I want to limit the IP traffic of an application (AceStream Player). The problem is that I get disconnected, if too many IP connections are established.  Does anyone know, how to use iptables to limit the connections to e.g. 10/second?  Inspirated by the answer below, I tried:  $iptables -A OUTPUT -p tcp --dport 8621 -m limit --limit 10/s -j ACCEPT $iptables -A OUTPUT -p tcp --dport 8621 -j DROP   This seems to limit the connections, but somehow to a lower limit like 2-3/sec. Do the upper rules limit the connections or packets to 10/sec?  Is it also possible to delay the connections by using QUEUE instead of DROP?
120967
I have a packet rate limit (max. 10 per seconds) which is set by my internet provider. This is a problem if I want to use the AceStream player, because if I exceed the limit I get disconnected.  How can I restrict the internet access of this program?  I tried the suggested command:  iptables -A OUTPUT -m limit --limit 10/s -j ACCEPT   but I get a fatal error message:  FATAL: Error inserting ip_tables (/lib/modules/3.2.0-67-generic/kernel/net/ipv4/netfilter/ip_tables.ko): Operation not permitted iptables v1.4.12: can't initialize iptables table `filter': Table does not exist (do you need to insmod?) Perhaps iptables or your kernel needs to be upgraded.   With administor rights:  sudo iptables -A OUTPUT -m limit --limit 10/s -j ACCEPT   there is no errror message anymore. But it is still not working, I get disconnected.  Is there an error in the command line? Or do I have to use other arguments of iptables?  Below is the actual message that I get, when I exceed the limits of the provider.  Up to now, I tried different approaches, but none of them didn't work.  sudo iptables -A INPUT -p tcp --syn --dport 8621 -m connlimit --connlimit-above 10 --connlimit-mask 32 -j REJECT --reject-with tcp-reset  sudo iptables -A INPUT -m state --state RELATED,ESTABLISHED -m limit --limit 9/second --limit-burst 10 -j ACCEPT  sudo iptables -A INPUT -p tcp --destination-port 8621 --syn -m state --state NEW -m limit --limit 9/s --limit-burst 10 -j ACCEPT   This approach seems not to help in order to still use the application. So, I posted another question:  .
92875
I'm learning about private/public IPs, port forwarding and NAT, and still fail to see the answer to a simple question:  Suppose two users on the same network are communicating with a single server outside their network (say, me &amp; my wife send http requests to yahoo.com).  The server sees both users as a single public ip, and often - as in this case - communicating on the same port.  How does the router route the packets according to the two different connections? Is there any routing info inside the packet beyond ip/port?  Is there some 'session table' maintained somewhere? By whom and what exactly does it include?
56653
Can someone please tell me how to restrict SSH access only to certain IP ranges (e.g. local network) and not the whole Internet? I guess this has to be done via firewall.
31111
As I'm learning about iptables I've made a couple of mistakes and locked myself out.  What method(s) do you use to test rules without locking yourself out?  I'm using ubuntu server 12.04 LTS    All the answers below were helpful.  In the end I used a combination of options.  It also helps to have IPMI access to your remote server just in case!  But ideally test the rules locally on a replicated environment and test that first.  Vagrant helps in this regard to get test setups working quickly.
31011
My iptables DNAT rules don't work until reboot. If I reboot my server, all of the rules work.  Desciption of the architecture :  Tens of hosts (senders) send some UDP packets (one-way on a specific port 9999) to my Linux router. This Linux router use iptables to forward those packets to several hosts (receivers).  senderX 10.0.0.X  ====> Linux router with iptables ====> receiverY 10.0.1.Y  The linux router have two network cards eth1 10.0.0.1/24 (senders side) and eth0 10.0.1.1/24 (receivers side).  Iptables setup :   ip_forwarding is activated all of the default policies are set to ACCEPT one iptables rules exist per sender, here is an example :    iptables -t nat -A PREROUTING -s 10.0.0.2 -i eth1 -j DNAT --to-destination 10.0.1.123   Network setup :  ip addr show :  1: lo: &lt;LOOPBACK,UP,LOWER_UP&gt; mtu 16436 qdisc noqueue state UNKNOWN     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00     inet 127.0.0.1/8 scope host lo     inet6 ::1/128 scope host        valid_lft forever preferred_lft forever 2: eth0: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc mq state UP qlen 1000     link/ether 54:9f:35:0a:16:38 brd ff:ff:ff:ff:ff:ff     inet 10.0.1.1/24 brd 10.0.1.255 scope global eth0     inet6 fe80::569f:35ff:fe0a:1638/64 scope link        valid_lft forever preferred_lft forever 3: eth1: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc mq state UP qlen 1000     link/ether 54:9f:35:0a:16:3a brd ff:ff:ff:ff:ff:ff     inet 10.0.0.1/24 brd 10.0.0.255 scope global eth1     inet6 fe80::569f:35ff:fe0a:163a/64 scope link        valid_lft forever preferred_lft forever   Symptom :  After adding a set of rules, some of the rules doesn't work. And I can see with tcpdump that UDP packets are no more routed and packets are rejected.  tcpdump -n -i eth1 host 10.0.0.2 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth1, link-type EN10MB (Ethernet), capture size 65535 bytes 16:12:58.241225 IP 10.0.0.2.56859 &gt; 10.0.0.1.9999: UDP, length 1464 16:12:58.241285 IP 10.0.0.1 &gt; 10.0.0.2: ICMP 10.0.0.1 udp port 9999 unreachable, length 556    If I flush all the rules and reinject them in iptables, rules that was not working still not work. If I reboot my server all the rules work fine.   Analysis done :  I have added a rule to log a specific sender which is not working :  iptables -t nat -A PREROUTING -s 10.0.0.2 -i eth1 -j LOG --log-prefix='PREROUTING LOG :'   But this rule doesn't log anything. Packets are coming because I see those in tcpdump but they are not logged. Also with the -v option in iptables, I don't see counters increasing for this rule.  If I apply the same rule before it stop working, I have some logs.  Question :   Is there any limits on UDP forwarding in iptables ? How I can troubleshoot this issue ?
48356
I have two Ethernet interface being configured to use as system gateway ex:    eth1: 10.10.1.0 eth2: 10.10.2.0   I want to forward all the packets which are coming to the 10.10.2.0 gateway contacting 10.10.1.x via eth1 (10.10.1.0), and the reverse as packets coming to 10.10.1.x, contacting 10.10.2.0 machines via eth2.    How can I write iptables rules for this?
64959
What's the best way, using SQL, to check the maximum number of connections that is allowed for an Oracle database? In the end, I would like to show the current number of sessions and the total number allowed, e.g. "Currently, 23 out of 80 connections are used".
54418
I have a web service running on debian 7 and listening on port 8080. I want to redirect 80 to 8080 for inbound connections and allow only port 80. Here is my iptables configuration:  root@localhost:~# iptables -v -L --line-numbers Chain INPUT (policy DROP 76 packets, 6266 bytes) num   pkts bytes target     prot opt in     out     source               destination          1       90  8898 ACCEPT     all  --  lo     any     anywhere             anywhere             2        0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:http 3     4515 3113K ACCEPT     all  --  any    any     anywhere             anywhere             state RELATED,ESTABLISHED  Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) num   pkts bytes target     prot opt in     out     source               destination           Chain OUTPUT (policy ACCEPT 4858 packets, 587K bytes) num   pkts bytes target     prot opt in     out     source               destination        and nat table:  root@localhost:~# iptables -L -n -v -t nat Chain PREROUTING (policy ACCEPT 14 packets, 2288 bytes)  pkts bytes target     prot opt in     out     source               destination              0     0 REDIRECT   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80 redir ports 8080     0     0 REDIRECT   udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:80 redir ports 8080  Chain INPUT (policy ACCEPT 0 packets, 0 bytes)  pkts bytes target     prot opt in     out     source               destination           Chain OUTPUT (policy ACCEPT 841 packets, 53415 bytes)  pkts bytes target     prot opt in     out     source               destination           Chain POSTROUTING (policy ACCEPT 841 packets, 53415 bytes)  pkts bytes target     prot opt in     out     source               destination    i can't establish a connection from outside on port 80. What are likely deficiencies?
75376
Fist let's block all Incoming, Outgoing signals  via iptables.     vi /etc/sysconfig/iptables   *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A OUTPUT -j DROP -A INPUT -j DROP -A FORWARD -j DROP COMMIT   start iptables:   service iptables start   My Ethernet Cable is plugged in. let's try something via terminal  ping 8.8.8.8 PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.   that is all. just 1 line. after that it stalls. clearly iptables is blocking it successfully  now I am going to disconnect my Ethernet cable. my internet is disconnected.  let's try it again:  ping 8.8.8.8 connect: Network is unreachable   this time .. instantly.. it returns that message.  Clearly, weather it is "ping" or any other program.. it is determining if a network interface is up or not before it executes it's internet command.  of course soon as it executes.. it is not able to pass through iptable rules. but what seems evident is.. it does not first consult to the iptables..  it first checks to see if a network interface is connected or not.   I would like to figure out how I can manually let it know that network interface is connected.  in other words unless I tell it network interface is up.. it should simply behave the same way it behaves when network interface is not connected ( when the ethernet cable is not plugged in)  how can this be done ?
16276
I'm using IPSEC in a tunnel mode.  How to make an iptables rule that will match only packets which arrived via IPSEC tunnel (i.e. after IPSEC decrypted them - not the IPSEC packets when they arrive and before decryption).   The point is to have a certain port which will be accessible only via IPSEC and inaccessible to the rest of the world.
79064
I have struggled throughout the years to get a solid understanding on iptables.  Any time I try and read through the man pages my eyes start to glaze over.  I have a service that I only want to allow the localhost to have access to.  What terms (or configuration, if someone is feeling generous) should I Google for to allow only localhost host to have access to a given port?
72395
I was wondering if there are any good applications to monitor how much data I use on my laptop in a month. My net connection has a restriction of how much data I can use after which the speed goes down considerably. I saw ntop, but I just wanted to ask if there are any other good options or suggestions regarding this. Regards.
10919
I'm sure this is very noobish, so forgive me. I'm trying to run a node.js server on port 8080 of my ubuntu 10.04.  Here's the result of iptables -L on the server:  Chain INPUT (policy ACCEPT) target     prot opt source               destination           Chain FORWARD (policy ACCEPT) target     prot opt source               destination           Chain OUTPUT (policy ACCEPT) target     prot opt source               destination   And here's the result of nmap -p 8080 (edited the ip address because everything is or should be wide open)  nmap 173.203.xxx.xxx -p 8080 -A  Starting Nmap 5.00 ( http://nmap.org ) at 2011-05-19 22:52 PDT Interesting ports on xxx (173.203.xxx.xxx): PORT     STATE  SERVICE    VERSION 8080/tcp closed http-proxy   Why on earth is 8080 seen as closed? Adding this did not help:  iptables -A OUTPUT -p tcp  --dport 8080 -j ACCEPT iptables -A INPUT -p tcp  --dport 8080 -j ACCEPT   I'm really confused.  I'll add this, in case it helps, but I don't know   netstat -pan | grep 80 tcp        0      0 127.0.0.1:8080          0.0.0.0:*               LISTEN          16785/node       tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      16471/apache2   I can access my regular website running off of port 80 on apache, but the node.js server is inaccessible from outside. Accessing it from the server itself works fine.  So my question is: how would I go about debugging this? Could there be something else than iptables blocking some ports? How do I find out what it is?  Any help much appreciated!
117159
For an ASP.NET C# application, we will need to restrict access based on IP address. What is the best way to accomplish this?
53950
I found , but I'm sorry I don't quite understand the settings on the two variables ServerAliveInterval and ClientAliveInterval mentioned in the accepted response.  If my local server is timing out, should I set this value to zero?  Will it then never time out?  Should I instead set it to 300 seconds or something?  My question is simply, some of my connections time out when I suspend &amp; then unsuspend my laptop with the response Write failed: Broken pipe and some don't.  How can I correctly configure a local sshd so that they don't fail with a broken pipe?
93232
I want to DROP more than 200 requests per ip to prevent ddos attack. this is command that i used to detect requests count per ip :  netstat -alpn | grep :80 | awk '{print $5}' |awk -F: '{print $(NF-1)}' |sort | uniq -c | sort -nr   now i want add all ip addresses that made more than 200 requests into IPtables to DROP input and out put.
96560
I'm trying to limit the bandwidth of a virtual machine running via VirtualBox.   trickle -d 5 virtualbox doesn't work, I believe because of an issue with child processes (trickle -d 5 sudo apt-get upgrade doesn't work either)  How can I limit the download/upload bandwidth of VirtualBox's VMs?