Questions tagged [iptables]

iptables allow creation of rules to define packet filtering behavior. The most reliable way to provide an iptables ruleset in a question is with the output of (as root): iptables-save -c

Filter by
Sorted by
Tagged with
0 votes
1 answer
31 views

How to define port forwarding

I run a server with a web server running as a rootless podman container. This exposes ports 10080 and 10443 because, as a rootless container, it is not allowed to expose ports 80 and 443. So that my ...
M.Ede's user avatar
  • 1
1 vote
1 answer
73 views

What exactly does the br_netfilter kernel module control?

I'm trying to get a clear understanding of what exactly the br_netfilter Linux kernel module does (I know it has something to do with networking). My simple question I'm posing here is as follows: ...
user1015214's user avatar
2 votes
1 answer
27 views

explanation of a iptables rule

what this iptables rule does, exactly? iptables -t nat -A PREROUTING -p tcp -d 192.168.7.50 --dport 422 -j DNAT --to 192.168.7.50:22 As far I know this rule take the packets incoming to 192.168.7.50:...
Lilia's user avatar
  • 121
0 votes
1 answer
13 views

IPTables - allow connection from only one random IP simultaneously

Please tell me how to limit the connection to the server's listening port to only one random IP address, if a TCP-Syn comes from any other second one, then it is reset, if there are no connections to ...
Глеб Щеголев's user avatar
0 votes
1 answer
31 views

iptables allow host for isolated VLAN

I'm having a real trouble trying to do a "simple" tweak in my network. So: there are two sites, A and B and are connected via IPsec and there's no problem in communication between them. ...
user37741's user avatar
  • 127
0 votes
2 answers
29 views

Iptables, subnet rule overwriting ip rule

I want to DROP all packet that come from the subnet 192.168.112.0/24 with destination 192.168.112.0/24 but I want to allow only a specific destination to be accessible (192.168.112.253). I am using ...
DevGorgando's user avatar
0 votes
0 answers
14 views

iptables MARK works to change gateway, CONNMARK does not

I have a routing table which sends some traffic from another host out a different, higher speed gateway ip route show table 88 default via 192.168.88.1 dev eno3 192.168.88.0/24 dev eno3 scope link src ...
Neo's user avatar
  • 101
1 vote
0 answers
29 views

Nftables does not work as expected to block with meter

Goal: Account for excess packets whose rate source IP and destination port are greater than 200 packets per second, example: 1s, 2s, 3s ...: IP 1.1.1.1 to MyServer:80 [This happens 201 times in ...
Gabriel's user avatar
  • 11
1 vote
0 answers
28 views

Route traffic to different IP addresses while using a single outgoing IP

So I have 3 servers, each with his own public IP address. Now I also have a virtual IP(178.x.x.x) that's publicly accessible and it's mounted to one of those servers. The virtual IP can be moved ...
r.m.ghimis's user avatar
0 votes
0 answers
54 views

What addrtype is to be used for only forwarded packets?

To "focus" an iptables rule on packets destined for the current host, we use "LOCAL", so which should we use for those destined for another host? The documentation is unclear ...
Cheyenne Forbes's user avatar
1 vote
0 answers
22 views

Why I cannot log packages passing through PREROUTING chain?

Recently I have been studying iptables. To grasp how packages pass through every chain of iptables, I inserted log rules at the first line of every default chain. Then I ping the test server from ...
likelyq's user avatar
  • 11
0 votes
0 answers
44 views

Squid transparent proxy for HTTPS requests that have been redirected by DNAT rule

I would like to look into suspicious activity of possibly infected web application in my network. I wanted to use squid to intercept https requests with https_port directive. My network setup: http/...
Marcel Tkáč's user avatar
0 votes
0 answers
60 views

Can't access webserver inside LAN

I have tried apache and php's internal server, with none of them I can access from another computer if I use the internal IP. \ In the browser it sais "The connection has timed out. The server at ...
Martzy's user avatar
  • 11
2 votes
1 answer
144 views

UFW Couldn't determine iptables version

I am building a custom embedded Linux platform based on the NXP i.MX8 with Yocto. I want to use UFW to setup the firewall. When I boot the system and try to use UFW it returns an error Couldn't ...
PhilBot's user avatar
  • 69
0 votes
1 answer
27 views

Firewall : firewalld with docker open port for local service

I'm trying to open port for ssh on non-standard port like 12452, i used these commands and non of them worked iptables -I INPUT -p tcp --dport 12452 -j ACCEPT iptables -I OUTPUT -p tcp --dport 12452 -...
Ebrahim Karimi's user avatar
1 vote
1 answer
54 views

nftables deleting a rule without passing handle (similar to iptables delete)

iptables syntax for delete is much simpler. if we replace the "append" with delete we get command for deletion of the rule. nftable provides similar construct for few rule management aspect ...
Amit Priyadarshi's user avatar
1 vote
1 answer
26 views

Linux Webserver not "Accepting" Connections

First off, thanks for any help anyone can provide, I greatly appreciate it! I have a basic network I have set up for testing. It has pfSense acting as a Gateway/DHCP/DNS host and two Linux machines ...
Twigg90's user avatar
  • 11
0 votes
0 answers
141 views

Podman: automatic network rules and iptables

When I run podman container and share port 4444 as following example: podman run -dit --name test -p 4444:4444 alpine It creates following iptable Chain INPUT (policy ACCEPT) target prot opt ...
Rafal Niznik's user avatar
2 votes
1 answer
61 views

iptables: prohibit access to interface by GID unless it is local network

I have the following rule to prohibit use of interface for users outside of fullnetwork group. iptables -I OUTPUT -o eth+ -m owner \! --gid-owner fullnetwork -j REJECT How can I allow local networks ...
andreoss's user avatar
  • 416
0 votes
3 answers
39 views

Unblock SSH on successful connection using only iptables

I currently have these iptables rules on a Linux router, to block repeated SSH connections: -A wan_ingress -p tcp --dport 22 -m state --state NEW -m recent --name sshthrottle --set -m comment --...
Malvineous's user avatar
  • 6,554
0 votes
0 answers
22 views

How can I redirect traffic for a specific user to connect to another server?

what I intend to do is transfer the traffic of just a specific user to another server (IP). with the commands below it will work very well to transfer only the traffic from the entire server, which ...
Luana's user avatar
  • 1
-1 votes
1 answer
37 views

iptables outgoing drop works but incoming drop seems not working. Why?

I have this setup: Host machine: 10.40.10.3 Device that is connected to host machine: 10.40.10.6 The traffic that I capture is repeatedly this: IP 10.40.10.3.53258 > 10.40.10.6.2883: UDP, length 12 ...
Mert Mertce's user avatar
0 votes
1 answer
85 views

iptables "--ttl-inc" not working

I get this error: $ iptables -t mangle -A PREROUTING -d 224.0.0.251 -j TTL --ttl-inc 1 iptables v1.8.7 (nf_tables): unknown option "--ttl-inc" Try `iptables -h' or 'iptables --help' for more ...
A D's user avatar
  • 1
0 votes
1 answer
31 views

iptables - forwarding traffic from internal network to external network not working

I'm running almalinux 8 and I've 3 network interfaces attached to my VM `[root@puppetmaster ~]# ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 ...
Vaibhav.c's user avatar
  • 133
0 votes
1 answer
36 views

RHEL 6.4 basic firewall rule port 6162 does not take effect

I'm dealing with a RHEL version 6.4 server's firewall setting and the goal is to allow remote device to connect tcp port 6162, regardless of the type of services. The iptables rules are shown below(...
user53815's user avatar
0 votes
1 answer
86 views

Service only listens on 127.0.0.1 port 1025. How do you allow any computer on your local network to communicate with this service?

Let me open by saying I have scoured the internet, even companies I purchased the software from and it's been 5 months!! So I am turning to the community as my eyes and brain are bleeding from reading ...
Frank's user avatar
  • 13
0 votes
1 answer
70 views

Route traffic from one IP address through a different interface

I have a local and a remote network. My local network has a router, ubuntu box and TV. The remote network has a router and a raspberry pi. The local ubuntu box and remote raspberry pi are connected ...
NinjaTuna's user avatar
0 votes
0 answers
25 views

How do you mark both incoming and outgoing packets to a cgroup v1 net classifier?

I'm attempting to isolate and tcpdump all network traffic from a single process, following the instructions here:(How to mark packets by program): $ sudo bash # mkdir /sys/...
PFudd's user avatar
  • 161
0 votes
1 answer
48 views

writing nftables for traffic pre/postrouting to an IDS

Trying to learn nftables since it has been implemented on Openwrt 22.03 with little backwards compatibility for iptables. I have iptables rules for forwarding traffic from my router to a VM running ...
robreiner's user avatar
1 vote
2 answers
257 views

fail2ban SSH jail change action REJECT to DROP

I am trying to configure a simple SSH jail with fail2ban. Below is the configuration of the jail in /etc/fail2ban/jail.conf : [sshd] # To use more aggressive sshd modes set filter parameter "...
PizzaYolo's user avatar
1 vote
2 answers
67 views

fail2ban action ipset retry or timeout

Recently in an Ubuntu 20.04 box from fail2ban I got the following error: 2023-07-13 06:57:05,129 fail2ban.actions [3063]: NOTICE [nginx-http-auth] Ban 2600:1005:b02d:3b6a:c1e:4a7e:6a9f:ccc4 ...
Javier López's user avatar
0 votes
0 answers
41 views

IPTABLES Routing traffic from 192.168.1.1 port 21516 to 192.168.2.3 port 80

I am using Debian/Linux Bullseye (version 11) What I am trying to accomplish is setting up a TabloTV to portfoward through a Linux firewall using IPTABLES. my linux firewall has two ethernet cards (...
Nerd's user avatar
  • 1
0 votes
1 answer
48 views

What does this iptables rule's options mean?

The rule is -A KUBE-SEP-G3HEJMIUHDVUA2GR -p udp -m comment --comment "kube-system/kube-dns:dns" -m udp -j DNAT --to-destination :0 --persistent --to-destination :0 --persistent --to-...
Jianbo Yan's user avatar
1 vote
1 answer
56 views

Restrict access to SocketCAN to a certain user group

I have a PC to which a robot is connected via CAN (using SocketCAN). I'd like to control who can send commands to the robot, ideally through a group (i.e. only users who are in the "use_robot&...
luator's user avatar
  • 181
0 votes
0 answers
42 views

Port forwarding socks5 proxy across network namespaces

I've finally set up the netns veth openvpn connection that works, made overrides to systemd service files so openvpn depended on netns single shot service and tor of openvpn service. Tor works, at ...
Xle6yWek's user avatar
  • 103
-1 votes
1 answer
34 views

Iptables not working properly in ubuntu VM under utm app

I want to setup my ubuntu machine like this so that it only opens youtube.com and pw.live website and block all other outgoing traffic. What I have done so far is created ip_table script below inside ...
bigDaddy's user avatar
0 votes
1 answer
83 views

Dedicated network interface for OpenVPN

I'm trying to use an OpenVPN client service to serve a vpn connection over specific application. In my case I want to setup my tor and only tor connection to go over vpn. Should How would I achieve ...
Xle6yWek's user avatar
  • 103
2 votes
1 answer
89 views

nftables does not limit ipv6 traffic in rate limit rule in bridge and ip6 family

I have a wifi router where the wlan0 interface (radio interface) is bridged with the ethernet interface eth0 (connected to another server acting as DHCP) / # brctl show br0 bridge name bridge id ...
Haswell's user avatar
  • 131
1 vote
0 answers
30 views

Filtering in INPUT chain didn't work for docker forwarded ports

I have a Linux server running a docker application, it exposes the 80 port inside docker to 20080 on the host. The server has IP address 10.10.10.10 and I need to block 10.10.10.11 from accessing the ...
daisy's user avatar
  • 53.7k
0 votes
0 answers
96 views

Firewall problem on Debian 11 while trying to grant access to 443 port

Want to grant access to port 443 for two other computers. All computers involved have Debian OS. Ping and traceroute are successful from both IP addresses. Rules added to iptables: -A INPUT -s 192.168....
Lars Volker's user avatar
0 votes
1 answer
42 views

Iptables MASQUARADE seems to return the "RESULT" on The Internet instead of the demanding interface

I am trying to do an iptables masquerade from a WireGuard Interface and the Internet. It used to work but lately, I did add a few (just four) WireGuard Interfaces, and it stops working for all of ...
JYL's user avatar
  • 1
0 votes
1 answer
30 views

help understanding these iptables rules

So i have these iptables rules sudo iptables -L -n --line-numbers Chain INPUT (policy DROP) num target prot opt source destination 1 ACCEPT all -- 0.0.0.0/0 0.0....
McJim's user avatar
  • 1
0 votes
0 answers
160 views

tun/tap interface cannot reach the internet

I am trying to set up a NAT: a tun/tap interface tap0, with IP masquerading. But i cannot reach the internet through tap0 when the default route is through it. Can you help me troubleshoot please? ...
HelloWorld's user avatar
0 votes
1 answer
139 views

How to convert iptables to nftables

I need to use nftables, instead of iptables. How can I convert the following to nftables format instead of iptables? sysctl net.ipv4.ip_forward=1 iptables -t nat -A PREROUTING -p tcp --dport 22 -j ...
Crow's user avatar
  • 1
0 votes
0 answers
51 views

Packets are unexpectedly routed to local lo interface

I have a question about routing between different network devices within the same Linux host: I created a Geneve network device (and this example is not related to Geneve tunnel; it's just that I ...
Howard  Yu's user avatar
0 votes
0 answers
21 views

Switching between tun interfaces without affecting session

I have two tun interfaces tun1 and tun2 with IP addresses 10.0.0.1 and 10.0.0.2 respectively. I can make applications use these interfaces by binding them to the IP. For example, I can make iperf3 use ...
Niloy Saha's user avatar
0 votes
0 answers
76 views

iptables rules for transit packets port forwarding (NAT) in both directions (still accepting packets to the current server)

I wrote such rules for forwarding all ports to another server and back, but I don't like that I reserve port 10000 for this. If you do not specify the port, then when receiving requests from 62.105.38....
Maxim Mandrik's user avatar
1 vote
0 answers
37 views

How to forward packets between net namespaces?

I have a lima VM with linux running Ubuntu 23.04 with kernel 6.2 and cgroupsv2. This VM is meant to serve as docker host. When I create docker network in this VM I get an interface in its own ...
Patryk's user avatar
  • 13.7k
0 votes
0 answers
164 views

How to route traffic of docker bridge interface via a VPN interface

I have a VPN interface nordlynx, default interface ens5 and a docker bridge interface br-83e694bd09ad. Currently, the nordlynx interface doesn't have any traffic being routed through it, however doing ...
ItsDrike's user avatar
  • 123
0 votes
0 answers
49 views

How to isolate machine using iptables and cgroups in ubuntu

I am trying to isolate a computer from the network. I am running the following commands in linux: #create net_cls folder for cgroup mkdir /sys/fs/cgroup/net_cls #mount the newly created folder mount ...
Mahe's user avatar
  • 101

1
2 3 4 5
53