Questions tagged [iptables]

iptables allow creation of rules to define packet filtering behavior.

136
votes
8answers
357k views

Viewing all iptables rules

Is there a way to view iptables rules in a bit more detail? I recently added masquerade to a range of IPs: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE service iptables save ...
81
votes
2answers
79k views

What is the difference between -m conntrack --ctstate and -m state --state

I'm reading this howto, and there's something like this: We can allow established sessions to receive traffic: $ sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT ...
69
votes
10answers
37k views

Block network access of a process?

Is it possible to block the (outgoing) network access of a single process?
49
votes
4answers
54k views

Reply on same interface as incoming?

I have a system with two interfaces. Both interfaces are connected to the internet. One of them is set as the default route; a side effect of this is that if a packet comes in on the non-default-route ...
42
votes
3answers
91k views

Why do iptables rules disappear when restarting my Debian system?

I add this rule: sudo iptables -t nat -A OUTPUT -d a.b.c.d -p tcp \ --dport 1723 -j DNAT --to-destination a.b.c.d:10000 When restart computer rules are deleted. Why? What I can do to make the ...
42
votes
3answers
162k views

How to ensure SSH port is only open to a specific IP address?

This is my /etc/sysconfig/iptables: It has two ports open 80 apache and 22 for ssh. # Firewall configuration written by system-config-firewall # Manual customization of this file is not recommended. ...
39
votes
3answers
72k views

iptables redirect outside requests to 127.0.0.1

I have a service running on 127.0.0.1 with port 2222. I need to forward all requests to 192.168.2.2:2222 (outside IP) only from subnet 192.168.1.0/24 to 127.0.0.1:2222. I'm trying to use this, but it'...
37
votes
2answers
50k views

Difference between SNAT and Masquerade

I am confused what's the actual difference between SNAT and Masquerade? If I want to share my internet connection on local network then whether should I select SNAT or Masquerade?
36
votes
3answers
90k views

Limit max connections per IP address and new connections per second with iptables

We have an Ubuntu 12.04 server with httpd on port 80 and we want to limit: the maximum connections per IP address to httpd to 10 the maximum new connections per second to httpd to 150 How can we do ...
36
votes
2answers
102k views

Why are some ports reported by nmap filtered and not the others?

I'm scanning a server which should have a pretty simple firewall using iptables: by default everything is DROPped besides RELATED and ESTABLISHED packets. The only type of NEW packets allowed are TCP ...
34
votes
2answers
26k views

What do numbers in INPUT,FORWARD,OUTPUT chains mean in iptables config file?

I came across the following config file: # Generated by iptables-save v1.3.1 on Sun Apr 23 06:19:53 2006 *filter :INPUT ACCEPT [368:102354] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [92952:20764374] -A ...
32
votes
1answer
64k views

What -A INPUT -j REJECT --reject-with icmp-host-prohibited Iptables line does exactly?

I have been reading redhat iptables documentation but can't figure out what do the following lines do: ... -j REJECT **--reject-with icmp-host-prohibited** ... -j REJECT **--reject-with icmp-host-...
31
votes
1answer
24k views

Is it better to set -j REJECT or -j DROP in iptables?

There's an example of iptables rules on archlinux wiki: # Generated by iptables-save v1.4.18 on Sun Mar 17 14:21:12 2013 *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [0:0] :TCP - [0:0]...
30
votes
5answers
176k views

Iptables to allow incoming FTP

I want to allow incoming FTP traffic. CentOS 5.4: This is my /etc/sysconfig/iptables file. # Generated by iptables-save v1.3.5 on Thu Oct 3 21:23:07 2013 *filter :INPUT ACCEPT [0:0] :FORWARD ...
29
votes
5answers
54k views

Is there a way to find which iptables rule was responsible for dropping a packet?

I have a system that came with a firewall already in place. The firewall consists of over 1000 iptables rules. One of these rule is dropping packets I don't want dropped. (I know this because I did ...
24
votes
2answers
124k views

How to modify iptables rules via editing a file rather than interacting via command line?

In the history, i would simply edit a file and then reboot the whole server. i would clone the line that had port 22 open change it to 80 and then save the file.. and reboot the whole system so ...
23
votes
4answers
76k views

Output traffic on different interfaces based on destination port

My question is basically the same as Only allow certain outbound traffic on certain interfaces. I have two interfaces eth1 (10.0.0.2) and wlan0 (192.168.0.2). My default route is for eth1. Let's say ...
21
votes
4answers
52k views

Port forward to VPN Client?

