I am somewhat new to  Linux networking and running in to a issue with iptables I am just not making any headway on.  Two notes before I get in too it. iptables is version 1.4.14, and it is a custom embedded server using custom distro of Linux.  The issues I am having is that -j REJECT parameter is unavailable. If I enter something like (as root) "iptables -A INPUT -p tcp --dport 80 -j REJECT" the error "iptables: No chain/target/match by that name." is returned.   If I enter the same thing with -j DROP instead iptables accepts it and works without issue.  So the question is what is missing in my installation that is causing this?  Thanks.
123305
I have recently setup a server with fail2ban, and it is mostly working except I am getting errors whenever this command tries to execute:  sudo iptables -D fail2ban-ssh -s xxx.xxx.xxx.xxx -j REJECT --reject-with icmp-port-unreachable   The error message is:  iptables: No chain/target/match by that name.   When I don't use REJECT, it works fine. For example:  sudo iptables -D fail2ban-ssh -s xxx.xxx.xxx.xxx -j DROP   Will execute just fine. I can't figure out why REJECT is being, er, rejected.
93232
I want to DROP more than 200 requests per ip to prevent ddos attack. this is command that i used to detect requests count per ip :  netstat -alpn | grep :80 | awk '{print $5}' |awk -F: '{print $(NF-1)}' |sort | uniq -c | sort -nr   now i want add all ip addresses that made more than 200 requests into IPtables to DROP input and out put.
42363
I'm still reading the iptables manual page and other documents and  digging around questions and their answers.  This is the problem which arises. When we setup the NAT we use a POSTROUTING rule such as this:  iptables -A POSTROUTING -t nat -j MASQUERADE -o eth0    It seems when a packet hits this chain then an internal host needs to initialize some connection with the internet right? Incoming traffic will route through the same path without hitting the chain? Am I right on this?
53906
I have a firewall with these simple rules:  iptables -A INPUT -p tcp -s 127.0.0.1/32 --dport 6000 -j ACCEPT iptables -A INPUT -p tcp -s 192.168.16.20/32 --dport 6000 -j ACCEPT iptables -A INPUT -p tcp --dport 6000 -j REJECT   Now, suppose I am using TCPDUMP like this:  tcpdump port 6000   And I have host 192.168.16.21 trying to connect to port 6000.  Will/should tcpdump output some packets coming from 192.168.16.21?
34998
I add this rule:  sudo iptables -t nat -A OUTPUT -d a.b.c.d -p tcp \        --dport 1723 -j DNAT --to-destination a.b.c.d:10000    When restart computer rules are deleted. Why? What I can do to make the rules persist?
45238
I drop all traffic on ports except on 80 for my web server.  I have some rules like this on iptables:  iptables -A INPUT -p tcp -m tcp --dport 80 -m string --string "cgi" --algo bm --to 1000 -j DROP   Someone who have more can share? I know always the bad hackers still updating, but some of them always begin with the same code. I need to Drop the connection based on some criteria. Here are some Apache log (I remove ips but each atack come from the same):  Attack 1: This I don't know what are trying to do, but make it 50 times from the same ip  GET / HTTP/1.1  301 224 -   Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.22 (KHTML, like Gecko) Chrome/25.0.1364.152 Safari/537.22 GET / HTTP/1.1  302 3387    -   Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.22 (KHTML, like Gecko) Chrome/25.0.1364.152 Safari/537.22   Attack 2: this try to get information about server only.  GET / HTTP/1.1  301 224 http://myip:80/ Go-http-client/1.1 GET / HTTP/1.1  302 3228    http mywebsite  Go-http-client/1.1 GET /es/ HTTP/1.1   200 40947   https mywebsite Go-http-client/1.1   Attack 3: they try get access to a login page vulnerability  GET /userlogin/login.aspx HTTP/1.1  302 186 -   -   Attack 4: this try to access a cgi at first request, (see my first iptables rule to drop this)  GET /hndUnblock.cgi HTTP/1.0    302 186 -   Wget(linux) GET /tmUnblock.cgi HTTP/1.0 302 186 -   Wget(linux)   I'm very new with server this 4 attacks are from only last 12 hours... Have thousands per week.
