Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [iptables]

iptables allow creation of rules to define packet filtering behavior.

0
votes
0answers
19 views

How can I make a router using CentOS 7

Route a print server I am asking this community for some advice on routing using a CentOS 7 server. This situation is as follows: I have an external print server (let’s say it’s on subnet 10.0.0.0/...
-1
votes
0answers
9 views

Proxy setup between a private and public [on hold]

I have two servers: Private Server with IP: 172.16.0.2 Public Server with 172.16.0.3 (private IP) and x.x.x.x (public IP) What I want to achieve is: Incoming communications to Public IP (x.x.x.x) ...
0
votes
1answer
38 views

Debian 9 allows hidden DNS queries?

In previous Debian Jessie I could configure iptables to restrict DNS traffic to my own router (192.168.1.1): Chain OUTBOUND (1 references) target prot opt source destination ...
1
vote
2answers
50 views

checking if iptables are set on a system in script [duplicate]

I'm writing a script in bash and I need to check if iptables are set...I have this: if [ `iptables-save | grep '^\-' | wc -l` > 0 ] then echo "Iptables already set, skipping..........!" else ...
0
votes
1answer
33 views

Centos 7 server iptables Active: active (exited)

When I check the iptables service status it says Active (exited) why and how do I fix it?
0
votes
1answer
21 views

Performance of active port - netstat

Below command [root@machine1 output]# netstat -s --udp IcmpMsg: InType0: 371137 InType3: 296 InType8: 386843 InType11: 4 InType13: 141 InType15:...
0
votes
0answers
12 views

Traffic flow OUTPUT set-mark and fwmark?

http://www.178linux.com/ueditor/php/upload/image/20160331/1459423355555023.png I know the ip rule is before OUTPUT.But I use the following command: iptables -t mangle -A OUTPUT -p tcp --dport 80 -j ...
-2
votes
1answer
22 views

How iptables release traffic flowing through port 80 of this machine?

A service running on port 80.I hope that the traffic flowing through it can be released.I used the following command: iptables -t mangle -A PREROUTING -p tcp --dport 80 -j MARK --set-mark 0x80 ...
1
vote
0answers
10 views

Purpose of UFW Allow All Rules in FORWARD chain?

What's the purpose of the allow all rules put into the FORWARD chain by UFW? They're currently messing up the 5 ACCEPT rules I've put in place underneath. Unless there's some specific valid reason ...
1
vote
0answers
11 views

OVPN/OpenVPN Including multiple machines on the client side when using a routed VPN (dev tun)

I'm going to build my own firewall using physical debian machine. This time it's a NAT-by-NAT conifguration until everything works fine. (Not to disturb primary network.) I got a Debian vServer ...
0
votes
0answers
13 views

can iptables or BPF be used to detect and drop replay attack traffic?

I would like to drop traffic that is 'old' and 'seen before' i.e replay attack. For example if someone uses tcpdump/wireshark to capture a 5min chunk of data and replays it in loop. The traffic is ...
0
votes
0answers
21 views

iptables mangle TEE and NAT

I have a service listening on port 192.168.2.15:8001 UDP, I need mirror packets on another port on a remote PC in the same LAN 192.168.2.4:8002 UDP. I tried mirroring via mangle TEE: iptables -A ...
0
votes
1answer
19 views

Ceph Monitor iptables rules strange behaviour

I'm trying to set up iptables for a Ceph cluster. I'm currently putting rules together for one of the monitor servers. The monitor daemon listens on tcp/6789 (ip address removed as it is a public ...
0
votes
0answers
25 views

Enable Services on SUSE 12 - yast

My question is very similar to this one, but fundamentally different. I need to understand how yast enables services in SUSE 12. I temporarily turned off firewalld and iptables (systemctl stop ...
0
votes
0answers
6 views

the behaviour of forward chain in iptables wrt to docker

https://docs.docker.com/v17.09/engine/userguide/networking/default_network/container-communication/#container-communication-between-hosts says: Communication between containers Docker will ...
-1
votes
0answers
25 views

How can I use iptables to duplicate outgoing DNS requests and send the copy to a different nameserver?

