Iptables is a module that provides the Linux operating system functions of firewall, NAT and logging of data traveling over a computer network.

learn more… | top users | synonyms

4
votes
2answers
9k views

CentOS 6 - iptables preventing web access via port 80

I'm setting up a new web server with CentOS 6.2 and am not able to connect via the web. Everything looks set up correctly in httpd.conf and Apache is running, so I'm assuming it's an iptables issue. ...
2
votes
1answer
217 views

dd-wrt: Keep source ip after port forward

I just started using dd-wrt on my wndr3700, but now all my incomming connections to a server inside the network gets the same source ip as the router. How can I change this back so I get the real ...
2
votes
1answer
287 views

Different routing rules for a particular user using firewall mark and ip rule

Running Ubuntu 12.10 on amd64. I'm trying to set up different routing rules for a particular user. I understand that the right way to do this is to create a firewall rule that marks the packets for ...
-2
votes
1answer
317 views

IP tables gateway

I am trying to make an iptables gateway. I ordered 3 dedicated server from my hosting company all with dual nics. One server has been given all the ip addresses and is connected directly to the ...
0
votes
1answer
883 views

Pinging an external server through OpenVPN tunnel doesn’t work

I have an OpenVPN server and a client, and I want to use this tunnel to access not only 10.0.8.0/24 but the whole internet. So far, pinging the server from the client through the tun0 interface works, ...
0
votes
1answer
197 views

CSF Unresolved issue

I began receiving service failures for CSF/LFD once the limit was reached in iptables preventing the service from working properly. I flushed all iptables rules, and redid by rules using CIDR rather ...
1
vote
0answers
396 views

iCloud stuff stops working while connected to OpenVPN

I have a fairly simple OpenVPN setup on an OpenVZ VPS with Ubuntu 11.10. Client is the Viscosity client on Mac OS X 10.8.2, and after some testing, we can rule out the client as being part of the ...
1
vote
0answers
199 views

Load-balancing: response packets not routed - iptables

I have a problem with iptables. I'm trying to setup a load balancer between 2 uplinks. I can mark packets and connections, use ip rule to choose routing table (so changing the gateway). But, when I ...
1
vote
1answer
452 views

Packets marked by iptables only sent to the correct routing table sometimes

I am trying to route packets generated by a specific user out over a VPN. I have this configuration: $ sudo iptables -S -t nat -P PREROUTING ACCEPT -P OUTPUT ACCEPT -P POSTROUTING ACCEPT -A ...
0
votes
1answer
48 views

Is there an alternative of TrivialProxy for linux?

Does anyone knows an alternative software of TrivialProxy for linux? iptables is not enough because I need a GUI. Thanks in advance.
1
vote
0answers
436 views

Routing table on Linux not respected

I have a very specific problem, building a Linux VPN endpoint (with external VPN Gateway), which should route certain networks over the tunnel, others via default gateway. The Linux VPN should do a ...
1
vote
1answer
284 views

Rate limiting traffic between specific hosts (based on their MAC) using iptables

I have setup a simple isolated network consist of following Linux based machines (simplified example): Node1<---->Router<---->Node2 Router's eth0 is connected with Node1's eth0. Router's eth1 is ...
1
vote
1answer
392 views

Reasons why ports below 1024 cannot be opened

I'm root on a machine I don't know how it was configured. I try to open SSHD on another port than 22 but it does not work. I changed the /etc/ssh/sshd_config file and added a new Port line extra to ...
1
vote
1answer
684 views

Difference default setting on iptables between CentOS 6.3 and Ubuntu 12.04

I would like to ask in ubuntu 12.04, there is no firewall settings by default? iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD ...
1
vote
0answers
147 views

Is there a decent diagram of packet flow for a modern era (2.6+) iptables setup?

