Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [iptables]

iptables allow creation of rules to define packet filtering behavior.

0
votes
0answers
3 views

Xen on Ubuntu 18.04 with multiple private NAT networks

This is more of a guide for people who want to set up a VM hosting environment via XEN than it is a question. However i would like to know if there are better ways to do it and if it is secure enough. ...
3
votes
2answers
33 views

Why does my NAT setup only work properly from time to time?

Homework assignment... There are 3 computers in a local network: 192.168.0.185 (the 'client'), 192.168.0.129 (the 'gateway') and 192.168.0.81 (the 'server'). The 'server' is running a HTTP server, so ...
1
vote
1answer
19 views

iptables, rpcbind, nfs (v4) - vagrant cannot mount

The setup debian 9.6 vagrant 2.2.3 VMs are all configured in vagrant as private network with static IPv4 in address space "192.168.3.0/24" as far as I discovered NFSv4 and later is listening to TCP:...
0
votes
1answer
24 views

possible packet loss

I have a program running on my local machine that prints data to port 50000. In a terminal on my local machine I run nc to connect to and print the data on the port. However, when using nc in terminal ...
0
votes
0answers
9 views

OpenVPN Gateway with Killswitch and Prerouting Ports

My Prerouting in UFW Doesnt work. I´m using an VPN Connection via tun0. Internet Connections via tun0 as a gateway works but not the Port Forwarding. im on debian Strech 9 UFW Before Rules. Only ...
0
votes
0answers
25 views

Can i use BPF for firewall, instead of iptables

I read somewhere that the BPF is the new iptables, i tried to find how i can i set up firewall like BPF in debian but no luck. You can't use the BPF like iptables ?
0
votes
0answers
57 views

making a SSH to Deny connections from all IP's except selected [duplicate]

So i made a SSH server and i want it to deny all incoming connections from all ip's except a few. local ip's and my phone 3G public ip...the problem is after a set of iptable rules i only can connect ...
0
votes
0answers
13 views

Getent Hosts For Port 1915/tcp -iptables

I have a scenario: i will have to protect my network from unsolicited access from my DMZ machine, configure node-A to allow new connections on port 1915/tcp from hosts (obtained by 'getent hosts node-...
0
votes
1answer
20 views

Block or drop DNS requests within forwarded packets

I have a default Debian 9 installed in minipc, which is forwarding packets further. I wish to be able to block hosts via domains, means if any forwarded packet of DNS type has request for example of ...
0
votes
1answer
42 views

What substitutes Debian's ufw in Arch?

When I use Debian I install ufw then running the following code to unfilter my desired ports: ufw --force enable ufw allow 22,25,80,443 As I think to move to Arch Linux I'd like to ask what ...
1
vote
0answers
20 views

firewalld to allow routing without NAT between NICs

As a network adminstrator, I often have to set up network gear for remote sites before shipping it. I have found it convenient to use a linux workstation with two network cards, setting the secondary ...
0
votes
1answer
41 views

iptables priority

After deploying all kubernetes ressources I wanna open port 443. I added it to my whitelist table but it is still closed. Same already happened to me for port 80. After flushing all tables, deleting ...
0
votes
0answers
23 views

Using netem on traffic filtered by iptables

I would like to use netem for only partion of the traffic on bridge. Edit 1 So, I was able to figure out at least something. tc qdisc del dev eth0.1 root tc qdisc add dev eth0.1 root handle 1: ...
0
votes
0answers
36 views

How to transparent proxy Linux's UDP traffic (DNS queries) using iptables?

I run dnscrypt-proxy or tor on Linux listning on port 1053 for DNS. I googled a lot and find two ways to do a transparent DNS proxy for Linux host: iptables -t nat -I OUTPUT -j REDIRECT -p udp --...
0
votes
0answers
25 views

Implementing a quota using iptables in an openwrt system

I would like to explain what I'm currently working on briefly and explain issues I need to address. We have a device (a TP-link Access Point) that we have our custom linux kernel running (which is a ...
1
vote
1answer
70 views

Client based routing on a gateway

I have a network gateway (Debian) with two interfaces: eth0 and tun0. In general all traffic from all clients is routed through tun0. I would like to change that in the following way: client a‘s ...
0
votes
1answer
50 views

How to apply rules per IP on IPTables?

How can I make these rule apply per IP instead of globally? If one IP sends more than 2 packets per second, all packets for all IPs get dropped, I need it to only drop the packets of the IP that is ...
3
votes
1answer
180 views

How to automatically permanently ban IP addresses?

