules over there. Chains are sequences of rules, and the default chains are traversed at specific points in the path of a packet. In theory, you could add a rule that does filtering to, say, the NAT table. But the front end ...


2

Audit entries are generated regardless some server is listening using audit_log_acct_message. As far as I know, syscall 102 is getuid() -- you can check using ausyscall 102 (I am afraid to install auditctl after all this :P). The audit message is not invoked by iptables itself, but somewhere in the kernel. You might get rid of it using audit_enable=0 or ...


2

TL;TR: FTP is a broken protocol and FTPS more so. Due to a combination of protocol design and encryption it plays very bad together with firewalls. Try to use SFTP (i.e. file transfer over SSH protocol) instead. FTP consists of a control connection (usually port 21) and the data connections. Which ports are used by the data connections are dynamically ...


2

sed -e "$(awk '/^[[:space:]]*(#|$)/ { next } ; { print "s/ PROTO="$2" / PROTO="$3" /;" }' \ /etc/protocols)" /path/to/iptables.log This uses awk to construct a sed script from fields 2 and 3 of the /etc/protocols file. It then runs that sed script on /path/to/iptables.log. This will convert ALL numbered protocols in the log file ...


2

You can send back a RST with iptables -p tcp [...] -j REJECT --reject-with tcp-reset. I doubt there is any real value to getting nmap to say a port is "closed" instead of "filtered", though. Mainly it's to get connections refused more quickly, instead of waiting for a timeout (e.g., with -j DROP) or sometimes-unreliable ICMP handling (with the other ...


2

The target "-j MARK --set-mark 2" will set the mark 2 on the packet, whatever the previous value was. If you want to avoid your mark to be erased, you can simply end the packet path in the chain with -j ACCEPT. For example : iptables -t mangle -A POSTROUTING -p tcp --dport 80 -j MARK --set-mark 10 iptables -t mangle -A POSTROUTING -p tcp --dport 80 -j ...


2

Maybe you could use audit. Fedora enables it by default, and it floods the journal with NETFILTER_CFG lines. See this question: Audit on changes to the running iptables configuration In the example shown, the relevant process is iptables, which may not be very helpful. However it also records ppid, the parent process (as well as the obvious pid). In ...


2

You will need both sets of rules within iptables. The two rulesets ensure that traffic leaving by the specified interfaces is appropriately masqueraded. Here is my suggestion, which is a little simpler than yours: # Masquerade outgoing traffic iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE # Allow ...


1

No. Replace the --update options with --rcheck; the appearance update already happens with --set. With --update the same packet causes up to three updates as it advances through the rules. In particular, it may well match the DROP rule without having matched the LOG rule, since each one increments the hit count. Changing to --rcheck should open it to allow ...


1

Here is a simple way to do it: iptables -A PREROUTING -d my.public.ip.address/32 -p tcp -m tcp --dport 587 -j DNAT --to-destination a.different.ip.address:587 Note that a.different.ip.address could be on any interface as long as the routing table is properly configured. You would also need the following to do the full loop: iptables -A POSTROUTING -s ...


1

You cannot do this with iptables. You can only operate on IP addresses with IPTables, not hostnames / URLs. You need a proxy such as what Apache allows you to do to redirect based on URL / vhost.


1

The handy tool is to list existing rules with line-numbers: iptables --line-numbers -t filter -L FORWARD You could delete the rules with -D option: iptables -t filter -D FORWARD 1 You could insert a new rule at specified location with -I option: iptables -t filter -I FORWARD 0 blah-blah-blah this would insert a new rule at the very beginning of a ...


1

No, the VPS is acting as a forward proxy, or just a regular proxy, in this case. You can achieve this using iptables, but there are probably some easier solutions available. Using iptables, you would want to set up DNAT and SNAT rules in your FORWARD table - no I don't have specific step-by-step instructions, but it shouldn't be too difficult for you to ...


1

The error message in the kernel logging is telling you that an inbound UDP packet to your port 53 was dropped. Looking at your configuration there is nothing that tells the firewall to accept UDP. (You've got a rule to accept established and related TCP connection packets, but nothing for UDP.) The solution is to remove the restriction on established and ...


1

It looks like you haven't allowed UDP connections in, thus blocking DNS on UDP port 53. If you are using DHCP, then you'll also need to allow DHCP on UDP ports 67-68 as well. Add the following two lines and it should connect: $iptables -A INPUT -p udp --dport 67:68 -j ACCEPT $iptables -A INPUT -p udp --dport 53 -j ACCEPT There may be other ports on udp ...


1

The -A INPUT -s adds a rule for any packets with the source subnets specified on the line. Therefore, in your example, you are logging and dropping all packets that have a source IP address that starts with 255 and all that start with 0, such as 255.1.2.3.4 or 0.56.78.90 The idea here is that there should will never be packets that start with those ...


1

The below rule will allow only your IP and Block all other IPs over port 22 or ssh. iptables -I INPUT -p tcp -s ! yourIPaddress --dport 22 -j DROP


1

The changes to iptables can't be rolled back one by one: you have to reset all the rules and re-apply the ones you need. In your case, you seem to have a clean firewall by default, so all you need to do is: sudo iptables --table nat ---flush This will remove all the rules from the "nat" table.



Only top voted, non community-wiki answers of a minimum length are eligible