Differences between revisions 11 and 12
⇤ ← Revision 11 as of 2015-07-01 21:14:02 →
Size: 3436
Editor: PieterSmit
Comment: route_localnet
← Revision 12 as of 2015-07-02 13:17:21 → ⇥
Size: 2868
Editor: PieterSmit
Comment:
Deletions are marked like this. Additions are marked like this.
Line 11: Line 11:
 * http://wiki.clover.co.za/FrontPage?action=fullsearch&context=180&value=iptables&titlesearch=Titles
 * http://serverfault.com/questions/551361/redirect-incoming-packets-to-loopback
 * http://serverfault.com/questions/504389/how-to-configure-port-forwarding-to-enable-internal-service-accessed-by-another?rq=1
 * http://serverfault.com/questions/149929/how-to-configure-traffic-from-a-specific-ip-hardcoded-to-an-ip-to-forward-to-ano?rq=1
 * Possible answer:
   * http://serverfault.com/questions/283409/how-to-use-iptables-to-forward-requests-to-a-jboss-server-running-on-a-different/285247#285247		  * Forwarding should be on - default
Line 18: Line 13:
   * in /etc/sysctl.conf: net.ipv4.ip_forward = 1
 * Sollutions, linux does not allow routing of traffic to 127.0.0.1/8 subnet by default, have to enable per interface		   * in /etc/sysctl.conf: net.ipv4.ip_forward = 1
 * Solutions, linux does not allow routing of traffic to 127.0.0.1/8 subnet by default, have to enable per interface

IPTABLES

2015 Problem redirecting traffic from outside interface to vnc service listening on localhost:127.0.0.1

  • Forwarding should be on - default

    • #echo 1 > /proc/sys/net/ipv4/ip_forward

      • in /etc/sysctl.conf: net.ipv4.ip_forward = 1
  • Solutions, linux does not allow routing of traffic to 127.0.0.1/8 subnet by default, have to enable per interface 
    • cat /proc/sys/net/ipv4/conf/eth0/route_localnet

Interesting modules 2010

  1. comment - Allows you to add comments (up to 256 characters) to any rule. 
    •        --comment comment
       Example:
              iptables -A INPUT -s 192.168.0.0/16 -m comment --comment "A privatized IP block"
  2. connlimit
    • Allows you to restrict the number of parallel connections to a server per client IP address (or client address block).
  3. rateest
    • The rate estimator can match on estimated rates as collected by the RATEEST target. It supports matching on absolute bps/pps values, com‐ paring two rate estimators and matching on the difference between two rate estimators.
  4. recent
    • Allows you to dynamically create a list of IP addresses and then match against that list in a few different ways. For example, you can create a "badguy" list out of people attempting to connect to port 139 on your firewall and then DROP all future packets from them without considering them.
  5. time
    • This matches if the packet arrival time/date is within a given range. All options are optional, but are ANDed when specified.
  6. TRACE
    • This target marks packes so that the kernel will log every rule which match the packets as those traverse the tables, chains, rules. (The ipt_LOG or ip6t_LOG module is required for the logging.) The packets are logged with the string prefix: "TRACE: tablename:chain‐ name:type:rulenum " where type can be "rule" for plain rule, "return" for implicit rule at the end of a user defined chain and "policy" for the policy of the built in chains. It can only be used in the raw table.

Common Problems and solutions

  • Multi-interface setup ignoring/dropping packets on certain interfaces
    • Caused by reverse path filtering.

      • Fix: 

               # Enables source route verification
       net.ipv4.conf.default.rp_filter = 2
       # Enable reverse path
       net.ipv4.conf.all.rp_filter = 2

...

CategoryLinux

linux/iptables (last edited 2015-07-02 13:17:21 by PieterSmit)