Questions tagged [iptables]
iptables allow creation of rules to define packet filtering behavior. The most reliable way to provide an iptables ruleset in a question is with the output of (as root): iptables-save -c
2,616
questions
0
votes
1
answer
31
views
How to define port forwarding
I run a server with a web server running as a rootless podman container. This exposes ports 10080 and 10443 because, as a rootless container, it is not allowed to expose ports 80 and 443.
So that my ...
- 1
1
vote
1
answer
63
views
What exactly does the br_netfilter kernel module control?
I'm trying to get a clear understanding of what exactly the br_netfilter Linux kernel module does (I know it has something to do with networking).
My simple question I'm posing here is as follows:
...
- 153
2
votes
1
answer
26
views
explanation of a iptables rule
what this iptables rule does, exactly?
iptables -t nat -A PREROUTING -p tcp -d 192.168.7.50 --dport 422 -j DNAT --to 192.168.7.50:22
As far I know this rule take the packets incoming to 192.168.7.50:...
- 121
0
votes
1
answer
13
views
IPTables - allow connection from only one random IP simultaneously
Please tell me how to limit the connection to the server's listening port to only one random IP address, if a TCP-Syn comes from any other second one, then it is reset, if there are no connections to ...
- 11
0
votes
1
answer
31
views
iptables allow host for isolated VLAN
I'm having a real trouble trying to do a "simple" tweak in my network. So:
there are two sites, A and B and are connected via IPsec and there's no problem in communication between them.
...
- 127
0
votes
2
answers
29
views
Iptables, subnet rule overwriting ip rule
I want to DROP all packet that come from the subnet 192.168.112.0/24 with destination 192.168.112.0/24 but I want to allow only a specific destination to be accessible (192.168.112.253).
I am using ...
0
votes
0
answers
14
views
iptables MARK works to change gateway, CONNMARK does not
I have a routing table which sends some traffic from another host out a different, higher speed gateway
ip route show table 88
default via 192.168.88.1 dev eno3
192.168.88.0/24 dev eno3 scope link src ...
- 101
1
vote
0
answers
28
views
Nftables does not work as expected to block with meter
Goal: Account for excess packets whose rate source IP and destination port are greater than 200 packets per second, example:
1s, 2s, 3s ...: IP 1.1.1.1 to MyServer:80
[This happens 201 times in ...
- 11
1
vote
0
answers
28
views
Route traffic to different IP addresses while using a single outgoing IP
So I have 3 servers, each with his own public IP address. Now I also have a virtual IP(178.x.x.x) that's publicly accessible and it's mounted to one of those servers.
The virtual IP can be moved ...
- 11
0
votes
0
answers
53
views
What addrtype is to be used for only forwarded packets?
To "focus" an iptables rule on packets destined for the current host, we use "LOCAL", so which should we use for those destined for another host? The documentation is unclear ...
- 153
1
vote
0
answers
22
views
Why I cannot log packages passing through PREROUTING chain?
Recently I have been studying iptables. To grasp how packages pass through every chain of iptables, I inserted log rules at the first line of every default chain. Then I ping the test server from ...
- 11
0
votes
0
answers
42
views
Squid transparent proxy for HTTPS requests that have been redirected by DNAT rule
I would like to look into suspicious activity of possibly infected web application in my network. I wanted to use squid to intercept https requests with https_port directive.
My network setup:
http/...
- 23
0
votes
0
answers
60
views
Can't access webserver inside LAN
I have tried apache and php's internal server, with none of them I can access from another computer if I use the internal IP. \
In the browser it sais "The connection has timed out. The server at ...
- 11
2
votes
1
answer
136
views
UFW Couldn't determine iptables version
I am building a custom embedded Linux platform based on the NXP i.MX8 with Yocto. I want to use UFW to setup the firewall. When I boot the system and try to use UFW it returns an error
Couldn't ...
- 69
0
votes
1
answer
27
views
Firewall : firewalld with docker open port for local service
I'm trying to open port for ssh on non-standard port like 12452, i used these commands and non of them worked
iptables -I INPUT -p tcp --dport 12452 -j ACCEPT
iptables -I OUTPUT -p tcp --dport 12452 -...
- 123
1
vote
1
answer
54
views
nftables deleting a rule without passing handle (similar to iptables delete)
iptables syntax for delete is much simpler. if we replace the "append" with delete we get command for deletion of the rule.
nftable provides similar construct for few rule management aspect ...
1
vote
1
answer
26
views
Linux Webserver not "Accepting" Connections
First off, thanks for any help anyone can provide, I greatly appreciate it!
I have a basic network I have set up for testing. It has pfSense acting as a Gateway/DHCP/DNS host and two Linux machines ...
- 11
0
votes
0
answers
133
views
Podman: automatic network rules and iptables
When I run podman container and share port 4444 as following example:
podman run -dit --name test -p 4444:4444 alpine
It creates following iptable
Chain INPUT (policy ACCEPT)
target prot opt ...
- 163
1
vote
0
answers
57
views
iptables: prohibit access to interface by GID unless it is local network
I have the following rule to prohibit use of interface for users outside of fullnetwork group.
iptables -I OUTPUT -o eth+ -m owner \! --gid-owner fullnetwork -j REJECT
How can I allow local networks ...
- 406
0
votes
3
answers
38
views
Unblock SSH on successful connection using only iptables
I currently have these iptables rules on a Linux router, to block repeated SSH connections:
-A wan_ingress -p tcp --dport 22 -m state --state NEW -m recent --name sshthrottle --set -m comment --...
- 6,554
0
votes
0
answers
22
views
How can I redirect traffic for a specific user to connect to another server?
what I intend to do is transfer the traffic of just a specific user to another server (IP). with the commands below it will work very well to transfer only the traffic from the entire server, which ...
- 1
-1
votes
1
answer
36
views
iptables outgoing drop works but incoming drop seems not working. Why?
I have this setup:
Host machine: 10.40.10.3
Device that is connected to host machine: 10.40.10.6
The traffic that I capture is repeatedly this:
IP 10.40.10.3.53258 > 10.40.10.6.2883: UDP, length 12
...
- 99
0
votes
1
answer
81
views
iptables "--ttl-inc" not working
I get this error:
$ iptables -t mangle -A PREROUTING -d 224.0.0.251 -j TTL --ttl-inc 1
iptables v1.8.7 (nf_tables): unknown option "--ttl-inc"
Try `iptables -h' or 'iptables --help' for more ...
- 1
0
votes
1
answer
31
views
iptables - forwarding traffic from internal network to external network not working
I'm running almalinux 8 and I've 3 network interfaces attached to my VM
`[root@puppetmaster ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
...
- 133
0
votes
1
answer
35
views
RHEL 6.4 basic firewall rule port 6162 does not take effect
I'm dealing with a RHEL version 6.4 server's firewall setting and the goal is to allow remote device to connect tcp port 6162, regardless of the type of services.
The iptables rules are shown below(...
- 57
0
votes
1
answer
84
views
Service only listens on 127.0.0.1 port 1025. How do you allow any computer on your local network to communicate with this service?
Let me open by saying I have scoured the internet, even companies I purchased the software from and it's been 5 months!! So I am turning to the community as my eyes and brain are bleeding from reading ...
- 13
0
votes
1
answer
62
views
Route traffic from one IP address through a different interface
I have a local and a remote network. My local network has a router, ubuntu box and TV. The remote network has a router and a raspberry pi. The local ubuntu box and remote raspberry pi are connected ...
0
votes
0
answers
25
views
How do you mark both incoming and outgoing packets to a cgroup v1 net classifier?
I'm attempting to isolate and tcpdump all network traffic from a single
process, following the instructions here:(How to mark packets by program):
$ sudo bash
# mkdir /sys/...
- 151
0
votes
1
answer
48
views
writing nftables for traffic pre/postrouting to an IDS
Trying to learn nftables since it has been implemented on Openwrt 22.03 with little backwards compatibility for iptables.
I have iptables rules for forwarding traffic from my router to a VM running ...
1
vote
2
answers
243
views
fail2ban SSH jail change action REJECT to DROP
I am trying to configure a simple SSH jail with fail2ban.
Below is the configuration of the jail in /etc/fail2ban/jail.conf :
[sshd]
# To use more aggressive sshd modes set filter parameter "...
- 13
1
vote
2
answers
64
views
fail2ban action ipset retry or timeout
Recently in an Ubuntu 20.04 box from fail2ban I got the following error:
2023-07-13 06:57:05,129 fail2ban.actions [3063]: NOTICE [nginx-http-auth] Ban 2600:1005:b02d:3b6a:c1e:4a7e:6a9f:ccc4
...
- 161
0
votes
0
answers
41
views
IPTABLES Routing traffic from 192.168.1.1 port 21516 to 192.168.2.3 port 80
I am using Debian/Linux Bullseye (version 11)
What I am trying to accomplish is setting up a TabloTV to portfoward through a Linux firewall using IPTABLES. my linux firewall has two ethernet cards (...
- 1
0
votes
1
answer
48
views
What does this iptables rule's options mean?
The rule is
-A KUBE-SEP-G3HEJMIUHDVUA2GR -p udp -m comment --comment "kube-system/kube-dns:dns" -m udp -j DNAT --to-destination :0 --persistent --to-destination :0 --persistent --to-...
- 53
1
vote
1
answer
54
views
Restrict access to SocketCAN to a certain user group
I have a PC to which a robot is connected via CAN (using SocketCAN). I'd like to control who can send commands to the robot, ideally through a group (i.e. only users who are in the "use_robot&...
- 181
0
votes
0
answers
42
views
Port forwarding socks5 proxy across network namespaces
I've finally set up the netns veth openvpn connection that works, made overrides to systemd service files so openvpn depended on netns single shot service and tor of openvpn service. Tor works, at ...
- 103
-1
votes
1
answer
34
views
Iptables not working properly in ubuntu VM under utm app
I want to setup my ubuntu machine like this so that it only opens youtube.com and pw.live website and block all other outgoing traffic.
What I have done so far is created ip_table script below inside ...
- 1
0
votes
1
answer
81
views
Dedicated network interface for OpenVPN
I'm trying to use an OpenVPN client service to serve a vpn connection over specific application. In my case I want to setup my tor and only tor connection to go over vpn. Should How would I achieve ...
- 103
2
votes
1
answer
88
views
nftables does not limit ipv6 traffic in rate limit rule in bridge and ip6 family
I have a wifi router where the wlan0 interface (radio interface) is bridged with the ethernet interface eth0 (connected to another server acting as DHCP)
/ # brctl show br0
bridge name bridge id ...
- 131
1
vote
0
answers
30
views
Filtering in INPUT chain didn't work for docker forwarded ports
I have a Linux server running a docker application, it exposes the 80 port inside docker to 20080 on the host.
The server has IP address 10.10.10.10 and I need to block 10.10.10.11 from accessing the ...
- 53.7k
0
votes
0
answers
94
views
Firewall problem on Debian 11 while trying to grant access to 443 port
Want to grant access to port 443 for two other computers.
All computers involved have Debian OS.
Ping and traceroute are successful from both IP addresses.
Rules added to iptables:
-A INPUT -s 192.168....
0
votes
1
answer
42
views
Iptables MASQUARADE seems to return the "RESULT" on The Internet instead of the demanding interface
I am trying to do an iptables masquerade from a WireGuard Interface and the Internet. It used to work but lately, I did add a few (just four) WireGuard Interfaces, and it stops working for all of ...
- 1
0
votes
1
answer
30
views
help understanding these iptables rules
So i have these iptables rules
sudo iptables -L -n --line-numbers
Chain INPUT (policy DROP)
num target prot opt source destination
1 ACCEPT all -- 0.0.0.0/0 0.0....
- 1
0
votes
0
answers
155
views
tun/tap interface cannot reach the internet
I am trying to set up a NAT: a tun/tap interface tap0, with IP masquerading.
But i cannot reach the internet through tap0 when the default route is through it. Can you help me troubleshoot please?
...
0
votes
1
answer
136
views
How to convert iptables to nftables
I need to use nftables, instead of iptables.
How can I convert the following to nftables format instead of iptables?
sysctl net.ipv4.ip_forward=1
iptables -t nat -A PREROUTING -p tcp --dport 22 -j ...
- 1
0
votes
0
answers
51
views
Packets are unexpectedly routed to local lo interface
I have a question about routing between different network devices within the same Linux host:
I created a Geneve network device (and this example is not related to Geneve tunnel; it's just that I ...
- 19
0
votes
0
answers
21
views
Switching between tun interfaces without affecting session
I have two tun interfaces tun1 and tun2 with IP addresses 10.0.0.1 and 10.0.0.2 respectively.
I can make applications use these interfaces by binding them to the IP. For example, I can make iperf3 use ...
- 109
0
votes
0
answers
75
views
iptables rules for transit packets port forwarding (NAT) in both directions (still accepting packets to the current server)
I wrote such rules for forwarding all ports to another server and back, but I don't like that I reserve port 10000 for this.
If you do not specify the port, then when receiving requests from 62.105.38....
- 101
1
vote
0
answers
36
views
How to forward packets between net namespaces?
I have a lima VM with linux running Ubuntu 23.04 with kernel 6.2 and cgroupsv2. This VM is meant to serve as docker host. When I create docker network in this VM I get an interface in its own ...
- 13.7k
0
votes
0
answers
163
views
How to route traffic of docker bridge interface via a VPN interface
I have a VPN interface nordlynx, default interface ens5 and a docker bridge interface br-83e694bd09ad. Currently, the nordlynx interface doesn't have any traffic being routed through it, however doing ...
- 123
0
votes
0
answers
49
views
How to isolate machine using iptables and cgroups in ubuntu
I am trying to isolate a computer from the network.
I am running the following commands in linux:
#create net_cls folder for cgroup
mkdir /sys/fs/cgroup/net_cls
#mount the newly created folder
mount ...
- 101