82803
In my Ubuntu's /etc/mysql/my.conf, I have:  bind-address = 192.168.2.20  # My external IP   It works fine from remote, but when I want to connect locally,  says: java.net.ConnectException: Connection refused at com.mysql.jdbc.StandardSocketFactory.connect.  So when I want to work locally, I change my.cnf to:  bind-address = 0.0.0.0   And it starts working locally, but then it doesn't work from remote anymore.  How to make MySQL accesible both from remote AND local?
3129
I would like do some NAT in iptables. So that, all the packets coming to 192.168.12.87 and port 80 will be forwarded to 192.168.12.77 port 80.  How to do this with iptables?  Or   Any other ways to achieve the same?
58193
I made changes to iptables config file in /etc/iptables/filter in Ubuntu and want to reload them. I read the man page and also googled but couldn't find the information. Any help will be appreciated.
77802
On a rackspace cloud server, I opened up Putty and it WORKS if I do "telnet localhost 25" on the VPS, the postfix process is running as well  However, if I try to telnet remotely like "telnet domain.com 25" it doesn't work, I've tried "telnet domain.com 22" and it works.  C:\Users\Shane&gt;telnet domain.com 25 Connecting To domain.com...Could not open connection to the host, on por t 25: Connect failed
39865
Is it possible to add a rule in linux firewalld to reject an entire host(not ip or ip range) ?  For example, I wish to reject all connection coming from my133y.org.  Using firewall rich language I can drop ip, but host rejection is not provided in man pages.  Example to reject ip  firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="192.168.100.4/24" drop'   when modified to :  firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="my133t.org" drop'   I got the error:  Error: INVALID_ADDR: my133t.org
107090
When I code like this:        ServerSocketChannel ssc = ServerSocketChannel.open(); InetSocketAddress sa = new InetSocketAddress("localhost",8888); ssc.socket().bind(sa); ssc.configureBlocking(false); ssc.socket().accept();   the ServerSocket.accept() method throws java.nio.channels.IllegalBlockingModeException. Why can't I call accept(), even though I set blocking to false?
104784
I've seen a couple other questions with this error message but it seemed that the host and ip in question were ones the OP knew. These two are unrelated to my server.  Where and why is postfix generating this error?     Jul 24 17:42:14 email postfix/smtpd[32277]: warning: hostname kimtake.respectedopinion.com does not resolve to address 62.210.28.114   Jul 24 17:42:14 email postfix/smtpd[32277]: connect from unknown[62.210.28.114]   Jul 24 17:42:14 email postfix/smtpd[32277]: disconnect from unknown[62.210.28.114]
7540
I know that the ip tool lets you bind multiple addresses to an interface (eg, ). Right now, though, I'm trying to build something on top of IPv6, and it would be really useful to have an entire block of addresses (say, a /64) available, so that programs could pick any address from the range and bind to that. Needless to say, attaching every IP from this range to an interface would take a while.  Does Linux support binding a whole block of addresses to an interface?
121600
so I'm having a client in my network connected to the router through my computer with arpspoof. When I know want to stop the packet forwarding I execute:  iptables -A FORWARD -j REJECT   that is working how I expected. But when I try to do something like:  iptables -A FORWARD -j ACCEPT   I cannot manage to make the packets go through like in the beginning.   Am I doing something wrong or are there any other arguments I should use different from "ACCEPT"?
54816
I am on Ubuntu 12.04, and the ip utility does not have ip netns identify &lt;pid&gt; option, I tried installing new iproute, but still, the option identify doesn't  seem to be working!.  If I were to write a script (or code) to list all processes in a network-namespace, or given a PID, show which network-namespace it belongs to, how should I proceed ? (I need info on a handful of processes, to check if they are in the right netns)
50895
This is quite messed up, I know. Let me explain it all.  I have a dynamic DNS set on my router. I verified that, after port forwarding, I can connect to desired application (if I run something on port 1337 and forward the port to appropriate machine I can connect to it from outside with no issues).  Now, if I connect my Macbook to VPN and run something as described above, it works as expected. BUT, if I connect my machine running Ubuntu Server 16.04 to the VPN and run something or want to connect by ssh, it fails. I forwarded port I'm using for SSH connection on router. I also tried hosting a web server, which also failed.  What can I do about this issue? This doesn't make sense to me.  About Ubuntu Server machine: it's a clean install with openvpn client and ssh server configured, no firewall running, iptables not edited, connected to router via ethernet.  EDIT: Here are the routing tables: