2022 Developer Survey is open! Take survey.

Questions tagged [iptables]

iptables allow creation of rules to define packet filtering behavior.

Filter by
Sorted by
Tagged with
0 votes
1 answer
33 views

Why am I getting connection refused with IP address even though it works with localhost and firewall is open?

When I run sudo ufw status on a Ubuntu box, I get the following output sudo ufw status Status: active To Action From -- ------ ---- 22/tcp ...
user avatar
0 votes
0 answers
34 views

Forwarding all traffic

There is such a scheme: The operating system ubuntu server 22.04 is installed on Raspberry Pi4. Through the main network interface, Rpi is connected to the home router and has access to the Internet. ...
user avatar
0 votes
0 answers
20 views

Marking packets of Wireguard peers

I am working with a firewalling system that heavily relies on fwmark to match rules to VPN connections (IPsec so far, but upgrading to WG). AFAICs Wireguard’s fwmark capability only applies to the ...
user avatar
  • 1,692
0 votes
0 answers
27 views

Iptables forwarding port to localhost

How can I use iptables in order to forward a port on domain example.com to 127.0.0.1? To be more clear, I would like to telnet 127.0.0.1 1234 instead of telnet example.com 1234. Is it possible? Thanks ...
user avatar
  • 113
0 votes
2 answers
54 views

How to update, instead of flush and re-write, iptables rules

Currently I'm updating my iptables rules using a bash script, where I call the command: iptables -F then I apply the rules. The problem being that I need to update the rules to gain access to port 80,...
user avatar
0 votes
1 answer
30 views

iptables: Failure when trying to block port access for most IP addresses, except for a few

I am using Debian 8 linux. I'm trying to block input access to a few ports for most IP addresses, except for a small, select list of IP addresses. I am doing the following, but it does not seem to ...
user avatar
  • 271
0 votes
0 answers
13 views

Forward Traffic to virtual box (Genymotion)

I am running an Android virtual machine (Samsung Galaxy S10 & android 10.0 API29) using Genymotion. I have a VPN running there (OpenVPN protocol). Now I am running all this over my Debian based ...
user avatar
0 votes
0 answers
17 views

Redirect traffic from interface tun0 to interface eth0 with iptables

I will first explain the scenario to you. I have a server installed in a virtual machine, and I have a controller connected with a Raspberry on eth0. my Raspberry is connected to my local network. the ...
user avatar
  • 1
0 votes
1 answer
39 views

Wireguard transfer of external ip address

There is an external server (host) with wireguard, ip address 98.XX.XX.XX and internal server (client) with wireguard 192.168.0.2. On client installed web server (nginx, phpfpm). On host all ports ...
user avatar
  • 1
-2 votes
1 answer
5 views

How to map menomic to number in `iptables` `log-level` option?

The numeric log-level I find sometimes used in examples is ambiguous with no clear way to map only from the documentation. How can I map from the log-level to the log-level number (enum value)? http://...
user avatar
  • 3,646
0 votes
1 answer
20 views

UFW Masquerade and outside traffic only on specific interfaces

I have a Ubuntu system (192.168.A.B) that is running as a Wireguard "server" with 2 tunnels with the following networks and UFW rules: Network 10.255.200.0/24 ufw allow XXX/udp && ...
user avatar
  • 103
0 votes
0 answers
36 views

Yet another Wireguard "handshake initiated but no internet or LAN access" request for troubleshooting assistance

I had this exact configuration working for over a year until out of the blue while I was traveling a few weeks ago my wireguard connection stopped working. When I got home I tried to troubleshoot but ...
user avatar
  • 21
1 vote
0 answers
30 views

Trying to forward port 53658 on my openvpn server

i am attempting to forward a port on my OpenVPN server hosted in the cloud. I am currently using transmission to download torrents, and have it set up against a self hosted OpenVPN server running ...
user avatar
  • 11
0 votes
1 answer
29 views

how to disable tcp_resets_received from netdata

I'm receiving TCP reset emails from netdata, how would I disable the resets from happening on my linux GCP Instance? Linux: 20.04 Provider: GCP I've tried doing this but it doesnt seem to be working. ...
user avatar
0 votes
0 answers
28 views

Isolated network chain for multiple KVM guests to access the internet

I have more or less 3 VMs (with KVM) that must be "chained" by 2 isolated connections like that : (NAT/internet access) --> |VM vm_A| -- (isolated network in_1) --> |VM vm_B| -- (...
user avatar
  • 43
0 votes
0 answers
29 views

Routing outgoing traffic on specific port through specific interface

First of all, I would like to thank you for all the previous answers everywhere? I couldn't get there without them. Learned a lot from the Stackexchange community (both about iptables and more). ...
user avatar
0 votes
0 answers
13 views

when iptabless add rules , add this param `-m socket` what will be done?

