Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [iptables]

iptables allow creation of rules to define packet filtering behavior.

0
votes
0answers
21 views

Xen on Ubuntu 18.04 with multiple private NAT networks

This is more of a guide for people who want to set up a VM hosting environment via XEN than it is a question. However i would like to know if there are better ways to do it and if it is secure enough. ...
3
votes
2answers
34 views

Why does my NAT setup only work properly from time to time?

Homework assignment... There are 3 computers in a local network: 192.168.0.185 (the 'client'), 192.168.0.129 (the 'gateway') and 192.168.0.81 (the 'server'). The 'server' is running a HTTP server, so ...
1
vote
1answer
19 views

iptables, rpcbind, nfs (v4) - vagrant cannot mount

The setup debian 9.6 vagrant 2.2.3 VMs are all configured in vagrant as private network with static IPv4 in address space "192.168.3.0/24" as far as I discovered NFSv4 and later is listening to TCP:...
0
votes
1answer
25 views

possible packet loss

I have a program running on my local machine that prints data to port 50000. In a terminal on my local machine I run nc to connect to and print the data on the port. However, when using nc in terminal ...
0
votes
0answers
9 views

OpenVPN Gateway with Killswitch and Prerouting Ports

My Prerouting in UFW Doesnt work. I´m using an VPN Connection via tun0. Internet Connections via tun0 as a gateway works but not the Port Forwarding. im on debian Strech 9 UFW Before Rules. Only ...
0
votes
0answers
26 views

Can i use BPF for firewall, instead of iptables

I read somewhere that the BPF is the new iptables, i tried to find how i can i set up firewall like BPF in debian but no luck. You can't use the BPF like iptables ?
0
votes
0answers
57 views

making a SSH to Deny connections from all IP's except selected [duplicate]

So i made a SSH server and i want it to deny all incoming connections from all ip's except a few. local ip's and my phone 3G public ip...the problem is after a set of iptable rules i only can connect ...
0
votes
0answers
14 views

Getent Hosts For Port 1915/tcp -iptables

I have a scenario: i will have to protect my network from unsolicited access from my DMZ machine, configure node-A to allow new connections on port 1915/tcp from hosts (obtained by 'getent hosts node-...
0
votes
1answer
20 views

Block or drop DNS requests within forwarded packets

I have a default Debian 9 installed in minipc, which is forwarding packets further. I wish to be able to block hosts via domains, means if any forwarded packet of DNS type has request for example of ...
0
votes
1answer
42 views

What substitutes Debian's ufw in Arch?

When I use Debian I install ufw then running the following code to unfilter my desired ports: ufw --force enable ufw allow 22,25,80,443 As I think to move to Arch Linux I'd like to ask what ...
2
votes
0answers
21 views

firewalld to allow routing without NAT between NICs

As a network adminstrator, I often have to set up network gear for remote sites before shipping it. I have found it convenient to use a linux workstation with two network cards, setting the secondary ...
0
votes
1answer
43 views

iptables priority

After deploying all kubernetes ressources I wanna open port 443. I added it to my whitelist table but it is still closed. Same already happened to me for port 80. After flushing all tables, deleting ...
0
votes
0answers
23 views

Using netem on traffic filtered by iptables

I would like to use netem for only partion of the traffic on bridge. Edit 1 So, I was able to figure out at least something. tc qdisc del dev eth0.1 root tc qdisc add dev eth0.1 root handle 1: ...
0
votes
0answers
42 views

Redirecting UDP to local port the reply packet isn't SNATed, w/ iptables

I ran dnscrypt-proxy or tor on Linux listning on 0.0.0.0:1053 to server DNS. This is how we transparent proxy UDP traffic: iptables -t nat -I OUTPUT -p udp --dport 53 -j REDIRECT--to-ports 1053 or ...
0
votes
0answers
26 views

Implementing a quota using iptables in an openwrt system

I would like to explain what I'm currently working on briefly and explain issues I need to address. We have a device (a TP-link Access Point) that we have our custom linux kernel running (which is a ...
1
vote
1answer
71 views

Client based routing on a gateway

I have a network gateway (Debian) with two interfaces: eth0 and tun0. In general all traffic from all clients is routed through tun0. I would like to change that in the following way: client a‘s ...
0
votes
1answer
50 views

How to apply rules per IP on IPTables?

How can I make these rule apply per IP instead of globally? If one IP sends more than 2 packets per second, all packets for all IPs get dropped, I need it to only drop the packets of the IP that is ...
3
votes
1answer
180 views

How to automatically permanently ban IP addresses?

Currently I have been using iptables on a new Debian server running Asterisk. Every day I have been checking auth.log for IP addresses and manually doing iptables -A INPUT -s IPA.DRE.SS.0/24 -j DROP ...
0
votes
1answer
33 views

Route from netns through a veth link

I have created a network namespace (with ip netns add) and a pair of veth links, virt-a and virt-b. The physical link in the root namespace is named eth0. virt-a is in the root namespace and virt-b is ...
-1
votes
0answers
42 views

Preventing other applications from using a port

One of my applications uses randomly-selected ports from a port range to listen on. By default, 40000-59999. The application runs on a firewalled server, and of course expects me to open the whole ...
0
votes
1answer
27 views

Source NAT rule for LXC containers

I've just noticed that MASQUERADE iptables rule added by lxc has ! -d part: iptables -t nat -A POSTROUTING -s 10.0.3.0/24 ! -d 10.0.3.0/24 -j MASQUERADE My guess is that -s 10.0.3.0/24 -d 10.0.3.0/...
0
votes
0answers
21 views

fwmark routing not taken

I'm trying to set up kind of "on my demand dynamic routing". Basically, when I activate a script , I would like it mounts a new interface (tun vpn for example) and define the appropriate firewall and ...
0
votes
0answers
37 views

Installing “iptables” in the remote machine

I have written a C++ program where I would capture the packets on the interfaces. Based on the packet values, I need to install iptables rules on the remote machine. For installing iptables on remote ...
0
votes
0answers
25 views

iptables using Plesk for Docker

I just wanted to use Plesk's Docker management extension and use it together with a nginx reverse proxy for HTTPS. Unfortunately, Plesk's firewall has a bug which makes it unable to block remote ...
0
votes
1answer
33 views

How to route traffic from br0 to tun0 when tun0 is not the default route of the system

I have a bridge network br0 that has the IP 10.0.0.1/24, I have a client connected with the IP 10.0.0.2 to it. I also have a VPN connection (tun0) that has an IP assigned by an DHCP, so it's IP may ...
-1
votes
1answer
15 views

How to open some port for only OpenVNP clients?

I have a web service on an external server, and an openvpn server on the same machine. I need to open port 80, but only for openvpn clients. In other words, if I do nmap-p 80 server_ip I expect to ...
0
votes
0answers
26 views

Routing packets to a container that has a destination that is an interface's IP, stopped working in recent kernels:

I have a flannel-based k8s system with a container at 10.233.64.18. I also have an interface ens224:1 with the IP address 10.5.2.11 With older kernels (3.x) I'm able to force packets destined to 10....
-1
votes
0answers
49 views

Why some bittorrent clients can connect to mine even if I have blocked their port?

I am using transmission as my bittorrent client. I tried to block most Thunder(Xunlei) clients with -A INPUT -p tcp -m tcp --sport 15000 -j REJECT --reject-with icmp-port-unreachable -A INPUT -p udp ...
3
votes
0answers
41 views

Allow iptables communication only between two clients (mac-addresses)

I have a network with two vlans (vlan 7 and vlan 8). i want to block any communication between this two networks except some client mac addresses. I want to allow one client in vlan 7 to communicate ...
1
vote
1answer
31 views

iptables blocking local traffic

My local machine IP: 192.168.0.35 What I did: Answer that i tried here!! sudo iptables -t nat -A OUTPUT -p tcp --dport 80 -j DNAT --to-destination 192.168.0.35:80 The error: Now I can not access ...
0
votes
1answer
34 views

Is it useful to set the policies to DROP for all tables in Iptables?

I use iptables to secure my server. The default policies for all chains in the filter table have been set to DROP # iptables -t filter -L | grep -i \ (policy Chain INPUT (policy DROP) Chain FORWARD (...
1
vote
1answer
41 views

VMs attached to the same bridge cannot ping each other

I am now trying to host two VMs directly by qemu, without any tools like libvirt. I did setup the bridge/tap interfaces for each of them like ip link add br0 type bridge ip addr add 192.168.122.1/24 ...
0
votes
1answer
44 views

Restrict access to 80 port-access only via OpenVPN

Now I have access from outside to 80 port with ownCloud web interface. But I want to get access to it only via OpenVPN connection. I tried to run: # iptables -I INPUT -i eth0 -p tcp --dport 80 -j ...
2
votes
1answer
34 views

Restrict local port access to a specific user

I'm trying to restrict access to a particular port for a particular user on my Debian. Let's say user's id is 1000 and port I would like to block is 5000. I tried using iptables with the following ...
0
votes
1answer
37 views

What is the difference between iptables -S and iptables -L

The help information doesn't seem to be very informative: --list -L [chain [rulenum]] List the rules in a chain or all chains --list-rules -S [chain [rulenum]] Print the rules in a ...
0
votes
1answer
25 views

iptables, vpn server, routing

I set up my server (let's call it server A) firewall so that no input/output rules be allowed, apart from: - incoming ssh conection - outgoing ssh connection This is working well by now! Now, i ...
-1
votes
1answer
34 views

How to forbid my PC in LAN to make DNS queries? (in a PC -> VPN gateway scenario)

scenario: i have 2 pc's that are connected to each other over ethernet in a lan and one of the pc's is configured as a gateway that tunnels the traffic of the other pc over to a vpn service. ...
0
votes
0answers
54 views

Debian : Iptables rule not staying persistent, getting deleted in sometime

I am working on a Debian stable system and we want to add a rule to allow access for Nagios. Unfortunately, the rule is automatically getting deleted after some time. We are unable to find out what's ...
0
votes
1answer
29 views

Editing multiple iptables rules

i am using iptables to allow certain IPs(users) to allow specific ports. Like so - ACCEPT tcp -- 1.2.3.4 anywhere tcp dpts:4358:4362 So for each IP address I have multiple ...
1
vote
1answer
27 views

iptables Masquerade leave out some local packet?

In openwrt i have config lan forward to wan with masqenabled. And my lan network is 192.168.100.0/24. when some pc ping with other network ip e.g: 192.168.1.15, tcpdump will get some local packet in ...
1
vote
3answers
53 views

in iptables, does MASQUERADE match only on NEW connections (SYN packets)?

I observed that MASQUERADE target does not match on packets in the reply direction (in terms of netfilter conntrack). I've a single simple -t nat -A POSTROUTING -s 10.a.0.0/16 -d 10.b.0.0/16 -j ...
2
votes
1answer
122 views

Adding iptables to yocto causes image do_rootfs to fail

My image builds nicely with kernel 4.13 (set in local.conf) and all of my recipes. When I try to add the iptables recipe (v1.6) to my image, the do_rootfs task fails with the following error: ERROR: ...
1
vote
2answers
54 views

Mac Address filter in IPtables

I have an application on 2001 Port and i want allow some users with mac addresses to connect to this port. so i use this commands : sudo iptables -A INPUT -p tcp --destination-port 2001 -j DROP ...
0
votes
0answers
41 views

Transparently redirect all incoming traffic from wifi hotspot to specific port?

I am using my laptop as a wifi hotspot to share my internet connection with other devices. My internet connection goes out through a socks proxy. In my laptop I configured redsocks to redirect all ...
0
votes
1answer
88 views

Enabling rp_filter loose (#2) mode for IPv6

does anyone have a solution to make reverse path filtering work (in loose mode) also for IPv6 and not only for IPv4? The setup I am having is a machine1 connected directly to a machine2, while ...
0
votes
1answer
71 views

How to limit 1 connection per 5 seconds? (IPTABLES)

I want to limit 1 connect per 5 seconds using IPTABLES for people, which are connecting to port "12871/12881". I was trying to find rule for it, but ineffectively. It must be like a "queue" of ...
1
vote
1answer
78 views

fail2ban with iptables-persistent

I've been running fail2ban for a bit, and recently installed iptables-persistent and am using it with ipset for a blacklist (there's one particular IP that is always hammering away at this machine). ...
0
votes
1answer
29 views

Masquerade rule with netfilter-persitent

I use netfilter-persistent to manage a firewall. I would like to share a connection between two interfaces using masquerading (example, or another). When I run those operations by invoking iptables ...
-1
votes
0answers
15 views

Redirect port 8888 on zone public to be redirected to same port on zone “external” and IP address 127.0.0.1

I've an application which is running locally on 127.0.0.1 and port 8888 in addition to openvpn which is installed and using eth1 interface The active zones on firewall firewall-cmd: public (...
0
votes
2answers
55 views

Rejecting TCP packets from certain IP on network using iptables

Say I wanted to reject packets that are sent to my computer from a specific IP on the network using iptables. Do I need to define the destination of the packet in my command or is it sufficient to ...