Currently I have been using iptables on a new Debian server running Asterisk. Every day I have been checking auth.log for IP addresses and manually doing iptables -A INPUT -s IPA.DRE.SS.0/24 -j DROP ...
0
votes
1answer
32 views

Route from netns through a veth link

I have created a network namespace (with ip netns add) and a pair of veth links, virt-a and virt-b. The physical link in the root namespace is named eth0. virt-a is in the root namespace and virt-b is ...
-1
votes
0answers
41 views

Preventing other applications from using a port

One of my applications uses randomly-selected ports from a port range to listen on. By default, 40000-59999. The application runs on a firewalled server, and of course expects me to open the whole ...
0
votes
1answer
27 views

Source NAT rule for LXC containers

I've just noticed that MASQUERADE iptables rule added by lxc has ! -d part: iptables -t nat -A POSTROUTING -s 10.0.3.0/24 ! -d 10.0.3.0/24 -j MASQUERADE My guess is that -s 10.0.3.0/24 -d 10.0.3.0/...
0
votes
0answers
21 views

fwmark routing not taken

I'm trying to set up kind of "on my demand dynamic routing". Basically, when I activate a script , I would like it mounts a new interface (tun vpn for example) and define the appropriate firewall and ...
0
votes
0answers
36 views

Installing “iptables” in the remote machine

I have written a C++ program where I would capture the packets on the interfaces. Based on the packet values, I need to install iptables rules on the remote machine. For installing iptables on remote ...
0
votes
0answers
25 views

iptables using Plesk for Docker

I just wanted to use Plesk's Docker management extension and use it together with a nginx reverse proxy for HTTPS. Unfortunately, Plesk's firewall has a bug which makes it unable to block remote ...
0
votes
1answer
32 views

How to route traffic from br0 to tun0 when tun0 is not the default route of the system

I have a bridge network br0 that has the IP 10.0.0.1/24, I have a client connected with the IP 10.0.0.2 to it. I also have a VPN connection (tun0) that has an IP assigned by an DHCP, so it's IP may ...
-1
votes
1answer
15 views

How to open some port for only OpenVNP clients?

I have a web service on an external server, and an openvpn server on the same machine. I need to open port 80, but only for openvpn clients. In other words, if I do nmap-p 80 server_ip I expect to ...
0
votes
0answers
26 views

Routing packets to a container that has a destination that is an interface's IP, stopped working in recent kernels:

I have a flannel-based k8s system with a container at 10.233.64.18. I also have an interface ens224:1 with the IP address 10.5.2.11 With older kernels (3.x) I'm able to force packets destined to 10....
0
votes
0answers
49 views

Why some bittorrent clients can connect to mine even if I have blocked their port?

I am using transmission as my bittorrent client. I tried to block most Thunder(Xunlei) clients with -A INPUT -p tcp -m tcp --sport 15000 -j REJECT --reject-with icmp-port-unreachable -A INPUT -p udp ...
3
votes
0answers
41 views

Allow iptables communication only between two clients (mac-addresses)

I have a network with two vlans (vlan 7 and vlan 8). i want to block any communication between this two networks except some client mac addresses. I want to allow one client in vlan 7 to communicate ...
1
vote
1answer
31 views

iptables blocking local traffic

My local machine IP: 192.168.0.35 What I did: Answer that i tried here!! sudo iptables -t nat -A OUTPUT -p tcp --dport 80 -j DNAT --to-destination 192.168.0.35:80 The error: Now I can not access ...
0
votes
1answer
34 views

Is it useful to set the policies to DROP for all tables in Iptables?

I use iptables to secure my server. The default policies for all chains in the filter table have been set to DROP # iptables -t filter -L | grep -i \ (policy Chain INPUT (policy DROP) Chain FORWARD (...
1
vote
1answer
40 views

VMs attached to the same bridge cannot ping each other

I am now trying to host two VMs directly by qemu, without any tools like libvirt. I did setup the bridge/tap interfaces for each of them like ip link add br0 type bridge ip addr add 192.168.122.1/24 ...
0
votes
1answer
44 views

Restrict access to 80 port-access only via OpenVPN

Now I have access from outside to 80 port with ownCloud web interface. But I want to get access to it only via OpenVPN connection. I tried to run: # iptables -I INPUT -i eth0 -p tcp --dport 80 -j ...
-1
votes
0answers
48 views

How can you remove the “any any” rule for ssh in iptables?

I try to reduce the allowed connections for ssh via iptables/firewall-cmd. When I list the rules with "iptables -L" it shows me the configured accepted IPs but at the end I have this "any any" rule ...
2
votes
1answer
33 views

Restrict local port access to a specific user

I'm trying to restrict access to a particular port for a particular user on my Debian. Let's say user's id is 1000 and port I would like to block is 5000. I tried using iptables with the following ...
0
votes
1answer
37 views

What is the difference between iptables -S and iptables -L

The help information doesn't seem to be very informative: --list -L [chain [rulenum]] List the rules in a chain or all chains --list-rules -S [chain [rulenum]] Print the rules in a ...
0
votes
1answer
24 views

iptables, vpn server, routing

I set up my server (let's call it server A) firewall so that no input/output rules be allowed, apart from: - incoming ssh conection - outgoing ssh connection This is working well by now! Now, i ...
-1
votes
0answers
20 views

How to translate these ufw rules to iptables?

I want to secure my OpenVPN configuration by using a killswitch. I don't know much about networks and firewalls but I found this ufw config which works just fine. ufw default deny outgoing ufw ...
-1
votes
1answer
34 views

How to forbid my PC in LAN to make DNS queries? (in a PC -> VPN gateway scenario)

scenario: i have 2 pc's that are connected to each other over ethernet in a lan and one of the pc's is configured as a gateway that tunnels the traffic of the other pc over to a vpn service. ...
0
votes
0answers
54 views

Debian : Iptables rule not staying persistent, getting deleted in sometime

I am working on a Debian stable system and we want to add a rule to allow access for Nagios. Unfortunately, the rule is automatically getting deleted after some time. We are unable to find out what's ...
0
votes
1answer
29 views

Editing multiple iptables rules

i am using iptables to allow certain IPs(users) to allow specific ports. Like so - ACCEPT tcp -- 1.2.3.4 anywhere tcp dpts:4358:4362 So for each IP address I have multiple ...
1
vote
1answer
27 views

iptables Masquerade leave out some local packet?

In openwrt i have config lan forward to wan with masqenabled. And my lan network is 192.168.100.0/24. when some pc ping with other network ip e.g: 192.168.1.15, tcpdump will get some local packet in ...
1
vote
3answers
53 views

in iptables, does MASQUERADE match only on NEW connections (SYN packets)?

I observed that MASQUERADE target does not match on packets in the reply direction (in terms of netfilter conntrack). I've a single simple -t nat -A POSTROUTING -s 10.a.0.0/16 -d 10.b.0.0/16 -j ...
2
votes
1answer
119 views

Adding iptables to yocto causes image do_rootfs to fail

My image builds nicely with kernel 4.13 (set in local.conf) and all of my recipes. When I try to add the iptables recipe (v1.6) to my image, the do_rootfs task fails with the following error: ERROR: ...
1
vote
2answers
54 views

Mac Address filter in IPtables

I have an application on 2001 Port and i want allow some users with mac addresses to connect to this port. so i use this commands : sudo iptables -A INPUT -p tcp --destination-port 2001 -j DROP ...
0
votes
0answers
41 views

Transparently redirect all incoming traffic from wifi hotspot to specific port?

I am using my laptop as a wifi hotspot to share my internet connection with other devices. My internet connection goes out through a socks proxy. In my laptop I configured redsocks to redirect all ...
0
votes
1answer
88 views

Enabling rp_filter loose (#2) mode for IPv6

does anyone have a solution to make reverse path filtering work (in loose mode) also for IPv6 and not only for IPv4? The setup I am having is a machine1 connected directly to a machine2, while ...
0
votes
1answer
69 views

How to limit 1 connection per 5 seconds? (IPTABLES)

I want to limit 1 connect per 5 seconds using IPTABLES for people, which are connecting to port "12871/12881". I was trying to find rule for it, but ineffectively. It must be like a "queue" of ...
-1
votes
0answers
33 views

Iptables --update recent module

This is what I have (in short): --update --seconds 60 --hitcount 10 -j DROP Does it mean that the rule will trigger if this hit count is 10 only? But what if the hit count is 9 or 11 will it not ...
1
vote
1answer
78 views

fail2ban with iptables-persistent

I've been running fail2ban for a bit, and recently installed iptables-persistent and am using it with ipset for a blacklist (there's one particular IP that is always hammering away at this machine). ...