I have the following NAT setup:  +--------------+       +-----------------------+     +-------------------+ |              |       |                       |     |                   | |              |       |                       |     |                   | |    PC 1      |       |    PC 2 (NAT)         |     |     PC 3          | |  10.0.0.3    +-------+                       +-----+  10.0.0.4         | |              |       |                       |     |  (NAT 172.24.4.2) | |              |       |                       |     |                   | +--------------+       +-----------------------+     +-------------------+   Whereas PC2 will do a NAT such that 10.0.0.4 will be translated to 172.24.4.2 during prerouting:  -A PREROUTING -d 172.24.4.2/32 -j DNAT --to-destination 10.0.0.4   When I try to ping from PC1 to PC3 with destination IP 172.24.4.2. Some how the packet is not doing any DNAT for me.  Here is what I capture on PC3:  10:15:41.017632 IP 10.0.0.3 &gt; 172.24.4.2: ICMP echo request, id 8705, seq 0, length 64   It works fine if I change PC3 IP to a different subnet.  Does anyone know why?
3129
I would like do some NAT in iptables. So that, all the packets coming to 192.168.12.87 and port 80 will be forwarded to 192.168.12.77 port 80.  How to do this with iptables?  Or   Any other ways to achieve the same?
120264
I got this packet captured with tcpdump but I'm not sure how to use the --hex-string param to match the packet. Can someone show me how to do it?  11:18:26.614537 IP (tos 0x0, ttl 17, id 19245, offset 0, flags [DF], proto UDP (17), length 37)     x.x.187.207.1234 &gt; x.x.152.202.6543: [no cksum] UDP, length 9         0x0000:  f46d 0425 b202 000a b853 22cc 0800 4500  .m.%.....S"...E.         0x0010:  0025 4b2d 4000 1111 0442 5ebe bbcf 6701  .%K-@....B^...g.         0x0020:  98ca 697d 6989 0011 0000 ffff ffff 5630  ..i}i.........V0         0x0030:  3230 3300 0000 0000 0000 0000            203.........
56660
I have purchased  a while back when I was connecting to my first ISP via ADSL.  Now, I have changed the ISP to a cable company and am having trouble setting up the router to connect to the new cable modem.  The Internet works, but only in bridge mode, i.e. my PC gets a public IP, and isn't part of the 192.168.1.0 network (and can't be accessed by other PCs in the network) which is what I want - I want the router to have the NAT and the clients behind it to have access to the Internet, but with 192.168.1.0 addresses.  The setup is pretty simple - from cable modem one network cable to router, from router another network cable to PC.  When I configure the router to use Encapsulation - Bridged (VC Mux), my PC gets the public IP and the Internet works. When I configure it to use a routed connection (either LLC or VC Mux) I do get the local IP but no Internet (regardless of the NAT setting)  The router also has diagnostics, status, ping etc, but nothing I change in the PVC settings enables the Internet.  Is what I'm trying even possible? If so, how can I do it? What am I missing?
57291
I'm trying to make my client forward all traffic through a VPS running OpenVPN. As you can see, it will allow pings to both domains and raw IP addresses, but it will not allow traffic like that made through curl and traceroute doesn't come up with anything. The traffic works correctly when not connected to the VPN.   All information is here:   Thank you.  Working configs thanks to solution below:  Server:  port &lt;integer&gt; proto udp dev tun ca ca.crt cert vpnserver.crt key vpnserver.key  # This file should be kept secret dh dh4096.pem tls-auth ta.key 0 server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "redirect-gateway autolocal" push "dhcp-option DNS 8.8.8.8" push "dhcp-option DNS 8.8.4.4" keepalive 10 120 cipher AES-256-CBC comp-lzo user nobody group nogroup persist-key persist-tun status openvpn-status.log verb 3   Client:  client dev tun proto udp remote x.x.x.x &lt;port number&gt; resolv-retry infinite nobind persist-key persist-tun ca ca.crt cert vpnclient.crt key vpnclient.key tls-auth ta.key 1 ns-cert-type server cipher AES-256-CBC comp-lzo verb 3
54418
I have a web service running on debian 7 and listening on port 8080. I want to redirect 80 to 8080 for inbound connections and allow only port 80. Here is my iptables configuration:  root@localhost:~# iptables -v -L --line-numbers Chain INPUT (policy DROP 76 packets, 6266 bytes) num   pkts bytes target     prot opt in     out     source               destination          1       90  8898 ACCEPT     all  --  lo     any     anywhere             anywhere             2        0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere             tcp dpt:http 3     4515 3113K ACCEPT     all  --  any    any     anywhere             anywhere             state RELATED,ESTABLISHED  Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) num   pkts bytes target     prot opt in     out     source               destination           Chain OUTPUT (policy ACCEPT 4858 packets, 587K bytes) num   pkts bytes target     prot opt in     out     source               destination        and nat table:  root@localhost:~# iptables -L -n -v -t nat Chain PREROUTING (policy ACCEPT 14 packets, 2288 bytes)  pkts bytes target     prot opt in     out     source               destination              0     0 REDIRECT   tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80 redir ports 8080     0     0 REDIRECT   udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:80 redir ports 8080  Chain INPUT (policy ACCEPT 0 packets, 0 bytes)  pkts bytes target     prot opt in     out     source               destination           Chain OUTPUT (policy ACCEPT 841 packets, 53415 bytes)  pkts bytes target     prot opt in     out     source               destination           Chain POSTROUTING (policy ACCEPT 841 packets, 53415 bytes)  pkts bytes target     prot opt in     out     source               destination    i can't establish a connection from outside on port 80. What are likely deficiencies?
53906
I have a firewall with these simple rules:  iptables -A INPUT -p tcp -s 127.0.0.1/32 --dport 6000 -j ACCEPT iptables -A INPUT -p tcp -s 192.168.16.20/32 --dport 6000 -j ACCEPT iptables -A INPUT -p tcp --dport 6000 -j REJECT   Now, suppose I am using TCPDUMP like this:  tcpdump port 6000   And I have host 192.168.16.21 trying to connect to port 6000.  Will/should tcpdump output some packets coming from 192.168.16.21?
21805
According to everything I read, the entire 127.x.x.x subnet should loopback.  However, on my Mac, I can only ping 127.0.0.1  I know I've done this before (though possibly on another OS) and has come in very useful for developing multiple SSL sites locally and for tunneling remote services for access on a local IP (for example I could ssh into my MySQL server, and just port forward the standard port to the same port on my local machine but on 127.0.0.2 while my local server ran at 127.0.0.1.
82477
I have two internet connections from two different ISPs and I need to balance the traffic originating to and from my network between the two ISPs. I am using Debian GNU/Linux.  My set-up is like this -  eth0 (192.168.0.0/24) -- Local network  eth1 (192.168.1.0/24) -- ISP #1  eth2 (192.168.2.0/24) -- ISP #2  My local network is connected to this server via eth0 and the box is the DHCP server cum Gateway for all the machines in the LAN.  The server needs to do load-balancing between the two ISPs and also needs to do NAT-ing.  I have followed the routing instructions on  but I still need instructions to do the NAT-ing properly.  Any help will be appreciated.   PS - I know about pFsense but I need to use Linux.
27568
When running netstat -a on my local machine, i see ports on the 0.0.0.0 address listening.    I would assume that 0.0.0.0 is my local machine, except that i also see 127.0.0.1 listening to specific ports.  What is the 0.0.0.0 address?  What is the difference between 0.0.0.0 and 127.0.0.1?  Below is an example of the output:  Proto  Local Address          Foreign Address        State TCP    0.0.0.0:445            MyComputer1:0          LISTENING TCP    0.0.0.0:49156          MyComputer1:0          LISTENING TCP    0.0.0.0:49157          MyComputer1:0          LISTENING TCP    127.0.0.1:6999         MyComputer1:0          LISTENING TCP    127.0.0.1:6999         MyComputer1:49801      ESTABLISHED TCP    127.0.0.1:6999         MyComputer1:57172      TIME_WAIT
40637
I have found that ping google.com from my Windows 7 box has stopped working.  Below is the output - note that the IPv4 ping works, and Yahoo works. Is my local router at fault here?  C:\Users\Jeff&gt;ping google.com  Pinging google.com [2001:4860:4007:801::1007] with 32 bytes of data: Destination net unreachable. Destination net unreachable. Destination net unreachable. Destination net unreachable.  Ping statistics for 2001:4860:4007:801::1007:     Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),  C:\Users\Jeff&gt;ping -4 google.com  Pinging google.com [74.125.224.206] with 32 bytes of data: Reply from 74.125.224.206: bytes=32 time=5ms TTL=55 Reply from 74.125.224.206: bytes=32 time=5ms TTL=55  Ping statistics for 74.125.224.206:     Packets: Sent = 2, Received = 2, Lost = 0 (0% loss), Approximate round trip times in milli-seconds:     Minimum = 5ms, Maximum = 5ms, Average = 5ms Control-C ^C C:\Users\Jeff&gt;ping yahoo.com  Pinging yahoo.com [98.139.183.24] with 32 bytes of data: Reply from 98.139.183.24: bytes=32 time=98ms TTL=46 Reply from 98.139.183.24: bytes=32 time=86ms TTL=46  Ping statistics for 98.139.183.24:     Packets: Sent = 2, Received = 2, Lost = 0 (0% loss), Approximate round trip times in milli-seconds:     Minimum = 86ms, Maximum = 98ms, Average = 92ms Control-C  C:\Users\Jeff&gt;ping -6 google.com  Pinging google.com [2001:4860:4007:801::1005] with 32 bytes of data: Destination net unreachable. Destination net unreachable. Destination net unreachable.  C:\Users\Jeff&gt;tracert google.com  Tracing route to google.com [2001:4860:4007:801::1008] over a maximum of 30 hops:    1  Destination net unreachable.  Trace complete.