I've run into a bit of a puzzle and haven't had much luck finding a solution. Right now I am (sadly) connected to the net via Verizon 3G. They filter all incoming traffic so it is impossible for me to ...
21
votes
2answers
49k views

What is the difference between OUTPUT and FORWARD chains in iptables?

CentOS 6.0 I'm studying iptables and am getting confused on the difference between FORWARD and OUTPUT chains. In my training documentation, it states: If you're appending to (-A) or deleting ...
21
votes
5answers
54k views

Iptables to redirect DNS lookup IP and Port

I have discovered that my ISP (verizon) is intercepting all DNS traffic on port 53. Using iptables, I want to redirect all DNS lookup traffic to a specific IP and Port (5353). Any attempt for my ...
21
votes
1answer
15k views

netfilter/iptables: why not using the raw table?

Under Linux, we usually use the "filter" table to do common filtering: iptables --table filter --append INPUT --source 1.2.3.4 --jump DROP iptables --table filter --append INPUT --in-interface lo --...
20
votes
3answers
127k views

iptables: allow certain ips and block all other connection

How do I allow certain ips and block all other connection in iptables?
20
votes
2answers
31k views

( /etc/sysconfig/iptables ) “Manual customization of this file is not recommended.” Why?

Editing this file directly /etc/sysconfig/iptables can save me so much headaches so much time and so on... and yet on the very top of the file it says.. Manual customization of this file is not ...
20
votes
1answer
33k views

How iptables tables and chains are traversed

I know linux has 3 built-in tables and each of them has its own chains as follow: FILTER: PREROUTING, FORWARD, POSTROUTING NAT: PREROUTING, INPUT, OUTPUT, POSTROUTING MANGLE: PREROUTING, INPUT, ...
18
votes
2answers
29k views

What is the tun network interface for?

I noticed when running ifconfig that there is a network interface called tun0 and it has an ipv4 address. A bit of research shows that it is a tunneling device, but I don't really know how it's used, ...
18
votes
2answers
9k views

Per process firewall?

I've been reading around but can't seem to find a way to create per-process firewall rules. I know about iptables --uid-owner but that only works for outgoing traffic. I've considered scripting ...
17
votes
3answers
46k views

How can I redirect outbound traffic to port 80 using iptables locally?

I'm trying to locally redirect ports on my Ubuntu machine using iptables. Similar to transparent proxying. I want to catch anything trying to leave my system on port 80 and redirect it to a remote ...
17
votes
4answers
61k views

Set some firewall ports to only accept local network connections?

How do I set up the firewall on a system in a LAN so that some ports are only open to connections from the local area network, and not from the outside world? For example, I have a box running ...
16
votes
5answers
45k views

Why isn't the Iptables persistent service saving my changes?

I followed this tutorial to set up IP rules on ubuntu 12.04. Everything worked fine on setup -- but now I've made changes to the firewall that do not persist upon reboot. I do not understand why that ...
16
votes
3answers
38k views

Move iptables rule (w/o removing and adding)

Is there a way to move a rule in the iptables and change it position ? I'm aware i can use -I to insert a rule in a specific position, but i also like to keep the counters.
16
votes
1answer
7k views

How does a transparent SOCKS proxy know which destination IP to use?

There are two SOCKS proxies that I know about that support transparent proxying for any outgoing TCP connection: Tor and redsocks. Unlike HTTP proxies, these SOCKS proxies can transparently proxy any ...
16
votes
1answer
18k views

Linux as router with multiple internet providers

Linux as router: I have 3 Internet providers, each with its own modem. Provider1, which is gateway address 192.168.1.1 Connected to linux router eth1/192.168.1.2 Provider2, gateway address 192.168.2....
16
votes
1answer
20k views

How to reset all iptables settings?

Are there any simpler commands to these? (e.g.: a oneliner? can one command reset iptables/netfilter settings to this?) IPTABLES="$(which iptables)" # RESET DEFAULT POLICIES $IPTABLES -P INPUT ...
15
votes
2answers
14k views

iptables does not list rules i have created

I'm using this guide to set-up a shared internet connection between two PC's. At step 8 it says I should run the commands: iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE /etc/rc.d/iptables ...
15
votes
3answers
2k views

Can I limit a user (and their apps) to one network interface?

I've actually got two scenarios to apply this: Multiseat Desktop: two network connections both with internet gateways and two accounts doing bandwidth-intensive tasks on each. I want to split them up ...
14
votes
1answer
29k views

Configuring OpenVPN to use Firewalld instead of iptables on Centos 7

I need to configure OpenVPN on Centos 7 using firewalld. I used iptables on Centos 6.5 and only had to add the following lines to /etc/sysconfig/iptables: -A POSTROUTING -s "10.0.0.0/24" -o "wlan0"...
14
votes
3answers
157k views

Open port 80 in CentOS 6.5

I'm trying to open the Port 80 in my CentOS 6.5, on my virtual machine, so I can access the apache from my desktop's browser. If you take a look at the screenshot above.... I've added the line before ...
13
votes
3answers
41k views

bash: iptables: command not found

How do I fix the iptables: command not found problem that happened to Debian 7.6? batman@gotham:~$ uname -a Linux gotham 3.14-0.bpo.2-amd64 #1 SMP Debian 3.14.13-2~bpo70+1 (2014-07-31) x86_64 GNU/...
13
votes
3answers
23k views

Only allow certain outbound traffic on certain interfaces

I have rather an odd issue. I have a server with two network interfaces eth0 and eth1. Each are connected to a different network. Each network has a internet gateway. The server has various outbound ...
13
votes
1answer
12k views

What's the difference between ULOG and NFLog?

Various places suggest to use ULOG or NFLOG instead of LOG for getting dedicated netfilter logging (see for example here or here). From looking at man iptables those two look quite alike. Except that ...
13
votes
2answers
57k views

iptables --set-mark - Route diferent ports through different interfaces

Short story, 3 interfaces, eth0 (LAN), eth1(ADSL), eth2(4G). eth0 -> eth1: Works (ports 80, 443, 4070) eth0 -> eth2: Doesn't happen This is a graphical representation of the idea: Port 80 & 443 ...
12
votes
1answer
27k views

iptables and RETURN target

I don't understand what the RETURN target does in a iptables command. The doubt comes from this guide where it says: A chain is a set of rules that a packet is checked against sequentially. When ...
12
votes
1answer
49k views

How to Allow Outgoing SMTP on iptables Debian Linux

If I choose to allow all traffic on the OUTPUT chain (iptables -P OUTPUT ACCEPT) mail sends fine. As soon as I lock down my server with these rules, outgoing mail stops working. All else works though, ...
12
votes
1answer
33k views

No route to host with nc but can ping

I'm trying to connect to port 25 with netcat from one virtual machine to another but It's telling me no route to host although i can ping. I do have my firewall default policy set to drop but I have ...
12
votes
2answers
1k views

Linux iptables ssh port forwarding (martian rejection)

I have a Linux gateway performing NAT for my home network. I have another network which I'd like to transparently forward packets to, but only to/from specific IP/ports (ie. not a VPN). Here's some ...
11
votes
1answer
27k views

How to understand why the packet was considered INVALID by the `iptables`?

I set up some iptables rules so it logs and drops the packets that are INVALID (--state INVALID). Reading the logs how can I understand why the packet was considered invalid? For example, the ...
11
votes
4answers
6k views

port forwarding to application in network namespace with vpn

I was able to set up a network namespace, establish a tunnel with openvpn and start an application that uses this tunnel inside the namespace. So far so good, but this application can be accessed via ...
11
votes
3answers
29k views

Is it better to set rules in ip6tables or disable ipv6?

I have the following network configuration: # ifconfig -a eth0 Link encap:Ethernet HWaddr 00:e0:1c:73:02:09 inet addr:10.1.4.41 Bcast:10.1.255.255 Mask:255.255.0.0 inet6 ...
11
votes
2answers
9k views

How to restrict internet access for a particular user on the lan using iptables in Linux

Let's say there are two users on the LAN, A and B. How do I restrict user A from internet access using iptables rules and saving the rules so that after reboot, they are still effective. Suppose also ...
11
votes
4answers
17k views

Fail2ban block with IPtables doesn't work on Debian Lenny. [moved ssh port]

I've recently decided to do some security maintenance. I saw my logs, and there were some tries against my SSH server. At first, I moved away the SSH port from the default 22. After it, I read ...