Questions tagged [iptables]

Iptables is a module that provides the Linux operating system functions of firewall, NAT and logging of data traveling over a computer network.

Filter by
Sorted by
Tagged with
4
votes
3answers
20k views

Block all ports except SSH/HTTP in ipchains and iptables

How can I block all ports except: ssh (port 22) httpd (port 80) using iptables and ipchains?
9
votes
2answers
35k views

Using iptables to redirect ip address

I have the requirement on a Linux system where the Linux device is using RSYNC to sync data to another Linux machine. This is working fine at the moment, however I need to move one of the machines to ...
2
votes
1answer
5k views

Block ARP requests (or broadcast message, if possible) from A SPECIFIC HOST in a subnet

My ISP provide username-password for authentication and also register the client's MAC address for authentication. I am concerned about someone misusing my connection while I am not using it. ...
9
votes
6answers
45k views

How to block sites with iptables

I would like to block sites using iptables. How do I go about this, and how do I ensure that the iptables rules are saved?
1
vote
1answer
136 views

iptables is treating traffic from different hosts differently in spite of rules

Something spooky is happening here and I don't know how to fix it. Summary: traffic that appears identical to tcpdump is being treated by iptables differently. Details below. Test setup: device ...
42
votes
2answers
306k views

need iptables rule to accept all incoming traffic

For my test environment i want to accept all incoming traffic, can someone please give me the iptable rule to be added. My current iptables -L -n output looks like this Chain INPUT (policy ACCEPT) ...
16
votes
1answer
21k views

pfctl port forwarding in Mac osx?

-A PREROUTING -s 10.0.10.0/24 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080 -A PREROUTING -s 10.0.10.0/24 -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 8080 -A POSTROUTING -s 10.0.10.0/24 -o ...
27
votes
4answers
23k views

With Linux iptables, is it possible to log the process/command name that initiates an outbound connection?

I would like to keep track of the processes that initiate outbound connections on a Linux desktop. The best I can come up with is this: iptables -A OUTPUT -m state --state NEW -j LOG --log-uid This ...
11
votes
1answer
24k views

Mirror Port via iptables

I have a dedicated Linux (Debian 7.5) root server, with a number of guests set up. The guests are KVM instances, and get network access via bridge-utils (NAT, internal IPs, use the host as a gateway). ...
9
votes
1answer
11k views

Ubuntu IPTables allow only allow 1 country

So I've been looking around on the net for a script that will drop all traffic to all ports except the http(80) and https(443) ports, and then only allow traffic on all other ports from country x (...
7
votes
1answer
9k views

How to deliberately introduce a delay for incoming UDP packets

I want each packet (that match iptables rule) to be delayed by some fixed time interval. How to to this? Preudocode: iptables -A INPUT -p udp <more conditions> -j DELAY --delay 50000 # delay ...
14
votes
1answer
8k views

How to transparently tunnel a port from IPv4 to a remote IPv6 device?

At home, I am connected with an IPv6 address and additionally, my provider provides a NAT-like setup through which I receive a public IPv4 address that I share with other customers (the reason being ...
5
votes
3answers
2k views

Iptables forwarding port/s to a external IP transparently (remote end should see the actual source IP)

The question is simple but I think the answer might not be as I went through countless related topics with no concrete reply. I wish to forward a port 1234 from x.x.x.x to y.y.y.y (both on internet ...
4
votes
4answers
12k views

OpenVPN connection through SSH tunnel

I'm currently visiting China, so I have some options for VPNs set up. However, my VPN servers have a habit of suddenly disappearing from the network after I've used them for a while. I thought it ...
2
votes
1answer
2k views

Traffic not being forwarded through NAT

I have a router which provides internet access using NAT, and a client Linux box (A) which is connected to this router on eth0. This Linux box also has a wlan interface, wlan0; what I would like is ...
5
votes
1answer
4k views

firewall-cmd - add-forward-port don't work

I have a KVM server (host) with multiple virtual machines (guests). My goal is my host forward port 222 to port 22 of a guest running an ssh service. This works... iptables -I OUTPUT -d 0.0.0.0/0 -...
64
votes
1answer
28k views

Does tcpdump bypass iptables?

