Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [iptables]

iptables allow creation of rules to define packet filtering behavior.

0
votes
0answers
13 views

Network gateway with OpenVPN and HAProxy on one server --> routing problems

I am setting up a gateway for my network that includes a reverse proxy (HAProxy) and a openvpn server on the same machine. I want to use the openvpn to connect to a vpn provider so that all the ...
0
votes
0answers
18 views

Sharing Internet Through a Network Interface

I am trying to share internet to another device using USB NCM functionality. I have successfully configured usb0 interface. However, I am not sure how to share internet. So far I have done: On the ...
2
votes
0answers
19 views

How to forward all packets to another subnet?

I am trying to send a copy of all packets to another ip that is not the same subnet. Let's say I want to send a copy of all traffic from 10.0.1.100 to 10.0.2.100. I have another IP, 10.0.1.101 that ...
0
votes
0answers
13 views

Block ping to interface in different subnet

I am currenttly refining the Firewall Rules on my DD-WRT Router. Specifically my question is about this Rule: iptables -I INPUT -i eth1.10 -d ! 192.168.10.0/28 -j DROP I was wondering if it was ...
-2
votes
0answers
18 views

How to block all outgoing connection, execpt of established one? [on hold]

I want to enable incoming HTTP connection to a server and the consequent established connection, but to block all other outgoing connections from the server. Any ideas how to do that?
-1
votes
0answers
7 views

firejail net filter LAN connections only

My goal is to have two computers download something over bittorent, but only one will use internet connection. The second one will be only use local peer discovery and local connections only. Is it ...
0
votes
1answer
13 views

Trying to setup port redirection through 2nd gateway

I am trying to setup configuration where all connections to port 161 will go through another gateway (through openvpn) while others are going directly [localhost] -> [gateway] -> [remote] - OK [...
1
vote
1answer
17 views

Block MAC for a port iptables

I'm trying to block a MAC address for a specific port. iptables -I FORWARD -p tcp -m mac --mac-source 40:00:00:74:0A:00 --destination-port 80,443 -j DROP
0
votes
0answers
18 views

How can the IP masquerading forwarding through a VPN gateway be configured to access the WAN router the gateway is attached to?

I have a gateway machine on my network running a VPN which routes outgoing traffic through a router, but the masquerading rules prevent the machines on the network from connecting directly to the ...
0
votes
1answer
19 views

How to open a port to specific IPs in iptables while using docker?

I have a postgreSQL database inside of Docker that I don't want to expose it to the host network as it causes all users to see the exposed database port. (For now I don't have a pfsense or anything ...
0
votes
1answer
25 views

Multiplex multiple services on same port discriminating by source port

imagine that on the same host I have 2 services: an ssh daemon listening on port 22 a socks5 proxy listening on port 1080 I want to multiplex both services using only port 22 but depending on the ...
0
votes
1answer
24 views

whitelist IP Addresses centos 6.10

How to allow specific IP Addresses to a dport in iptables ? for example : i have 2 clients, first client's IP Address is 182.3.3.1 and the second ones is 202.4.5.6, and i have a port let's say 2222. ...
0
votes
0answers
23 views

Best way to filter/limit ARP packets on embedded Linux

I have an embedded Linux on some network device. Because this device is pretty important I have to make many network tests (I have a separate device for that). These tests include flooding my device ...
-1
votes
1answer
32 views

How to route between two bridge interfaces?

So I have a total of two bridges. One has the 10.0.0.1/24 subnet (br0), and the other has the 10.1.0.1/8 subnet (br1). I want to setup an NGINX reverse proxy that would run on a container connected ...
1
vote
1answer
26 views

How to prevent iptables and nftables rules from running simultaneously?

I'm trying to set up a firewall on my own desktop (currently I'm tinkering with a Fedora 29 virtual machine). I would like to have it on the "deny-everything-by-default" basis. Almost immediately I ...
-1
votes
1answer
36 views

linux network traffic accounting

I have a network with several Hosts N1, N2, N3, ... and they all communicate with each other. I'm in the N2 host CLI with linux. Can you know how much traffic was in bytes between a N2 Host and N3 in ...
-1
votes
1answer
29 views

How to check multiple list from IPSet in IPTables with a single rule?

How can I check multiple list of IPs from IPSet in IPTables with a single rule? I need to add check two list of IPs because it is too big. I know it is not healthy, but I need to do it that way. ...
0
votes
1answer
29 views

Save iptables DD-WRT command

I am trying to save an ip-blocking rule in DD-WRT but without success, every time I reboot the router the rule disappears. I wanted to save the rule permanently. I entering the GUI going under ...
0
votes
2answers
37 views

Block IP range using iptables [duplicate]

I am trying to use in DD-WRT iptables to block an ip range Ex: I want to block iptables -I FORWARD -s 192.168.2.105-192.168.2.110 -j DROP but it does not work.
0
votes
0answers
58 views

Docker container has no route to host

If I stop the iptables service, things will work. I need to know how to change the iptables configuration to allow container access to host ports. I have an nginx container on this RHEL 7 server ...
-2
votes
0answers
21 views

FTP is not working. Error message: unrecoverable backend error: (1251)

I rent the VPS for studying and it has installed the zpanel sentora. And now I can access the admin panel page, just using ssh to control it. There are an account name tuananh and FTP account name ...
0
votes
0answers
26 views

IPTables and Port Forwarding on an OpenVPNAS Server

I have a new OpenVPNas server running on CentOS 7 (Not married to CentOS 7). That I working on replacing an expensive Commercial VPN that has a Public Static IP. Being that the OpenVPNas server is ...
1
vote
1answer
63 views

Redirect all outgoing DNS queries to local stub resolver at 127.0.0.1:53

I am attempting to redirect all outgoing DNS queries on my Linux box to my local caching stub resolver (unbound). iptables -t nat -A OUTPUT -p tcp --dport 53 -j DNAT --to 1.1.1.1:53 iptables -t nat -...
1
vote
2answers
28 views

How do I block public port(3306) access in Linux but allow from other nodes on local network?

I have a MySQL server running on port 3306 with a private IP: 10.64.30.117. I also have a web app running on another node with a private IP: 10.17.23.1. I want the web app to be able to access the ...
1
vote
2answers
72 views

How to convert `iptables -S` output to a breadth-first listing

I'm looking for a program that takes the output of iptables -S and converts it to a breadth-first listing. Why? I'm doing some work on a router using VyOS where several layers of tables are pre-...
0
votes
1answer
34 views

Why actual host ip is removed from iptables rule

I added this rule in iptables iptables -A INPUT -s 192.168.0.100/24 -p tcp --dport 27 -j ACCEPT To my surprise, when I list the iptables rules, i see this: source value became 192.168.0.0/24 Why?
1
vote
0answers
45 views

FTP Connection Refused after passive mode

when using ftp via commandline I can connect and authenticate but when I issue commands I receive the message connection refused. I am able to connect to this FTP server from other servers and locally ...
2
votes
0answers
37 views

Kernel modules for iptables ftp forward

I have two ARM devices connected to each other with TCP/IP, one of them is connected to my network, on the other one is FTP server. I'm trying to set up port forwarding to ftp using conntrack and ...
1
vote
1answer
37 views

Allow all incoming ICMP connections internal network iptables

I'm trying to allow all incoming ICMP connections from the internal network using iptables, but somehow it won't allow it. I've added the following rules: iptables -P INPUT DROP iptables -A INPUT -...
0
votes
0answers
38 views

iptables to ip6tables

How do I turn my iptables rules to ip6tables rules? I am getting a Bad Address: iptables -A OUTPUT -p tcp -j ALLOW iptables -t nat -A PREROUTING -d 192.168.0.0/24 -i eth0 -j DNAT --to 192.168.255....
0
votes
0answers
38 views

What part of my iptable isn't working correctly?

I've followed two separate guides(1, 2) to setup my Raspberry Pi up as a VPN router. To clarify, the RPi isn't acting as a VPN server but rather acting as a router to forward traffic from some, but ...
0
votes
0answers
29 views

Does routing table work like a per-IP-address firewall, while iptables work like a per-port firewall?

I heard that in a routing table, we can drop packets. Does that work like a per-IP-address firewall to prevent access to certain range of IP addresses from the local device? In comparison, does ...
0
votes
1answer
122 views

How to redirect incoming traffic from port A to port B, and allow localhost traffic on port B but not incoming?

