Iptables is a module that provides the Linux operating system functions of firewall, NAT and logging of data traveling over a computer network.

learn more… | top users | synonyms

2
votes
4answers
456 views

Block all but http traffic on a network interface

I've got two network interfaces on an Ubuntu machine which go out to two different networks but both have internet gateways. I need to limit it so that any outgoing http requests it makes (ie ...
2
votes
1answer
255 views

Restrict the number of http and https connections from a specified IP address to ten connections per minute

How I can restrict the number of http and https connections from a specified IP address to ten per minute usingiptables commands? I’ve tried this but it is not working: iptables -A INPUT -s ...
1
vote
2answers
6k views

Block all ports except SSH/HTTP in ipchains and iptables

How can I block all ports except ssh (port 22) httpd (port 80) using iptables and iphains?
1
vote
2answers
553 views

How to “shut off” all networking on Linux from bash?

I'd like to write a bash/shell script that "turns off" the machine's ability to communicate over it's network card, effectively shutting down all networking. From the command line: # To turn all ...
1
vote
2answers
6k views

iptables - How to forward all external ports to one local port

I want a service to be running on every external port on my system. Since it wouldn't work to start 65535 single instances of that service (I guess...) I thought of using iptables for this. The ...
1
vote
5answers
6k views

Home network to accept only certain MAC addresses from LAN

I have Ubuntu 10 as router with WAN(eth0) and LAN(eth1). How can I restric eth1 to accept only packets from certain MAC addresses and drop the rest? I am also about to setup DHCP to certain MAC ...
1
vote
3answers
937 views

iptables LOG actio writes to STDOUT

when I use LOG action in some chane of iptables rules, I get the output both in STDOUT or STDERR of the xm console and in /var/log/messages. Is there way to make iptables to write only to log ...
1
vote
2answers
426 views

Why after Accepting Ports 20 and 21 in iptables are they still closed?

I am trying to open the FTP Ports on my server. I have vsftpd installed on the server already. However I am unable to reach the server on ports 20 and 21 Somehow it is allowing me to access port 21 ...
1
vote
2answers
84 views

How to check/adjust SSH server on embedded board

I'm currently having difficulties connecting to an embedded board from my Linux machine through ssh. The embedded board is a FOX G20 V with a Linux OS. I've tried to connect to the board through ...
1
vote
1answer
131 views

How iptables behaves on timezone change?

I have doubt how iptables keep changing the info in iptables when timezone is change. I am using iptables s v 1.4.8 I have blocked one IP with following details # date Thu Jun 6 12:46:42 IST ...
1
vote
1answer
2k views

Will increasing number of rules in iptables slow down my internet

How much impact will the rules have on speed, if we are using match to queue the packets.
1
vote
1answer
38 views

Should my server ever need to directly communicate with the NAT gateway?

What I mean by ``directly communicate'' Does it ever need to receive packets with the gateway's IP address as the source IP address, or send packets with the gateway's IP address as the destination ...
1
vote
1answer
68 views

Forwarding all traffic to other server with iptables

Assume I have a sever with X.X.X.X IP address and a web server with Y.Y.Y.Y IP address. How would I forward web traffic from X.X.X.X to Y.Y.Y.Y using iptables? My servers run Linux and use iptables
1
vote
1answer
217 views

bind/named not working on UDP from external

This one is weird. I've set this up a long while ago, on a centos5. From what I remember, it used to work. For some time now, it's not. I've just been informed so no clue what changed when that made ...
1
vote
2answers
204 views

Connecting to an SSH server behind a NAT

I am having trouble connecting to an SSH server behind a NAT on an ubuntu workstation. I've installed openssh package(both the client and the server) and forwarded port 22 through the NAT and tried to ...
1
vote
2answers
440 views

Is selective VPN routing worth it?

I want to setup routing tables on my RT-N66U router to selectively route traffic through a VPN. For instance, only Pandora requests would go via the VPN. I've found a way to do this with iptables: ...
1
vote
1answer
133 views

iptables detects clients behind NAT?

