New answers tagged

1

PREROUTING chain only available for nat, mangle and raw tables. iptables assumes filter table, so you must specify one of these, eg. iptables -t nat ...


5

Because PREROUTING chain belongs to the NAT table, not the FILTER table. If you do not mention any table explicitly by -t option, then FILTER is assumed. So, you need to mention the table type with -t nat: sudo iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-ports 8443 Note that, MANGLE and RAW tables also have PREROUTING chain but as ...


0

Rule 1 in chain ufw-before-output has the additional condition of being only for the local interface (lo). The two packets that hit the ufw-user-output chain DROP rule would not have been destined for the local interface. They were also probably new tcp connection syn packets and therefore did not satisfy the RELATED,ESTABLISHED rule.


1

This is my setup sudo ufw default deny outgoing sudo ufw default deny incoming sudo ufw allow 993 sudo ufw allow 6969 sudo ufw allow out 53 sudo ufw allow out http sudo ufw allow out https sudo ufw allow out 465 sudo ufw allow out 587 sudo ufw allow out 993 This works well with Ubuntu 16.04: Everything works properly sudo ufw status numbered ...


0

I think iptables would do something for you. First, activate packet forwarding: $ echo 1 > /proc/sys/net/ipv4/ip_forward Redirect your traffic from 50.60.70.80:105 to 10.8.0.105:80 $ iptables -t nat -A PREROUTING -d 50.60.70.80 -p tcp --dport 105 -j DNAT --to-destination 10.8.0.105:80 Make the Iptables marquerade the requisition: $ iptables -t ...


1

If you are asking if you add an iptable rule as root do affect other users, then YES. Iptables are kernel thing so it is the lower level of rules. For example if you are using firewall like CSF and you ban/drop/deny specific ip, the program (CSF) will just translate your ban to an iptables rule and the kernel will start to drop packages from that IP.


0

edit /etc/sysctl.conf and uncomment: # net.ipv4.ip_forward=1 And the iptables part should look something like below, where eth0 is internet and eth1 is LAN: iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE iptables -A FORWARD -i eth1 -o eth0 -m state -–state RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT If you have 2 ...


1

I experienced the same problem, but on Debian 8.4 (Jessie). Like the above, the solution was the IPTables flush script as listed at http://insanelabs.net/linux/linux-reset-iptables-firewall-rules/. Though iptables reported no rules, there must have been some "hidden" rules, or otherwise a bug in iptables itself. I am reporting this bug to the Debian ...


1

The problem was that rsyslog was loading the 50-default.conf preferences before the custom preferences set in my_iptables.conf. The solution was to add a number prefix to the conf filename, one that was lower than 50. So I renamed it to 10-my_iptables.conf. File /etc/rsyslog.d/10-my_iptables.conf # Log kernel generated iptables log messages to file :msg,...


1

Thanks for all your help. I didn't find the answer exactly, but I believe the cause was that I had copied over some ufw rules from my old ubuntu 14 install, which are located in /lib/ufw. Seems the ufw on ubuntu 16 did not like this, even after I deleted them. Reinstalling solved the issue.


1

Have you tried this command? sudo ufw default allow outgoing


0

In order to redirect from ip1:port to ip2:port you will need some software in addition to iptables. First you should make sure that iptables properly routes from one port to the new port. You can review the accepted answer in this question to modify the page that is displayed. Generally this is index.html by default. http://stackoverflow.com/questions/...


0

you can also try a SAAS solution for managing iptables -> https://www.efw.io/Forum it can do AWS cloud integration also.


0

I would suggest installing a firewall builder like shorewall or ufw. Only allow incoming traffic on the ports required for the services you want to provide. These tools will help ensure you allow critical traffic like DNS and certain ICMP types, while blocking things that need to be blocked. They should also log appropriate traffic. fail2ban does work ...


0

I don't think there's anything wrong with the syntax of your command (either of the ufw command itself, or the bash loop - although it would be good practice to quote the $line variable i.e. ... from "$line" to any ...). The ERROR: Bad source address error indicates a problem with the address string itself, and we can guess that it might be due to DOS-style ...


0

Try with this. Create iptables.sh and put in /root/ Give x permission chmod +x /root/iptables.sh Edit /etc/rc.local to trigger script on reboot sudo nano /etc/rc.local add at the end of file sh /root/iptables.sh Script #!/bin/bash #echo service iptables stop | at now + 3 min ################################################# # clear existing ...


0

I believe these rules will help # Drop everything iptables -P INPUT DROP # Allow certain ports iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT iptables -A INPUT -i eth0 -p tcp --dport 33332 -j ACCEPT iptables -A INPUT -i eth0 -p tcp --dport 35060 -j ACCEPT iptables -A INPUT -p udp -m udp --dport 10000:20000 -j ACCEPT # Disable ICMP iptables -I ...


0

Re-read man ufw. There are two, similar, ufw invocations that you're confusing: ufw [--dry-run] [delete] [insert NUM] allow|deny|reject|limit [in|out] [log|log-all] PORT[/PROTOCOL] ufw [--dry-run] [rule] [delete] [insert NUM] allow|deny|reject|limit [in|out [on INTERFACE]] [log|log-all] [proto PROTOCOL] [from ADDRESS [port PORT]] [to ADDRESS [port ...


1

Blocking all IP's except 1 or 2: sudo /sbin/iptables -I INPUT -j DROP sudo /sbin/iptables -I INPUT -s xxx.xxx.x.xxx -j ACCEPT sudo /sbin/iptables -I INPUT -s xxx.xxx.x.yyy -j ACCEPT The first command blocks all IP's; the second and third tell the computer to accept connections from specific IP's. If you want to make these changes permanent, after running ...



Top 50 recent answers are included