Iptables is a module that provides the Linux operating system functions of firewall, NAT and logging of data traveling over a computer network.

learn more… | top users | synonyms

20
votes
1answer
47k views

What are the iptables rules to permit ntp?

My server's clock is wrong because the firewall doesn't permit ntp traffic. What are the iptables rules required to allow the ntp client to get out and back? Any suggestions how to implement those ...
19
votes
4answers
13k views

With Linux iptables, is it possible to log the process/command name that initiates an outbound connection?

I would like to keep track of the processes that initiate outbound connections on a Linux desktop. The best I can come up with is this: iptables -A OUTPUT -m state --state NEW -j LOG --log-uid This ...
18
votes
4answers
26k views

How can I check if an iptables rule already exists?

I need to add a rule to iptables to block connections to a tcp port from the Internet. Since my script may be called multiple times and there is not a script to delete the rule, I want to check if ...
15
votes
2answers
92k views

need iptables rule to accept all incoming traffic

For my test environment i want to accept all incoming traffic, can someone please give me the iptable rule to be added. My current iptables -L -n output looks like this Chain INPUT (policy ACCEPT)...
14
votes
1answer
12k views

pfctl port forwarding in Mac osx?

-A PREROUTING -s 10.0.10.0/24 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080 -A PREROUTING -s 10.0.10.0/24 -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 8080 -A POSTROUTING -s 10.0.10.0/24 -o ...
11
votes
2answers
21k views

No idea what is listening on port 80 in OS X

I'm on OSX Mountain Lion 10.8.3, and I've freshly rebooted my Mac. I want to start a service (like Apache on port 80), but there is already something going on with port 80: telnet localhost 80 ...
10
votes
1answer
6k views

iptables vs route

What's the difference between these two tools? Can anybody tell me what the main workflow of networking behind Linux (in relation to IPv4 packet filtering, NAT and IP routing table) is?
8
votes
1answer
12k views

How to negate a range in iptables?

I've seen people use the exclamation mark (!) in multiple examples, but when I try to use it I get an error. The rule I'm trying: -A OUTPUT -m owner --gid-owner 1006 -d ! 192.168.1.0/24 -j DROP The ...
8
votes
2answers
7k views

What does an empty iptables mean?

I’m using CentOS and when type in the following iptables command: iptables -L -v The output is as follows: Chain INPUT (policy ACCEPT 19614 packets, 2312K bytes) pkts bytes target prot opt in ...
8
votes
1answer
10k views

Mirror Port via iptables

I have a dedicated Linux (Debian 7.5) root server, with a number of guests set up. The guests are KVM instances, and get network access via bridge-utils (NAT, internal IPs, use the host as a gateway). ...
8
votes
1answer
260 views

SSH to Vmware virtual machine with NAT network [duplicate]

right now I am able to ssh to host over internet and ssh from host to the virtual machine. What I want to do is ssh directly to the Guest machine from outside. I tried to do this using iptables: ...
8
votes
2answers
11k views

Setup routing and iptables for new VPN connection to redirect **only** ports 80 and 443

I have a new VPN connection (using openvpn) to allow me to route around some ISP restrictions. Whilst it is working fine, it is taking all the traffic over the vpn. This is causing me issues for ...
7
votes
1answer
3k views

Does tcpdump bypass iptables?

I mistakenly setup open resolver DNS server, which was soon used for bunch of DDoS attacks originating somewhere from / to russia. For that reason I completely blocked port 53 on both DNS servers for ...
7
votes
1answer
1k views

Sharing transparently proxied Internet connection with PS3

I am trying to play a Japanese karaoke game on a PS3 but the latency is just horrendous and downloading songs takes forever. One recommendation I got was to turn my laptop into a SOCKS proxy by ...
6
votes
2answers
12k views

Iptables redirect to localhost?

Suppose I have a network with a server routing all connections from inside the network to the Internet. How can I set up iptables so that instead of routing incoming connections to the Internet, it ...
6
votes
1answer
6k views

How to configure a firewall on Centos using Vagrant and Chef

I've created a server box using Vagrant and Chef and everything is up and running correctly. However, when the box is installed from scratch the default iptables rules are in place and so I need to ...
6
votes
1answer
6k views

Disable or block outgoing email

To do web site testing, how can I disable or block the Centos server to not send out emails. Now, if I run in command line mail xxx@gmail.com I can send out emails. This is not good for website ...
6
votes
1answer
2k views

How to transparently tunnel a port from IPv4 to a remote IPv6 device?

