Iptables command - Revision history http://wiki.dd-wrt.com/wiki/index.php?title=Iptables_command&action=history Revision history for this page on the wiki en MediaWiki 1.10.1 Fri, 29 Mar 2024 11:23:09 GMT Kernel-panic69: /* Modifying the TTL */ http://wiki.dd-wrt.com/wiki/index.php?title=Iptables_command&diff=56146&oldid=prev <p><span class="autocomment">Modifying the TTL</span></p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 16:41, 15 December 2021</td> </tr> <tr><td colspan="2" align="left"><strong>Line 325:</strong></td> <td colspan="2" align="left"><strong>Line 325:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">*'''Example 1:''' Set the incoming TTL to 10, ''before'' the router routes it into the LAN</td><td> </td><td style="background: #eee; font-size: smaller;">*'''Example 1:''' Set the incoming TTL to 10, ''before'' the router routes it into the LAN</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"> iptables -t mangle -I PREROUTING -i <del style="color: red; font-weight: bold; text-decoration: none;">`</del>get_wanface<del style="color: red; font-weight: bold; text-decoration: none;">` </del>-j TTL --ttl-set 10</td><td>+</td><td style="background: #cfc; font-size: smaller;"> iptables -t mangle -I PREROUTING -i <ins style="color: red; font-weight: bold; text-decoration: none;">$(</ins>get_wanface<ins style="color: red; font-weight: bold; text-decoration: none;">) </ins>-j TTL --ttl-set 10</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">*'''Example 2:''' Set the outgoing TTL to 128, just as if a Windows machine was connected directly to the modem.</td><td> </td><td style="background: #eee; font-size: smaller;">*'''Example 2:''' Set the outgoing TTL to 128, just as if a Windows machine was connected directly to the modem.</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"> iptables -t mangle -I POSTROUTING -o <del style="color: red; font-weight: bold; text-decoration: none;">`</del>get_wanface<del style="color: red; font-weight: bold; text-decoration: none;">` </del>-j TTL --ttl-set 128</td><td>+</td><td style="background: #cfc; font-size: smaller;"> iptables -t mangle -I POSTROUTING -o <ins style="color: red; font-weight: bold; text-decoration: none;">$(</ins>get_wanface<ins style="color: red; font-weight: bold; text-decoration: none;">) </ins>-j TTL --ttl-set 128</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">*'''Example 3:''' Try to hide the fact that an outgoing packet was routed, by incrementing the TTL by one.</td><td>+</td><td style="background: #cfc; font-size: smaller;">*'''Example 3<ins style="color: red; font-weight: bold; text-decoration: none;">:''' Try to hide the fact that you are using a tethered phone as WAN:</ins></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"> iptables -t mangle -I POSTROUTING -o <del style="color: red; font-weight: bold; text-decoration: none;">`</del>get_wanface<del style="color: red; font-weight: bold; text-decoration: none;">` </del>-j TTL --ttl-inc 1</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> iptables -t mangle -I POSTROUTING -o $(get_wanface) -j TTL --ttl-set 65</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> iptables -t mangle -I PREROUTING -i $(get_wanface) -j TTL --ttl-set 65</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">&#160;</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*'''Example 4</ins>:''' Try to hide the fact that an outgoing packet was routed, by incrementing the TTL by one.</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"> iptables -t mangle -I POSTROUTING -o <ins style="color: red; font-weight: bold; text-decoration: none;">$(</ins>get_wanface<ins style="color: red; font-weight: bold; text-decoration: none;">) </ins>-j TTL --ttl-inc 1</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">==Firewall Forwarded Ports==</td><td> </td><td style="background: #eee; font-size: smaller;">==Firewall Forwarded Ports==</td></tr> </table> Wed, 15 Dec 2021 16:41:15 GMT Kernel-panic69 http://wiki.dd-wrt.com/wiki/index.php/Talk:Iptables_command Jeremywh7: update links http://wiki.dd-wrt.com/wiki/index.php?title=Iptables_command&diff=54944&oldid=prev <p>update links</p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 16:09, 9 October 2019</td> </tr> <tr><td colspan="2" align="left"><strong>Line 429:</strong></td> <td colspan="2" align="left"><strong>Line 429:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">==External Resources==</td><td> </td><td style="background: #eee; font-size: smaller;">==External Resources==</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">*[<del