Tag Info

New answers tagged

0

If you've executed your rules they are already running and no reloading is necessary. In case where you have a configuration file but it hasn't been executed best way I've seen so far is to use iptables-apply (an iptables extension). iptables-apply -t 60 your_rules_file This will apply the rules for 60 seconds (10 by default) and revert them if you don't ...


1

Below is a guide I found on Airvpn forums. It was very helpful in understanding the same problem I had. In the following quick tutorial I will try to give you some guidance to get a simple setup (hopefully) working. This is only for general guidance. Adjust addresses, port numbers and protocols as needed. E.g. If your router is on a different IP-address ...


0

I Found the issue, the ethernet frame was bad (in the sense that dest mac address was not vEth0 mac address). I didn't realize tcpdump sniffs packets even before layer 2 processing.


1

the service command works on RedHat-based systems with iptables very well, even on Centos 7, which has adopted systemd. So if Debian-based systems don't consider iptables a service per se, it still might be thought of as one. And the command "service iptables restart" is actually very useful, especially when you want iptables to restore the 'default' rule ...


1

iptables does not know about interface aliasing and so you would only refer to eth0 and eth1 in any iptables rules. Assuming you have the default policy of ACCEPT for the FORWARD chain, and already have /proc/sys/net/ipv4/ip_forward set to 1, then all you should need is: sudo iptables -t nat -A PREROUTING -i eth0 -d 168.XXX.XXX.72 -j DNAT --to-destination ...


0

The command works for me. However, and since I never defined $OUTIF, I just entered what it is. I am saying I did this: sudo -i iptables --table nat --append POSTROUTING --out-interface eth0 --jump MASQUERADE


1

To place a rule at a specific spot in the rule set for a specific chain, give it a rule number. Meaning, instead of: sudo iptables -s 10.1.10.201 -j DROP which is missing both a chain (or table) designation and a rule number, do this: sudo iptables I INPUT 1 -s 10.1.10.201 -j DROP I just used INPUT as an example, you do whatever it is you are trying to ...


1

So why dont you use ufw ? Its so simple to implement firewall on ubuntu, to open port 80 on all your network card you only need - sudo ufw allow 80 - sudo ufw enable to make sure if your web server is running use netstat -nat it will display all service in all port


1

Specify the port using --dport: sudo iptables -A INPUT -s 10.10.10.10 --dport 80 -j DROP #http sudo iptables -A INPUT -s 10.10.10.10 --dport 21 -j DROP #ftp


0

The problem is not with your firewall but with your apache configuration. As, muru explained correctly, you can see by this line: tcp6 0 0 :::80 :::* LISTEN 19199/apache2 that apache is listening on both ipv4 and ipv6. Since you mentioned it is working from localhost I would suggest checking your ...


0

I don't fully understand your iptables listing, or how it came to be so. However, there does appear to be nat and mangle tables, and therefore it is entirely conceivable that your problem packets do not traverse the normal INPUT chain, but rather are directed through the iptables via another path at the prerouting stage (which would only be traversed once ...


0

Your attempt to ping "ipaddress" doesn't get out in the first place, as it gets dropped in the output chain. Try this: sudo iptables -F sudo iptables -A INPUT -i lo -j ACCEPT sudo iptables -A INPUT -s ipaddress -j ACCEPT sudo iptables -A INPUT -j DROP sudo iptables -A OUTPUT -d ipaddress -j ACCEPT sudo iptables -A OUTPUT -j DROP sudo iptables -A FORWARD -j ...


2

--source-port and -destination-port (and their short forms) are provided by the tcp extension (and some other extensions). Extensions are documented in the iptables-extensions man page.


0

How does your computer get its IP address? If it is via DHCP, then you need to allow UDP replies to port 68 (or from port 67, see later on): sudo iptables -A INPUT -p udp --sport 67 --dport 68 -m state --state RELATED,ESTABLISHED -j ACCEPT If your objective is to just allow website browsing, then the connection would always be initiated from your end so ...


0

Usually the iptables rules are loaded up by using iptables-restore on a specific file in /etc. So if you can figure out what that file is named, you can manually invoke iptables-save and write out your good rules to that file. Then on next boot it will use your modified rules instead of what used to be in there. I'm guessing the location is ...



Top 50 recent answers are included