Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [iptables]

iptables allow creation of rules to define packet filtering behavior.

1
vote
0answers
33 views

Forwarding HTTP Request through a VPN and to a local IP [on hold]

Hi, what i'm trying to do is explained as follows: I need to retrieve some JSON data from the Arduino (192.168.1.101) making an HTTP request to 80.X.X.X or to the associated DDNS. First, i have a ...
0
votes
0answers
17 views

iptables with cups - hp printer not visible

I have a linux system on which I need to configure the firewall. Unfortunately scanning the network for printers doesn't work after I set the firewall (without the firewall the the printer is seen). ...
0
votes
1answer
14 views

iptables MASQUERADE vs SNAT for traffic two hops away

I have successfully used the rule: iptables -t nat -A POSTROUTING -o eno1 -j MASQUERADE to NAT traffic from a local 10.0.2.0 subnet out onto the internet (on the far side of eno1). Traffic from a ...
0
votes
0answers
25 views

How to route all incoming packets to remote proxy?

I have a Wi-Fi hotspot setup in Kali. Interface wlan0 on 10.10.10.1/24. I setup an Android (10.10.10.2) to proxy requests through Burp on port 10.10.10.1:9999. This is done in the Android's Wi-Fi ...
1
vote
4answers
59 views

Making my remote SSH more secure

I recently set up SSH access to a small Ubuntu box which I currently log into both from my local network and from offsite. Currently I just have 2 users that are remoting in, but checking my /var/...
1
vote
2answers
22 views

How to save only specific iptables chains?

I need to configure iptables on a linux machine with running docker containers. If I save iptables rules with iptables-save > /etc/iptables/rules.v4, rules from all chains will be written to file. ...
0
votes
0answers
10 views

Routing from LXC container to another host over VPN

I've got an LXC container 10.10.3.100 on host server 10.10.3.1 On server 10.10.3.1 I have tunnel to another server 10.10.2.1 I've added iptables rule: -A POSTROUTING -s 10.10.0.0/16 -o vmbr1 -j ...
0
votes
0answers
17 views

Analyzing iptables logs to map network traffic and create firewall rules / access lists [closed]

Primary task: Setup of a segmented network with several security zones, allowing only specific protocols to communicate across zones. Objective: Collect and analyze iptables logs (or similar) ...
2
votes
1answer
30 views

OpenVPN clients unable to connect to internet

I'm having some issue getting clients to connect to the internet. It can connect to the internal network, but not the internet. Anyone know what might be wrong? Here are my iptables for the OpenVPN ...
0
votes
1answer
35 views

Does intrusion detection system(IDS) make sense on a firewalled web-server?

I'm running Apache on a server with stateful firewall where new IPv4/IPv6 ingress connections are allowed only to TCP ports 80 and 443. SSH is allowed from few trusted hosts and only certain ICMP/...
0
votes
1answer
21 views

Cant open a port on Debian

I'm have a Debian installation ~$ cat /etc/os-release PRETTY_NAME="Debian GNU/Linux 9 (stretch)" NAME="Debian GNU/Linux" VERSION_ID="9" VERSION="9 (stretch)" ID=debian HOME_URL="https://www.debian....
1
vote
0answers
16 views

How to chain two proxies, or: How to redirect network traffic from one process, to a local proxy

Here's the scenario: I have a proxy, that when Chrome is setup to map requests to, records the requests from Chrome + the responses from the real server. It records all of this in a special format, so ...
0
votes
1answer
47 views

How do I fix this error: “ipset v6.11: Hash is full, cannot add more elements”

When I run the update script for voipbl manually, I get this error from ipset: ipset v6.11: Hash is full, cannot add more elements. I am running it manually because some IPs that are on the blacklist ...
0
votes
1answer
28 views

How to forward traffic to socks proxy?

Installation is like this: on server1, use ssh -D server1:1080 root@server2 to setup a socks proxy. meanwhile, on server1, there is an IPsec/xauth VPN server running with vpn network 192.168.42.0/24. ...
0
votes
1answer
56 views

iptables redirect dns to proxy

Can we redirect DNS (tcp/udp) requests to Squid proxy in non-transparent mode (3128) using iptables? (Would the squid proxy understand this and process it?) example rule to redirect tcp 53 (It could ...
-3
votes
0answers
36 views

How to intercept DNS and prompt before completion of each query [duplicate]

A gateway is to block all traffic except DNS, intercept DNS and prompt the user before completion of each DNS query. If the user's answer is yes, complete the DNS query and add an iptables rule to ...
0
votes
1answer
31 views

Conntrack and dynamic ipset/iptables rules

I don't understand some basic concepts of conntrack module. First of all, I'm sure it's enabled in my system (Ubuntu 18.04), modinfo shows info about nf_conntrack and /proc/modules file tells ...
0
votes
1answer
24 views

Why would my router reject forwarded packets to itself?

The first rule in the FORWARD chain is interesting to me. Why would this be a necessary rule if the policy is to DROP? root@tomato:/tmp/home/root# iptables -L --line-numbers Chain INPUT (policy DROP) ...
1
vote
0answers
18 views

How to stop mangled output packets from using default route?

I have a router. It has a few interfaces. One of them is the VPN called vpn0, one is the default route to the physical interface, called out0 and an input interface in0. Packets from in0 with ...
2
votes
0answers
35 views

Simulate network on a single machine

I'm trying to simulate a network on a single machine. I have multiple nodes that communicate through tcp sockets. I tried to create one dummy interface for each node like this: ip link add name ...
1
vote
1answer
49 views

Why ip_forward is disable by default? any side effect?

I need to forward an interface and I wonder why is disable by default? There is any security issue when I enable it? Is there any side effect when I enable it?
0
votes
0answers
12 views

Is the default state of iptables reflected in UFW?

When checking the firewall status using ufw status, does this reflect the current status of iptables or what is currently set in ufw? For example, lets say the default state of iptables blocks all ...
-1
votes
0answers
5 views

psad keeps removing and adding bad IP even though bad IP set in auto_dl

I've set a bad IP to auto_dl with DL 5. This IP keeps hammering my server. So, I thought it'd be a good idea to put it in this file. Unfortunately, I've got this: # systemctl status psad mai 28 15:58:...
0
votes
0answers
14 views

Why is netfilter not applying rule to these packets?

There are 4 servers: A - partner server with public IP B - our server with public IP C - our another server, but in LAN D - external third party server for testing I control B, C and D. There is GRE ...
0
votes
0answers
26 views

Why is my FWKNOP SSH set up not working?

I'm learning about port knocking and SPA. I'm following along with a guide, everything seems to be working fine until I close down my ports on my server. I am running two ubuntu servers on VirtualBox ...
1
vote
1answer
24 views

why iptables marked but not route as my except

I want to control the route packets of my browser using domain name , let traffic packets within special domain names through VPN ,and other traffic packets without special domain names through ...
1
vote
1answer
30 views

Firewall Blocking NATed Traffic Suddenly after adding a NIC

I have home a server that used to have one NIC, but I added a second one to give a dedicated link to the TV tuner. I went from having eth0 (the onboard NIC) to enp7s0 (the new NIC) and enp9s1 (the ...
0
votes
0answers
28 views

routing vpn connection via gateway1 but vpn traffic via gateway2

Situation: network via dhcp internet gateway 192.168.x.1 dhcp server 192.168.x.10 dhcp gateway 192.168.x.2 => this gateway has a permanent vpn tunnel via openvpn to vpn provider, so I want to ...
0
votes
0answers
17 views

ICMP “TTL expired in transit” and “Fragmentation required” messages when forwarding is disabled

I have a server with IPv4 forwarding(routing) disabled: # sysctl net.ipv4.ip_forward net.ipv4.ip_forward = 0 # Is there a circumstance where such server sends out ICMP 11/0(TTL expired in transit) ...
-1
votes
0answers
12 views

PIVPN with one 4G connection (wlan0) and one landline (eth0)

In my current project I am trying to make a "out of bounds" Raspberry PI(Raspbian Strech) for remote troubleshooting of network equipment. To connect to the remote location in case of an outage of ...
0
votes
0answers
22 views

Creating Iptables rules for router in front of several servers

I'm trying to create a test environment for some software I've written and I'm running into issues with creating the right iptable rules. I have a router that the rules are being written too, and I ...
0
votes
0answers
15 views

How do I drop non-Tor traffic in iptables and allow only Whonix-Gateway traffic?

I want to drop all non-Tor traffic in iptables and allow only traffic from Whonix-Gateway virtual machine on the host. My iptables config: # Generated by iptables-save v1.8.2 on Sat May 18 15:54:56 ...
0
votes
0answers
19 views

How to apply iptables nat rules on reply packets only?

I know the following about iptables nat chains. PREROUTING chain are applied for packets that have just arrived on an interface. POSTROUTING chain works on those packets leaving an interface. OUTPUT ...
1
vote
1answer
31 views

Is it possible to talk to a different subnet through another device?

I am trying to adjust the networking on a system so that two subnets can talk to each (ping) other via a device. Setup looks as follows: (192.168.1.128) (172.16.248.223) Router <------&...
0
votes
0answers
28 views

Assigning a IPTABLES custom chain to the OUTPUT chain

I've created a custom chain with a bunch of IP addresses to block. I now want to assign my custom chain, called ipblacklist to the OUTPUT chain so that those sites will be blocked. My ipblacklist ...
0
votes
0answers
29 views

Making Squid Work with DD-WRT

I'm trying to run Squid with DD-WRT, but I can not. I use as a DNS server the Pi-hole. Ubuntu 18.04 This error appears ERROR The requested URL could not be retrieved The following error was ...
0
votes
0answers
20 views

Linux seperate a network into two using MACVLAN - one for internet, one for internal communication

I have two minimal embedded devices that has ip, ipconfig, nat, etc support. The embedded devices share network over USB. I want to configure each board so that they have two seperate interfaces, ...
1
vote
0answers
27 views

Redirecting incoming tcp traffic back to the sender

I have created this program that runs inside a router. The program is essentially a speed test and for the upload part of the test, the program is utilising a lot CPU and generating a file inside the ...
1
vote
0answers
16 views

Routing specific user/application through VPN only

I have a similar setup to a question raised here some time ago. Here I have a VPN (OpenVPN) running on my ClearOS server (acting as a gateway for my LAN's internet/security, with two network ...
0
votes
0answers
53 views

Wireguard server with active OpenVPN client

I need to run a Wireguard server on a machine with an active OpenVPN client. Clients connected to the Wireguard server would be NATed to the OpenVPN client at 'tun0' and access the internet through ...
1
vote
0answers
29 views

Unable to block packets to Guest OS with iptables

My home workstation is running a windows OS Guest Machine with bridged connection to br-ex ( OVS bridge). enp0s25 is the LAN NIC connected to br-ex ovs bridge. Host OS has IP 194.168.1.4 and ...
0
votes
0answers
35 views

Route traffic to particular interface for specific port

I would like to route the outbound traffic to a particular interface for ssh port. We have a routing table like this: default via gw_ip dev eth0 default via gw_ip dev eth1 metric 10001 10.x.y.z/23 ...
3
votes
1answer
86 views

iptables to allow traffic from one country only

I would like to allow traffic from one country only. I have seen and read online multiple ways, but most of them are outdated (with Xtables-addons), and the other half show how to blacklist IPs that ...
0
votes
1answer
29 views

iptables Performance with long chains

I'd like to know if long chains in iptables is likely to cause a performance issue. Here a long chain might be >2,500 individual IP bans. My concern is that my limited knowledge of iptables suggests ...
0
votes
0answers
20 views

Network gateway with OpenVPN and HAProxy on one server --> routing problems

I am setting up a gateway for my network that includes a reverse proxy (HAProxy) and a openvpn server on the same machine. I want to use the openvpn to connect to a vpn provider so that all the ...
0
votes
0answers
30 views

Sharing Internet Through a Network Interface

I am trying to share internet to another device using USB NCM functionality. I have successfully configured usb0 interface. However, I am not sure how to share internet. So far I have done: On the ...
2
votes
0answers
35 views

How to forward all packets to another subnet?

I am trying to send a copy of all packets to another ip that is not the same subnet. Let's say I want to send a copy of all traffic from 10.0.1.100 to 10.0.2.100. I have another IP, 10.0.1.101 that ...
1
vote
1answer
40 views

Block ping to interface in different subnet

I am currenttly refining the Firewall Rules on my DD-WRT Router. Specifically my question is about this Rule: iptables -I INPUT -i eth1.10 -d ! 192.168.10.0/28 -j DROP I was wondering if it was ...
0
votes
1answer
16 views

Trying to setup port redirection through 2nd gateway

I am trying to setup configuration where all connections to port 161 will go through another gateway (through openvpn) while others are going directly [localhost] -> [gateway] -> [remote] - OK [...
1
vote
1answer
21 views

Block MAC for a port iptables

I'm trying to block a MAC address for a specific port. iptables -I FORWARD -p tcp -m mac --mac-source 40:00:00:74:0A:00 --destination-port 80,443 -j DROP