I'd like to add a "small" security to MySql server. I want to leave open port 330, but only for internal purpose (localhost), and open another port (say 12345), that redirect to 3306. So I need to ...
0
votes
0answers
37 views

Policy Based Routing with multiple outbound gateways based on source MAC

I'm implementing a central pool of servers to handle "over capacity" error messages in a legacy network, and I'm under the impression that I need to do some tricky policy based routing with ...
1
vote
0answers
23 views

Filter PPPoE packets

Can you somehow inspect PPPoE packets and then filter them with iptables or other tools? PPPoE is below ipv4 so I can't use iptables directly.
0
votes
1answer
42 views

How to remotely access by name a device which is only accessible locally

I have several switches with the same factory-set static address, each connected to a server with two interfaces, one server to each switch. The server's primary interface is to the local house ...
0
votes
1answer
50 views

Changing Destination IP address using iptables and DNAT

I am trying to experiment with DNAT in PREROUTING. I found a tutorial here. It contains the following sentence: This is done in the PREROUTING chain, just as the packet comes in; this means that ...
0
votes
0answers
12 views

iptables-restore - what does `:CHAIN` do?

This is a followup to https://unix.stackexchange.com/a/400203/21615 . When using iptables-restore --noflush, :<chain> <policy> [<packets_count>:<bytes_count>] seems to flush ...
-2
votes
1answer
17 views

I enabled iptables logging from the command line. How do I undo this logging configuration?

I ran sudo iptables -A INPUT -p udp -j LOG --log-prefix "udp:" How do I make it stop?
2
votes
1answer
51 views

Accessing internet hosts from qemu guests behind a bridged network

I am trying to set up a number of qemu quests on the same private network. I want them to not be accessible outside the host but they should be able to access each other and resources from the ...
3
votes
1answer
63 views

ip6table-restore failed in Debian buster/sid

I have the below iptable rule in /etc/iptables/rule.V6 and /etc/iptables/rule.V4 -4 -A INPUT -p icmp -j ACCEPT -6 -A INPUT -p ipv6-icmp -j ACCEPT when I tried to restart the netfilter-persistent, it ...
1
vote
1answer
48 views

iptables-restore failed in Debian buster/sid if it has --multiport option in the rules file

I have /etc/iptables/rule.v4 file contains many rule, the below is the line where I see the issue -A INPUT -p tcp -m multiport --dports 22 -j ACCEPT -A INPUT -p udp -m multiport --dports 16384:32768 -...
3
votes
0answers
30 views

Why fail2ban would ban an IP that is whitelisted (on ignoreip)?

I have fail2ban configured to protect the authentication on a postfix service. The jail is working properly on the ban side, but the ignoreip option seems to be ignored or misconfigured since it bans ...
1
vote
0answers
18 views

Where are iptables rules fetched from while running command 'service iptables save'?

I have created my own file- /etc/sysconfig/iptables-config. On service iptables save my rules are successfully updated and that updates the /etc/sysconfig/iptables file as well. Now even after i ...
1
vote
2answers
48 views

Traffic between subnets VirtualBox

I'm trying to build a prototype of a real network in VirtualBox. I have 3 guest systems: Debian-based router with 3 NICs: enp0s3 Looks outsude.(bridged) enp0s8 LAN1.(gateway to internal ...
0
votes
0answers
16 views

CentOS not recognizing Rackspace verbiage for saving iptables

I'm getting back into the Linux game and have installed CentOS server and am stalled with saving the iptables for Apache operation. The Rackspace guide tells me how to use the service command to save ...
1
vote
1answer
25 views

How do rules with overlap coverage work together in general?

https://serverfault.com/questions/247176/iptables-only-allow-localhost-access#comment224878_247180 iptables -A INPUT -p tcp -s localhost --dport 25 -j ACCEPT iptables -A INPUT -p tcp --dport 25 -j ...
-2
votes
1answer
65 views

What is a chain in iptables?

Iptables is used to set up, maintain, and inspect the tables of IPv4 packet filter rules in the Linux kernel. Several different tables may be defined. Each table contains a number of built-in ...
0
votes
1answer
32 views

How can I configure bidirectional protocol-independent port forwarding?

I am attempting to solve the following problem: I have a system which I will henceforth refer to as "Local" that hosts a service on port 80 and port 443, and depends on sending outgoing requests on ...
0
votes
1answer
26 views

iptables: what happen after a reboot?

Installing NCPA for nagios, I found these instructions iptables -I INPUT -p tcp --destination-port 5693 -j ACCEPT apt-get install -y iptables-persistent Answer yes to saving existing rules Of course,...