Iptables is a module that provides the Linux operating system functions of firewall, NAT and logging of data traveling over a computer network.

learn more… | top users | synonyms

1
vote
1answer
3k views

iptables trouble: nat with ip alias (virtual interface) not working

I'm setting up an Ubuntu 11.10 server to act as firewall for a network running several different SSL websites. The idea is fairly common: have all public IP's for each site aliased to the public ...
1
vote
1answer
3k views

How do I block all ports except 22 and 80 in Fedora's iptables? [duplicate]

I am trying to only allow port 22 TCP/UDP and port 80 TCP/UDP from anywhere using Fedora 15 iptables, and all the rest will be never accessible nor scannable from a public network. But it never ...
1
vote
2answers
3k views

Setting up a Linux server with a public Static IP

I have setup a Ubuntu Linux server in an office. It should have a public IP so that outside users can access the internet. Currently, it is set with a public IP, but is it supposed to have a local ...
1
vote
1answer
664 views

Feedback to router users during access-restricted hours for DD-WRT

Following router schedule rules that I change often, the stock firmware on my D-Link 825NA rev. B redirects HTTP requests to a built-in "Access denied!" warning at appointed times. I just upgraded ...
1
vote
2answers
2k views

Howto compile a kernel module on CentOS [required packages]

What yum commands do I need to get available packages installed on CentOS to build a iptables MATCH kernel module.
1
vote
2answers
2k views

Routing from the DMZ to the interior network only

I have a home network connected to Verizon's FIOS service. Verizon's ActionTec router is connected to the ONT via coax to establish the MOCA network. My DD-WRT router's WAN port is connected to one ...
1
vote
1answer
857 views

What do these numbers mean in the output of iptable-save?

In the output of iptables-save # Generated by iptables-save v1.3.8 on Sun Mar 14 19:42:45 2010 *filter :INPUT ACCEPT [328764:37367248] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [324693:28884726] COMMIT # ...
1
vote
1answer
20 views

Cannot access DNS from external network

I have setup a MaraDNS instance on CentOS 6.5. I can access the DNS records from local machine—on which MaraDNS is installed—by doing nslookup but cannot access the DNS server records from Internet on ...
1
vote
1answer
43 views

iptables always needs restart

I have a CentOS 7 PC, on which I'm using iptables. I have an Oracle 11gR2 instance on that PC and I need to access is from other PCs in the LAN. My /etc/sysconfig/iptables: # Generated by ...
1
vote
2answers
40 views

How to print iptable firewall rules?

How does one print or dump the firewall rules being used by iptables in an effort to trouble shoot connection problems? I'm fairly certain its going to include -L or --list, but I'm not sure of other ...
1
vote
1answer
92 views

iptables - UDP Packets from unknown IP addresses

I'm really new to basic systems administration, and this question is a bit difficult for me to Google. I'm setting up a small raspberry pi server for my own personal use, to teach myself some basic ...
1
vote
1answer
554 views

iptables duplicate traffic to another ip

This blog post has a template iptables rule to forward traffic, to and from the router to another ip address. iptables -t mangle -A POSTROUTING \ -d [IP to spy on] \ -j ROUTE –tee –gw ...
1
vote
2answers
232 views

Is it possible to force DNS for certain devices with iptables?

I'm trying to use iptables to force DNS for certain devices (Shibby Tomato on Asus RT-N66U). I haven't found anything online describing such a configuration. The closest I could find was this: # For ...
1
vote
1answer
261 views

Expose a Reverse SSH Tunnel on the Remote server

I set up a Reverse SSH tunnel from my home computer to my work server: ssh -f -N -R 19999:localhost:22 remoteuser@server To connect to my home computer I have to first log in to the server and then ...
1
vote
1answer
61 views

confusing INPUT,OUTPUT iptables rules

Following is my iptables rules in Ubuntu. ╰─$ sudo iptables -S -P INPUT ACCEPT -P FORWARD DROP -P OUTPUT ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT -A ...
1
vote
1answer
136 views

Most secure way to have IPtables auto-loaded using Debian / Linux

I'd like to know the safest way to load iptables using Debian. Of course, I can use a script that uses iptables-restore : #!/bin/sh iptables-restore < /etc/firewall.conf but : 1) where is the ...
1
vote
1answer
2k views

How to permanently disable firewall in Red Hat Linux

I have followed the below steps to disable the firewall in Linux. After reboot, again firewall is enabled. How to disable firewall permanently? Login as the root user. Next enter the following three ...
1
vote
1answer
352 views

OpenWRT Firewarll INPUT Chain allowing everything?

