Search type Search syntax
Tags [tag]
Exact "words here"
Author user:1234
user:me (yours)
Score score:3 (3+)
score:0 (none)
Answers answers:3 (3+)
answers:0 (none)
isaccepted:yes
hasaccepted:no
inquestion:1234
Views views:250
Sections title:apples
body:"apples oranges"
URL url:"*.example.com"
Favorites infavorites:mine
infavorites:1234
Status closed:yes
duplicate:no
migrated:no
wiki:no
Types is:question
is:answer
Exclude -[tag]
-apples
For more details on advanced search visit our help page
Results tagged with Search options questions only user 33060

iptables allow creation of rules to define packet filtering behavior.

1
vote
0answers
14400 7200 604800 86400 (152) I would like to replace the destination IP address from 198.51.100.183 to 10.10.10.1. I made a following rule to PREROUTING table: # iptables -t nat -L PREROUTING -v …
asked Nov 30 '15 by Martin
2
votes
0answers
networks configured to VLAN sub-interfaces. What is the most optimal way to achieve this? iptables -A FORWARD -i eth2 -s 0.0.0.0/0 -d 192.168.300.0/24 -j ACCEPT in router/firewall-PC with DROP FORWARD chain policy? …
asked Feb 11 '15 by Martin
3
votes
2answers
Does iptables multiport module provide a performance benefit over multiple separate rules? In other words, is this: iptables -A INPUT -p tcp -m multiport --sports 1,2,3,4,5,6,7,8,9,10,11,12,13,14,80 … -j ACCEPT ..more efficient than this: iptables -A INPUT -p tcp --sport 1 -j ACCEPT iptables -A INPUT -p tcp --sport 2 -j ACCEPT iptables -A INPUT -p tcp --sport 3 -j ACCEPT iptables -A INPUT -p tcp …
asked Mar 23 '18 by Martin
1
vote
1answer
When I list the iptables rules for filter table with iptables -t filter -L -vvv --line-numbers command, then I see entry numbers from 0 to 124 under the debug output. Last entry is following: Entry …
asked Feb 22 '17 by Martin
6
votes
3answers
Why does SNAT(modifies source IP and/or ports) happen in nat table POSTROUTING chain, i.e after routing? And why does DNAT(modifies destination IP ant/or ports) happen in PREROUTING chain? I guess lat …
asked Apr 29 '16 by Martin
2
votes
1answer
I have seen a similar technique used in several iptables examples for matching new connections: -A INPUT -p tcp -m tcp --dport 443 --syn -m conntrack --ctstate NEW -j SSH As seen above, TCP …
asked Mar 21 '18 by Martin
4
votes
3answers
result with certain threshold and if higher, writes a message to /var/log/messages file. However, is there a smarter method? I mean for example with iptables or tc which could create a log message in case certain bandwidth threshold on interface is exceeded? …
asked Mar 12 '15 by Martin
3
votes
1answer
I have fairly complex iptables/ip6tables rules affecting multiple interfaces. I would like to make sure, that firewall rules are always in place. As one can create rules even for (at that moment) non … -existing interfaces(for example iptables -A INPUT -i eth999 -j ACCEPT), then I thought that I'll not associate the rules with a physical interface, but rather with lo interface which is always …
asked Aug 23 '18 by Martin
0
votes
0answers
I have a server with IPv4 forwarding(routing) disabled: # sysctl net.ipv4.ip_forward net.ipv4.ip_forward = 0 # Is there a circumstance where such server sends out ICMP 11/0(TTL expired in transit) …
asked May 20 by Martin
0
votes
1answer
I'm running Apache on a server with stateful firewall where new IPv4/IPv6 ingress connections are allowed only to TCP ports 80 and 443. SSH is allowed from few trusted hosts and only certain ICMP/ICMP …
asked Jun 10 by Martin
0
votes
1answer
correct to think of netfilter/iptables architecture in a way that chains define the place where operations happen and tables determine which operations can be done? In addition, do tables matter for kernel as well or are they simply meant for iptables users to group types of processing which can occur? …
asked May 5 '16 by Martin
2
votes
1answer
I have an IPTV solution at home where the ISP sends me hundreds of large UDP datagrams per second from 10.4.4.5 port 10 to 239.3.5.3 port 10, i.e. it is using multicast. My current iptables … configuration for ingress traffic is very simple: ~# iptables -L INPUT -v -n --line-numbers Chain INPUT (policy DROP 0 packets, 0 bytes) num pkts bytes target prot opt in out source …
asked Aug 24 '18 by Martin