48356
I have two Ethernet interface being configured to use as system gateway ex:    eth1: 10.10.1.0 eth2: 10.10.2.0   I want to forward all the packets which are coming to the 10.10.2.0 gateway contacting 10.10.1.x via eth1 (10.10.1.0), and the reverse as packets coming to 10.10.1.x, contacting 10.10.2.0 machines via eth2.    How can I write iptables rules for this?
119472
Part of a firewall on a server :  iptables -A INPUT -p tcp --dport 22 -m state NEW --state -m recent --set  iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 100 --hitcount 10 -j DROP   When I search online I always see NEW being used in that rule but I'm having a hard time understanding why ESTABLISHED and RELATED aren't being used.  Like this :  iptables -A INPUT -p tcp --dport 22 -m state NEW,ESTABLISHED,RELATED --state -m recent --set  iptables -A INPUT -p tcp --dport 22 -m state --state NEW,ESTABLISHED,RELATED -m recent --update --seconds 100 --hitcount 10 -j DROP   Can someone explain to me when exactly a NEW packet changes into ESTABLISHED and RELATED ?
44086
I've noticed an IP address today on my network (192.168.15.1) which when visited actually goes to a page that has a router webconfig page (Not my router)  The puzzling thing is that i tried traceroute 192.168.15.1 which said that the distance between me and that host is 9 hops, whereas the distance between me and any other computer on my home network is 2 hops away (My computer --> Router --> Host)   Can someone please explain what's going on here ?  tracert output:  Tracing route to 192.168.15.1 over a maximum of 30 hops    1    &lt;1 ms    &lt;1 ms    &lt;1 ms  192.168.1.1   2    47 ms    51 ms    49 ms  [163.121.171.123]   3     *        *        *     Request timed out.   4   128 ms     *        *     163.121.211.134.dnet.net [163.121.211.134 ]   5     *      134 ms   126 ms  10.37.242.18   6    94 ms    90 ms    95 ms  10.35.2.157   7   178 ms   254 ms   206 ms  10.32.8.107   8    85 ms    57 ms   318 ms  10.35.0.186   9   215 ms   241 ms   230 ms  192.168.15.1  Trace complete.
77844
I have been told that we have two devices on a network:  10.40.225.142 and 10.40.225.144  These devices both have   Gateway 10.40.225.129  Subnet mask 225.225.225.128 (note 225 is Not a typo)   These are communication intermittently with a server 10.40.224.156  So my question is: Is that a valid subnet? I have only ever seen 255 or 0 in the first one - three octets.
59766
I'm trying to verify that a couple of our servers can communicate via certain ports before migrating some of our services to them, and that they're not blocked by our organizations firewall ACLs.  Makes Sense  [mrduki@mybox1~]$ nc -ul 40000 --- [mrduki@mybox2~]$ nc -zvuw2 mybox1.com 40000 Connection to mybox1.com 40000 port [udp/*] succeeded!   Doesn't Make Sense  [mrduki@mybox1~]$ nc -ul 40000 [mrduki@mybox1~]$ ^C --- [mrduki@mybox2~]$ nc -zvuw2 mybox1.com 40000 Connection to mybox1.com 40000 port [udp/*] succeeded!   In fact, if I do a port scan from 40000-40100, every single port succeeds.   If I do the same tests without -u (so that it tests TCP instead of UDP), I get 40000 (tcp) timed out: Operation now in progress errors, as I would expect (since I have no such TCP service listening on 40000).  Doing a sudo netstat -alnp | grep LISTEN on mybox1 though shows no such services listening on these ports. So what am I missing?
11796
Sometimes I need to send my traffic to a proxy, sometimes I don't.  Currently, I have to go to the settings every time to click it.  Is there any simple way for me to switch this? For instance, use a shell command to do this.
89812
I am wondering what is the difference between:  # ifconfig eth0:0 1.1.1.1/24   and just  # ip addr add 1.1.1.1/24 dev eth0   Btw I cannot do  # ip addr add 1.1.1.1/24 dev eth0:0 RTNETLINK answers: File exists   In ip addr show it appears differently :  eth0: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc pfifo_fast state UP qlen 1000  link/ether 8c:ae:4c:fe:1f:75 brd ff:ff:ff:ff:ff:ff inet 1.1.1.1/24 brd 1.1.1.255 scope global eth0:0 ---&gt; with ifconfig inet 2.2.2.2/24 scope global eth0 ----&gt; with ip   When should I prefer the first way and when should I prefer the second way? It seems more cool to