I'm currently trying to debug a particularly hairy set of DNAT based iptables rules (the UDP reply never makes it back to the original requester) and I'm struggling to visualise the packet flow ...
1
vote
1answer
70 views

iptables -L lags on non localhost or anywhere address

I am trying to configure iptables for ubuntu 10.04 and I have a problem with iptables -L lagging on rows where the destination or source address is not localhost or anywhere. The following entries ...
2
votes
1answer
2k views

Reverse Proxy for TCP (RDP, VPN, etc) and HTTP

I have a domain that points to my ISP assigned IP though a CNAME (cname goes to my noip address incase my ISP decides to change the IP), I would like to route different subdomains to various IP:PORT ...
0
votes
1answer
107 views

iptables rule cannot be added

Is there anything wrong with these rules? They cannot be added to iptables, no error but they just don't show up in iptables -vnL iptables -I FORWARD 1 -s 1.2.3.4 -p udp -m connlimit ...
1
vote
1answer
1k views

Will increasing number of rules in iptables slow down my internet

How much impact will the rules have on speed, if we are using match to queue the packets.
1
vote
1answer
322 views

internet connection gone after $ iptables -F INPUT

I have a PC with two Ethernet cards, and I was trying to configure my eth1, but when I typed $ iptables -F INPUT, the internet was gone on eth0. Does anyone has any idea how to get my internet ...
2
votes
1answer
1k views

How to match multiple strings in iptables

I have 2 strings, and i wish to queue the packet if it contains both the strings ( something like ("jsh"&&"gjhyg")), i tried following ways, but they don't seem to work: sudo iptables -A ...
1
vote
0answers
114 views

How to redirect local connection to my things in IPv6 on linux?

With IPv4 I can make some program connect to my service instead of where it wants using REDIRECT and DNAT targets in OUTPUT chain in iptables (sometimes combined with -m owner) In IPv6 hovewer I ...
0
votes
1answer
192 views

Is it possible to figure out which http request generated the corresponding response

I am using iptables to listen to tcp (http) packets. I am filtering out INPUT responses containing a matching string. Is it possible to know which http request generated the response. Assuming 10 ...
0
votes
1answer
222 views

iptables: understanding the rationale behind its tables and chains

I'm going through the iptables tutorial and am currently at Chapter 6, Traversing of tables and chains. I'm having trouble understanding the why's behind Tables 6-1, 6-2, and 6-3 listed in the above ...
1
vote
1answer
111 views

Separating two networks

I have two routers, R1 and R2. R1 (a stock linksys router running dd-wrt) is connected to internet and is serving internet to a network of 5 devices/PCs running a DHCP server, with a network of ...
2
votes
1answer
1k views

Gateway on a virtual network interface used by LXC guests

I'm currently having some problems with configuring a gateway for a virtual network interface. Here is what I've done : I created a virtual network interface : # brctl addbr lxc0 # brctl setfd lxc0 ...
0
votes
0answers
630 views

Iptables - having trouble opening port 443

I am attempting to set up https, but I am having difficulty opening that port. Nmap scan report for localhost (127.0.0.1) Host is up (0.000073s latency). PORT STATE SERVICE 443/tcp closed https ...
6
votes
1answer
3k views

pfctl port forwarding in Mac osx?

-A PREROUTING -s 10.0.10.0/24 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080 -A PREROUTING -s 10.0.10.0/24 -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 8080 -A POSTROUTING -s 10.0.10.0/24 -o ...
0
votes
1answer
444 views

Router 2wire, Slackware desktop in DMZ mode, iptables policy aginst ping, but still pingable

I'm in DMZ mode, so I'm firewalling myself, stealthy all ok, but I get faulty test results from Shields Up that there are pings. Yesterday I couldn't make a connection to game servers work, because ...
1
vote
0answers
272 views

How to enable iptables with verbose mode in DD-WRT?

I want to log all packets to messages through iptables. Can you help me how to set verbose mode in DD-WRT. Just DYI, I have optware installed to store the large messages file and do log rotation.
2
votes
1answer
340 views

What other ports should I block to maximize server security? PS using IPTABLES

I have blocked ports 80, 9001, 9080. What other ports should be blocked to maximize security? PS: It is a asterisk server / PBX Sorry: New Systems Admin here :) Thanks!
1
vote
1answer
42 views

Networking - In what scenarios do “RELATED” connections occur?

I am trying to use iptables and ip6tables to establish basic networking security on my webserver. However, I am having a hard time understanding the RELATED state of the conntrack module... I know ...
0
votes
2answers
663 views

blocking port 80 via iptables

I'm having problems with iptables. I am trying to block port 80 from the outside, basically plan is we just need to Tunnel via SSH then we can get on the GUI etc. on a server I have this in my rule: ...
3
votes
1answer
98 views

Use port forwarding with masquerade

I'm using a debian as a router with nat configured. How can I set up port forwarding, to set an rdp server on the local network for example?
1
vote
0answers
141 views

Linux route/IPtables with internal VM network

I am having some trouble figuring this all out. I have Windows 7 [10.10.30.1] ROUTER [eth0=192.168.4.134 eth1=10.10.30.254] Ubuntu [192.168.4.143] I can ping eth0 and eth1 from Win7, and also ...
0
votes
2answers
773 views

Filezilla not showing directory listing?

I had downloaded iptables from server to my windows desktop .I edited some lines for opening port (2195) .after download i added some line for enabling port using this link ...
0
votes
1answer
175 views

Is this a decent set of IPTables rules?

Can anyone please point out to me whether, assuming that the needs for a given (Ubuntu 12.04) server are only SSH, NTP (client), HTTP(S) and system updates (apt-get or aptitude), the following set of ...
0
votes
1answer
27 views

A dumb about iptable

I saw a iptable command like this: iptables -t nat -A xx -p tcp -m tcp --dport 80 -j DNAT --to %myweb%:80 what's "%" there for? Thanks. Where I can get a manual to tell me what kind of symbols I ...
2
votes
2answers
2k views

iptables firewall only allows internet traffic if source port of 80 is allowed

I am configuring an iptables firewall, currently just to allow http and https traffic. It is working but under a particularly strange rule - I must allow incoming connections with a source port of ...
1
vote
1answer
395 views

Ubuntu iptables web browsing

I am trying to build iptables to protect my system. After I save my iptables, I cannot connect to any web page (through browser or wget). Is it perhaps related to DNS? I tried to access ...
0
votes
2answers
1k views

iptables - Allowing Established Sessions?

I'm learning how to use iptables on ubuntu server. Can you please explain to me what "Allowing Established Sessions" means and why should I include it in rules? sudo iptables -A INPUT -m conntrack ...
2
votes
4answers
7k views

iptables: Allow only HTTP access for web browsing

Have a linux box, want it locked down but just be able to surf internet on it. Why is this script blocking http too? #!/bin/sh # # iptables -F # #Set default policies for INPUT, FORWARD and OUTPUT ...
2
votes
2answers
698 views

Iptables port mapping from two PCs to one

We have 3 PCs, two of it are connected to internet (both of it have 2 NIC) PC1: eth0 - 1.0.0.1 (external IP) eth1 - 172.16.0.1 (internal IP) PC2: eth0 - 1.0.0.2 (external IP) eth1 - 172.16.0.2 ...
1
vote
1answer
802 views

Rerouting traffic from port 80 to another port on a single ip

I have a server with multiple IP addresses associated with it. I'm trying to run a node.js web server (which I do not want to run as root), using only one of those ip addresses (it would be very bad ...
0
votes
0answers
685 views

DHCP Client Can't Find DHCP Server

I currently have 3 machines: CentOS (router) eth1 - 18.0.168.1 eth2 - 145.165.34.1 Windows Server 2008 (server) 18.0.168.2 DHCP scope - 145.165.34.10 - 145.165.34.20 Windows 7 (client) Supposed ...
1
vote
1answer
615 views

Linux Iptables Routing

I need help with a problem. My setup is: CentOS (Router) eth1 18.0.168.1 255.255.248.0 eth2 145.165.34.1 255.255.254.0 Windows Server 2008 18.0.168.2 My problem is from the Windows machine, I ...
1
vote
2answers
6k views

iptables - How to forward all external ports to one local port

I want a service to be running on every external port on my system. Since it wouldn't work to start 65535 single instances of that service (I guess...) I thought of using iptables for this. The ...
1
vote
2answers
2k views

What means empty iptables?

I'm using CentOS and when type the command: iptables -L -v The output is as follows: Chain INPUT (policy ACCEPT 19614 packets, 2312K bytes) pkts bytes target prot opt in out ...
5
votes
1answer
1k views

IPv4, IPv6 and IPTables

I have just recently learned that even if I block all traffic to my webserver using iptables it is still vulnerable to external attacks via IPv6. In my understanding, this renders iptables-only ...
0
votes
1answer
94 views

NATing with a single-homed machine possible?

I have the following setup: a) a single-homed machine, A, that can see the Internet. b) other machines B, C, and D that cannot see the Internet. c) A, B, C, and D can see each other. d) all ...