Is iptables a service running with ufw or can i run it as standalone without ufw.In the result of sudo iptables -L there are chains of ufw also,so what is the difference between the input,output and forward chains of iptables and chains of ufw .Is there any good material online for this .Please help..
120893
On my Ubuntu computer I have Iptables,ufw and gufw installed on it but I am trying to figure out if I need to remove one so I did a experiment and removed iptables and I saw ufw and gufw was removed automatically with iptables I reintall iptables and it did not  automatically came with ufw or gufw I install gufw without installing ufw and ufw was install automatically with gufw It like there are all connected to function properly but that just a experiment I went a true answer?
55920
I want my iptables rules to automatically be loaded on startup. According to the wiki on Debian this can be done by placing a script with the name iptables in /etc/network/if-pre-up.d/ So I did, this is what it looks like:  cat /etc/network/if-pre-up.d/iptables  #!/bin/sh /sbin/iptables-restore &lt; /etc/firewall/iptables.rules /sbin/ip6tables-restore &lt; /etc/firewall/ip6tables.rules   This script works: if I run it as root my firewall rules get applied. But on reboot there are no firewall rules. What am I doing wrong?  On request: the /etc/network/interfaces (I did not touch this file)  user@DebianVPS:~$ cat /etc/network/interfaces  # This file describes the network interfaces available on your system # and how to activate them. For more information, see interfaces(5).  # The loopback network interface auto lo iface lo inet loopback  # The primary network interface allow-hotplug eth0 iface eth0 inet dhcp
43687
If I enter for example "block 59.164.0.0/20" as a firewall rule.  Does that mean it blocks the IPs 59.164.0.0 to 59.164.0.20 or does it mean something else ?
78468
I am running sendmail + dovecot in my Debian server. I have enabled the firewall rules to allow everything:   iptables -P INPUT ACCEPT   iptables -P OUTPUT ACCEPT   iptables -P FORWARD ACCEPT   iptables -F   iptables -X  However after a quick check at yougetsignal.com, my port 25 is still being blocked. But 143, 80 are okay.
9555
My web server (Ubuntu, Nginx) have both IPv4 and IPv6 addresses assigned by the host. For my website, shall I bind it to only an IPv6 address? Is it the standard recommended way? Or, shall I use both IPv4 and IPv6 addresses?
108325
I know linux has 3 built-in tables and each of them has its own chains as follow:  FILTER: PREROUTING, FORWARD, POSTROUTING  NAT: PREROUTING, INPUT, OUTPUT, POSTROUTING  MANGLE: PREROUTING, INPUT, FORWARD, OUTPUT, POSTROUTING  But I can't understand how they are traversed, in which order, if there is. For example, how are they traversed when:   I send a packet to a pc in my same local network when I send a packet to a pc in a different network when a gateway receives a packet and it has to forward it when I receive a packet destinated to me any other case (if any)
119472
Part of a firewall on a server :  iptables -A INPUT -p tcp --dport 22 -m state NEW --state -m recent --set  iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 100 --hitcount 10 -j DROP   When I search online I always see NEW being used in that rule but I'm having a hard time understanding why ESTABLISHED and RELATED aren't being used.  Like this :  iptables -A INPUT -p tcp --dport 22 -m state NEW,ESTABLISHED,RELATED --state -m recent --set  iptables -A INPUT -p tcp --dport 22 -m state --state NEW,ESTABLISHED,RELATED -m recent --update --seconds 100 --hitcount 10 -j DROP   Can someone explain to me when exactly a NEW packet changes into ESTABLISHED and RELATED ?
100031
I have a little VPS I run apache and a Minecraft server on. I don't ever turn it off, but should I restart it for some reason, IPTables blocks most of my ports, including port 80. I've tried so many different suggestions on fixing this, but with no luck. Also, since the provider is OVH, the support is... lacking.  So, I've created a workaround, which I'm happy with. I created a simple shell script file to open certain ports I need opened on restart (80 and 25565 for now). The important ones such as 21 and 22 are not affected on restart.   The script looks like this:  iptables -I INPUT -p tcp --dport 80 -j ACCEPT iptables -I INPUT -p udp --dport 80 -j ACCEPT iptables -I INPUT -p tcp --dport 25565 -j ACCEPT iptables -I INPUT -p udp --dport 25565 -j ACCEPT /sbin/service iptables save   When I manually run it by typing /iptdef.sh, it runs fine, the ports become open and it's all good.  Of course, it's not practical having to remember to run it every time I restart the server, so I added a crontab. The problem is, it doesn't work/run. This is my crontab file:  */5 * * * * /backup2.sh */55 * * * * /backup3.sh @reboot /iptdef.sh * * * * *  /iptdef.sh   The first two lines work. They are just simple scripts that make a backup of a folder for me. The second two lines are what's not working.   Is there a chance that perhaps it's not possible to run iptables commands from a cron? It sounds silly, but I can't see any other reason for it not to work. The scripts have the correct permissions.
18497
I want to limit 1 connect per 5 seconds using IPTABLES for people, which are connecting to port "12871/12881". I was trying to find rule for it, but ineffectively. It must be like a "queue" of connects - for example 1 connect per 5 seconds.  I had here discussion:   but Im not able to reply on this account, previous was unregistered and logged me out.
93122
I just switched from Windows 8 to Ubuntu 13.04. I installed UFW GUI interface for the firewall. In the listening report it shows the something called dhclient and avahi-daemon running in a few ports.  I google both, but could not find a clear answer on if I need them and if not how do I turn them off. The only things I use my home computer for is the internet (Midori browser), steam and arduino.  Any help would be appreciate.
31011
My iptables DNAT rules don't work until reboot. If I reboot my server, all of the rules work.  Desciption of the architecture :  Tens of hosts (senders) send some UDP packets (one-way on a specific port 9999) to my Linux router. This Linux router use iptables to forward those packets to several hosts (receivers).  senderX 10.0.0.X  ====> Linux router with iptables ====> receiverY 10.0.1.Y  The linux router have two network cards eth1 10.0.0.1/24 (senders side) and eth0 10.0.1.1/24 (receivers side).  Iptables setup :   ip_forwarding is activated all of the default policies are set to ACCEPT one iptables rules exist per sender, here is an example :    iptables -t nat -A PREROUTING -s 10.0.0.2 -i eth1 -j DNAT --to-destination 10.0.1.123   Network setup :  ip addr show :  1: lo: &lt;LOOPBACK,UP,LOWER_UP&gt; mtu 16436 qdisc noqueue state UNKNOWN     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00     inet 127.0.0.1/8 scope host lo     inet6 ::1/128 scope host        valid_lft forever preferred_lft forever 2: eth0: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc mq state UP qlen 1000     link/ether 54:9f:35:0a:16:38 brd ff:ff:ff:ff:ff:ff     inet 10.0.1.1/24 brd 10.0.1.255 scope global eth0     inet6 fe80::569f:35ff:fe0a:1638/64 scope link        valid_lft forever preferred_lft forever 3: eth1: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc mq state UP qlen 1000     link/ether 54:9f:35:0a:16:3a brd ff:ff:ff:ff:ff:ff     inet 10.0.0.1/24 brd 10.0.0.255 scope global eth1     inet6 fe80::569f:35ff:fe0a:163a/64 scope link        valid_lft forever preferred_lft forever   Symptom :  After adding a set of rules, some of the rules doesn't work. And I can see with tcpdump that UDP packets are no more routed and packets are rejected.  tcpdump -n -i eth1 host 10.0.0.2 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth1, link-type EN10MB (Ethernet), capture size 65535 bytes 16:12:58.241225 IP 10.0.0.2.56859 &gt; 10.0.0.1.9999: UDP, length 1464 16:12:58.241285 IP 10.0.0.1 &gt; 10.0.0.2: ICMP 10.0.0.1 udp port 9999 unreachable, length 556    If I flush all the rules and reinject them in iptables, rules that was not working still not work. If I reboot my server all the rules work fine.   Analysis done :  I have added a rule to log a specific sender which is not working :  iptables -t nat -A PREROUTING -s 10.0.0.2 -i eth1 -j LOG --log-prefix='PREROUTING LOG :'   But this rule doesn't log anything. Packets are coming because I see those in tcpdump but they are not logged. Also with the -v option in iptables, I don't see counters increasing for this rule.  If I apply the same rule before it stop working, I have some logs.  Question :   Is there any limits on UDP forwarding in iptables ? How I can troubleshoot this issue ?
10919
I'm sure this is very noobish, so forgive me. I'm trying to run a node.js server on port 8080 of my ubuntu 10.04.  Here's the result of iptables -L on the server:  Chain INPUT (policy ACCEPT) target     prot opt source               destination           Chain FORWARD (policy ACCEPT) target     prot opt source               destination           Chain OUTPUT (policy ACCEPT) target     prot opt source               destination   And here's the result of nmap -p 8080 (edited the ip address because everything is or should be wide open)  nmap 173.203.xxx.xxx -p 8080 -A  Starting Nmap 5.00 ( http://nmap.org ) at 2011-05-19 22:52 PDT Interesting ports on xxx (173.203.xxx.xxx): PORT     STATE  SERVICE    VERSION 8080/tcp closed http-proxy   Why on earth is 8080 seen as closed? Adding this did not help:  iptables -A OUTPUT -p tcp  --dport 8080 -j ACCEPT iptables -A INPUT -p tcp  --dport 8080 -j ACCEPT   I'm really confused.  I'll add this, in case it helps, but I don't know   netstat -pan | grep 80 tcp        0      0 127.0.0.1:8080          0.0.0.0:*               LISTEN          16785/node       tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      16471/apache2   I can access my regular website running off of port 80 on apache, but the node.js server is inaccessible from outside. Accessing it from the server itself works fine.  So my question is: how would I go about debugging this? Could there be something else than iptables blocking some ports? How do I find out what it is?  Any help much appreciated!
33864
I am trying to use iptables but I am clueless in understanding the documentation even so that I've locked myself out of my server twice already whilst trying to implement it.  These are the simple rules that I want to implement:   Allow ports 80, 6667 and 6697 to everyone Allow port 22 to just my IP for example 10.10.10.10   Please can someone help me implement these simple rules, without locking myself out?
23446
How could I filter a single IP address or a range of IP addresses to prevent them from accessing my computer?  Examples:   Block 31.13.76.102 Block from 216.58.192.0 to 216.58.223.255 Block from 173.194.0.0 to 173.194.255.255 Block from 74.125.136.0 to 74.125.136.255   I would like to block them from accessing my computer without additionnal conditions.  I know that one can use iptables in this situation, but I am unaware of the exact syntax, how to make the changes permanent, and which command to run in order to launch the iptables service at startup. I also don't want to make mistakes that may break my access to the Internet.
112962
How I can allow only my own ip to login for my ubuntu server ? Yesterday got 1500 unwanted failed login attempts.  Allowing only my own IP, could be the most secure from hackers ? I use Postfix only for sending, so that wont need to allow any incoming connections.
52599
let's look at these two iptables rules which are often used to allow outgoing DNS:  iptables -A OUTPUT -p udp --sport 1024:65535 --dport 53     -m state --state NEW,ESTABLISHED -j ACCEPT  iptables -A INPUT -p udp --sport 53 --dport 1024:65535    -m state --state ESTABLISHED -j ACCEPT   My question is: How exactly should I understand the ESTABLISHED state in UDP? UDP is stateless.  Here is my intuition - I'd like to know, if or where this is incorrect:  The man page tells me this:     state   This module, when combined with connection tracking, allows access to the connection tracking state for this packet.    --state ...    So, iptables basically remembers the port number that was used for the outgoing packet (what else could it remember for a UDP packet?), and then allows the first incoming packet that is sent back within a short timeframe? An attacker would have to guess the port number (would that really be too hard?)  About avoiding conflicts:  The kernel keeps track of which ports are blocked (either by other services, or by previous outgoing UDP packets), so that these ports will not be used for new outgoing DNS packets within the timeframe? (What would happen, if I accidentally tried to start a service on that port within the timeframe - would that attempt be denied/blocked?)  Please find all errors in the above text :-) Thanks,  Chris
42844
I understand that any one connection (such as a non-p2p download) will use just one of the connections, but since most normal activity involves multiple connections at once, I can still in theory increase my overall bandwidth by sending some traffic over each connection.  See also the following similar questions, most of which are for windows:            Here's my partial self-answer:  You can use ipfw to direct outgoing traffic. For instance, if you want udp (such as most bittorrent traffic) to use one connection while everything else uses the other, make sure the general-use connection is above in the network control panel, then type:  ipfw add fwd ip.for.bittorrent.router udp from any to any out   at the command line. (Or use WaterRoof, the ipfw gui; then you don't need the "ipfw add" part.) Note that that's the router ip (typically similar to your ip but ending in .1).