Sponsored Content
Top Forums UNIX for Advanced & Expert Users How iptables directs to localhost in this series of iptable rules Post 302570442 by otheus on Thursday 3rd of November 2011 10:04:57 AM
Old 11-03-2011
I understand your objection to being given a very general answer, but as your post had gone unanswered after 2 weeks, it made little sense to give a very long response in case you had since solved the problem. Also, as I was posting from my iPhone, i couldn't give you more than a general response.

Here's one visual aid but I prefer this one. These should give you a better idea of the distinction between POST/PRE-ROUTING, etc.

Code:
#1
-A OUTPUT -d 127.0.0.1 -p tcp --dport 8118 
       -m owner ! --uid-owner dansguardian -j DROP
#2
-A POSTROUTING -t nat -o lo -p tcp --dport 8080 -j SNAT --to 127.0.0.1
#3
-A OUTPUT -t nat ! -d 127.0.0.1 -p tcp --dport 80 
       -m owner ! --uid-owner root -j REDIRECT --to-ports 8080

#4
-A INPUT -d 255.255.255.255/0.0.0.255 -j DROP
#5
-A INPUT -d 224.0.0.1 -j DROP
#6
-A INPUT -j REJECT

For #1,
I have no idea what dansguardian is doing, but this rule will drop any packet sent to the loopback interface and port 8118 that is not from a process owned by dansguardian.

For #2 / #3, It looks like port 8080 is some sort of proxy server for all outbound "typical HTTP" traffic (unless you're running as root, in which case it's not proxied). #4 instructs to redirect all traffic to the service on port 8080 on the loopback interface, and #3 tells it to spoof the packets as if they were really supposed to go there in the first place. (Otherwise, the listening interface would not see packets for 127.0.0.1 but for their original destination, which it's not listening for.)

For #4
I'm not sure, but anything to 255.255.255.xxx is dropped. Normally that's a broadcast from ill-behaved equipment.

For #5, that's multicast it's dropping.

For #6 REJECT vs DROP - That's just an issue of preference. REJECT will result in an icmp packet sent back to the sender indicating the packet has not been accepted. DROP simply ignores the packet and no further action is taken.

Last edited by otheus; 11-03-2011 at 11:07 AM.. Reason: typo
 

9 More Discussions You Might Find Interesting

1. IP Networking

Iptables rules at boot

Hi I have small home network and I want to block some forums on web When I use this iptables -A INPUT -s forum -j DROP rules is applied but when I restart some of PC rules are not present any more also I tried to save firewall settings iptables-save > /root/dsl.fw but how to... (2 Replies)
Discussion started by: solaris_user
2 Replies

2. Cybersecurity

Editing rules on iptables

Hello, I was playing around with iptables to setup an isolated system. On a SLES10 system, I ran the below to setup my first draft of rules. I noticed that the rules come into effect immediately and do not require any restart of iptables. iptables -A INPUT -j ACCEPT iptables -A OUTPUT -m... (4 Replies)
Discussion started by: garric
4 Replies

3. Ubuntu

iptables rules (ubuntu)

Could someone help me with writing rules for iptables? I need a dos attacks protection for a game server. port type udp ports 27015:27030 interface: eth0 Accept all packets from all IPs Chek if IP sent more than 50 packets per second Drop all packets from this IP for 5 minutes I would be... (0 Replies)
Discussion started by: Greenice
0 Replies

4. Red Hat

iptables Rules for my network

Hi Champs i am new in Iptables and trying to write rules for my Samba server.I took some help from internet, created one script and run from rc.local : #Allow loopback iptables -I INPUT -i lo -j ACCEPT # Accept packets from Trusted network iptables -A INPUT -s my-network/subnet -j... (0 Replies)
Discussion started by: Vaibhav.T
0 Replies

5. Web Development

$_SERVER['DOCUMENT_ROOT'] directs to /var/www not ~/public_html

Hi all, Exactly like my title says. I am learning PHP and MySQL and I used to use /var/www/ to host (contain or store) my files (.htm/.php) for testing. I could configure, finally, apache2 to use ~/public_html instead. Now I when I tried to use $_SERVER it still directs (I used echo to show... (7 Replies)
Discussion started by: faizlo
7 Replies

6. Proxy Server

IPtable rules for DNS/http/https traffic for specific hosts only, not working.