I have a host running Debian which is making DNS requests to some nameserver. My goal is to copy the outgoing DNS requests, change the destination IP and fire away. The authoritative copy is still the ...
0
votes
0answers
7 views

Issue in network routing when load balancing a network system

Trying to Bypass a load Balancer Our system directs network traffic across a three way load balancer serving three cellular modems in normal operation. We use a program called speedtest_cli that ...
0
votes
1answer
21 views

nmap bypass iptables rules | Redhat 5.6 [closed]

I have legacy system on Redhat Linux 5.6, with Nmap 4.11. ( IP: 10.11.4.22 ). I want to block access from this legacy system via every port/protocols to another server( IP: 10.11.4.24 ). I first ...
-1
votes
0answers
26 views

who/what issues iptables commands?

a couple containers lost networking a couple days ago, i'm thinking it likely the issue is iptables commands being issued by system code somewhere. we manage iptables with our own firewall script. ...
0
votes
1answer
29 views

Firewalld and iptables priority

Simple question: What is the priority if we have both firewalld and iptables in use? Which takes the priority in the rules. For example, if I block ICMP with firewalld and with iptables I accept it, ...
0
votes
1answer
33 views

Proxify all the traffic from B to A [duplicate]

My computer A has two networks, one connects to internet. The other one connects to computer B. How can I setup A to route all the internet traffic from B through a proxy running on A without setting ...
0
votes
0answers
11 views

Isolate VMnets with iptables

I would like to ask about iptables: I have my the following config - host= Ubuntu 18.04 - VM1= Ubuntu18.04 - VM2= Win10 My ifconfig as follows: docker0: flags=4099<UP,BROADCAST,MULTICAST> ...
0
votes
0answers
21 views

Redirect - IPtables

I want to be redirected to page 192.168.1.1 when the user enters the www.google.com site. So I add the following iptables rules on the router: iptables -t nat -I PREROUTING -p tcp --dport 80 -j DNAT ...
0
votes
1answer
30 views

How to log quantities of IP traffic by src/dst (and port for UDP & TCP)?

How can I log quantities of IP traffic by src/dst (and port for UDP & TCP)? For each interval (probably each hour) I would like to see something like: proto, src, dst, packets, octets ICMP, 192....
0
votes
2answers
26 views

iptables allow everything, is it safe?

The os is Ubuntu Server 18 and I am running a web server on it. Is it safe to accept all traffic on all ports? iptables -P INPUT ACCEPT iptables -P FORWARD ACCEPT iptables -P OUTPUT ACCEPT I tried ...
0
votes
0answers
35 views

Why there's no Internet (Tor + VirtualBox)

There's a page which has steps to make VirtualBox work within Tor. There's a script which makes rules below on this page. After all steps finished, these are the rules as a result of script (at guest ...
0
votes
0answers
21 views

Load-balancing through multiple interfaces on the same server using Nginx

I'm testing proxy server with combination of Nginx TCP load balancing and SNI based HTTPS proxy. In my testing debian box I have following interfaces configured eth0 192.168.1.10 - proxy eth0:1 ...
0
votes
1answer
36 views

How to let locally generated packets pass through PREROUTING chain?

I would like to let locally generated packets pass through PREROUTING chain bacause I want to use sudo iptables -t mangle -A PREROUTING -p tcp -d somewebsite.com -j TPROXY --on-port 32794 to ...
2
votes
0answers
121 views

CentOS 7 Firewall: How to allow SMTP outgoing emails with IPTables?

I am running a Spring-Boot Java application inside a Docker container on a server running CentOS 7. [root@dev-machine ~]# rpm --query centos-release centos-release-7-5.1804.4.el7.centos.x86_64 I ...
0
votes
1answer
29 views

Iptables connecting between two subnets [duplicate]

I have a Linux machine (which I want to use as a gateway) and two other machines A and B. Gateway machine has eth0, eth1, and eth2. eth1 connects to machine A and eth2 connects to machine B. I want ...
1
vote
1answer
26 views

Open Port443 on Linux Ubuntu 12.04

i have a Linux Ubuntu 12.04.3 LTS with Elastic Search installed. the Elastic Search is configured to accept the local requests via HTTP. i have a php website on the same server. it was on port 80 but ...
0
votes
1answer
19 views

Log accepted packets with ufw

I'm using ufw on Ubuntu 18.04 LTS, and I want to log both dropped and accepted packets (I am aware this will generate a lot of logs). I can do this by increasing the ufw log level with ufw logging ...
0
votes
2answers
10 views

Configure VPS so only authenticated VPN users can access web server

I am setting up an intentionally vulnerable website to show some security stuff, but I don't want unauthorized people exploiting it. How would I be able to configure my VPS so that only people ...
0
votes
1answer
102 views

How --set-mark option works on Netfilter (IPTABLES)?

