Questions tagged [iptables]

iptables allow creation of rules to define packet filtering behavior. The most reliable way to provide an iptables ruleset in a question is with the output of (as root): iptables-save -c

According to Wikipedia:

iptables is a user space application program that allows a system administrator to configure the tables provided by the Linux kernel firewall (implemented as different Netfilter modules) and the chains and rules it stores. Different kernel modules and programs are currently used for different protocols; iptables applies to IPv4, ip6tables to IPv6, arptables to ARP, and ebtables for Ethernet frames.

Iptables requires elevated privileges to operate and must be executed by user root, otherwise it fails to function. On most Linux systems, iptables is installed as /usr/sbin/iptables and documented in its man page [2], which can be opened using man iptables when installed. It may also be found in /sbin/iptables, but since iptables is not an "essential binary", but more like a service, the preferred location remains /usr/sbin.

iptables is also commonly used to inclusively refer to the kernel-level components. x_tables is the name of the kernel module carrying the shared code portion used by all four modules that also provides the API used for extensions; subsequently, Xtables is more or less used to refer to the entire firewall (v4,v6,arp,eb) architecture.

2607 questions
182
votes
8 answers

Viewing all iptables rules

Is there a way to view iptables rules in a bit more detail? I recently added masquerade to a range of IPs: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE service iptables save service iptables restart Which has done what I want…
TheLovelySausage
  • 4,183
  • 9
  • 30
  • 49
110
votes
11 answers

Block network access of a process?

Is it possible to block the (outgoing) network access of a single process?
larkee
  • 1,203
  • 2
  • 9
  • 5
108
votes
2 answers

What is the difference between -m conntrack --ctstate and -m state --state

I'm reading this howto, and there's something like this: We can allow established sessions to receive traffic: $ sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT The above rule has no spaces either side of the comma in…
Mikhail Morfikov
  • 10,309
  • 19
  • 69
  • 104
88
votes
6 answers

Why do iptables rules disappear when restarting my Debian system?

I add this rule: sudo iptables -t nat -A OUTPUT -d a.b.c.d -p tcp \ --dport 1723 -j DNAT --to-destination a.b.c.d:10000 When restart computer rules are deleted. Why? What I can do to make the rules persist?
Jhonathan
  • 3,525
  • 4
  • 24
  • 23
77
votes
4 answers

Reply on same interface as incoming?

I have a system with two interfaces. Both interfaces are connected to the internet. One of them is set as the default route; a side effect of this is that if a packet comes in on the non-default-route interface, the reply is sent back through the…
Shawn J. Goff
  • 45,338
  • 25
  • 134
  • 145
66
votes
3 answers

iptables redirect outside requests to 127.0.0.1

I have a service running on 127.0.0.1 with port 2222. I need to forward all requests to 192.168.2.2:2222 (outside IP) only from subnet 192.168.1.0/24 to 127.0.0.1:2222. I'm trying to use this, but it's not working. $ iptables -t nat -I PREROUTING -p…
SimWhite
  • 785
  • 1
  • 7
  • 9
64
votes
3 answers

Difference between SNAT and Masquerade

I am confused what's the actual difference between SNAT and Masquerade? If I want to share my internet connection on local network, should I select SNAT or Masquerade?
Chankey Pathak
  • 1,833
  • 8
  • 27
  • 35
51
votes
4 answers

How to ensure SSH port is only open to a specific IP address?

This is my /etc/sysconfig/iptables: It has two ports open 80 apache and 22 for ssh. # Firewall configuration written by system-config-firewall # Manual customization of this file is not recommended. *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT…
user78337
51
votes
3 answers

Why are some ports reported by nmap filtered and not the others?

I'm scanning a server which should have a pretty simple firewall using iptables: by default everything is DROPped besides RELATED and ESTABLISHED packets. The only type of NEW packets allowed are TCP packets on port 22 and 80 and that's it (no HTTPS…
Cedric Martin
  • 2,777
  • 6
  • 28
  • 32
48
votes
2 answers

No route to host with nc but can ping

I'm trying to connect to port 25 with netcat from one virtual machine to another but It's telling me no route to host although i can ping. I do have my firewall default policy set to drop but I have an exception to accept traffic for port 25 on that…
Katz
  • 1,021
  • 5
  • 19
  • 36
47
votes
2 answers

What is the difference between OUTPUT and FORWARD chains in iptables?

CentOS 6.0 I'm studying iptables and am getting confused on the difference between FORWARD and OUTPUT chains. In my training documentation, it states: If you're appending to (-A) or deleting from (-D) a chain, you'll want to apply it to network…
Mike B
  • 8,769
  • 24
  • 70
  • 96
47
votes
1 answer

What -A INPUT -j REJECT --reject-with icmp-host-prohibited Iptables line does exactly?

I have been reading RedHat iptables documentation but can't figure out what does the following line do: ... -j REJECT --reject-with icmp-host-prohibited
David
  • 573
  • 1
  • 4
  • 5
46
votes
5 answers

Is there a way to find which iptables rule was responsible for dropping a packet?

I have a system that came with a firewall already in place. The firewall consists of over 1000 iptables rules. One of these rule is dropping packets I don't want dropped. (I know this because I did iptables-save followed by iptables -F and the…
Shawn J. Goff
  • 45,338
  • 25
  • 134
  • 145
39
votes
1 answer

Is it better to set -j REJECT or -j DROP in iptables?

There's an example of iptables rules on archlinux wiki: # Generated by iptables-save v1.4.18 on Sun Mar 17 14:21:12 2013 *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [0:0] :TCP - [0:0] :UDP - [0:0] -A INPUT -m conntrack --ctstate…
Mikhail Morfikov
  • 10,309
  • 19
  • 69
  • 104
38
votes
3 answers

Limit max connections per IP address and new connections per second with iptables

We have an Ubuntu 12.04 server with httpd on port 80 and we want to limit: the maximum connections per IP address to httpd to 10 the maximum new connections per second to httpd to 150 How can we do this with iptables?
evachristine
  • 2,603
  • 10
  • 39
  • 55
1
2 3
99 100