I'm setting up a server that I want to protect from DoS attacks, by setting a limit using iptables: iptables -A INPUT -p tcp --dport 80 -m limit --limit 25/minute --limit-burst 100 -j ACCEPT (default ...
1
vote
2answers
996 views

Route traffic through VPN to some IPs occasionally

I would like to route traffic to some specific addresses through VPN. Easy enough, one can simply add a route: ip route add <destination ip> dev tun0 scope link Here comes the catch: I do not ...
1
vote
2answers
320 views

Why nic with incorrect subnet mask can still ping the gate way?

At first, my network config was like this: $ ip a 2: em1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 3c:97:0e:bd:b1:68 brd ff:ff:ff:ff:ff:ff ...
1
vote
1answer
368 views

iptables NAT doesn't preserve remote IP

I have the iptables rules below forwarding incoming ssh traffic on port 2222 to a virtual machine running in a vmware "vmnet" network on the same host. 192.168.1.1 192.168.1.40 +---------+ ...
1
vote
2answers
2k views

iptables gives me and error “can't initialize iptables NAT”

I am trying to use iptables and it is giving me the following error root@vikkyhacks:~# iptables -t NAT -L iptables v1.4.18: can't initialize iptables table `NAT': Table does not exist (do you need to ...
1
vote
2answers
112 views

DNS set correctly but website unreachable

I have the (sub)domain elo.bernardinuscollege.nl, which has a DNS A record that points to 54.225.118.87, which is correct (checked it with telnet, which indeed returns the right IP). For some reason ...
1
vote
3answers
413 views

Setting up two ADSL lines for home/business use

As a follow-up to this question which is still unresolved. I have two ADSL routers with different providers connected to different phone lines to the internet. As shown in the diagram. These routers ...
1
vote
1answer
189 views

Can't reach web server from local virtual network

I have installed a couple of virtual machines. Some uder Windows, some under Fedora Linux. On one of the Fedora machined I've installed Apache web server. I have setup server name in httpd.conf to ...
1
vote
1answer
109 views

Valid Type Of Service Values

I need to know what are valid values for TOS field in iptables. I mean when I try to add a rule with ip rule add what can I give as tos value I could not find any resource about tos value. I know ...
1
vote
1answer
2k views

unable to connect to localhost:80 after installing nginx

I just installed nginx by doing sudo yum install nginx and I'm unable to connect to it on port 80. I tried stopping iptables by doing sudo service iptables start and was still unable to connect. I'm ...
1
vote
1answer
72 views

iptables -L lags on non localhost or anywhere address

I am trying to configure iptables for ubuntu 10.04 and I have a problem with iptables -L lagging on rows where the destination or source address is not localhost or anywhere. The following entries ...
1
vote
1answer
844 views

Rerouting traffic from port 80 to another port on a single ip

I have a server with multiple IP addresses associated with it. I'm trying to run a node.js web server (which I do not want to run as root), using only one of those ip addresses (it would be very bad ...
1
vote
2answers
5k views

How to alias an IP address to make DLNA resource accessible from different IP network

what I have I have a home wifi network 192.168.1.0/24 having DLNA resource 192.168.1.100. I have a TV with ethernet and a netbook with both wifi and ethernet interfaces. I want to make my notebook ...
1
vote
2answers
3k views

Setting up a Linux server with a public Static IP

I have setup a Ubuntu Linux server in an office. It should have a public IP so that outside users can access the internet. Currently, it is set with a public IP, but is it supposed to have a local ...
1
vote
1answer
611 views

Feedback to router users during access-restricted hours for DD-WRT

Following router schedule rules that I change often, the stock firmware on my D-Link 825NA rev. B redirects HTTP requests to a built-in "Access denied!" warning at appointed times. I just upgraded ...
1
vote
2answers
2k views

Howto compile a kernel module on CentOS [required packages]

What yum commands do I need to get available packages installed on CentOS to build a iptables MATCH kernel module.
1
vote
2answers
2k views

Routing from the DMZ to the interior network only

I have a home network connected to Verizon's FIOS service. Verizon's ActionTec router is connected to the ONT via coax to establish the MOCA network. My DD-WRT router's WAN port is connected to one ...
1
vote
1answer
19 views

confusing INPUT,OUTPUT iptables rules

Following is my iptables rules in Ubuntu. ╰─$ sudo iptables -S -P INPUT ACCEPT -P FORWARD DROP -P OUTPUT ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT -A ...
1
vote
1answer
54 views

Most secure way to have IPtables auto-loaded using Debian / Linux

I'd like to know the safest way to load iptables using Debian. Of course, I can use a script that uses iptables-restore : #!/bin/sh iptables-restore < /etc/firewall.conf but : 1) where is the ...
1
vote
1answer
65 views

OpenWRT Firewarll INPUT Chain allowing everything?

I haven't done anything to my the default firewall rules except open a port for ssh from the wan and add the rules for OpenVPN as defined in this tutorial: ...
1
vote
3answers
37 views

Firewall init script

On Debian, what is the best way to start an iptables firewall script : /etc/init.d/firewall_script.sh in /etc/network/interfaces, add post-up /etc/network/if-up.d/firewall_script.sh Do you check ...
1
vote
3answers
358 views

How to block all ports except 80,443 with iptables? [duplicate]

Blocking all ports(in and out) is easy but it's hard with the word "except". I don't know any rules that satisfies the condition. PS: I know this question is nothing new. But in fact, I didn't find ...
1
vote
1answer
172 views

Combination of NAT, DHCP, and OpenVPN on lubuntu 14.04

Okay, so I've got a set up, where eth0 my internal IP address (192.168.1.3) it has been configured as my default gateway using the iptables this sudo sysctl -w net.ipv4.ip_forward=1 sudo ...
1
vote
1answer
141 views

Iptables deny access to a specific IP address not working

I'm not able to deny access to a specific IP address or deny access to a specific IP address range as well. My network environment is, I have one router which IP is (30.30.10.1) and second my hotspot ...
1
vote
2answers
265 views

Apache runs locally but can't be accessed from other machine

I'm running Apache 2.2.3 in a VM for a test environment on CentOS 5. Apache is running and responding to requests on the VM itself. If I run "lynx localhost" on the VM I do get my test page. When I ...
1
vote
1answer
226 views

How to transparently tunnel a port from IPv4 to a remote IPv6 device?

At home, I am connected with an IPv6 address and additionally, my provider provides a NAT-like setup through which I receive a public IPv4 address that I share with other customers (the reason being ...
1
vote
1answer
216 views

How to block incoming traffic on a virtual interface?

How do I block all incoming traffic on eth0:0 but keep eth0 open? What I've tried is this: iptables -P INPUT DROP iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -i eth0 -j ACCEPT But this ...
1
vote
1answer
174 views

Iptables limit user access time and mac

I am trying to create an iptable chain to kick my daughter off her ipad during the night. With the mac only filter I can block access but when I add time it no longer works. Does anyone see an issue ...
1
vote
1answer
102 views

Traffic not being forwarded through NAT

I have a router which provides internet access using NAT, and a client Linux box (A) which is connected to this router on eth0. This Linux box also has a wlan interface, wlan0; what I would like is ...
1
vote
1answer
158 views

With iptables only allow certain outbound ports

Okay, I'm running a router with shibby tomato (linux based) v1.28-115 and have a bridge network setup (br1) that consists of a guest wifi. I want to only allow access to specific outbound ports... ...
1
vote
1answer
374 views

Chromecast, Unblock-Us and Edimax BR-6478AC router

It seems that Google has hard coded the Google DNS into the Chromecast, thus making it pretty much useless for anyone outside the U.S. who wants to use it for Netflix and Hulu. I have the above ...
1
vote
1answer
76 views

Drop IP fragments of a certain protocol

When conntrack is active, the iptables stack never sees a fragmented IP packet, only the reassembled one (source), so the -f test never matches. If I want to block any fragment I could set ...
1
vote
1answer
167 views

Disable SSH remote tunneling

I need to restrict SSH tunnel functions. Users should not be allowed to create remote tunnels but only tunnels to localhost. I tried to setup the whole thing in the SSH configuration but I can only ...
1
vote
2answers
1k views

CentOS 6.4 and alternate SSH port not working

I've got a CentOS 6.4 machine and would like to change the default SSH port, and followed these instructions: CentOS Wiki After making those changes (including the "semanage port -a -t ssh_port_t -p ...