Iptables is a module that provides the Linux operating system functions of firewall, NAT and logging of data traveling over a computer network.

learn more… | top users | synonyms

1
vote
1answer
772 views

Block traffic to LAN but allow traffic to Internet (iptables)

On my home network I am setting up a CentOS server that will be used by about a dozen or so for educational purposes - e.g. learn how to use the Linux shell and host websites, among other things. I ...
1
vote
1answer
56 views

Should my server ever need to directly communicate with the NAT gateway?

What I mean by ``directly communicate'' Does it ever need to receive packets with the gateway's IP address as the source IP address, or send packets with the gateway's IP address as the destination ...
1
vote
2answers
708 views

Is Iptables blocking outgoing ssh connections?

I have been trying to do pulls from github and it keeps hanging. My iptables rules have no rules which block outgoing traffic but I cannot connect to github using either ssh or http. I can't even ...
1
vote
1answer
100 views

Forwarding all traffic to other server with iptables

Assume I have a sever with X.X.X.X IP address and a web server with Y.Y.Y.Y IP address. How would I forward web traffic from X.X.X.X to Y.Y.Y.Y using iptables? My servers run Linux and use iptables
1
vote
1answer
2k views

IPTABLES forward all ports except ssh

I have nat and packet routing working just fine, but I'd like to forward all ports except SSH to a static ip(192.168.0.3) What would be the correct iptables syntax to do this?
1
vote
1answer
562 views

bind/named not working on UDP from external

This one is weird. I've set this up a long while ago, on a centos5. From what I remember, it used to work. For some time now, it's not. I've just been informed so no clue what changed when that made ...
1
vote
2answers
2k views

Is selective VPN routing worth it?

I want to setup routing tables on my RT-N66U router to selectively route traffic through a VPN. For instance, only Pandora requests would go via the VPN. I've found a way to do this with iptables: #!/...
1
vote
1answer
271 views

iptables detects clients behind NAT?

I'm setting up a server that I want to protect from DoS attacks, by setting a limit using iptables: iptables -A INPUT -p tcp --dport 80 -m limit --limit 25/minute --limit-burst 100 -j ACCEPT (default ...
1
vote
2answers
2k views

Route traffic through VPN to some IPs occasionally

I would like to route traffic to some specific addresses through VPN. Easy enough, one can simply add a route: ip route add <destination ip> dev tun0 scope link Here comes the catch: I do not ...
1
vote
1answer
2k views

How to block incoming traffic on a virtual interface?

How do I block all incoming traffic on eth0:0 but keep eth0 open? What I've tried is this: iptables -P INPUT DROP iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -i eth0 -j ACCEPT But this ...
1
vote
2answers
1k views

Why nic with incorrect subnet mask can still ping the gate way?

At first, my network config was like this: $ ip a 2: em1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 3c:97:0e:bd:b1:68 brd ff:ff:ff:ff:ff:ff ...
1
vote
1answer
2k views

iptables NAT doesn't preserve remote IP

I have the iptables rules below forwarding incoming ssh traffic on port 2222 to a virtual machine running in a vmware "vmnet" network on the same host. 192.168.1.1 192.168.1.40 +---------+ +----...
1
vote
1answer
2k views

INPUT or PREROUTING, which is first checked?

About iptables. I saw contradictory explanations. This site and most article say PREROUTING chain is checked before INPUT chain. But another tutorial(page 4-6) says INPUT is before PREROUTING. Whom ...
1
vote
1answer
772 views

Understanding how dnat works in iptables

I'm running 3 virtual machines with Fedora 19. The machine B is set up with two networks adapters and provides que channel between machine A and machine C. The machine A IP is set to 192.168.1.3 and ...
1
vote
2answers
176 views

DNS set correctly but website unreachable

I have the (sub)domain elo.bernardinuscollege.nl, which has a DNS A record that points to 54.225.118.87, which is correct (checked it with telnet, which indeed returns the right IP). For some reason ...
1
vote
3answers
698 views

Setting up two ADSL lines for home/business use

As a follow-up to this question which is still unresolved. I have two ADSL routers with different providers connected to different phone lines to the internet. As shown in the diagram. These routers ...
1
vote
1answer
365 views

Can't reach web server from local virtual network

I have installed a couple of virtual machines. Some uder Windows, some under Fedora Linux. On one of the Fedora machined I've installed Apache web server. I have setup server name in httpd.conf to ...
1
vote
1answer
214 views

Valid Type Of Service Values

I need to know what are valid values for TOS field in iptables. I mean when I try to add a rule with ip rule add what can I give as tos value I could not find any resource about tos value. I know ...
1
vote
1answer
475 views

How can I detect long-lived connections and mark them for shaping

I would like to detect TCP connections which have been open for more than one minute (or for greater than N bytes, or M packets), so I can classify them as bulk traffic ("downloads") and de-prioritise ...
1
vote
1answer
79 views

iptables -L lags on non localhost or anywhere address

I am trying to configure iptables for ubuntu 10.04 and I have a problem with iptables -L lagging on rows where the destination or source address is not localhost or anywhere. The following entries ...
1
vote
2answers
2k views

iptables - Allowing Established Sessions?

I'm learning how to use iptables on ubuntu server. Can you please explain to me what "Allowing Established Sessions" means and why should I include it in rules? sudo iptables -A INPUT -m conntrack --...
1
vote
1answer
1k views

Rerouting traffic from port 80 to another port on a single ip

I have a server with multiple IP addresses associated with it. I'm trying to run a node.js web server (which I do not want to run as root), using only one of those ip addresses (it would be very bad ...
1
vote
2answers
8k views

How to alias an IP address to make DLNA resource accessible from different IP network

what I have I have a home wifi network 192.168.1.0/24 having DLNA resource 192.168.1.100. I have a TV with ethernet and a netbook with both wifi and ethernet interfaces. I want to make my notebook ...
1
vote
1answer
5k views

iptables trouble: nat with ip alias (virtual interface) not working

I'm setting up an Ubuntu 11.10 server to act as firewall for a network running several different SSL websites. The idea is fairly common: have all public IP's for each site aliased to the public ...
1
vote
1answer
4k views

How do I block all ports except 22 and 80 in Fedora's iptables? [duplicate]

I am trying to only allow port 22 TCP/UDP and port 80 TCP/UDP from anywhere using Fedora 15 iptables, and all the rest will be never accessible nor scannable from a public network. But it never ...
1
vote
2answers
5k views

Setting up a Linux server with a public Static IP

I have setup a Ubuntu Linux server in an office. It should have a public IP so that outside users can access the internet. Currently, it is set with a public IP, but is it supposed to have a local ...
1
vote
2answers
428 views

Is this firewall completely secure?

I'd like to know if there's any holes/flaws in this firewall setup. I want to lock down the server as much as possible so it is impossible to hack in to. The only services running are openvpn and ssh. ...
1
vote
1answer
759 views

Feedback to router users during access-restricted hours for DD-WRT

Following router schedule rules that I change often, the stock firmware on my D-Link 825NA rev. B redirects HTTP requests to a built-in "Access denied!" warning at appointed times. I just upgraded ...
1
vote
2answers
2k views

Routing from the DMZ to the interior network only

I have a home network connected to Verizon's FIOS service. Verizon's ActionTec router is connected to the ONT via coax to establish the MOCA network. My DD-WRT router's WAN port is connected to one ...
1
vote
3answers
4k views

iptables syntax to forward remote desktop requests to a virtual machine on CentOS host

I can rdesktop into a VM running Windows XP hosted on my CentOS 5.4 machine from the hosting machine and work just fine using the private address (192.168.122.65), but I now need to allow remote ...
1
vote
1answer
67 views

How to add virtual NICs to my linux PC, so that they expose their MACs to ISP's domain?

I have learned how to add virtual NICs to a guest system in VirtualBox, just using Shared Adapter, then all the virtual NICs and my host's NIC will appear as real NICs to the ISP. So I guess there ...
1
vote
1answer
108 views

Iptables route specific port outside VPN (Tomato router firmware)

Im trying to configure my router to what I feel is the perfect setup for me. I have managed to connect the router to my VPN-provider (PIA), and routed such that only one computer connects through VPN ...
1
vote
1answer
133 views

OpenVPN Routing Port 80 Traffic only DD-WRT

I've setup openvpn client on my dd-wrt to connect to a host a couple states away. Works great(checked route table as well) but I want to only tunnel http traffic. I've always used IPtables for my dd-...
1
vote
1answer
770 views

Ubuntu IPTables allow only allow 1 country

So I've been looking around on the net for a script that will drop all traffic to all ports except the http(80) and https(443) ports, and then only allow traffic on all other ports from country x (...
1
vote
2answers
160 views

does IPTABLES as a router always require masquerade / SNAT?

If I set up a linux box as a router behind a DSL gateway, do I need to enable masquerading or SNAT? Logically I would assume that all I need to do is enable ip_forwarding (done) but traffic to ...
1
vote
1answer
55 views

Connect to wifi while hosting AP on another iface

I have two wireless interfaces. wlan1 and wlan0. And I want to host some Access Point on wlan1 (airbase-ng and isc-dhcp-server) and redirect packets from access point interface(at0) to wlan0 which ...
1
vote
1answer
1k views

Squid 3.3 Transparent IPv4 and IPv6 Proxy with TPROXY

I'm attempting to change my Squid transparent setup from using generic NAT that's limited to IPv4 only and switching it to TPROXY, for IPv6 support. I'm having difficulties getting transparent clients ...
1
vote
1answer
645 views

Check for packets MARKed by iptables

I am marking TCP and UDP packets in order to send them to two different interfaces (say wlan0 and eth0), I did this by following this answer. Assuming this configuration: eth0 address: 192.168.0.84 ...
1
vote
1answer
446 views

Is it possible to setup a NAT loopback on a router with a dynamic IP using iptables?

I've set-up a Raspberry Pi home server attached to my router. I have a dynamic IP. I can access the server within my network using the internal IP (192.168.0.8). I can also access the server outside ...
1
vote
1answer
77 views

allow specific port past VPN while denying all other internet access

I have a local machine that connects to a VPN for internet access, and is configured so that it can't access the internet at all besides through the VPN, although the local network can be accessed ...
1
vote
2answers
233 views

Linux - redirect SSH on a port to another machine on local network

I have a KVM guest machine on a virtual network. It has an IP address like 192.168.122.65. The host machine is connected to the public internet. If I open a terminal on the host machine, I can SSH ...
1
vote
1answer
42 views

What is MASQUERADE made for?

A simple redirection is used on my server, with iptables rules : $ iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 13.37.42.1:80 $ iptables -t nat -A POSTROUTING -j ...
1
vote
2answers
229 views

How to passthrough Wifi DNS and internet access to DHCP client

I have a laptop that connects to wifi for internet access. This computer is running Linux (Fedora), and it is acting as a DHCP server for another (ubuntu linaro) computer that does not have a wifi ...
1
vote
1answer
375 views

vpn, IP forwarding and nat

I have setup a Softether VPN on an Ubuntu 14.04 server in an aws network which has about a dozen servers using this guide. The only difference is that I have used SecureNat and softether DHCP. I can ...
1
vote
1answer
98 views

Ubuntu router setup guide iptables rules

I'm trying to figure out the meaning of the iptables rules in the Official Guide for Setting up a Ubuntu Router. For example, *nat. I can not find anywhere on the internet that has *nat for iptables. ...
1
vote
1answer
133 views

What does the column after destination in iptables overview show?

If I print the iptables overview with iptables -L I get the following output: $ sudo iptables -t nat -L Chain PREROUTING (policy ACCEPT) target prot opt source destination ...
1
vote
1answer
160 views

Why doesn't iptables accept IP address as source?

The command sudo iptables -t nat -A PREROUTING -i eth1 -s ! 192.168.178.30 -p tcp --dport 80 -j DNAT --to 192.168.178.30:3128 fails with Bad argument `192.168.178.30' Try `iptables -h' or '...
1
vote
1answer
641 views

Confusion about the `conntrack` extension of `iptables`

The iptables-extensions manpage has this to say about the conntrack extension (emphasis mine): This module, when combined with connection tracking, allows access to the connection tracking state ...
1
vote
1answer
553 views

How do I know if certain iptables extensions are available and enabled?

I was reading this: https://help.ubuntu.com/community/IptablesHowTo#Allowing_Established_Sessions It says "If the line above doesn't work, you may be on a castrated VPS whose provider has not made ...
1
vote
1answer
65 views

Cannot access DNS from external network

I have setup a MaraDNS instance on CentOS 6.5. I can access the DNS records from local machine—on which MaraDNS is installed—by doing nslookup but cannot access the DNS server records from Internet on ...