When I read this project document: there add a rule: iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT I know -m module means load extension, but I don't know -m socket what will be done ...
user avatar
1 vote
1 answer
37 views

NAT setup with iptables MASQUERADE rule adds conntrack entries for packets entering from the external WAN interface

I'm simulating a NAT/router setup inside a network namespace and I've encountered strange behaviour where conntrack entries are being created by packets sent to the router from the external WAN ...
user avatar
0 votes
2 answers
38 views

During the lifecycle of "iptables", in which step, will kernel take advantage of "route table"?

iptables. I have went though the manual of Iptables and known some basic concepts, e.g. chain, table, hook, rule and targets. In the Linux ecosystem, iptables is a widely used firewall tool that ...
user avatar
  • 125
0 votes
1 answer
51 views

Convert iptable rules to firewalld

Need your help to convert this to a firewalld command. I'm not sure that i will do it in proper way, so yeah :) -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A ...
user avatar
  • 109
2 votes
1 answer
46 views

Logging ICMP Packets with Iptables

I am learning about iptables and I am hitting a wall here. My task is to log ICMP Requests and Replies from 192.168.1.2 to 192.168.1.1 That's why I added this rule iptables -A INPUT -p icmp --icmp-...
user avatar
  • 21
1 vote
2 answers
77 views

Iptables and fail2ban on Yocto Linux

I've installed both iptables and fail2ban on my embedded Yocto-Linux. When fail2ban set the following command: iptables -w -I INPUT -p tcp -m multiport --dports http,https -j f2b-NoScript I have that ...
user avatar
0 votes
0 answers
20 views

Convert iptables rules to firewalld for supporting domain

I have a list of iptables rules (see below). The main idea of rules replace source ip address for each request on a specific destination IP address. These rules work properly, but in my case the ...
user avatar
0 votes
0 answers
23 views

Forward a port through a VPN to remote host

Preface: I would like to setup a game server for me and my friends to play on that is hosted on my local machine. My machine is currently at university which doesn't allow me to forward ports. I ...
user avatar
  • 1
0 votes
0 answers
36 views

Use iptables to filter traffic based on cgroup v2

I have been using cgroups and iptables for a while to make decisions on what applications would be allowed access to the network. For example, to only allow outgoing traffic from my own service: mkdir ...
user avatar
  • 101
0 votes
0 answers
24 views

How to forward a port from a private interface to a public one?

I need to forward port 25565 (Minecraft) from a server which has got public ip to another one (without a public ip) to port 25565 too. These servers are in a Wireguard network 10.1.0/24 on interface ...
user avatar
1 vote
1 answer
60 views

Undoing full cone NAT using IPtables for IPsec

I currently have a free VPS hosted in Oracle Cloud. This machine sits in a so-called "Virtual Cloud Network", which is just a virtual LAN with an address in the range of 10.0.0.0/8 (10.0.0....
user avatar
1 vote
1 answer
135 views

qemu/KVM iptables port forwarding

After dozens of articles, blob, tutorials and even answered questions here on stackoverflow, I'm still stuck on my problem: how to setup port forwarding from host to guests VMs. First: sorry for my ...
user avatar
  • 13
0 votes
1 answer
42 views

Netfilter: in which situation, NF_IP_FORWARD will be triggered?

Netfilter Hook: NF_IP_FORWARD There are five netfilter hooks that programs can register with. As packets progress through the stack, they will trigger the kernel modules that have registered with ...
user avatar
  • 125
1 vote
1 answer
95 views

which layer does Netfilter and IPTables works on in the OSI model?

IPTables are the basic and very commonly used firewall in Linux systems. netfilter provides 5 hooks that programs can register with. which layer does Netfilter and IPTables works on? IP Packet level ...
user avatar
  • 125
0 votes
1 answer
19 views

Iptables - Wifi Router User Sessions to OpenVPN in VM

The goal is to route wireless user sessions from a TP-Link TL-WR902AC Wifi travel router on the same LAN to an OpenVPN Client in a virtual machine. My attempt at this is based on previous successful ...
user avatar
1 vote
1 answer
75 views

How to invoke iptables from systemd unit file?

