Tag Archives: iptables

Iptables Tricks and Tweaks

This a general listing of some tweaks to iptables. It may also require extra kernel modules to be loaded.

#Kernel sysctl configuration file for Red Hat Linux
#
# For binary values, 0 is disabled, 1 is enabled. See sysctl(8) and
# sysctl.conf(5) for more details.

# Disables packet forwarding
net.ipv4.ip_forward=0

Read More

Various Iptables Tricks

> iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
> iptables -t nat -P PREROUTING DROP
> # Box 1
> iptables -t nat -A PREROUTING -m mac –mac-source 00:50:da:e3:f3:45 -j
> ACCEPT
> # Box 2
> iptables -t nat -A PREROUTING -m mac –mac-source 00:d0:b7:18:0f:f5 -j
> ACCEPT
>
> Now this works as expected, all packets from the two MAC addresses above are
> masq’ed and routed, anything from any other MAC address is DROP’ed.

mmh… but it is a bit unclean to drop packets in the nat table. You want
to filter packets, so use the filter table. Why? Because it is
– unclean
– only the first packet of each connection hits the nat table.

iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

iptables -t filter -N restr
iptables -t filter -A restr -p tcp –dport 25 -j DROP

iptables -t filter -P FORWARD DROP
iptables -t filter -A FORWARD -m mac –mac-source 00:50:da:e3:f3:45 -j ACCEPT
iptables -t filter -A FORWARD -m mac –mac-source 00:d0:b7:18:0f:f5 -j restr

Read More

Bad Behavior has blocked 181 access attempts in the last 7 days.