style="color: red; font-weight: bold; text-decoration: none;">http</del>://dd-wrt.com/<del style="color: red; font-weight: bold; text-decoration: none;">forum</del>/viewtopic.php?t=66351 <del style="color: red; font-weight: bold; text-decoration: none;">blocking </del>all traffic except HTTP HTTPS and MSN <del style="color: red; font-weight: bold; text-decoration: none;">(Windows Live </del>Messenger<del style="color: red; font-weight: bold; text-decoration: none;">) With </del>iptables]</td><td>+</td><td style="background: #cfc; font-size: smaller;">*[<ins style="color: red; font-weight: bold; text-decoration: none;">https</ins>://<ins style="color: red; font-weight: bold; text-decoration: none;">forum.</ins>dd-wrt.com/<ins style="color: red; font-weight: bold; text-decoration: none;">phpBB2</ins>/viewtopic.php?t=66351 <ins style="color: red; font-weight: bold; text-decoration: none;">Blocking </ins>all traffic except HTTP HTTPS and MSN Messenger <ins style="color: red; font-weight: bold; text-decoration: none;">with </ins>iptables]</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">*[http://www.linuxjournal.com/video/mastering-iptables-part-i linux_journal_video_tut]</td><td> </td><td style="background: #eee; font-size: smaller;">*[http://www.linuxjournal.com/video/mastering-iptables-part-i linux_journal_video_tut]</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">*http://linux.<del style="color: red; font-weight: bold; text-decoration: none;">die</del>.<del style="color: red; font-weight: bold; text-decoration: none;">net</del>/man/<del style="color: red; font-weight: bold; text-decoration: none;">8</del>/iptables</td><td>+</td><td style="background: #cfc; font-size: smaller;">*http:/<ins style="color: red; font-weight: bold; text-decoration: none;">/man7.org</ins>/linux<ins style="color: red; font-weight: bold; text-decoration: none;">/man-pages/man8/iptables</ins>.<ins style="color: red; font-weight: bold; text-decoration: none;">8</ins>.<ins style="color: red; font-weight: bold; text-decoration: none;">html</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">*http://man7.org/linux</ins>/man<ins style="color: red; font-weight: bold; text-decoration: none;">-pages</ins>/<ins style="color: red; font-weight: bold; text-decoration: none;">man8</ins>/iptables<ins style="color: red; font-weight: bold; text-decoration: none;">-extensions.8.html</ins></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">*http://www.iptables.org/documentation/HOWTO//packet-filtering-HOWTO-7.html</td><td> </td><td style="background: #eee; font-size: smaller;">*http://www.iptables.org/documentation/HOWTO//packet-filtering-HOWTO-7.html</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">*http://www.iptables.org/documentation/HOWTO//netfilter-hacking-HOWTO.html</td><td> </td><td style="background: #eee; font-size: smaller;">*http://www.iptables.org/documentation/HOWTO//netfilter-hacking-HOWTO.html</td></tr> </table> Wed, 09 Oct 2019 16:09:17 GMT Jeremywh7 http://wiki.dd-wrt.com/wiki/index.php/Talk:Iptables_command Bib: /* Caution */ http://wiki.dd-wrt.com/wiki/index.php?title=Iptables_command&diff=49562&oldid=prev <p><span class="autocomment">Caution</span></p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 13:47, 15 April 2015</td> </tr> <tr><td colspan="2" align="left"><strong>Line 420:</strong></td> <td colspan="2" align="left"><strong>Line 420:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">iptables [t table] -[n]vL [chain] --line-numbers&lt;/pre&gt;and see if it works as you think it would.</td><td> </td><td style="background: #eee; font-size: smaller;">iptables [t table] -[n]vL [chain] --line-numbers&lt;/pre&gt;and see if it works as you think it would.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">&lt;font color=#FF6F00 &gt;'''* Caution!'''&lt;/font&gt; In the GUI, ''echo$?'' always returns ''0'' whether the command succeeded or failed.</td><td>+</td><td style="background: #cfc; font-size: smaller;">&lt;font color=#FF6F00 &gt;'''* Caution!'''&lt;/font&gt; In the GUI, ''echo $?'' always returns ''0'' whether the command succeeded or failed.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">==See Also==</td><td> </td><td style="background: #eee; font-size: smaller;">==See Also==</td></tr> </table> Wed, 15 Apr 2015 13:47:21 GMT Bib http://wiki.dd-wrt.com/wiki/index.php/Talk:Iptables_command Bib: /* Caution */ http://wiki.dd-wrt.com/wiki/index.php?title=Iptables_command&diff=49536&oldid=prev <p><span class="autocomment">Caution</span></p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 12:38, 10 April 2015</td> </tr> <tr><td colspan="2" align="left"><strong>Line 420:</strong></td> <td colspan="2" align="left"><strong>Line 420:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">iptables [t table] -[n]vL [chain] --line-numbers&lt;/pre&gt;and see if it works as you think it would.