I mistakenly setup open resolver DNS server, which was soon used for a bunch of DDoS attacks originating somewhere from / to Russia. For that reason I completely blocked port 53 on both DNS servers ...
37
votes
3answers
70k views

No idea what is listening on port 80 in OS X

I'm on OSX Mountain Lion 10.8.3, and I've freshly rebooted my Mac. I want to start a service (like Apache on port 80), but there is already something going on with port 80: telnet localhost 80 ...
19
votes
3answers
142k views

How to block all ports except 80,443 with iptables? [duplicate]

Blocking all ports(in and out) is easy but it's hard with the word "except". I don't know any rules that satisfies the condition. PS: I know this question is nothing new. But in fact, I didn't find ...
15
votes
2answers
46k views

Windows 10 - NAT - Port forwarding & IP masquerade

I'm looking for a way to get iptables functionality in windows 10. I enabled IP routing and I need to forward tcp data to another host (port 8080) and then forward his response while masquerading IP. ...
8
votes
2answers
13k views

Setup routing and iptables for new VPN connection to redirect **only** ports 80 and 443

I have a new VPN connection (using openvpn) to allow me to route around some ISP restrictions. Whilst it is working fine, it is taking all the traffic over the vpn. This is causing me issues for ...
6
votes
2answers
20k views

iptables - How to forward all external ports to one local port

I want a service to be running on every external port on my system. Since it wouldn't work to start 65535 single instances of that service (I guess...) I thought of using iptables for this. The ...
4
votes
3answers
23k views

Source Based Policy Routing & NAT (DNAT/SNAT) aka Multi WANs on CentOS 5

Originally posted at Unix and Linux but nobody was able to answer it, so m migrating the question here: My question is regarding Source Based Policy Routing on CentOS 5 with 2 WANs plus a LAN (NAT) ...
28
votes
1answer
83k views

What are the iptables rules to permit ntp?

My server's clock is wrong because the firewall doesn't permit ntp traffic. What are the iptables rules required to allow the ntp client to get out and back? Any suggestions how to implement those ...
9
votes
1answer
1k views

SSH to Vmware virtual machine with NAT network [duplicate]

right now I am able to ssh to host over internet and ssh from host to the virtual machine. What I want to do is ssh directly to the Guest machine from outside. I tried to do this using iptables: ...
5
votes
2answers
6k views

Program to block an IP temporarily with iptables

Is there a program on Debian to block an IP address temporarily just by launching a command (specifying the IP and the duration)? With iptables/ip6tables alone I can create a rule, but I would then ...
4
votes
2answers
15k views

Transparent tunnel between interfaces on remote hosts

I need to make a solution which will work as a network switch with two ports: one port located in one country and second port is in another country. +------------ Virtual switch --------...
6
votes
1answer
8k views

Load balancing with multiple gateways

I have to different ISPs, each on each own network. The main connects via ethernet and the secondary via wifi. The two networks have no relation at all. I just connect to them simultaneously. The ...
4
votes
2answers
4k views

SSH reverse tunnel into Docker container

I need to xdebug something that fails on the server in a docker container and from my laptop I have ran ssh -R 9000:localhost:9000 server and verified the tunnel by telnet localhost 9000. So far so ...
3
votes
3answers
4k views

How to force Google safesearch on entire network

I've a problem filtering web searches on Google domains. Currently I've a linux openVPN Server running with openDNS "family block". I can block a lot of websites with dangerous content and it's ok. ...
2
votes
1answer
3k views

Policy routing for OpenVPN server & client on the same router?

PROBLEM An OpenVPN server instance (tun, udp, port 1194) is set up on a Linux-based router that also runs an OpenVPN client instance (tun, udp, port 1197) connecting it to a VPN provider. Both the ...
2
votes
1answer
2k views

How to route specific traffic through OpenVPN?

I'm running a server at home with rtorrent and apache2. I would like to route my rtorrent traffic via OpenVPN and since im kinda new to OpenVPN and iptables i would like to have a user friendly guide. ...
2
votes
2answers
1k views

Iptables port mapping from two PCs to one

We have 3 PCs, two of it are connected to internet (both of it have 2 NIC) PC1: eth0 - 1.0.0.1 (external IP) eth1 - 172.16.0.1 (internal IP) PC2: eth0 - 1.0.0.2 (external IP) eth1 - 172.16.0.2 (...
1
vote
1answer
10k views

How to forward http request to a proxy server?

I have an Internet Linux server and my client computer (running windows) accesses internet via a SSH tunnel to the the server. Now for some reason this server can only accesses internet by a http ...
8
votes
3answers
14k views

iptables/1.8.2 Failed to initialize nft: Protocol not supported

I'm having a problem using iptables on my Raspberry PI. I've just downloaded a fresh version of Raspbian Lite on my PI and all I'm trying to do is check my iptables rules but it's not working and I'm ...
2
votes
1answer
3k views

Route LAN traffic through eth0, not tun0, on my VPN access point

How can I make my Access Point send traffic to 192.168.1.0 through eth0 and all other traffic through tun0? I have set up a Raspberry Pi VPN access point. It sits on the same subnet as all my servers,...
2
votes
3answers
4k views

How to install firewall script in Ubuntu?

https://help.ubuntu.com/community/Router/Firewall In the link above there is a firewall script described. How can I install this script in Ubuntu 10.0.4 desktop?
1
vote
1answer
226 views

Iptables NATforwarding setup

I have 2 Virtual machines with CentOS7: Networkcard : Intern network IP 192.168.1.10 w/ GW: 192.168.1.254 enp0s3 (Client1) (NO DIRECT CONNECTION TO INTERNET) Networkcard : Intern network IP 192.168.1....
1
vote
2answers
697 views

How do I set iptables so that https://bing.com is blocked, but http://bing.com is not?

-A OUTPUT -d bing.com -j DROP – works: Block bing.com through http and https as well. So I try to modify it so that only https is blocked: -A OUTPUT -d bing.com --dport 443 -j DROP – but this won’t ...
1
vote
2answers
429 views

What is difference between Port Knocking and URL Knocking?

I know what is Port Knocking. But I read somewhere wrote URL Knocking. I didn't find any useful link about URL Knocking. Now I really want to know what is it and what is its difference with Port ...
1
vote
1answer
722 views

How to add virtual NICs to my linux PC, so that they expose their MACs to ISP's domain?

I have learned how to add virtual NICs to a guest system in VirtualBox, just using Shared Adapter, then all the virtual NICs and my host's NIC will appear as real NICs to the ISP. So I guess there ...
1
vote
1answer
2k views

DD-WRT - Host-based forwarding

I would like to know if I can configure DD-WRT router, that operates as the server's network gateway, so support different forwards based on hostname (other than port 80). I've configured ...
0
votes
2answers
2k views

Traffic redirection with Rasperry Pi router

I use a Rasperry Pi (running raspbian) as a wi-fi router. It redirects traffic from the Ethernet wire (eth0 - wire + ppp0 - L2TP connection, lx2tp used for it) to wlan0 (USB wi-fi dongle, hostapd used ...
0
votes
2answers
664 views

Why can’t I block https?

May I ask why can I not block all https traffic in iptables? I tried: OUTPUT --dport 443 -j DROP And even: OUTPUT --sport 443 -j DROP None of this works. Https webpages are still perfectly ...
-1
votes
1answer
1k views

Bind incoming packets to 1 interface and outgoing packets to 2nd interface?

I am have a Linux machine with 2 network interface cards, I need to use one for incoming packets, other for outgoing packets.
8
votes
2answers
17k views

How to allow FORWARDing with firewalld on a Fedora 19 router

I've just installed Fedora 19 and I'm using firewalld instead of iptables, but I'm having difficulty interpretting the new terminology. I have 2 NICs. One is specificed ZONE="internal" and the other "...
6
votes
1answer
2k views

iptables reject tcp-reset on loopback

I am trying to check how a software would behave if there is a network failure. That software is using tcp send() and recv() to communicate. Previously I was making the software communicate by ...
5
votes
2answers
15k views

Synergy client won't connect, despite open port?

I want to use a Debian KDE desktop computer (network name bradbury) as the server, and a Windows 7 laptop (network name Clarke) as the client. I have used this setup before without problems, but then ...
5
votes
1answer
2k views

Block Windows 10 P2P updates with a corporate firewall

I work for a small IT company that fix mostly Windows computers, and lately we have an huge issue with Windows 10 updates. When a new computer enters our network and starts downloading updates, it ...
4
votes
1answer
1k views

ip6tables: how to handle periodically changing prefix?

My ISP provides me with native IPv6 (unfortunately DS-Lite for v4) and I'm using SLAAC for the clients in my local network behind a broadband router. As I don't trust the router (which is configured ...