Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [iptables]

iptables allow creation of rules to define packet filtering behavior.

23
votes
4answers
76k views

Output traffic on different interfaces based on destination port

My question is basically the same as Only allow certain outbound traffic on certain interfaces. I have two interfaces eth1 (10.0.0.2) and wlan0 (192.168.0.2). My default route is for eth1. Let's say ...
69
votes
10answers
36k views

Block network access of a process?

Is it possible to block the (outgoing) network access of a single process?
11
votes
2answers
9k views

How to restrict internet access for a particular user on the lan using iptables in Linux

Let's say there are two users on the LAN, A and B. How do I restrict user A from internet access using iptables rules and saving the rules so that after reboot, they are still effective. Suppose also ...
49
votes
4answers
54k views

Reply on same interface as incoming?

I have a system with two interfaces. Both interfaces are connected to the internet. One of them is set as the default route; a side effect of this is that if a packet comes in on the non-default-route ...
18
votes
2answers
9k views

Per process firewall?

I've been reading around but can't seem to find a way to create per-process firewall rules. I know about iptables --uid-owner but that only works for outgoing traffic. I've considered scripting ...
30
votes
5answers
176k views

Iptables to allow incoming FTP

I want to allow incoming FTP traffic. CentOS 5.4: This is my /etc/sysconfig/iptables file. # Generated by iptables-save v1.3.5 on Thu Oct 3 21:23:07 2013 *filter :INPUT ACCEPT [0:0] :FORWARD ...
8
votes
6answers
36k views

iptables to block https websites

I wish to block a few websites that also run upon https, like facebook, twitter, and gmail, in my organization. Squid is not supposed to be used here as per the orders from higher management. We can ...
36
votes
3answers
90k views

Limit max connections per IP address and new connections per second with iptables

We have an Ubuntu 12.04 server with httpd on port 80 and we want to limit: the maximum connections per IP address to httpd to 10 the maximum new connections per second to httpd to 150 How can we do ...
13
votes
3answers
23k views

Only allow certain outbound traffic on certain interfaces

I have rather an odd issue. I have a server with two network interfaces eth0 and eth1. Each are connected to a different network. Each network has a internet gateway. The server has various outbound ...
21
votes
4answers
52k views

Port forward to VPN Client?

I've run into a bit of a puzzle and haven't had much luck finding a solution. Right now I am (sadly) connected to the net via Verizon 3G. They filter all incoming traffic so it is impossible for me to ...
9
votes
1answer
3k views

Dual network connection

I have a usb cellular modem and a Home LAN connection on my Ubuntu 10.10 box. Both work independently. I want to know how to have both connected at the same time, and be able to specify which ...
42
votes
3answers
90k views

Why do iptables rules disappear when restarting my Debian system?

I add this rule: sudo iptables -t nat -A OUTPUT -d a.b.c.d -p tcp \ --dport 1723 -j DNAT --to-destination a.b.c.d:10000 When restart computer rules are deleted. Why? What I can do to make the ...
37
votes
2answers
50k views

Difference between SNAT and Masquerade

I am confused what's the actual difference between SNAT and Masquerade? If I want to share my internet connection on local network then whether should I select SNAT or Masquerade?
31
votes
1answer
24k views

Is it better to set -j REJECT or -j DROP in iptables?

There's an example of iptables rules on archlinux wiki: # Generated by iptables-save v1.4.18 on Sun Mar 17 14:21:12 2013 *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [0:0] :TCP - [0:0]...
16
votes
1answer
18k views

Linux as router with multiple internet providers

Linux as router: I have 3 Internet providers, each with its own modem. Provider1, which is gateway address 192.168.1.1 Connected to linux router eth1/192.168.1.2 Provider2, gateway address 192.168.2....
10
votes
1answer
84k views

iptables forward all traffic to interface

I have two interfaces eth1 and eth0. I want all traffic on eth0to be forwarded to eth1. I created an iptable rule like this: iptables -A FORWARD -s 0/0 -i eth0 -p tcp -o eth1 -j ACCEPT But this ...
14
votes
1answer
29k views

Configuring OpenVPN to use Firewalld instead of iptables on Centos 7

I need to configure OpenVPN on Centos 7 using firewalld. I used iptables on Centos 6.5 and only had to add the following lines to /etc/sysconfig/iptables: -A POSTROUTING -s "10.0.0.0/24" -o "wlan0"...
6
votes
1answer
7k views

iptables/pf rule to only allow XY application/user?

I think there is no iptables/pf solution to only allow an XY application on e.g.: outbound tcp port 80, eth0. So if I have a userid: "500" then how could I block any other communications then the ...
1
vote
1answer
920 views

Understanding an iptables shell script

SITUATION: I recently found the following shell script that works with iptables to block all internet access to/from the linux OS, except for terminals opened that were in a group called internet: ...
136
votes
8answers
355k views

Viewing all iptables rules

Is there a way to view iptables rules in a bit more detail? I recently added masquerade to a range of IPs: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE service iptables save ...
42
votes
3answers
162k views

How to ensure SSH port is only open to a specific IP address?

This is my /etc/sysconfig/iptables: It has two ports open 80 apache and 22 for ssh. # Firewall configuration written by system-config-firewall # Manual customization of this file is not recommended. ...
20
votes
1answer
33k views

How iptables tables and chains are traversed

I know linux has 3 built-in tables and each of them has its own chains as follow: FILTER: PREROUTING, FORWARD, POSTROUTING NAT: PREROUTING, INPUT, OUTPUT, POSTROUTING MANGLE: PREROUTING, INPUT, ...
20
votes
3answers
126k views

iptables: allow certain ips and block all other connection

How do I allow certain ips and block all other connection in iptables?
18
votes
3answers
46k views

How can I redirect outbound traffic to port 80 using iptables locally?

I'm trying to locally redirect ports on my Ubuntu machine using iptables. Similar to transparent proxying. I want to catch anything trying to leave my system on port 80 and redirect it to a remote ...
36
votes
2answers
102k views

Why are some ports reported by nmap filtered and not the others?

I'm scanning a server which should have a pretty simple firewall using iptables: by default everything is DROPped besides RELATED and ESTABLISHED packets. The only type of NEW packets allowed are TCP ...
17
votes
4answers
61k views

Set some firewall ports to only accept local network connections?

How do I set up the firewall on a system in a LAN so that some ports are only open to connections from the local area network, and not from the outside world? For example, I have a box running ...
7
votes
1answer
18k views

Settings when using a bridge

I have a bridge set up between my physical Ethernet interface, eth0, and the virtual interface for OpenVPN, tap0. The bridge has an IP address, and the machine can be contacted on that IP address from ...
13
votes
2answers
57k views

iptables --set-mark - Route diferent ports through different interfaces

Short story, 3 interfaces, eth0 (LAN), eth1(ADSL), eth2(4G). eth0 -> eth1: Works (ports 80, 443, 4070) eth0 -> eth2: Doesn't happen This is a graphical representation of the idea: Port 80 & 443 ...
8
votes
2answers
16k views

iptables port-mirroring

I need to be able to get a copy of packets received on port 8001 to port 8002. I have tried the following but I get an error that --tee is undefined. sudo iptables -t nat -A PREROUTING -p TCP -s 127....
5
votes
2answers
12k views

How does NAT reflection (NAT loopback) work?

I use the auto generated rules that come from OpenWRT as an example of NAT reflection (NAT loopback). So let's pretend there's a network 192.168.1.0/24 with two hosts (+ router): 192.168.1.100 and ...
11
votes
4answers
6k views

port forwarding to application in network namespace with vpn

I was able to set up a network namespace, establish a tunnel with openvpn and start an application that uses this tunnel inside the namespace. So far so good, but this application can be accessed via ...
9
votes
2answers
8k views

Iptables: matching outgoing traffic with conntrack and owner. Works with strange drops

In my iptables script I have been experimenting with writing as finely grained rules as possible. I limit which users are allowed to use which services, partly for security and partly as a learning ...
5
votes
2answers
5k views

How is the IFB device positioned in the packet flow of the Linux kernel

I would like to know the exact position of the following device in the packet flow for ingress traffic shaping: IFB: Intermediate Functional Block I would like to better understand how packets are ...
6
votes
1answer
3k views

multigateway routing for specific src port

I have two gateway to access internet, somehow I want to load balancing it, so far its working, but some connection or service need persistent gateway IP to be used, so the client should never change ...
3
votes
2answers
2k views

How can I Forward a subDomain to a specific port?

