Debian 7  iptables v1.4.14 (there are no rules)  Need to block all outgoing connections on ports 25,587,465 and allow only on specific IP's.  What I've tried:  iptables -A OUTPUT -p tcp --match multiport --dports 25,587,465 -j REJECT iptables -A OUTPUT -p tcp -s 127.0.1.1 --match multiport --dports 25,587,465 -j ACCEPT iptables -A OUTPUT -p tcp -s **.**.**.*** --match multiport --dports 25,587,465 -j ACCEPT iptables -A OUTPUT -p tcp -s **.**.**.*** --match multiport --dports 25,587,465 -j ACCEPT   I tried different order for rules, but it's not working as expected.
121600
so I'm having a client in my network connected to the router through my computer with arpspoof. When I know want to stop the packet forwarding I execute:  iptables -A FORWARD -j REJECT   that is working how I expected. But when I try to do something like:  iptables -A FORWARD -j ACCEPT   I cannot manage to make the packets go through like in the beginning.   Am I doing something wrong or are there any other arguments I should use different from "ACCEPT"?
106157
What do the [368:102354], [0:0] and [92952:20764374] in my iptables output file mean?  :INPUT ACCEPT [368:102354] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [92952:20764374]
55920
I want my iptables rules to automatically be loaded on startup. According to the wiki on Debian this can be done by placing a script with the name iptables in /etc/network/if-pre-up.d/ So I did, this is what it looks like:  cat /etc/network/if-pre-up.d/iptables  #!/bin/sh /sbin/iptables-restore &lt; /etc/firewall/iptables.rules /sbin/ip6tables-restore &lt; /etc/firewall/ip6tables.rules   This script works: if I run it as root my firewall rules get applied. But on reboot there are no firewall rules. What am I doing wrong?  On request: the /etc/network/interfaces (I did not touch this file)  user@DebianVPS:~$ cat /etc/network/interfaces  # This file describes the network interfaces available on your system # and how to activate them. For more information, see interfaces(5).  # The loopback network interface auto lo iface lo inet loopback  # The primary network interface allow-hotplug eth0 iface eth0 inet dhcp
34998
I add this rule:  sudo iptables -t nat -A OUTPUT -d a.b.c.d -p tcp \        --dport 1723 -j DNAT --to-destination a.b.c.d:10000    When restart computer rules are deleted. Why? What I can do to make the rules persist?
75379
From my understanding, all IP addresses of the form 127.x.y.z are loopback addresses. Now that seems to be quite a waste to me; indeed, already more than one address seems like a waste.  Is there any use in having so many loopback addresses?
40966
So here's the problem:   I have a single server with multiple hostnames, meaning I have A records example.com and *.example.com pointing to the server's ip-address I want to limit incoming ssh connections to a specific hostname, that is I want to allow only logins to user@secret.example.com, and disallow login attempts using user@ip-address or user@example.com   The man page from sshd_config has the following for ListenAddress:  Specifies the local addresses sshd(8) should listen on.   The following forms may be used:  ListenAddress host|IPv4_addr|IPv6_addr ListenAddress host|IPv4_addr:port ListenAddress [host|IPv6_addr]:port   which seems to indicate that sshd has the ability to restrict itself to a a specific hostname. However I've tried ListenAddress secret.example.com:22, but after restarting sshd that doesn't seem to add any restrictions based on hostname used.  man sshd_config doesn't seem to show any other options in that vein.  Is there something I'm missing, or does sshd simply not have that ability?
53391
echo "1.1.1.1" | awk '/[0-9]*\.[0-9]*\.[0-9]*\.[0-9]*/ {print $1}'   How can I filter IPv4 addresses in a script, and how can I filter IPv6 addresses.  I mean more precisely then this so the oneliner should only output VALID IPv4 addresses or another script to output only VALID IPv6 addr. In different languages? like: awk, perl?  ty!
57358
I'm trying to determine where connectivity to an external host using a specific TCP port is being blocked. Traceroute for Windows only uses ICMP, and telnet will only tell me that the port is blocked and not where. Does anyone know of a Windows utility similar to traceroute that will achieve this?
59767
I am setting up a new server with 18.04 based on instructions written for 14.04. I have got as far as these steps:  /sbin/iptables -A FORWARD -p tcp --destination-port 80 -j ACCEPT /sbin/iptables -t nat -A PREROUTING -j REDIRECT -p tcp --destination-port 80 --to-ports 8080 /sbin/iptables-save # To save permanently (reset-persistent): sudo sh -c "iptables-save &gt; /etc/iptables.rules" # Modify in /etc/network/interfaces # Add this line:     pre-up iptables-restore &lt; /etc/iptables.rules     # As below:  # The loopback network interface auto lo iface lo inet loopback     pre-up iptables-restore &lt; /etc/iptables.rules  # The primary network interface auto eth0 eth1 iface eth0 inet static         address XXX.XXX.XX.XXX         netmask 255.255.255.0         gateway XXX.XXX.XX.1         dns-nameservers 8.8.4.4 8.8.8.8 XXX.XXX.0.3 iface eth1 inet static         address XX.XXX.67.47         netmask 255.255.0.0   But it turns out that 18.04 does things a different way, using something called netplan.   I have found questions and answers related to how to revert back to how things were done in 14.04, but I am wondering whether it is better to do the same thing the new way.   How can I do what is being done the old way using netplan?