At home, I am connected with an IPv6 address and additionally, my provider provides a NAT-like setup through which I receive a public IPv4 address that I share with other customers (the reason being ...
6
votes
2answers
19k views

CentOS 6 - iptables preventing web access via port 80

I'm setting up a new web server with CentOS 6.2 and am not able to connect via the web. Everything looks set up correctly in httpd.conf and Apache is running, so I'm assuming it's an iptables issue. ...
6
votes
1answer
5k views

How to deliberately introduce a delay for incoming UDP packets

I want each packet (that match iptables rule) to be delayed by some fixed time interval. How to to this? Preudocode: iptables -A INPUT -p udp <more conditions> -j DELAY --delay 50000 # delay ...
6
votes
2answers
289 views

Open up firewall automatically to anybody who has successfully connected via SSH

I have a server which runs a few services. However, for security reasons, I configured the server so that nothing, except for SSH, is accessible from outside. What I'd like to do instead, though, is ...
5
votes
2answers
10k views

Deny all incoming connections with iptables?

I want to make some simple iptables rules to deny all incoming connections and allow outgoing. How can I do that?
5
votes
3answers
42k views

How to block all ports except 80,443 with iptables? [duplicate]

Blocking all ports(in and out) is easy but it's hard with the word "except". I don't know any rules that satisfies the condition. PS: I know this question is nothing new. But in fact, I didn't find ...
5
votes
1answer
7k views

tc / iproute2, how to list the configuration

This is my first time using traffic shaping and I am wondering how I can list the rules I applied like you can with iptables? Walter
5
votes
1answer
9k views

How to allow FORWARDing with firewalld on a Fedora 19 router

I've just installed Fedora 19 and I'm using firewalld instead of iptables, but I'm having difficulty interpretting the new terminology. I have 2 NICs. One is specificed ZONE="internal" and the other "...
5
votes
2answers
5k views

what does “-m tcp” mean in this iptables rule?

Firewall configuration written by system-config-firewall -A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
5
votes
5answers
13k views

How to block sites with iptables

I would like to block sites using iptables. How do I go about this, and how do I ensure that the iptables rules are saved?
5
votes
1answer
2k views

IPv4, IPv6 and IPTables

I have just recently learned that even if I block all traffic to my webserver using iptables it is still vulnerable to external attacks via IPv6. In my understanding, this renders iptables-only ...
5
votes
1answer
6k views

How to use NAT iptables rules for hostapd

My PC is equipped with two net interfaces - wlan0 and eth0. I want to use WiFi port as access point on wlan0. So i use hostapd facility and it works properly in routing mode in local network. Users ...
5
votes
2answers
4k views

Blocking Skype using snort and iptables

I am trying to block Skype using snort and iptables. I read a lot of papers and blocked the port, keywords and patterns which Skype uses. But it is still not blocked. My question is: if Skype uses ...
5
votes
1answer
549 views

Rackspace Firewall/Gateway Setup

I have rackspace account and wish to have this sort of setup: Firewall/Gateway eth0 - Public IP (56.X.X.X) eth1 - Private IP (10.X.X.X) Ubuntu 10.10. Accepts connections from the internet and ...
5
votes
0answers
4k views

How do I configure DD-WRT to forward IPSec traffic to an internal server to support a road warrior configuration?

I use dd-wrt as my home router setup and that's been working fine. Now I wanted to figure out a way to be able to use my iPad to set up a IPSec tunnel to my home network while I'm on the road. PPTP ...
5
votes
1answer
2k views

How to configure port forwarding for an IP camera

I need to configure port forwarding for my IP camera so that I can access it from internet. UPNP is not supported on my gateway. My network configuration is the following: Gateway (Ubuntu Server 12) ...
5
votes
1answer
3k views

Why is this iptables rule that does port forwarding not working?

