Iptables is a module that provides the Linux operating system functions of firewall, NAT and logging of data traveling over a computer network.

learn more… | top users | synonyms

15
votes
1answer
28k views

What are the iptables rules to permit ntp?

My server's clock is wrong because the firewall doesn't permit ntp traffic. What are the iptables rules required to allow the ntp client to get out and back? Any suggestions how to implement those ...
14
votes
4answers
10k views

With Linux iptables, is it possible to log the process/command name that initiates an outbound connection?

I would like to keep track of the processes that initiate outbound connections on a Linux desktop. The best I can come up with is this: iptables -A OUTPUT -m state --state NEW -j LOG --log-uid This ...
13
votes
3answers
13k views

How can I check if an iptables rule already exists?

I need to add a rule to iptables to block connections to a tcp port from the Internet. Since my script may be called multiple times and there is not a script to delete the rule, I want to check if ...
10
votes
1answer
5k views

pfctl port forwarding in Mac osx?

-A PREROUTING -s 10.0.10.0/24 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080 -A PREROUTING -s 10.0.10.0/24 -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 8080 -A POSTROUTING -s 10.0.10.0/24 -o ...
9
votes
2answers
8k views

No idea what is listening on port 80 in OS X

I'm on OSX Mountain Lion 10.8.3, and I've freshly rebooted my Mac. I want to start a service (like Apache on port 80), but there is already something going on with port 80: telnet localhost 80 ...
8
votes
1answer
3k views

iptables vs route

What's the difference between these two tools? Can anybody tell me what the main workflow of networking behind Linux (in relation to IPv4 packet filtering, NAT and IP routing table) is?
7
votes
1answer
757 views

Sharing transparently proxied Internet connection with PS3

I am trying to play a Japanese karaoke game on a PS3 but the latency is just horrendous and downloading songs takes forever. One recommendation I got was to turn my laptop into a SOCKS proxy by ...
6
votes
2answers
30k views

need iptables rule to accept all incoming traffic

For my test environment i want to accept all incoming traffic, can someone please give me the iptable rule to be added. My current iptables -L -n output looks like this Chain INPUT (policy ...
6
votes
1answer
6k views

How to negate a range in iptables?

I've seen people use the exclamation mark (!) in multiple examples, but when I try to use it I get an error. The rule I'm trying: -A OUTPUT -m owner --gid-owner 1006 -d ! 192.168.1.0/24 -j DROP The ...
6
votes
2answers
8k views

Setup routing and iptables for new VPN connection to redirect **only** ports 80 and 443

I have a new VPN connection (using openvpn) to allow me to route around some ISP restrictions. Whilst it is working fine, it is taking all the traffic over the vpn. This is causing me issues for ...
6
votes
1answer
3k views

How to deliberately introduce a delay for incoming UDP packets

I want each packet (that match iptables rule) to be delayed by some fixed time interval. How to to this? Preudocode: iptables -A INPUT -p udp <more conditions> -j DELAY --delay 50000 # delay ...
6
votes
2answers
259 views

Open up firewall automatically to anybody who has successfully connected via SSH

I have a server which runs a few services. However, for security reasons, I configured the server so that nothing, except for SSH, is accessible from outside. What I'd like to do instead, though, is ...
5
votes
2answers
12k views

CentOS 6 - iptables preventing web access via port 80

I'm setting up a new web server with CentOS 6.2 and am not able to connect via the web. Everything looks set up correctly in httpd.conf and Apache is running, so I'm assuming it's an iptables issue. ...
5
votes
5answers
5k views

How to block sites with iptables

I would like to block sites using iptables. How do I go about this, and how do I ensure that the iptables rules are saved?
5
votes
1answer
3k views

Disable or block outgoing email

To do web site testing, how can I disable or block the Centos server to not send out emails. Now, if I run in command line mail xxx@gmail.com I can send out emails. This is not good for website ...
5
votes
1answer
1k views

IPv4, IPv6 and IPTables

I have just recently learned that even if I block all traffic to my webserver using iptables it is still vulnerable to external attacks via IPv6. In my understanding, this renders iptables-only ...
5
votes
2answers
3k views

Blocking Skype using snort and iptables

I am trying to block Skype using snort and iptables. I read a lot of papers and blocked the port, keywords and patterns which Skype uses. But it is still not blocked. My question is: if Skype uses ...
5
votes
1answer
503 views

Rackspace Firewall/Gateway Setup

I have rackspace account and wish to have this sort of setup: Firewall/Gateway eth0 - Public IP (56.X.X.X) eth1 - Private IP (10.X.X.X) Ubuntu 10.10. Accepts connections from the internet and ...
4
votes
1answer
4k views

How to configure a firewall on Centos using Vagrant and Chef

I've created a server box using Vagrant and Chef and everything is up and running correctly. However, when the box is installed from scratch the default iptables rules are in place and so I need to ...
4
votes
1answer
2k views

Blocking access to a specific url

I have a lightweight linux device which I would like to block from accessing one specific URL. Instead of making the request to the external URL, I would like to return the contents of a local file. ...
4
votes
1answer
2k views

Mirror Port via iptables

I have a dedicated Linux (Debian 7.5) root server, with a number of guests set up. The guests are KVM instances, and get network access via bridge-utils (NAT, internal IPs, use the host as a gateway). ...
4
votes
3answers
4k views

iptables for transparent TCP proxy

Here's my situation. I have an iPad, a TiVo, and an dd-wrt router on my network, along with a machine that I'd like to use to sniff/decrypt draffic between the iPad and the TiVo. The iPad has an app ...
4
votes
3answers
2k views

Block a user from accessing internet on Linux

How do I block a user from accessing the internet under Linux? I'm trying the following: iptables -A OUTPUT -p tcp --dport 80,443 -m owner --uid-owner $USERNAME -j DROP Is that the right syntax or ...
4
votes
1answer
2k views

Access Apache server running in Fedora guest VirtualBox from host

I have trouble accessing Apache server from host. I’ve Fedora 15 VM VirtualBox installed on Windows 7. Within this VM I have Apache server running and working fine within the guest. Not sure what ...
4
votes
1answer
3k views

Load balancing with multiple gateways

I have to different ISPs, each on each own network. The main connects via ethernet and the secondary via wifi. The two networks have no relation at all. I just connect to them simultaneously. The ...
4
votes
1answer
6k views

How to use iptables to forward all data from an IP to a Virtual Machine

OK, in an attempt to get some response, a TL;DR version. I know that the following command: iptables -A PREROUTING -t nat -i eth0 --dport 80 --source 1.1.1.1 -j REDIRECT --to-port 8080 ... will ...
4
votes
1answer
1k views

How to configure port forwarding for an IP camera

I need to configure port forwarding for my IP camera so that I can access it from internet. UPNP is not supported on my gateway. My network configuration is the following: Gateway (Ubuntu Server 12) ...
3
votes
2answers
5k views

Deny all incoming connections with iptables?

I want to make some simple iptables rules to deny all incoming connections and allow outgoing. How can I do that?
3
votes
2answers
3k views

What does an empty iptables mean?

I'm using CentOS and when type the command: iptables -L -v The output is as follows: Chain INPUT (policy ACCEPT 19614 packets, 2312K bytes) pkts bytes target prot opt in out ...
3
votes
1answer
4k views

tc / iproute2, how to list the configuration

This is my first time using traffic shaping and I am wondering how I can list the rules I applied like you can with iptables? Walter
3
votes
3answers
2k views

bridge does not forwarding packets centos

I am using CentOS 6.5 64 and use xen to create a virtual machine (CentOS) ifconfig [root@CentOS ~]# ifconfig eth0 Link encap:Ethernet HWaddr 08:00:27:54:B3:FA inet6 addr: ...
3
votes
1answer
400 views

Why small TCP connections succeeds, but big ones fails?

Sometimes from Linux system I see the following weird behaviour: I able to ping things and sometimes use some services, but networking is very bad. For example, now I routed connection through my ...
3
votes
1answer
102 views

Use port forwarding with masquerade

I'm using a debian as a router with nat configured. How can I set up port forwarding, to set an rdp server on the local network for example?
3
votes
2answers
230 views

Blocking ports with iptables

I have a server with multiple interfaces (IPs). I'd like to block all ports on one of the IPs (I don't want to change anything for other IPs/interfaces), but allow outgoing connections from it. For ...
3
votes
1answer
3k views

How do I forward traffic between Tun device and eth0?

In summary, I would like to have Tun device traffic forwarded back and forth through another network interface that has internet connection. While I can see the traffic going out to internet ...
3
votes
1answer
688 views

Seting up IPTables to forward multiple GoPro cameras

I have an interesting problem that involves multiple GoPro cameras. Basically, I need to have the ability to communicate with multiple GoPro cameras via a single network. The challenge is that the ...
3
votes
1answer
1k views

IP forwarding on the same network

I have a raspberry pi that I have put wifi on. I am also using its ethernet connection to bring internet to my XBox 360. I want to bridge these connections AND keep them both on the same network. For ...
3
votes
2answers
4k views

How to blacklist IPs on Windows 7?

I'm trying to find something similar to iptables in Linux for Windows. I've tried using Windows firewall as well as editing the host file to block specific IPs, but had no success. I've also tried ...
3
votes
1answer
2k views

Properly portforwarding the external IP with iptables

I am trying to forward all the incoming internet/LAN requests on port 80 to my local machine (running Apache), current iptables work (forward incoming internet traffic to my desktop, but if I try to ...
3
votes
2answers
5k views

Ubuntu 11.04 server iptables port forwarding

I'm pretty new to iptables. My server has two Ethernet cards (eth0, eth1) and an ADSL router that is in bridge mode connected to the eth0 which created ppp0 when dialed. I'm trying to forward ...
3
votes
4answers
902 views

IP forwarding from one interface to another on Debian 7

Background The Debian 7 that I run has the following interfaces wlan3 == Internet connection 85.5.48.64/24 wlan2 == act as an AP (hostapd) 192.168.5.1/24 I run the following settings on the ...
3
votes
0answers
1k views

Route outgoing VPN traffic through local transparent proxy

I have a Digital Ocean droplet (similar to an Amazon EC2 instance) running Ubuntu Server 12.04.3 x64 with both strongswan 5.1.1 (built from source) and squid 3.4.2 (also built from source) installed. ...
3
votes
1answer
1k views

Linux iptables forward from ip1:port1 to ip2:port2

I connect thought tunnel to other machine like this: ssh user@ip -L2000:192.168.64.88:80 So on my local machine I want to configure iptables that way like I have a "native" access to ...
3
votes
0answers
2k views

How do I configure DD-WRT to forward IPSec traffic to an internal server to support a road warrior configuration?

I use dd-wrt as my home router setup and that's been working fine. Now I wanted to figure out a way to be able to use my iPad to set up a IPSec tunnel to my home network while I'm on the road. PPTP ...
3
votes
2answers
3k views

Using iptables SNAT based on source interface and ip address

I would like to change source ip address according to ip address and interface it came in. Let's consider following example: ----------------------------- | | | ...
3
votes
1answer
2k views

Allow access from outside network with dmz and iptables

I'm having a problem with my home network. So my setup is like this: In my Router (using Ubuntu desktop v11.04), I installed squid proxy as my transparent proxy. So I would like to use dyndns ...
3
votes
1answer
2k views

Why is this iptables rule that does port forwarding not working?

I have a server bound to localhost:7060. It is using ipv6 socket instead of ipv4. Below is netstat outout. # netstat -an Proto Recv-Q Send-Q Local Address Foreign Address State tcp ...
2
votes
3answers
1k views

iptables - add rules not as root

One of our servers is being hit daily by a large number of spam bots. They're not able to post any spam, but they still try and end up slowing down the server for real users. To counter this, I have ...
2
votes
1answer
383 views

What other ports should I block to maximize server security? PS using IPTABLES

I have blocked ports 80, 9001, 9080. What other ports should be blocked to maximize security? PS: It is a asterisk server / PBX Sorry: New Systems Admin here :) Thanks!
2
votes
2answers
453 views

Why after Accepting Ports 20 and 21 in iptables are they still closed?

I am trying to open the FTP Ports on my server. I have vsftpd installed on the server already. However I am unable to reach the server on ports 20 and 21 Somehow it is allowing me to access port 21 ...