Sponsored Content
Special Forums IP Networking Nat and packet limits with iptables Post 302835173 by ahmerin on Monday 22nd of July 2013 04:16:35 AM
Old 07-22-2013
Nat and packet limits with iptables

Hi all,

I have a following situation:

- I want certain source IPs to be natted to a different destination IP and Port. Following is how I am achieving it:

Code:
/usr/local/sbin/iptables -t nat -A PREROUTING -p tcp -s 192.168.10.12
  --dport 1500 -j DNAT --to-destination 192.168.10.20:2000

Above runs on 192.168.10.12 and is working perfectly fine.

- Now, I want that if there are more than, say 20 packets per minute from source IP then further packets should be dropped.

Above is what I am having difficulty to achieve.


I have done the following but is not working:
Code:
/usr/local/sbin/iptables -t nat -A PREROUTING -p tcp -s 192.168.10.12 
  --dport 1500 -m limit --limit 20/m --limit-burst 5 -j DNAT --to-destination 192.168.10.20:2000

/usr/local/sbin/iptables -t nat -A PREROUTING -p tcp -s 192.168.10.12
  --dport 1500 -j LOG --log-level 4 --log-prefix "192.168.10.12 Packet Limit exceeded: "

/usr/local/sbin/iptables -A INPUT -p tcp -s 192.168.10.12 --dport 1500 -j DROP

Can someone help me get the correct statement or confirm whether I can achieve the above requirement through IP tables.

Many thanks for your help.

Regards
Ahmerin

---------- Post updated at 08:16 AM ---------- Previous update was at 06:44 AM ----------

Sorry... My mistake... the following IPtables command runs perfectly fine on the server where source actualy goes to first. It is not running on 192.168.10.12:

Code:
/usr/local/sbin/iptables -t nat -A PREROUTING -p tcp -s 192.168.10.12
  --dport 1500 -j DNAT --to-destination 192.168.10.20:2000


Last edited by Scott; 07-25-2013 at 09:24 AM.. Reason: Code tags
 

10 More Discussions You Might Find Interesting

1. UNIX for Advanced & Expert Users

iptables internal NAT with two public IP

Hello Guys, I have a debian machine that work as a firewall (iptables + squid 2.6) with two physical interfaces: eth0 (public interface) and eth1 (internal interface LAN). I have created an alias eth1:1 in order to have two subnets on same physical interface: cat/etc/network/interfaces auto... (0 Replies)
Discussion started by: sincity2006
0 Replies

2. IP Networking

How to configure Full Cone NAT using iptables ?

Hi Experts; I want to find the right iptables commands combination to address the following need: - NEs are NATed thru the linux box (using iptables) towards the WAN cloud, where the NTP servers are situated. - In order to achieve redundancy, the NTP Servers are in a load balancing cluster... (0 Replies)
Discussion started by: lvl1s7a
0 Replies

3. Debian

Iptables Nat forward port 29070

Hello, the Nat and the forward worked on my debian server up to the reboot of machines. The following rules*: /sbin/iptables -t nat -A PREROUTING -p tcp -i eth2 -d xxx.xxx.xxx.xxx --dport 29070 -j DNAT --to-destination 10.0.1.7:29070 /sbin/iptables -A FORWARD -p tcp -i eth2 -o eth0 -d... (0 Replies)
Discussion started by: titoms
0 Replies

4. IP Networking

iptables NAT prerouting & postrouting

Good morning, I'm a newbie of iptables and as far as I've seen on tutorials on the Internet it seems that both prerouting and postrouting NAT chains are undergone both by a packet that goes from an internal LAN to the Internet and of a one that goes in the opposite direction (from the Internet to... (0 Replies)
Discussion started by: giac85
0 Replies

5. Red Hat

NAT Loopback and iptables

Hello, please can you help and explain me. I have two servers. Both are RHEL6. I use the first one like router and the second one for apache. Router forwards 80 port on the second server and I can open that from the internet (mysite.com, for example). But I can not open mysite.com if i try to... (0 Replies)
Discussion started by: 6765656755
0 Replies

6. Cybersecurity

iptables in a NAT scenario

Hi, I am learning IPTables have this question. My server is behind a firewall that does a PAT & NAT to the LAN address. Internet IP: 68.1.1.23 Port: 10022 Server LAN IP: 10.1.1.23 port: 22 Allowed Internet IPs: 131.1.1.23, 132.1.1.23 I want to allow a set of IPs are to be able to... (1 Reply)
Discussion started by: capri_guy84
1 Replies

7. IP Networking

Debugging NAT / prerouting issues (iptables)

Hello, Recently I discovered an issue with packet routing in the latest Android releases (4.4+ KitKat & Lollipop). It seems that the problem Android specific, but essentially it comes from the Linux kernel. I already filed a bug report to Google. You can see the details by searching for... (0 Replies)
Discussion started by: Vladislav
0 Replies

8. IP Networking

NAT via iptables - Won't work!!

Hi guys I'm running on debian on a small embedded system. I have a ppp interface that is connected to the internet (and works). My unit also has wifi access point (which works and I can connect to it). I want to allow connections to the wifi to be able to use the internet from ppp0... (1 Reply)
Discussion started by: alirezan1
1 Replies

9. UNIX for Dummies Questions & Answers

Soft and hard limits for nproc value in /etc/security/limits.conf file (Linux )

OS version : RHEL 6.5 Below is an excerpt from /etc/security/limits.conf file for OS User named appusr in our server appusr soft nproc 2047 appusr hard nproc 16384 What will happen if appusr has already spawned 2047 processes and wants to spawn 2048th process ? I just want to know... (3 Replies)
Discussion started by: kraljic
3 Replies

10. Cybersecurity

Openvpn nat and iptables

good day good people hi first to tell that firewall and vpn is working as expected, but I notice something strange. I have host system 11.11.11.11(local ip) firewall is blocking everything except port to vpn. I have vpn on virtualized system 22.22.22.22 (CentOS both host and virtual). ... (0 Replies)
Discussion started by: end
0 Replies
RLM_IPPOOL_TOOL(8)					      System Manager's Manual						RLM_IPPOOL_TOOL(8)

NAME
rlm_ippool_tool - dump the contents of the FreeRadius ippool database files SYNOPSIS
If an ipaddress is specified then that address is used to limit the actions or output. rlm_ippool_tool [-a] [-c] [-o] [-v] session-db index-db [ipaddress] Mark the entry nasIP/nasPort as having ipaddress rlm_ippool_tool -n session-db index-db ipaddress nasIP nasPort Update old format database to new. rlm_ippool_tool -u session-db new-session-db DESCRIPTION
rlm_ippool_tool dumps the contents of the FreeRADIUS ippool databases for analyses or for removal of active (stuck?) entries. Or with the -n argument adds a usage entry to the FreeRADIUS ippool databases. OPTIONS
-a Print all active entries. -c Report number of active entries. -r Remove active entries. -v Verbose report of all entries. -o Assume old database format (nas/port pair, not md5 output). -n Mark the entry nasIP/nasPort as having ipaddress. -u Update old format database to new. EXAMPLES
Given the syntax in the FreeRadius radiusd.conf: ippool myippool { range-start = 192.168.1.0 range-stop = 192.168.1.255 [...] session-db = ${raddbdir}/ip-pool.db ip-index = ${raddbdir}/ip-index.db } To see the number of active entries in this pool, use: $ rlm_ippool_tool -c ip-pool.db ip-index.db 13 To see all active entries in this pool, use: $ rlm_ippool_tool -a ip-pool.db ip-index.db 192.168.1.5 192.168.1.82 192.168.1.244 192.168.1.57 192.168.1.120 192.168.1.27 [...] To see all information about the active entries in the use, use: $ rlm_ippool_tool -av ip-pool.db ip-index.db NAS:172.16.1.1 port:0x2e8 - ipaddr:192.168.1.5 active:1 cli:0 num:1 NAS:172.16.1.1 port:0x17c - ipaddr:192.168.1.82 active:1 cli:0 num:1 NAS:172.16.1.1 port:0x106 - ipaddr:192.168.1.244 active:1 cli:0 num:1 NAS:172.16.1.1 port:0x157 - ipaddr:192.168.1.57 active:1 cli:0 num:1 NAS:172.16.1.1 port:0x2d8 - ipaddr:192.168.1.120 active:1 cli:0 num:1 NAS:172.16.1.1 port:0x162 - ipaddr:192.168.1.27 active:1 cli:0 num:1 [...] To see only information of one entry, use: $ rlm_ippool_tool -v ip-pool.db ip-index.db 192.168.1.1 NAS:172.16.1.1 port:0x90 - ipaddr:192.168.1.1 active:0 cli:0 num:0 To add an IP address usage entry, use: $ rlm_ippool_tool -n ip-pool.db ip-index.db 192.168.1.1 172.16.1.1 0x90 rlm_ippool_tool: Allocating ip to nas/port: 172.16.1.1/144 rlm_ippool_tool: num: 1 rlm_ippool_tool: Allocated ip 192.168.1.1 to client on nas 172.16.1.1,port 144 SEE ALSO
radiusd(8) AUTHORS
Currently part of the FreeRADIUS Project (http://www.freeradius.org) Originally by Edwin Groothuis, edwin@mavetju.org (http://www.mavetju.org) Mailing list details are at http://www.freeradius.org/ RLM_IPPOOL_TOOL(8)
All times are GMT -4. The time now is 11:55 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy