Differences between revisions 3 and 11 (spanning 8 versions)
Revision 3 as of 2009-12-16 19:07:29
Size: 2108
Editor: PieterSmit
Comment:
Revision 11 as of 2015-07-01 21:14:02
Size: 3436
Editor: PieterSmit
Comment: route_localnet
Deletions are marked like this. Additions are marked like this.
Line 10: Line 10:
== 2015 Problem redirecting traffic from outside interface to vnc service listening on localhost:127.0.0.1 ==
 * http://wiki.clover.co.za/FrontPage?action=fullsearch&context=180&value=iptables&titlesearch=Titles
 * http://serverfault.com/questions/551361/redirect-incoming-packets-to-loopback
 * http://serverfault.com/questions/504389/how-to-configure-port-forwarding-to-enable-internal-service-accessed-by-another?rq=1
 * http://serverfault.com/questions/149929/how-to-configure-traffic-from-a-specific-ip-hardcoded-to-an-ip-to-forward-to-ano?rq=1
 * Possible answer:
   * http://serverfault.com/questions/283409/how-to-use-iptables-to-forward-requests-to-a-jboss-server-running-on-a-different/285247#285247
   * #echo 1 > /proc/sys/net/ipv4/ip_forward
   * in /etc/sysctl.conf: net.ipv4.ip_forward = 1
 * Sollutions, linux does not allow routing of traffic to 127.0.0.1/8 subnet by default, have to enable per interface
   {{{
cat /proc/sys/net/ipv4/conf/eth0/route_localnet
   }}}
Line 11: Line 24:
== Interesting modules == == Interesting modules 2010 ==
Line 16: Line 29:
              iptables -A INPUT -s 192.168.0.0/16 -m comment --comment "A pri
              
vatized IP block"
              iptables -A INPUT -s 192.168.0.0/16 -m comment --comment "A privatized IP block"
Line 46: Line 58:
== Common Problems and solutions ==
 * Multi-interface setup ignoring/dropping packets on certain interfaces
   * Caused by reverse path filtering.
     * Fix: {{{
       # Enables source route verification
       net.ipv4.conf.default.rp_filter = 2
       # Enable reverse path
       net.ipv4.conf.all.rp_filter = 2
       }}}

IPTABLES

2015 Problem redirecting traffic from outside interface to vnc service listening on localhost:127.0.0.1

Interesting modules 2010

  1. comment - Allows you to add comments (up to 256 characters) to any rule.
    •        --comment comment
             Example:
                    iptables -A INPUT -s 192.168.0.0/16 -m comment --comment "A privatized IP block"
  2. connlimit
    • Allows you to restrict the number of parallel connections to a server per client IP address (or client address block).
  3. rateest
    • The rate estimator can match on estimated rates as collected by the RATEEST target. It supports matching on absolute bps/pps values, com‐ paring two rate estimators and matching on the difference between two rate estimators.
  4. recent
    • Allows you to dynamically create a list of IP addresses and then match against that list in a few different ways. For example, you can create a "badguy" list out of people attempting to connect to port 139 on your firewall and then DROP all future packets from them without considering them.
  5. time
    • This matches if the packet arrival time/date is within a given range. All options are optional, but are ANDed when specified.
  6. TRACE
    • This target marks packes so that the kernel will log every rule which match the packets as those traverse the tables, chains, rules. (The ipt_LOG or ip6t_LOG module is required for the logging.) The packets are logged with the string prefix: "TRACE: tablename:chain‐ name:type:rulenum " where type can be "rule" for plain rule, "return" for implicit rule at the end of a user defined chain and "policy" for the policy of the built in chains. It can only be used in the raw table.

Common Problems and solutions

  • Multi-interface setup ignoring/dropping packets on certain interfaces
    • Caused by reverse path filtering.
      • Fix:

               # Enables source route verification
               net.ipv4.conf.default.rp_filter = 2
               # Enable reverse path
               net.ipv4.conf.all.rp_filter = 2

...


CategoryLinux

linux/iptables (last edited 2015-07-02 13:17:21 by PieterSmit)