On Netfilter, you have the option --set-mark for packets that pass through the mangle table. The majority of tutorials and examples over the Internet, say that this just adds a mark on the packet, ...
1
vote
0answers
62 views

order of rules' processing in iptables chains [closed]

Isn't the order of processing the rules in iptables top to bottom? Given the following example; Chain DOCKER (2 references) target prot opt source destination RETURN ...
0
votes
2answers
50 views

remap port 80 to 22

I would like to remap incoming requests on port 80 to port 22 and tried the following: sudo iptables -A PREROUTING -t nat -p tcp --dport 80 -j REDIRECT --to-ports 22 but still, ssh -i key user@host -p ...
0
votes
1answer
80 views

Iptables masquerade breaks dns lookups

I'm testing something with IP masquerade on locally generated traffic but it seems to be breaking DNS lookups. Everything else works fine--all IP traffic without DNS queries work. $ iptables -t ...
1
vote
0answers
97 views

DROP or REJECT packets from PREROUTING NAT table in iptables

Goal is to allow only specific networks to access docker container services/ports running on my server. Tried adding ACCEPT rules in to INPUT filter chain. That did not help, networks even without ...
2
votes
1answer
20 views

Source-MAC Filter iptables

I have a HAProxy box with centos7 and doing load balance proxy for a smtp cluster providing mail relay to our customers. default gateway => 10.0.0.1 master-relay.example.net => 10.0.0.254 ...
1
vote
1answer
83 views

iptables No chain/target/match by that name

I'm trying to simple block DDoS attacks by using: iptables -A INPUT -p udp --dport 27015 -m limit --limit 10/s --limit-burst 20 -j DROP But getting: iptables: No chain/target/match by that name. ...
0
votes
0answers
44 views

Iptables rule for a server in DMZ

I would like to add one of our servers in DMZ and block all and every egress and ingress access with the exception of ingress TCP 80 and 443. The server has an IP address of 10.2.100.208. The problem ...
0
votes
0answers
60 views

Port Forwarding to OpenVPN client?

My ISP doesn't allow Port Forwarding. So I bought myself a VPS server and installed OpenVPN server on it. I want to port forward ports through this VPS to my OpenVPN client. I have followed many ...
0
votes
1answer
76 views

iptables reject-with tcp-reset without ACK flag

I created iptables rule: iptables -I INPUT -p tcp --tcp-flags SYN,RST,ACK,FIN SYN --dport 10000 -j REJECT --reject-with tcp-reset But actually what it does is a rejecting with RST,ACK flags. It is ...
2
votes
1answer
108 views

multicast traffic is able to poke a hole into the netfilter connection tracking system

I have an IPTV solution at home where the ISP sends me hundreds of large UDP datagrams per second from 10.4.4.5 port 10 to 239.3.5.3 port 10, i.e. it is using multicast. My current iptables ...
0
votes
1answer
31 views

Does ping omit iptables / postrouting rules

I have a server with a proxmox installation and only 1 outbound connection (eth0). To make the machines network between each other I created a network bridge (vmbr0) in the interfaces configuration ...
3
votes
1answer
60 views

Are there any disadvantages or hazards to load all the firewall rules before loopback interface is initialized?

I have fairly complex iptables/ip6tables rules affecting multiple interfaces. I would like to make sure, that firewall rules are always in place. As one can create rules even for (at that moment) non-...
0
votes
1answer
31 views

Network interface routing when using VPN

I want to connect to a VPN but not send all traffic through it. Here is how my network is setup with the VPN redirecting all traffic. This is the default with the vpn config not changed. $ ip rule ...
1
vote
0answers
53 views

Failed to ping external network from linux namespace, why?

I created a namespace, and used a veth pair(veth1 and veth2) to connect the namespace with my host. I also created a linux bridge in my host and add eth0 and veth1 to the bridge as interfaces. Hers is ...
0
votes
0answers
16 views

Search ipset with settype instead of setname Ask Question

I know the basic functionality of ipset list. With ipset list, we can get a particular ipset details by providing the setname. But I want to know if any ipset rule is present in the list of a ...
0
votes
2answers
45 views

Block Docker port and access it to few IP addresses

I need to block all INPUT traffic to port 8090 on the Ubuntu server 16.04. I used Iptables but it did not help. Commands I used: iptables -A INPUT -p tcp --dport 8090 -j DROP iptables -A INPUT -p tcp ...