</td><td> </td><td style="background: #eee; font-size: smaller;">iptables [t table] -[n]vL [chain] --line-numbers&lt;/pre&gt;and see if it works as you think it would.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">&lt;font color=#FF6F00 &gt;'''* Caution!'''&lt;/font&gt; In the GUI, ''echo$?'' always returns ''0''.</td><td>+</td><td style="background: #cfc; font-size: smaller;">&lt;font color=#FF6F00 &gt;'''* Caution!'''&lt;/font&gt; In the GUI, ''echo$?'' always returns ''0'' <ins style="color: red; font-weight: bold; text-decoration: none;">whether the command succeeded or failed</ins>.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">==See Also==</td><td> </td><td style="background: #eee; font-size: smaller;">==See Also==</td></tr> </table> Fri, 10 Apr 2015 12:38:31 GMT Bib http://wiki.dd-wrt.com/wiki/index.php/Talk:Iptables_command Bib: /* Caution */ http://wiki.dd-wrt.com/wiki/index.php?title=Iptables_command&diff=49535&oldid=prev <p><span class="autocomment">Caution</span></p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 12:37, 10 April 2015</td> </tr> <tr><td colspan="2" align="left"><strong>Line 416:</strong></td> <td colspan="2" align="left"><strong>Line 416:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">Adding iptables commands to your startup routine risks locking yourself out of the box with no option but to start over. If you are experimenting with new commands, you can insure yourself against this scenario by inserting a sleep command before the iptables command(s). This way you can grant yourself, say five minutes (sleep 300), before your commands take effect. If your commands do backfire and you are unable to log in to your box, simply restart it by switching it off and on again and you will have five minutes to get in.</td><td> </td><td style="background: #eee; font-size: smaller;">Adding iptables commands to your startup routine risks locking yourself out of the box with no option but to start over. If you are experimenting with new commands, you can insure yourself against this scenario by inserting a sleep command before the iptables command(s). This way you can grant yourself, say five minutes (sleep 300), before your commands take effect. If your commands do backfire and you are unable to log in to your box, simply restart it by switching it off and on again and you will have five minutes to get in.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">An other way is to try the command with ssh or GUI Command shell then click &quot;Run command&quot;: if your command doesn't touch nvram it won't survive a reboot, but it will allow an immediate addition/insertion of the new firewall rule for test. Check it immediately with</td><td>+</td><td style="background: #cfc; font-size: smaller;">An other way is to try the command with ssh <ins style="color: red; font-weight: bold; text-decoration: none;">(</ins>or GUI Command shell then click &quot;Run command&quot;<ins style="color: red; font-weight: bold; text-decoration: none;">*)</ins>: if your command doesn't touch nvram it won't survive a reboot, but it will allow an immediate addition/insertion of the new firewall rule for test. Check it immediately with</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">&lt;pre&gt;echo $? # must output 0, but remember in case of multiple commands this is only the success of the last one </td><td> </td><td style="background: #eee; font-size: smaller;">&lt;pre&gt;echo $? # must output 0, but remember in case of multiple commands this is only the success of the last one </td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">iptables [t table] -[n]vL [chain] --line-numbers&lt;/pre&gt;and see if it works as you think it would.</td><td> </td><td style="background: #eee; font-size: smaller;">iptables [t table] -[n]vL [chain] --line-numbers&lt;/pre&gt;and see if it works as you think it would.</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">&lt;font color=#FF6F00 &gt;'''* Caution!'''&lt;/font&gt; In the GUI, ''echo$?'' always returns ''0''.</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">==See Also==</td><td> </td><td style="background: #eee; font-size: smaller;">==See Also==</td></tr> </table> Fri, 10 Apr 2015 12:37:34 GMT Bib http://wiki.dd-wrt.com/wiki/index.php/Talk:Iptables_command Bib: /* Caution */ http://wiki.dd-wrt.com/wiki/index.php?title=Iptables_command&diff=49534&oldid=prev <p><span class="autocomment">Caution</span></p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 12:27, 10 April 2015</td> </tr> <tr><td colspan="2" align="left"><strong>Line 415:</strong></td> <td colspan="2" align="left"><strong>Line 415:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">==Caution==</td><td> </td><td style="background: #eee; font-size: smaller;">==Caution==</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">Adding iptables commands to your startup routine risks locking yourself out of the box with no option but to start over. If you are experimenting with new commands, you can insure yourself against this scenario by inserting a sleep command before the iptables command(s). This way you can grant yourself, say five minutes (sleep 300), before your commands take effect. If your commands do backfire and you are unable to log in to your box, simply restart it by switching it off and on again and you will have five minutes to get in.</td><td> </td><td style="background: #eee; font-size: smaller;">Adding iptables commands to your startup routine risks locking yourself out of the box with no option but to start over. If you are experimenting with new commands, you can insure yourself against this scenario by inserting a sleep command before the iptables command(s). This way you can grant yourself, say five minutes (sleep 300), before your commands take effect. If your commands do backfire and you are unable to log in to your box, simply restart it by switching it off and on again and you will have five minutes to get in.</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">An other way is to try the command with ssh or GUI Command shell then click &quot;Run command&quot;: if your command doesn't touch nvram it won't survive a reboot, but it will allow an immediate addition/insertion of the new firewall rule for test. Check it immediately with</td><td> </td><td style="background: #eee; font-size: smaller;">An other way is to try the command with ssh or GUI Command shell then click &quot;Run command&quot;: if your command doesn't touch nvram it won't survive a reboot, but it will allow an immediate addition/insertion of the new firewall rule for test. Check it immediately with</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">&lt;pre&gt;echo $? # must output 0, but remember in case of multiple commands this is only the success of the last one </td><td> </td><td style="background: #eee; font-size: smaller;">&lt;pre&gt;echo $? # must output 0, but remember in case of multiple commands this is only the success of the last one </td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">iptables [t table] -[n]vL [chain] --line-numbers&lt;/pre&gt;</td><td>+</td><td style="background: #cfc; font-size: smaller;">iptables [t table] -[n]vL [chain] --line-numbers&lt;/pre&gt;and see if it works as you think it would.</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">and see if it works as you think it would.</td><td>+</td><td style="background: #cfc; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">==See Also==</td><td> </td><td style="background: #eee; font-size: smaller;">==See Also==</td></tr> </table> Fri, 10 Apr 2015 12:27:54 GMT Bib http://wiki.dd-wrt.com/wiki/index.php/Talk:Iptables_command Bib: /* Caution */ http://wiki.dd-wrt.com/wiki/index.php?title=Iptables_command&diff=49533&oldid=prev <p><span class="autocomment">Caution</span></p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 12:25, 10 April 2015</td> </tr> <tr><td colspan="2" align="left"><strong>Line 415:</strong></td> <td colspan="2" align="left"><strong>Line 415:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">==Caution==</td><td> </td><td style="background: #eee; font-size: smaller;">==Caution==</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">Adding iptables commands to your startup routine risks locking yourself out of the box with no option but to start over. If you are experimenting with new commands, you can insure yourself against this scenario by inserting a sleep command before the iptables command(s). This way you can grant yourself, say five minutes (sleep 300), before your commands take effect. If your commands do backfire and you are unable to log in to your box, simply restart it by switching it off and on again and you will have five minutes to get in.</td><td> </td><td style="background: #eee; font-size: smaller;">Adding iptables commands to your startup routine risks locking yourself out of the box with no option but to start over. If you are experimenting with new commands, you can insure yourself against this scenario by inserting a sleep command before the iptables command(s). This way you can grant yourself, say five minutes (sleep 300), before your commands take effect. If your commands do backfire and you are unable to log in to your box, simply restart it by switching it off and on again and you will have five minutes to get in.</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">&#160;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">An other way is to try the command with ssh or GUI Command shell then click &quot;Run command&quot;: if your command doesn't touch nvram it won't survive a reboot, but it will allow an immediate addition/insertion of the new firewall rule for test. Check it immediately with</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">&lt;pre&gt;echo $? # must output 0, but remember in case of multiple commands this is only the success of the last one </ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">iptables [t table] -[n]vL [chain] --line-numbers&lt;/pre&gt;</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">and see if it works as you think it would.</ins></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">==See Also==</td><td> </td><td style="background: #eee; font-size: smaller;">==See Also==</td></tr> </table> Fri, 10 Apr 2015 12:25:21 GMT Bib http://wiki.dd-wrt.com/wiki/index.php/Talk:Iptables_command Masterman: /* Deny access to a specific IP address */ http://wiki.dd-wrt.com/wiki/index.php?title=Iptables_command&diff=47704&oldid=prev <p><span class="autocomment">Deny access to a specific IP address</span></p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 23:40, 25 October 2014</td> </tr> <tr><td colspan="2" align="left"><strong>Line 238:</strong></td> <td colspan="2" align="left"><strong>Line 238:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">====Deny access to a specific IP address====</td><td> </td><td style="background: #eee; font-size: smaller;">====Deny access to a specific IP address====</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;"> iptables -I FORWARD -d 123.123.123.123 -j DROP</td><td>+</td><td style="background: #cfc; font-size: smaller;"> iptables -I FORWARD -d 123.123.123.123 -j DROP <ins style="color: red; font-weight: bold; text-decoration: none;">(K24 Only)</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;"> iptables -I FORWARD 1 -d 123.123.123.123 -j DROP (K26 and K3.x)</ins></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">Which would DROP all packets destined to the given IP. Useful to block access to whatnot. If you want to log the entry when the IP is blocked you would set the jump location to logdrop, instead of DROP.</td><td> </td><td style="background: #eee; font-size: smaller;">Which would DROP all packets destined to the given IP. Useful to block access to whatnot. If you want to log the entry when the IP is blocked you would set the jump location to logdrop, instead of DROP.</td></tr> </table> Sat, 25 Oct 2014 23:40:59 GMT Masterman http://wiki.dd-wrt.com/wiki/index.php/Talk:Iptables_command Masterman: /* Targets */ http://wiki.dd-wrt.com/wiki/index.php?title=Iptables_command&diff=47703&oldid=prev <p><span class="autocomment">Targets</span></p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 23:39, 25 October 2014</td> </tr> <tr><td colspan="2" align="left"><strong>Line 120:</strong></td> <td colspan="2" align="left"><strong>Line 120:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">ACCEPT - packets are accepted/allowed</td><td> </td><td style="background: #eee; font-size: smaller;">ACCEPT - packets are accepted/allowed</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">DROP - packets are dropped/denied</td><td>+</td><td style="background: #cfc; font-size: smaller;">DROP - packets are dropped/denied <ins style="color: red; font-weight: bold; text-decoration: none;">(Router does NOT send a response back)</ins></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">REJECT - packets are rejected/denied</td><td>+</td><td style="background: #cfc; font-size: smaller;">REJECT - packets are rejected/denied <ins style="color: red; font-weight: bold; text-decoration: none;">(Router DOES send a response back)</ins></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">logaccept - packets are accepted and logged to /tmp/var/log/messages</td><td> </td><td style="background: #eee; font-size: smaller;">logaccept - packets are accepted and logged to /tmp/var/log/messages</td></tr> </table> Sat, 25 Oct 2014 23:39:50 GMT Masterman http://wiki.dd-wrt.com/wiki/index.php/Talk:Iptables_command Masterman: /* Interfaces */ http://wiki.dd-wrt.com/wiki/index.php?title=Iptables_command&diff=47702&oldid=prev <p><span class="autocomment">Interfaces</span></p> <table border='0' width='98%' cellpadding='0' cellspacing='4' style="background-color: white;"> <tr> <td colspan='2' width='50%' align='center' style="background-color: white;">←Older revision</td> <td colspan='2' width='50%' align='center' style="background-color: white;">Revision as of 23:36, 25 October 2014</td> </tr> <tr><td colspan="2" align="left"><strong>Line 87:</strong></td> <td colspan="2" align="left"><strong>Line 87:</strong></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">==Interfaces==</td><td> </td><td style="background: #eee; font-size: smaller;">==Interfaces==</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">When using the -i or -o to define the physical interfaces, remember that by default:&lt;br&gt;</td><td> </td><td style="background: #eee; font-size: smaller;">When using the -i or -o to define the physical interfaces, remember that by default:&lt;br&gt;</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">''vlan0'' is the 4 LAN ports&lt;br&gt;</td><td>+</td><td style="background: #cfc; font-size: smaller;">''vlan0'' is the 4 LAN ports <ins style="color: red; font-weight: bold; text-decoration: none;">(K24 Only)</ins>&lt;br&gt;</td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">''vlan1'' is the WAN port (ppp0 is the WAN interface when PPPoE is used)&lt;br&gt;</td><td>+</td><td style="background: #cfc; font-size: smaller;">''vlan1'' is the WAN port <ins style="color: red; font-weight: bold; text-decoration: none;">(K24 Only) or the 4 LAN ports (K26 and K3.x) </ins>(ppp0 is the WAN interface when PPPoE is used<ins style="color: red; font-weight: bold; text-decoration: none;">)&lt;br&gt;</ins></td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;"><ins style="color: red; font-weight: bold; text-decoration: none;">''vlan2'' is the WAN port (K26 and K3.x</ins>)&lt;br&gt;</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">''eth1'' is the WIFI&lt;br&gt;</td><td> </td><td style="background: #eee; font-size: smaller;">''eth1'' is the WIFI&lt;br&gt;</td></tr> <tr><td colspan="2">&nbsp;</td><td>+</td><td style="background: #cfc; font-size: smaller;">''eth2-3'' is the WIFI (Dual Radio routers)&lt;br&gt;</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">''br0'' is a bridge connecting the 4 LAN and the WIFI together&lt;br&gt;</td><td> </td><td style="background: #eee; font-size: smaller;">''br0'' is a bridge connecting the 4 LAN and the WIFI together&lt;br&gt;</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td>-</td><td style="background: #ffa; font-size: smaller;">&lt;p&gt;Note: ppp0 is the WAN interface when PPPoE is used. This information is from [[IPv6]] page and quoted here: &quot;The <del style="color: red; font-weight: bold; text-decoration: none;">detailled </del>configuration steps are targeted toward users with a basic DHCP connection for the WAN part. So, if using PPPoE will require replacing vlan1 with ppp0 in each instance. Other connection types will vary.&quot;&lt;/p&gt;</td><td>+</td><td style="background: #cfc; font-size: smaller;">&lt;p&gt;Note: ppp0 is the WAN interface when PPPoE is used<ins style="color: red; font-weight: bold; text-decoration: none;">. It is also for PPTP VPN connections</ins>. This information is from [[IPv6]] page and quoted here: &quot;The <ins style="color: red; font-weight: bold; text-decoration: none;">detailed </ins>configuration steps are targeted toward users with a basic DHCP connection for the WAN part. So, if using PPPoE will require replacing vlan1 with ppp0 in each instance. Other connection types will vary.&quot;&lt;/p&gt;</td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;"></td><td> </td><td style="background: #eee; font-size: smaller;"></td></tr> <tr><td> </td><td style="background: #eee; font-size: smaller;">&lt;p&gt;Tip: To list the network interfaces on the router use 'ifconfig' on the command line.&lt;/p&gt;</td><td> </td><td style="background: #eee; font-size: smaller;">&lt;p&gt;Tip: To list the network interfaces on the router use 'ifconfig' on the command line.&lt;/p&gt;</td></tr> </table> Sat, 25 Oct 2014 23:36:11 GMT Masterman http://wiki.dd-wrt.com/wiki/index.php/Talk:Iptables_command