Search type Search syntax
Tags [tag]
Exact "words here"
Author user:1234
user:me (yours)
Score score:3 (3+)
score:0 (none)
Answers answers:3 (3+)
answers:0 (none)
isaccepted:yes
hasaccepted:no
inquestion:1234
Views views:250
Sections title:apples
body:"apples oranges"
URL url:"*.example.com"
Favorites infavorites:mine
infavorites:1234
Status closed:yes
duplicate:no
migrated:no
wiki:no
Types is:question
is:answer
Exclude -[tag]
-apples
For more details on advanced search visit our help page
Results tagged with Search options questions only user 52763

iptables allow creation of rules to define packet filtering behavior.

0
votes
2answers
Let's say we need some ssh rules in iptables. But we also want to specify another chain for all the rules. We could use something like this: iptables -t filter -N ssh iptables -t filter -N tcp … iptables -t filter -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW -j tcp iptables -t filter -A tcp -p tcp --dport 22 -m conntrack --ctstate NEW -j ssh iptables -t filter …
asked Jun 18 '14 by Mikhail Morfikov
2
votes
0answers
There's a part in iptables manual concerning SNAT and MASQUERADE targets. I know the key difference between the two, but I don't fully get the following sentence: It is still possible to use the …
asked Aug 3 '14 by Mikhail Morfikov
34
votes
2answers
I came across the following config file: # Generated by iptables-save v1.3.1 on Sun Apr 23 06:19:53 2006 *filter :INPUT ACCEPT [368:102354] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [92952:20764374] -A … limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7 -A INPUT -j DROP COMMIT # Completed on Sun Apr 23 06:19:53 2006 Does anyone know what [368:102354], [0:0] and [92952:20764374] mean? …
asked Jan 7 '14 by Mikhail Morfikov
9
votes
1answer
I often see that people set STEAL target in iptables rules. It's possible to get this target by installing (on debian) xtables-addons-common and xtables-addons-dkms. I was curious why people prefer …
asked Jan 11 '14 by Mikhail Morfikov
82
votes
2answers
I'm reading this howto, and there's something like this: We can allow established sessions to receive traffic: $ sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT … , in which case an inferior version can be used as last resort: $ sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT Is there a significant difference in working between -m …
asked Jan 7 '14 by Mikhail Morfikov
11
votes
3answers
ipv6 address fe80::2e0:4cff:fe75:309: $ ping6 fe80::2e0:4cff:fe75:309 connect: Invalid argument I have set some iptables rules (ipv4): # iptables -S -P INPUT DROP -P FORWARD DROP -P OUTPUT ACCEPT … packets, 26296 bytes) pkts bytes target prot opt in out source destination I followed this guide, and they say that I should copy the iptables (ipv4) configuration and paste it …
asked Jan 6 '14 by Mikhail Morfikov
2
votes
1answer
When you want to mark a packet in iptables, you would generally add the following line to your firewall script: iptables -t mangle -A POSTROUTING -p tcp -m multiport --dports 80,443 -j MARK --set …
asked May 13 '16 by Mikhail Morfikov
3
votes
0answers
packets will hit the INVALID rule and you have to make a new connection, which now goes through the new rules of iptables. In OpenWRT, you can simply do the following: # echo f > /proc/net/nf_conntrack …
asked Jun 5 '16 by Mikhail Morfikov
5
votes
2answers
following rules to iptables: iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.1.200:80 I know … what the rules mean. But there's also two other rules, which are responsible for NAT reflection. One of them isn't that clear to me as the ones above. So the first rule looks like this: iptables -t nat …
asked May 9 '16 by Mikhail Morfikov
31
votes
1answer
There's an example of iptables rules on archlinux wiki: # Generated by iptables-save v1.4.18 on Sun Mar 17 14:21:12 2013 *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [0:0] :TCP - [0 …
asked Jan 15 '14 by Mikhail Morfikov