I have a server bound to localhost:7060. It is using ipv6 socket instead of ipv4. Below is netstat outout. # netstat -an Proto Recv-Q Send-Q Local Address Foreign Address State tcp ...
4
votes
2answers
10k views

Using iptables to redirect ip address

I have the requirement on a Linux system where the Linux device is using RSYNC to sync data to another Linux machine. This is working fine at the moment, however I need to move one of the machines to ...
4
votes
1answer
6k views

Remove port aliases in iptables

How can I make iptables show me port numbers instead of aliases for well known port numbers (eg. http for 80, https for 443 etc.). Is there a way to make it show just port numbers at all times?
4
votes
1answer
7k views

IPTables module ip_tables not found for root

We got a custom build Linux distribution from a vendor, which is not shipped with iptables enabled. root@xxxx:~# iptables -L modprobe: FATAL: Module ip_tables not found. iptables v1.4.21: can't ...
4
votes
1answer
2k views

Blocking access to a specific url

I have a lightweight linux device which I would like to block from accessing one specific URL. Instead of making the request to the external URL, I would like to return the contents of a local file. ...
4
votes
2answers
225 views

dhclient unicast DHCPREQUEST excessive logs

I am using centos 7 with dhclient 4.2.5: $ uname -a Linux hostname 3.10.0-229.el7.x86_64 #1 SMP Fri Mar 6 11:36:42 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux $ dhclient -V Internet Systems Consortium ...
4
votes
1answer
3k views

What is command to look list of redirect rules, iptables

im using command like this : iptables -t nat -A PREROUTING -p tcp -d 192.168.1.118 --dport 4080 -j DNAT --to-destination 192.168.1.118:4088 My question what is command to look all rules in the ...
4
votes
3answers
8k views

iptables for transparent TCP proxy

Here's my situation. I have an iPad, a TiVo, and an dd-wrt router on my network, along with a machine that I'd like to use to sniff/decrypt draffic between the iPad and the TiVo. The iPad has an app ...
4
votes
3answers
3k views

Block a user from accessing internet on Linux

How do I block a user from accessing the internet under Linux? I'm trying the following: iptables -A OUTPUT -p tcp --dport 80,443 -m owner --uid-owner $USERNAME -j DROP Is that the right syntax or ...
4
votes
1answer
193 views

Windows 10 - NAT - Port forwarding & IP masquerade

I'm looking for a way to get iptables functionality in windows 10. I enabled IP routing and I need to forward tcp data to another host (port 8080) and then forward his response while masquerading IP. ...
4
votes
1answer
58 views

Configuration of DMZ on LRT214

I want to learn more about network technology. Therefore I want to run a raspberry pi in the DMZ as a web server. What is working: Appache Server on the pi is working. When I use it in the LAN and ...
4
votes
1answer
425 views

Program to block an IP temporarily with iptables

Is there a program on Debian to block an IP address temporarily just by launching a command (specifying the IP and the duration)? With iptables/ip6tables alone I can create a rule, but I would then ...
4
votes
1answer
1k views

Seting up IPTables to forward multiple GoPro cameras

I have an interesting problem that involves multiple GoPro cameras. Basically, I need to have the ability to communicate with multiple GoPro cameras via a single network. The challenge is that the ...
4
votes
1answer
2k views

Access Apache server running in Fedora guest VirtualBox from host

I have trouble accessing Apache server from host. I’ve Fedora 15 VM VirtualBox installed on Windows 7. Within this VM I have Apache server running and working fine within the guest. Not sure what ...
4
votes
1answer
4k views

Load balancing with multiple gateways

I have to different ISPs, each on each own network. The main connects via ethernet and the secondary via wifi. The two networks have no relation at all. I just connect to them simultaneously. The ...
4
votes
1answer
7k views

How to use iptables to forward all data from an IP to a Virtual Machine

OK, in an attempt to get some response, a TL;DR version. I know that the following command: iptables -A PREROUTING -t nat -i eth0 --dport 80 --source 1.1.1.1 -j REDIRECT --to-port 8080 ... will ...
4
votes
2answers
5k views

Ubuntu 11.04 server iptables port forwarding

I'm pretty new to iptables. My server has two Ethernet cards (eth0, eth1) and an ADSL router that is in bridge mode connected to the eth0 which created ppp0 when dialed. I'm trying to forward ...