My apologies if this has been asked before. I haven't found an adequate solution so... yeah. When a specific domain, "example.com" is accessed, I want it to act normally. In other words, it should go ...
1
vote
1answer
904 views

What do the numbers in brackets mean on the iptables-save output?

What do the [368:102354], [0:0] and [92952:20764374] in my iptables output file mean? :INPUT ACCEPT [368:102354] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [92952:20764374]
4
votes
1answer
9k views

iptables: how to allow traffic from redirected port

I have a web service running on debian 7 and listening on port 8080. I want to redirect 80 to 8080 for inbound connections and allow only port 80. Here is my iptables configuration: root@localhost:~# ...
4
votes
1answer
13k views

How To Persist ip Rule And Route Whenever Server Rebooted?

I'm using Centos 7 Server And I Would Like To Save ip Rule And Route Whenever Server Rebooted. ip rule add from x.x.x.x table 128 ip route add table 128 to y.y.y.y/y dev eth0 ip route add table 128 ...
3
votes
2answers
2k views

RELATED,ESTABLISHED state in iptables

What do the words 'RELATED' and 'ESTABLISHED' individually signify in RELATED,ESTABLISHED state in iptables?
3
votes
3answers
3k views

How can I block all ports except some?

I am trying to use iptables but I am clueless in understanding the documentation even so that I've locked myself out of my server twice already whilst trying to implement it. These are the simple ...
2
votes
0answers
237 views

Redirection of traffic from one computer to another

I have two computers on the same lan Comp A: 192.1681.151.15 Comp B: 192.1681.151.19 When I open Wireshark, for all traffic browsed on comp A, I would like Wireshark to capture traffic of comp A and ...
2
votes
1answer
884 views

Port forwarding an ssh request from a global IP to a specific local IP

I need to accomplish port forwarding from a global IP address to a specific local IP address on a local system running on Linux that is connected to the Internet via a Squid Proxy Server Running over ...
1
vote
1answer
481 views

Allow SSH access after port knocking from any source IP

I have a working port knocking setup for SSH on Linux using only iptables rules and the “recent” module following this tutorial: https://wiki.archlinux.org/index.php/Port_knocking#...
1
vote
1answer
343 views

Iptable forward interfaces for gateway machine

I have two Ethernet interface being configured to use as system gateway ex: eth1: 10.10.1.0 eth2: 10.10.2.0 I want to forward all the packets which are coming to the 10.10.2.0 gateway contacting 10....
1
vote
2answers
169 views

Use the LANs of one server to access the LAN of another

I'm a bit lost here, so I'm asking for your help. =D I have three servers: 1# - LANs A and B 2# - LANs B and C 3# - LANs C and D How can I make server 1# access through LAN B an ip that is in LAN D ...
1
vote
1answer
8k views

ufw: how to forward single port to another port on different interface

I have two interfaces eth0 (192.168.1.2) and eth1 (192.168.3.2). I receive data from 8080 at eth0. I want to forward it to eth1 port 80. I'm using UFW, because i don't understand iptables and how to ...
1
vote
1answer
4k views

Service Active but (exited)

I have already install firewall (iptables) on a server Debian 8. The service is active but in (exited) state. What does "Active: active (exited)" mean ? And how can i fix or change it into (running) ?...
0
votes
1answer
361 views

How to limit 1 connection per 5 seconds? (IPTABLES)

I want to limit 1 connect per 5 seconds using IPTABLES for people, which are connecting to port "12871/12881". I was trying to find rule for it, but ineffectively. It must be like a "queue" of ...
0
votes
1answer
7k views

viewing firewalld logs via remote login to CentOS 7 server

I have firewalld installed in a remote CentOS server. When I log into the server over the internet as root, I type the following command to access the firewalld logs: journalctl --output=json-...
81
votes
2answers
79k views

What is the difference between -m conntrack --ctstate and -m state --state

I'm reading this howto, and there's something like this: We can allow established sessions to receive traffic: $ sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT ...