Iptables is a module that provides the Linux operating system functions of firewall, NAT and logging of data traveling over a computer network.

learn more… | top users | synonyms

3
votes
1answer
305 views

Allow only one website using iptables in a linux router [duplicate]

I have a Linux server I'm using as a router for my internal network. I need to block all the websites except one or two using iptables. How can I set this up?
0
votes
1answer
229 views

Redirecting marked packets to Tun device

I have a small program that needs to do various things with a selection of packets, based on various iptable rules. The packets are MARKed this way: iptables -t mangle -d 10.10.0.0/16 -j MARK --set-...
0
votes
1answer
38 views

How to white list some ip and all the rest block while having already a DMZ?

I have a Linux machine running which has local ip: 192.168.1.2 connected to a router with public IP 8.8.8.8, now the router 8.8.8.8 has DMZ to 192.168.1.2 As a result spammers, hackers, crackers ...
0
votes
1answer
219 views

Samba ports still closed even with iptables rules flushed and disabled

I’m trying to install Samba on a server running CentOS 6 with WHM/cPanel, and I’m having some trouble with ports. This is a brand new system as of yesterday, and I haven’t yet started locking down ...
1
vote
0answers
333 views

Why do my nat iptables rules not work with marked packets?

System: debian squeeze, Linux server 2.6.32-5-amd64 #1 SMP Tue May 13 16:34:35 UTC 2014 x86_64 GNU/Linux, iptables v1.4.8 lsmod | grep iptable iptable_security 2176 0 iptable_mangle ...
0
votes
2answers
321 views

iptables subdomain port forward

Hello i know i can setup iptables to forward to an other ip when a port is given Example: user enters domain.com and it shows site other user types domain.com:28015 and it connects to a game server ...
0
votes
1answer
72 views

port forward in INPUT level

I want to change the destination port of the ipv6 packet in the INPUT level. So I tried to use ip6tables with nat in the INPUT level but seems this command does not work # ip6tables -t nat -I INPUT ...
1
vote
0answers
217 views

Use Ubuntu Iptable to route public ip to pc in private network

I am currently set up a Ubuntu server as a Router which has two network interface. eth0 -> Connecting to public internet ( 10.10.1.78 ) eth0:1 -> 10.10.1.79 eth0:2 -> 10.10.1.83 eth0:3 -> 10.10.1.81 ...
1
vote
3answers
54 views

iptables catches on DENY but not on ACCEPT place prior to it in the chain

I have a weird problem with my iptables firewall: If I set two consecutive identical rules, the first is ACCEPT and the second is DENY, the incoming packet is denied (and logged as such). How is it ...
0
votes
2answers
622 views

iptables directing traffic through vpn

Networking newbie. I have two interfaces on the host: eth0 and tun0 from my OpenVPN client. The IP addresses are: eth0 192.168.1.22 tun0 10.1.0.8 Question 1 For outgoing traffic by changing ...
0
votes
1answer
29 views

what the “!” means in the iptable rule

what the "!" means in the following iptable rule iptables -I inacc ! -i br0 -p UDP --dport 69 -j ACCEPT I think is related to the interface br0. I think it mean any interface except the br0 Am I ...
1
vote
1answer
349 views

iptables problem in Evil Twin

I've been looking into the Evil Twin method and I found this steps: Creating AP airmon-ng start wlan0 airbase-ng -e PrivateWIFI -c 9 -v mon0 at0 Configuration ifconfig at0 up ifconfig at0 192....
2
votes
1answer
836 views

How to block docker-mapped ports with a firewall from outside the host without messing up docker routing inside the host?

I have a docker container running on a host with some port mapped to a port on the host. docker run -d -p 9009:9009 someserver I want this machine firewalled off from the internet except for 80, ...
1
vote
1answer
539 views

Docker tunnel traffic on specific port via VPN

Not sure if this is docker specific or a general networking question. I'm running a Debian Jessie server with serveral docker containers. My understanding is that docker creates a virtual interface (...
1
vote
1answer
131 views

What does the column after destination in iptables overview show?

If I print the iptables overview with iptables -L I get the following output: $ sudo iptables -t nat -L Chain PREROUTING (policy ACCEPT) target prot opt source destination ...
1
vote
1answer
160 views

Why doesn't iptables accept IP address as source?

The command sudo iptables -t nat -A PREROUTING -i eth1 -s ! 192.168.178.30 -p tcp --dport 80 -j DNAT --to 192.168.178.30:3128 fails with Bad argument `192.168.178.30' Try `iptables -h' or '...
2
votes
1answer
519 views

Man in the middle using iptables

I wish to test a subsystems which communicates with another subsystems via tcp. I have used the following: "iptables -A OUTPUT -p tcp --dport "+port_number" -j DROP" to stop the traffic on a port ...
1
vote
1answer
199 views

iptables limit number of outgoing connections on a port

I'm currently using the following to limit the number of incoming connections on port 9001 to 900. iptables -t filter -I INPUT -p tcp --syn --dport 9001 -m connlimit --connlimit-above 900 -j REJECT --...
2
votes
1answer
93 views

tcpdump capturing packets only when interface is specified

I have tried 3 different ways of capturing a stream of packets coming into my server. Two of them work and the third does not. I am trying to determine why it is missed by the third approach: ...
0
votes
0answers
87 views

WordPress won't load unless iptables is disabled

I am running CentOS 6.6 using nginx. WordPress will not load unless iptables is disabled. I tried to add the 9000 port for fastcgi, but that did not work. I am guessing it has something to do with ...
1
vote
1answer
622 views

Confusion about the `conntrack` extension of `iptables`

The iptables-extensions manpage has this to say about the conntrack extension (emphasis mine): This module, when combined with connection tracking, allows access to the connection tracking state ...
1
vote
1answer
534 views

How do I know if certain iptables extensions are available and enabled?

I was reading this: https://help.ubuntu.com/community/IptablesHowTo#Allowing_Established_Sessions It says "If the line above doesn't work, you may be on a castrated VPS whose provider has not made ...
1
vote
1answer
254 views

Make traffic go one-way by using iptables

I have a network topology: [C1] - [R1] - [R2] - [C2] C1-R1 network is 192.168.100.0/24 R1-R2 network is 10.9.8.0/30 R2-C2 network is 192.168.200.0/24 What I need to do is to make C2 be able to ...
0
votes
1answer
78 views

Where do port knocking services listen for incoming knocks?

I'm trying to understand how a port-knocking daemon is able to monitor for knocks, independent of the firewall rules (e.g. accept/drop/reject packets). I've installed knockd, which listens for lets ...
2
votes
1answer
767 views

Linux iptables DNAT on incoming packet without conntrack (stateless)

In my linux box 10.20.1.1, i got two UDP apps binded on port 46000 (App A) and 36000(App B) respectively. The apps communicate with two UDP servers bindeded as 10.10.1.1:36000 (Srv X) and 10.10.1.2:...
0
votes
0answers
31 views

Manage NAT using a tool

I have a Raspberry Pi on which I had previously installed Raspbian and am now installing another version on again. It is mainly used to be a test maschine for small programs and primarily as a NAT ...
0
votes
1answer
40 views

iptables: Routing requests to localhost:8080 to google.com

I am trying a simple routing rule that would forward the requests to localhost:8080 to some external address (ex google). I added the following rule : sudo iptables -t nat -A PREROUTING -p tcp -d ...
1
vote
1answer
297 views

Connecting my Xbox 360 to my Raspberry Pi 2 to use an OpenVPN connection

Here is my brief setup: Xbox360 Raspberry PI 2 running ArchLinuxARM (alarm) The raspberry pi's main ethernet port has a cable connecting directly to my main router The xbox has a cross-over cable ...
0
votes
0answers
152 views

Tor Middlebox: How to check if there is a DNS leak?

I created a tor middlebox. Laptop plus WLAN. Creates a WLAN AP all traffic from that AP should be routed into tor. But I am not sure, if the DNS requests are not leaked. How can I check that? This ...
0
votes
1answer
2k views

ssh: connect to host * port 22: Connection timed out

I have CentOS 7 running on a VPS machine and after a computer restart, I could no longer SSH to it. $ ssh -v <IP> OpenSSH_6.6.1, OpenSSL 1.0.1e 11 Feb 2013 debug1: Reading configuration data /...
0
votes
2answers
328 views

Traffic redirection with Rasperry Pi router

I use a Rasperry Pi (running raspbian) as a wi-fi router. It redirects traffic from the Ethernet wire (eth0 - wire + ppp0 - L2TP connection, lx2tp used for it) to wlan0 (USB wi-fi dongle, hostapd used ...
3
votes
1answer
179 views

Connecting router traffic to sshuttle tunnel

I am using sshuttle to get cleanly out of a questionable hotel wifi connection. I have a little travel router and would like to use it as well, briding my laptop's sshuttle connection so I can connect ...
0
votes
2answers
563 views

iptables default rules understanding

What does the last part in the following rules means in term of traffic that is allowed in (dtp:domain, bootps) ? From my research I understand that bootps is bootstrap and dpt is destination port but ...
0
votes
0answers
93 views

iptables - How to mirror all ports from one IP to a single port on another IP

I would like to set up IP tables on my router to mirror traffic on all ports from 192.168.1.30 and send it to 192.168.1.10:5860 I think I need to combine the two commands below, but I'm at a loss. ...
1
vote
0answers
625 views

DDWRT - Virtual Interface - firewall command - RDP

I have DD-WWRT flashed on my Linksys e2500v3 router. I added virtual interface to create a guest wifi network that would have access to the internet, but not to the private network or router. At ...
0
votes
0answers
79 views

How to see who's blocking my internet connection? fail2ban?

I was just running apt-get dist-upgrade from a distant ssh console when I lost the connection. I would like to know which service blocked my connection. I know fail2ban is sometime a bit flaky, but ...
0
votes
0answers
313 views

Unable to Telnet to the Linux SUSE from windows with port 50000

Firewall has been disable at Linux SUSE server, port numbers from 50000:60020 has been enabled. I can able to ping the server able to telnet using IP. When I give port 50000 or 60000 in my telnet ...
0
votes
0answers
178 views

iptables TCP flags

I'm beginner with iptables and networking so please excuse me for such beginner questions. I found on the Internet part of filtering malformed packets: /usr/bin/sudo /sbin/iptables -A tcpchk -p tcp -...
0
votes
0answers
63 views

rsyslog loses messages from firewall

I am trying to make rsyslog to log messages from iptables MASQUERADE. I have iptables LOG rule in nat table and PREROUTING chain before the MASQUERADE rules. The actual iptables rules: iptables -t ...
0
votes
1answer
360 views

MaraDNS- Unable to forward DNS queries

I tried forwarding DNS queries to Google DNS but it is not working. Below is the content of my /etc/mararc file: csv2 = {} csv2["example.net."] = "db.example.net" csv2["google.com."] = "db.google....
1
vote
1answer
64 views

Cannot access DNS from external network

I have setup a MaraDNS instance on CentOS 6.5. I can access the DNS records from local machine—on which MaraDNS is installed—by doing nslookup but cannot access the DNS server records from Internet on ...
1
vote
0answers
417 views

Configuring iptables for guest WLAN in DD-WRT

I'm constantly failing to get a guest WLAN in DD-WRT working. I can connect to the second SSID and get an IP address of the second DHCP server range. But I cannot connect to the internet. I followed ...
0
votes
1answer
189 views

Using ppp0 via VPN for everything but ftp

I have an ubuntu server I use to wget certain files from the internet via a VPN. I have set the VPN up using PPP0 and currently adjust the route like this: sudo route add default ppp0 Everything ...
3
votes
2answers
1k views

SSH reverse tunnel into Docker container

I need to xdebug something that fails on the server in a docker container and from my laptop I have ran ssh -R 9000:localhost:9000 server and verified the tunnel by telnet localhost 9000. So far so ...
0
votes
1answer
528 views

iptables failed with “ iptables v1.4.21: Couldn't load match `-d':No such file or directory” message

I am running kernel 3.14.18 and using iptables 1.4.21, built with these options --static-enable --disable-shared. When I run this command: /sbin/iptables -A PREROUTING -m -d 127.3.0.2/24 -j DNAT --...
0
votes
2answers
77 views

How configure requests from other ports to port 443?

I am trying to configure my first https, and i think i get it, but there is a problem: the site wont open in http, just https, because of this, i want redirect everything to https. I am using ...
0
votes
1answer
904 views

How to allow only subnet for port with iptables

What i am trying to do is to DROP any packets to specific UDP port, except those one from my secured subnet 10.8.0.0/24. iptables -t nat -A --src 10.8.0.0/24 -p udp --destination-port 63210 -j ACCEPT ...
1
vote
0answers
394 views

Open ports with iptables — still closed

I'm trying to open some ports for a gameserver, which is running on my Linux vServer (Ubuntu 14.04 LTS 64bit). The game needs the following ports: 16261 (UDP) 16262 (TCP) // Player 1 16263 (TCP) // ...
0
votes
0answers
97 views

Connectivity from different network segment

I have 3 machines 10.10.3.1 Windows # srv1 10.10.3.2 Lubuntu # srv2 10.10.200.1 Windows #cli1 network masks are 255.255.255.240 I can succesfully ping from cli1 to srv1 srv1 to srv2 srv2 to ...
0
votes
2answers
1k views

How to use iptables to allow traffic only through ONE SPECIFIC VPN

I'm trying to allow all traffic from my Banana PI running Lubuntu to only go to my LAN or otherwise through an VPN Server. I'm following this guide: http://joelslowik.blogspot.co.uk/2013/05/setup-...