I haven't done anything to my the default firewall rules except open a port for ssh from the wan and add the rules for OpenVPN as defined in this tutorial: ...
1
vote
3answers
55 views

Firewall init script

On Debian, what is the best way to start an iptables firewall script : /etc/init.d/firewall_script.sh in /etc/network/interfaces, add post-up /etc/network/if-up.d/firewall_script.sh Do you check ...
1
vote
1answer
477 views

Combination of NAT, DHCP, and OpenVPN on lubuntu 14.04

Okay, so I've got a set up, where eth0 my internal IP address (192.168.1.3) it has been configured as my default gateway using the iptables this sudo sysctl -w net.ipv4.ip_forward=1 sudo ...
1
vote
1answer
281 views

Iptables deny access to a specific IP address not working

I'm not able to deny access to a specific IP address or deny access to a specific IP address range as well. My network environment is, I have one router which IP is (30.30.10.1) and second my hotspot ...
1
vote
2answers
1k views

Apache runs locally but can't be accessed from other machine

I'm running Apache 2.2.3 in a VM for a test environment on CentOS 5. Apache is running and responding to requests on the VM itself. If I run "lynx localhost" on the VM I do get my test page. When I ...
1
vote
1answer
728 views

What does this iptables rule mean: tcp flags:0x06/0x02 TCPMSS clamp to PMTU?

What does this iptables rule mean: tcp flags:0x06/0x02 TCPMSS clamp to PMTU? Doing iptables -vnL on my DD-WRT router shows the following rule in the FORWARD chain: TCPMSS tcp -- * * 0.0.0.0/0 ...
1
vote
1answer
564 views

How to block incoming traffic on a virtual interface?

How do I block all incoming traffic on eth0:0 but keep eth0 open? What I've tried is this: iptables -P INPUT DROP iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -i eth0 -j ACCEPT But this ...
1
vote
1answer
300 views

Iptables limit user access time and mac

I am trying to create an iptable chain to kick my daughter off her ipad during the night. With the mac only filter I can block access but when I add time it no longer works. Does anyone see an issue ...
1
vote
1answer
298 views

With iptables only allow certain outbound ports

Okay, I'm running a router with shibby tomato (linux based) v1.28-115 and have a bridge network setup (br1) that consists of a guest wifi. I want to only allow access to specific outbound ports... ...
1
vote
1answer
540 views

Chromecast, Unblock-Us and Edimax BR-6478AC router

It seems that Google has hard coded the Google DNS into the Chromecast, thus making it pretty much useless for anyone outside the U.S. who wants to use it for Netflix and Hulu. I have the above ...
1
vote
1answer
109 views

Drop IP fragments of a certain protocol

When conntrack is active, the iptables stack never sees a fragmented IP packet, only the reassembled one (source), so the -f test never matches. If I want to block any fragment I could set ...
1
vote
1answer
226 views

Disable SSH remote tunneling

I need to restrict SSH tunnel functions. Users should not be allowed to create remote tunnels but only tunnels to localhost. I tried to setup the whole thing in the SSH configuration but I can only ...
1
vote
2answers
1k views

CentOS 6.4 and alternate SSH port not working

I've got a CentOS 6.4 machine and would like to change the default SSH port, and followed these instructions: CentOS Wiki After making those changes (including the "semanage port -a -t ssh_port_t -p ...
1
vote
1answer
519 views

Internet access to host behind firewall using ssh tunnel

My goal is to give host behind firewall access to the internet. Below you can find brief description of network [internet] <-> [proxy] <-> [A] <-> (firewall) <-> [B] [A] - ...
1
vote
3answers
6k views

Source Based Policy Routing & NAT (DNAT/SNAT) aka Multi WANs on CentOS 5

Originally posted at Unix and Linux but nobody was able to answer it, so m migrating the question here: My question is regarding Source Based Policy Routing on CentOS 5 with 2 WANs plus a LAN (NAT) ...
1
vote
1answer
2k views

Forward connections on 0.0.0.0:80 to 127.0.0.1:9091

I'm trying to set up a tor-relay. In order to allow tor to present a static web page explaining what it is I want the server to listen on port 80 and 443. In order to allow tor to use ...
1
vote
1answer
665 views

OpenVPN + Squid or another way of blocking advertisements/websites?

I have a personal VPN that I use on my tablet for public wifi protection. Adblock+ is limited on android in that you need to set up a proxy for it to work, and this isn't ideal. Before I started ...
1
vote
1answer
294 views

ICMP firewall policy for standard ubuntu desktop

For a standard desktop computer running Ubuntu 12.04 behind a NAT router, what ICMP packets should one accept in the firewall, say iptables? It seems there is often conflicting advice; some say block ...
1
vote
1answer
316 views

How can I detect long-lived connections and mark them for shaping

I would like to detect TCP connections which have been open for more than one minute (or for greater than N bytes, or M packets), so I can classify them as bulk traffic ("downloads") and de-prioritise ...
1
vote
2answers
774 views

How do I route a port range in a linux host to a guest VM?

I am trying to redirect a certain port range in a linux host to one of its guest VMs. I would like for this redirection to apply to all the host's interfaces, including localhost. I was able to do: ...
1
vote
1answer
3k views

iptables rule for loopback interface lo

I want to test some network performance, where I need to use a tcp client to connect to a tcp server program on the same host, so I used localhost(127.0.0.1) however, when the TCP SYN is sent, it get ...
1
vote
1answer
1k views

Can't connect to SSH over VPN when using 3G only

I'm having a bit of a strange problem that I'm not sure how to debug/fix. I have a Raspberry Pi connected to a Windows VPN via either a wired interface or 3G dongle. With the wired interface I can ...
1
vote
2answers
1k views

IPtables Rules to Block IP Range

I've applied the following rules from a text file called "iptables.save" to iptables. But to my dismay, I found that the ip address 107.22.26.176 is still able to access my server via TCP. What did ...
1
vote
2answers
987 views

How to test IP Tables Rule (Linux Ubuntu12.04)

I wanted to ask how to test IP Table Rules. For example, I have a port number and I want to be sure that it accepts all packets. How can I do it? After I type iptables -L I see that the rule has been ...
1
vote
1answer
944 views

What is command to look list of redirect rules, iptables

im using command like this : iptables -t nat -A PREROUTING -p tcp -d 192.168.1.118 --dport 4080 -j DNAT --to-destination 192.168.1.118:4088 My question what is command to look all rules in the ...
1
vote
2answers
2k views

iptables port based routing

I've been Googling this for days with no success. I connect to a VPN from my server from time to time and I'm trying to configure my Debian server to only use port 80 and 443 through the VPN and all ...
1
vote
2answers
773 views

iptables block everything except http

I'm trying to configure my iptables to block any network traffic except HTTP: iptables -P INPUT DROP #set policy of INPUT to DROP iptables -P OUTPUT DROP #set policy of OUTPUT to DROP iptables -A ...
1
vote
2answers
621 views

Packets marked by iptables only sent to the correct routing table sometimes

I am trying to route packets generated by a specific user out over a VPN. I have this configuration: $ sudo iptables -S -t nat -P PREROUTING ACCEPT -P OUTPUT ACCEPT -P POSTROUTING ACCEPT -A ...
1
vote
1answer
355 views

Rate limiting traffic between specific hosts (based on their MAC) using iptables

I have setup a simple isolated network consist of following Linux based machines (simplified example): Node1<---->Router<---->Node2 Router's eth0 is connected with Node1's eth0. Router's eth1 is ...
1
vote
1answer
497 views

Reasons why ports below 1024 cannot be opened

I'm root on a machine I don't know how it was configured. I try to open SSHD on another port than 22 but it does not work. I changed the /etc/ssh/sshd_config file and added a new Port line extra to ...
1
vote
1answer
741 views

Difference default setting on iptables between CentOS 6.3 and Ubuntu 12.04

I would like to ask in ubuntu 12.04, there is no firewall settings by default? iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD ...
1
vote
1answer
354 views

internet connection gone after $ iptables -F INPUT

I have a PC with two Ethernet cards, and I was trying to configure my eth1, but when I typed $ iptables -F INPUT, the internet was gone on eth0. Does anyone has any idea how to get my internet ...
1
vote
1answer
126 views

Separating two networks

I have two routers, R1 and R2. R1 (a stock linksys router running dd-wrt) is connected to internet and is serving internet to a network of 5 devices/PCs running a DHCP server, with a network of ...