40484
I'm trying to redirect a single port to a local server via IPtables.  Currently I have the following rules:  iptables -t nat -A PREROUTING -p tcp -m tcp --dport 55555 -j DNAT --to-destination 10.188.44.125:3306 iptables -t nat -A POSTROUTING -j MASQUERADE   When I have these rules in place, my rsync process of ssh fails.  I'm assuming something here is conflicting, but I'm not sure what.  Any suggestions?  Thanks!  Update: Here are the rules I have in place to allow the rsync over ssh connection.  My input policy is set to drop.  Other policys are set to accept.  iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A INPUT -p icmp -j ACCEPT iptables -A INPUT -s 127.0.0.1/32 -d 127.0.0.1/32 -i lo -j ACCEPT   Update 2  Here are the results of iptables-save for the nat:  *nat :PREROUTING ACCEPT [8:468] :INPUT ACCEPT [7:408] :OUTPUT ACCEPT [2:134] :POSTROUTING ACCEPT [0:0] [0:0] -A PREROUTING -p tcp -m tcp --dport 53306 -j   DNAT --to-destination 10.183.42.125:3306 [2:134] -A POSTROUTING -j MASQUERADE COMMIT
55923
It's very annoying to have this limitation on my development box, when there won't ever be any users other than me.  I'm aware of , but none of them do exactly what I want:    (The version in Debian testing, 1.0, only supports IPv4)  (the "nat" table is not yet implemented for ip6tables, the IPv6 version of iptables) sudo (Running as root is what I'm trying to avoid) SELinux (or similar). (This is just my dev box, I don't want to introduce a lot of extra complexity.)   Is there some simple sysctl variable to allow non-root processes to bind to "privileged" ports (ports less than 1024) on Linux, or am I just out of luck?  EDIT: In some cases, you can  to do this.
119472
Part of a firewall on a server :  iptables -A INPUT -p tcp --dport 22 -m state NEW --state -m recent --set  iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 100 --hitcount 10 -j DROP   When I search online I always see NEW being used in that rule but I'm having a hard time understanding why ESTABLISHED and RELATED aren't being used.  Like this :  iptables -A INPUT -p tcp --dport 22 -m state NEW,ESTABLISHED,RELATED --state -m recent --set  iptables -A INPUT -p tcp --dport 22 -m state --state NEW,ESTABLISHED,RELATED -m recent --update --seconds 100 --hitcount 10 -j DROP   Can someone explain to me when exactly a NEW packet changes into ESTABLISHED and RELATED ?
54991
It was specified somewhere (presumably in an RFC) that Class A addresses range from 1-126 in the first octet, and that class E addresses range from 240-254, but that leaves out two potential networks on either side, namely a 0 and a 255 network.  I believe that addresses starting with these IPs are invalid. Does this mean that they wouldn't work on a private network, and is there a reason for them being invalid?
100031
I have a little VPS I run apache and a Minecraft server on. I don't ever turn it off, but should I restart it for some reason, IPTables blocks most of my ports, including port 80. I've tried so many different suggestions on fixing this, but with no luck. Also, since the provider is OVH, the support is... lacking.  So, I've created a workaround, which I'm happy with. I created a simple shell script file to open certain ports I need opened on restart (80 and 25565 for now). The important ones such as 21 and 22 are not affected on restart.   The script looks like this:  iptables -I INPUT -p tcp --dport 80 -j ACCEPT iptables -I INPUT -p udp --dport 80 -j ACCEPT iptables -I INPUT -p tcp --dport 25565 -j ACCEPT iptables -I INPUT -p udp --dport 25565 -j ACCEPT /sbin/service iptables save   When I manually run it by typing /iptdef.sh, it runs fine, the ports become open and it's all good.  Of course, it's not practical having to remember to run it every time I restart the server, so I added a crontab. The problem is, it doesn't work/run. This is my crontab file:  */5 * * * * /backup2.sh */55 * * * * /backup3.sh @reboot /iptdef.sh * * * * *  /iptdef.sh   The first two lines work. They are just simple scripts that make a backup of a folder for me. The second two lines are what's not working.   Is there a chance that perhaps it's not possible to run iptables commands from a cron? It sounds silly, but I can't see any other reason for it not to work. The scripts have the correct permissions.
23446
How could I filter a single IP address or a range of IP addresses to prevent them from accessing my computer?  Examples:   Block 31.13.76.102 Block from 216.58.192.0 to 216.58.223.255 Block from 173.194.0.0 to 173.194.255.255 Block from 74.125.136.0 to 74.125.136.255   I would like to block them from accessing my computer without additionnal conditions.  I know that one can use iptables in this situation, but I am unaware of the exact syntax, how to make the changes permanent, and which command to run in order to launch the iptables service at startup. I also don't want to make mistakes that may break my access to the Internet.
104019
I have some questions about SNAT with iptables. Assume there is one router who plays DHCP server for assign private IPs in my LAN and NAT for the hosts in my LAN can access the public internet.  The router has two interfaces, one "eth0" with dynamic public IP and the other "eth1" with private IP 192.168.0.1 and the subnet is 192.168.0.0/24. Assume the ipv4 packet forwarding is enable on that router. I know I have to set one rule in NAT table for masquerading the source IP of the packet to the public internet from the hosts in my LAN. This rule may looks like the one under.  iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -o eth0 -j MASQUERADE  I understand why I need the rule since the packet from my LAN needs a public IP for internet routing.  But I do not understand why I do not need set another rule in PREROUTING chain for the response packets in order to modify their destination IP addresses.  Is the modification of destination address of those response packets a default behavior of the MASQUERADE rule I just set?  And another question is that how iptable know which packets should be modified?  Thank You.
48356
I have two Ethernet interface being configured to use as system gateway ex:    eth1: 10.10.1.0 eth2: 10.10.2.0   I want to forward all the packets which are coming to the 10.10.2.0 gateway contacting 10.10.1.x via eth1 (10.10.1.0), and the reverse as packets coming to 10.10.1.x, contacting 10.10.2.0 machines via eth2.    How can I write iptables rules for this?