Hi there, I have a VPS and am working on a little side project for myself and friend which is a DNS proxy. Everything was great till recently. My VPS IP has been detected by some botnet or something, and I believe SMURF attacks are occuring. The VPS provider keeps shutting down my VPS... (3 Replies)
Discussion started by: phi0x
3 Replies

7. UNIX for Advanced & Expert Users

iptables help with rules

Hi, I've been struggling with this all morning and seem to have a blind spot on what the problem is. I'm trying to use iptables to block traffic on a little cluster of raspberry pi's but to allow ssh and ping traffic within it. The cluster has a firewall server with a wifi card connecting to... (4 Replies)
Discussion started by: steadyonabix
4 Replies

8. Cybersecurity

Need help for iptables rules

Hello, I did 2 scripts. The second one is, I hope, more secure. What do you think? Basic connection (no server, no router, no DHCP and the Ipv6 is disabled) #######script one #################### iptables -F iptables -X -t filter iptables -P INPUT DROP iptables -P FORWARD... (6 Replies)
Discussion started by: Thomas342
6 Replies

9. IP Networking

iptables - formatting icmp rules

Hi, I am relatively new to firewalls and netfilter. I have a Debian Stretch router box running dnsmasq, connected to a VPN. Occasionally dnsmasq polls all of the desired DNS servers to select the fastest. When it does this it responds to replies of the non-selected DNS servers with a icmp type... (0 Replies)
Discussion started by: CrazyDave
0 Replies
IPTABLES-APPLY(8)						  iptables 1.6.1						 IPTABLES-APPLY(8)

NAME
iptables-apply - a safer way to update iptables remotely SYNOPSIS
iptables-apply [-hV] [-t timeout] [-w savefile] {[rulesfile]|-c [runcmd]} DESCRIPTION
iptables-apply will try to apply a new rulesfile (as output by iptables-save, read by iptables-restore) or run a command to configure iptables and then prompt the user whether the changes are okay. If the new iptables rules cut the existing connection, the user will not be able to answer affirmatively. In this case, the script rolls back to the previous working iptables rules after the timeout expires. Successfully applied rules can also be written to savefile and later used to roll back to this state. This can be used to implement a store last good configuration mechanism when experimenting with an iptables setup script: iptables-apply -w /etc/network/iptables.up.rules -c /etc/network/iptables.up.run When called as ip6tables-apply, the script will use ip6tables-save/-restore and IPv6 default values instead. Default value for rulesfile is '/etc/network/iptables.up.rules'. OPTIONS
-t seconds, --timeout seconds Sets the timeout in seconds after which the script will roll back to the previous ruleset (default: 10). -w savefile, --write savefile Specify the savefile where successfully applied rules will be written to (default if empty string is given: /etc/network/iptables.up.rules). -c runcmd, --command runcmd Run command runcmd to configure iptables instead of applying a rulesfile (default: /etc/network/iptables.up.run). -h, --help Display usage information. -V, --version Display version information. SEE ALSO
iptables-restore(8), iptables-save(8), iptables(8). LEGALESE
Original iptables-apply - Copyright 2006 Martin F. Krafft <madduck@madduck.net>. Version 1.1 - Copyright 2010 GW <gw.2010@tnode.com or http://gw.tnode.com/>. This manual page was written by Martin F. Krafft <madduck@madduck.net> and extended by GW <gw.2010@tnode.com or http://gw.tnode.com/>. Permission is granted to copy, distribute and/or modify this document under the terms of the Artistic License 2.0. iptables 1.6.1 IPTABLES-APPLY(8)
All times are GMT -4. The time now is 04:52 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy