Questions tagged [iptables]

iptables allow creation of rules to define packet filtering behavior.

Filter by
Sorted by
Tagged with
0 votes
1 answer
16 views

Disable port 8910 and then again enable when required in my linux based server

As you see below jsvc.exe is running on 8910 with PID 23943. [root@pxgrid-163 ~]# netstat -tulpn | grep :8910 tcp6 0 0 :::8910 :::* LISTEN 23943/jsvc....
  • 101
0 votes
1 answer
23 views

Blocking many disjoint IP addresses

I'm looking for the right tool to block a fairly large number (~1000s) of IP addresses from contacting my server. The application is very latency sensitive, so the blocking needs to occur directly on ...
  • 109
0 votes
0 answers
13 views

IPTables: DNAT working for every port I define except 443 (HTTPS)

My IPTables already had content inside it that I'm not sure what generated it. I'm tying to point traffic with specific ports to an internal bridge adapter for a virtual machine. Every port I have ...
0 votes
0 answers
12 views

Wireguard Some Local Ports reachable, others not

I have several services running on my ubuntu 20.04 server, which also has wireguard running but i am unable to connect to all of the services in the LAN once connected to the VPN. To clarify: I am ...
0 votes
0 answers
12 views

Route traffic through static route instead of default gateway for docker services

In my linux based server, default-gateway is set as ip default-gateway 10.77.122.1 and static route is set as ip route 0.0.0.0 0.0.0.0 gateway 10.106.142.1 I have a java based app which is ...
  • 101
1 vote
1 answer
21 views

How do we access the "icmp" protocol in ip6tables?

The ip6tables command accepts icmp and icmpv6 protocols: $ sudo ip6tables -A INPUT -p icmp -j ACCEPT $ sudo ip6tables -A INPUT -p ipv6-icmp -j ACCEPT However, when I test with the ping command: $ ...
  • 2,419
0 votes
2 answers
27 views

Is there a better way to prevent other device access to IPv6/IPv4:80 on network?

There are two device A and B. Usually, only use 10.0.0.1 to access their webpage, but I found that I can use IPv6 or IPv4 with port 80 to access device-B's webpage on device-A. example. http://[IPv6-B]...
  • 11
0 votes
2 answers
18 views

docker exposed port not accessible from outside even when port is opened using iptables command

I have a sample docker tar image in my linux based server and ran that though docker run command as below where 9521f101839f is image id. docker run -p 0.0.0.0:9895:9898 -td 9521f101839f So now ...
  • 101
0 votes
0 answers
30 views

Routing traffic from VPN network/interface to another VPN / Public IP?

I've been setting up a web server on my router / home network, which I've been able to get up and running, with SSL, DNS, Cloudflare server, etc. On the Router, I have an OpenVPN network setup to run ...
1 vote
0 answers
24 views

Redirecting traffic to SOCKS5 tunnel with iptables

I've got a home server (lets call it "A") and I want to access it when I'm outside, not directly though, but through a support machine connected to the same network (lets call it "B&...
0 votes
0 answers
9 views

traffic doesn't flow through static route when Kong is enabled

In my linux based server, default-gateway is set as ip default-gateway 192.168.1.200 and static route is set as ip route 0.0.0.0 0.0.0.0 gateway 10.48.60.1 When Kong/API-Gateway is disabled no issue ...
  • 101
0 votes
1 answer
17 views

Why didn't iptables apply the sames rules?

For some reason, my network encountered "Destination unreachable no route" error, this error happened periodicly, later I found that was a bug of my program. But during that time, I found a ...
0 votes
0 answers
17 views

DNAT to-destination on interface IP

Imagine I have a two IP addresses: eth0: 1.2.3.4 eth0:0 1.2.3.5 gre1 10.0.0.2 so I have a traffic from gre1 and I want to use DNAT to destination eth0:0 IP address. But it's not working I am ...
1 vote
0 answers
33 views

Port Forwarding over VPN link cloud VPS (To bypass CG-NAT)

I have a radio setup on a 4G connection that utilises CG-NAT. This means I am unable to access the radio remotely using the supplied remote software. To get around this I have setup a cloud VPS ...
1 vote
1 answer
13 views

Output of iptables -L after changing policy

When I change default policy of INPUT, output of iptables -L stops after third line. I checked it both through ssh and locally. Output of my terminal (yes I know I should not be using root). root@pi4:/...
0 votes
1 answer
21 views

How a transparent proxy knows the original destination address of DNATed packet?

I have two machines: machine A and machine B. Machine A routes all the traffic through the machine B. On machine A I set these iptables rules: iptables -t nat -A PREROUTING -i wlan0 -j DNAT --to-...
  • 13
0 votes
1 answer
20 views

Why packet is lost after nat:PREROUTING phase?

I was trying to debug iptables rules of calico and found an weird problem: some packets are lost after nat:PREROUTING. I have three pods on three different nodes, say: edge1/net-tool-edge1: 10.22.46....
0 votes
1 answer
59 views

Routing between Wireguard site-to-site interfaces and Internet

I have a Linux VPS that I am using as a gateway to the internet for two sites using iptables and Wireguard VPN Tunnels. While internet access throught the VPS from the both sites is working, I am ...
0 votes
0 answers
37 views

Invalid iptables arguments

While looking for a solution to remote server port forwarding I came across this answer which suggests using the following command: sudo iptables -t nat -A PREROUTING -p tcp --dport 800 -j DNAT --to-...
  • 1
0 votes
0 answers
12 views

IPTables rules to access SERVER B (Docker container) through Host A with port forwarding

Thanks for reading my question :) I am trying to send HTTPS request from a Client (C) to a server (B) that is within a Docker container on a host A. C is connected to A through a WIFI connection (A is ...
  • 1
-1 votes
0 answers
25 views

How to get a linux server to act as a buffer for another server

I have a steamcmd server that I am trying to keep the ip from reaching the internet, I have had successful attempts at having traffic from a specified domain be redirected via Nginx and reach the ...
  • 1
0 votes
1 answer
12 views

sudo iptables -P OUTPUT DROP not working on manjaro pinephone

I did: sudo iptables -P OUTPUT DROP sudo iptables -S -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT DROP curl example.com # this actually fetches the website, not affected by iptables How can I debug ...
-1 votes
1 answer
52 views

Why block with "no route"

I had an issue similar to No route to host with nc but can ping It was a case that for certain ports, iptables (default) rules returned a host forbidden ICMP packet which translates to "no route&...
  • 1,761
2 votes
1 answer
63 views

Setting IP forwarding with a bridge

I'm familiar with how to set IP forwarding between two interfaces, and it always worked. Now I have a different scenario where I want to set IP forwarding from a local network bridge to an output ...
0 votes
1 answer
80 views

Device "ip_tables" does not exist on Alpine Linux

I'm trying to run a docker-in-docker (dind) (more specifically, docker:22.06.0-beta.0-dind-rootless) image on a Alpine Linux host, that is running inside VirtualBox, whenever the container starts up, ...
1 vote
0 answers
31 views

virtual gateway interface

I would like your opinion on my Linux router setup. Let's say I have default ISP (main routing table) and a specific one (routing table custom). Default ISP is on eth0 and custom one is on eth2. For ...
  • 125
0 votes
0 answers
69 views

Iptables: redirect marked traffic to another interface

I have a config which redirects all marked packets to a proxy server listening on port 1082 and it works: ipset create unblock hash:net -exist iptables -I PREROUTING -w -t nat -i br0 -p tcp -m set --...
  • 1
0 votes
0 answers
34 views

Access to pfsense wan interface by ip public

I have this diagram. I have a server(centos 7) with ip public and staic 1.2.3.4 on internet, I want when user send request to this public ip 1.2.3.4, this request pass my modem with not static ip ...
  • 589
0 votes
0 answers
88 views

Unable to connect to a listening tcp port 80, Iptables is not blocking it

I am trying to see if tcp port 80 is open on a debian 11 server. I logged into it using SSH and did curl -v telnet://localhost:80. It says connection refused. If I do the same with port 22, it shows ...
  • 375
0 votes
0 answers
19 views

Optimizing iptables chains with large ipsets

If I have a rule like this in a hardware firewall, will each packet be checked against $bigset set regardless of whether or not the source MAC matches? -A FORWARD -m mac --mac-source $hwaddr -m set --...
  • 1,584
0 votes
0 answers
20 views

How can I make a port inside a virtual machine accessible to the host if the virtual interface has its traffic forwarded through a TPROXY target?

I have a virtual machine connected to virtual interface that has all its traffic sent through a TPROXY transparent proxy: ip tuntap add tap0 mode tap ip link set tap0 up ip addr add 10.0.0.1/24 dev ...
0 votes
1 answer
25 views

Unknown Local Rsyncd Interruptions Error (104)

I am on Ubuntu 20.04 running UFW. Problem: No matter, whether I use rsync or rsyncd to backup my home folder, with the command below. I always get rsync error (104): cputool --load-limit 7.5 -- nice -...
1 vote
2 answers
146 views

How to forward packets with keeping the original IP address

I need forward packets from one server ("as a proxy") to another with keeping the original IP address of clients. Topology is: X.X.X.X - public IP1 ("proxy server") Y.Y.Y.Y - ...
  • 575
1 vote
0 answers
26 views

Prevent network namespaces / lxd-bridges from talking to each other, but keep internet access?

Following goal: I have lxd containers each set of containers should have their dedicated isolated network each should still be able to connect to the internet (e.g. apt update or curl), but not leak ...
1 vote
1 answer
31 views

Why is this MAC address iptables whitelisting not working?

This is on a router. I have $mac as the MAC of one client and $set is an ipset of type hash:net. My intention is to deny access to all networks in $set, except for $mac who can access the networks. -A ...
0 votes
0 answers
19 views

Logging Outbound TCP-SYN packets with UFW

I'm hoping to harden security by implementing strict rules on outbound connections. But as a first step I'd like to audit outbound connections. I'm failing to find the UFW equivalent to something ...
0 votes
0 answers
17 views

Why it have to do SNAT on endpoint IP when do NAT hairpin?

I was trying to figure out how kube-proxy works. So I built a expriment enviroment using docker. There are two containers: net-tool with IP 172.0.0.3 and nginx with IP 172.0.0.4. I use ipvsadm built a ...
0 votes
0 answers
36 views

Parallel connections limit per IP

So basically we are providing an API, where people connect remotely. The idea is to deny everyone the access/ping to the IP of our server, except the whitelisted people (which are our customers). I ...
1 vote
1 answer
58 views

Matching AAAA records using iptables u32 module

I need to match the two bytes four from the end of the UDP payload and check them against 0x001c. This would be easy if the UDP payload didn't have a variable length. How do I get the length of the ...
0 votes
1 answer
36 views

forward outgoing port and sourcenat this traffic

I have crawled the internet, and tried some config, but so far, i am stucked, so i would need a little help if someone has a better experience than me on this. :) I got a server,server1, behind a ...
  • 1
1 vote
1 answer
32 views

How do I change the destination IP of all outgoing packets (especially DNS)?

I have a Raspberry Pi 4 with the latest build of (Debian) raspberry pi OS. I am trying to configure iptables to redirect all traffic coming from the Pi (with ) to another machine (lets say with an IP ...
  • 31
0 votes
0 answers
18 views

Restrict a certain third-party application to make request only to a certain domain?

If I take some third-party program, is there a way for me to restrict it in such a way as to guarantee that whenever a program makes any internet requests, they can only be sent to/from a certain ...
  • 3
1 vote
1 answer
40 views

"routing back" through a wireless hotspot does not work

I have a Linux device running a wireless hotspot: my laptop (LAN only: 192.168.1.100) | LAN | wireless hotspot laptop (LAN: 192.168.1.101, wireless hotspot: 10.42.0.1, VMs: 10.254.2.x) | ...
  • 11
0 votes
0 answers
13 views

How can I forward my http/https request to 2 different upstream proxies based in the destilanation url?

Hi I am quite struggling to find a good solution to my problem. I have to forward http/https requests from my (Linux) server to 2 different proxy based on the destination URL. I've tried different ...
  • 260
0 votes
0 answers
19 views

How do I bridge an ethernet device to the wireless network interface from within a VirtualBox Ubuntu 20.04 LTS VM?

I have a VirtualBox Ubuntu VM, the "VM", set up on my primary Windows machine, using bridged VirtualBox connections to the wireless interface and the ethernet port (i.e. Ethernet <-> ...
0 votes
1 answer
113 views

iptables couldn't load ipset match

I tried to add some rules, but it kept failing. Here is the rule like: ipset create FABEDGE-PEER-CIDR hash:net iptables -t nat -N FABEDGE-NAT-OUTGOING iptables -t nat -A POSTROUTING -j FABEDGE-NAT-...
0 votes
1 answer
23 views

what does this iptables chain rule do? [closed]

What does this iptables command do and why do we use -m state and what does it means ? iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
0 votes
0 answers
243 views

How to port forward my ubuntu 22.04 using iptables

Do you know how to gives iptables rules to my machine in order to allow trafic from my public interfaces(wlp3s0) to my private interfaces(lo). Kinda with this topology: 192.168.1.1:80 => 127.0.0.1:...
  • 1
0 votes
1 answer
33 views

IP tables forwarding with initial delay

I have a situation where I would like to forward traffic on a machine to another IP, but with an initial connection delay of x seconds. More specifically, I have a rule like iptables -t nat -A ...
  • 253
0 votes
1 answer
24 views

Specific need for tcp/ip routing with iptables

I would like to do the following thing: One server with public IP (say 1.2.3.4) and internal IP (say 192.168.1.1) Multiple VPN routers connecting (IPSEC and OPENVPN) (port 500/1194/4500) Internal VPN ...

1
2 3 4 5
50