I am trying to implement a highly available memcache service. The startup needs to block incoming connections until the data has been seeded from a running instance. However, even though I have set ...
user avatar
  • 4,225
0 votes
1 answer
29 views

Redirecting traffic for inside network, and allow this from only IP address

I have problem with iptables. In IP tables I make redirect traffic from port 4440 to inside IP Adresses 10.0.10.102:4440 -A PREROUTING -p tcp -m tcp --dport 4440 -j DNAT --to-destination 10.0.10.102:...
user avatar
  • 3
0 votes
1 answer
94 views

Reply on same interface as incoming, but with dynamic IP addresses

I have a system with two network interfaces, both of which are connected to the internet with different IP addresses. I would like responses to incoming requests to be sent over the same interface ...
user avatar
  • 1,297
0 votes
1 answer
80 views

Expose a behind-NAT virtual machine under a VPS's public IP

There is a VPS somewhere in the cloud with a public IP address. Also, there is a virtual machine somewhere deep in my garage, connected to the Internet behind NAT. I have established a permanent ...
user avatar
1 vote
0 answers
366 views

How do i convert iptables rules to nftables rules?

I was trying to figure out how to convert my iptables rules to nftables rules on an Ubuntu system. I tried to convert iptables to nftables using the automated converter, but it didn't appear to work. ...
user avatar
0 votes
0 answers
10 views

AWS OpenVPN, Squid and smartphones

I have AWS EC2 with Ubuntu, OpenVPN server, Squid and some services like calDAV, remote git repo and so on. Usually i use it for these services only and sometimes for internet access by setting up ...
user avatar
1 vote
0 answers
13 views

Unable To Access Port Forwarded Content via Domain Name/Public IP Address From Within LAN

I have iptables setup to forward Traefik ports 80 and 443 to WAN, and am able to view the content via my public IP address and registered domain name from outside of my LAN (tested on mobile with WiFi ...
user avatar
  • 11
0 votes
0 answers
16 views

Is a vpn in and a vpn out possible on one machine?

I have created a vpn setup where i connect with a vpn to my local network with an anonymous vpn out. I use two virtual machines. One is the gateway to the vpn out connecting to one of many vpn ...
user avatar
  • 1
0 votes
2 answers
28 views

How to allow only incoming response to a request made from the machine

I am setting IP table rules in such a way that input traffic from only certain IP range is allowed. -A INPUT -i eth0 -m iprange --src-range x.y.0.0-x.y.255.255 -j ACCEPT -A INPUT -i eth0 -m iprange --...
user avatar
0 votes
0 answers
29 views

BAD REQUEST when using iptables for a captive portal on raspberry pi

I have my raspberry pi setup as a wireless access point by following the documentation on the official site https://www.raspberrypi.com/documentation/computers/configuration.html#setting-up-a-routed-...
user avatar
1 vote
1 answer
51 views

Local transparent proxy SSLSplit causes forwarding loop

I am trying to debug an application which sends RPCs via HTTPS. In order to read the actual RPC content, I am trying to use SSLSplit on the same machine as the application to MITM the connection. To ...
user avatar
  • 113
0 votes
1 answer
38 views

Mismatching kernel versions during installation inside chroot

I'm trying to install Artix on a QEMU virtual machine through an automated script i've wrote, in one of the latest installation steps, where i setup Rootless Docker, it's required to enable the ...
user avatar
1 vote
1 answer
379 views

Understanding docker port forwarding and iptables/nftables

Given a fairly common firewall setup with nftables/iptables (OUTPUT accept, INPUT/FORWARD accept established+related, default drop): table ip nat { chain DOCKER { iifname "docker0&...
user avatar
2 votes
1 answer
29 views

Mixing `conntrack` with `--protocol`, etc trying to rewrite my rules.v4

I just read iptables man page. And it appears that with conntrack module, I should use/prefer --ctproto to --protocol? I will better show you what I used up until now, I migrated at some point to ct*. ...
user avatar
3 votes
1 answer
44 views

iptables group matching: modifying the primary group of a user

I'm trying to configure network access restrictions specific to a group of users on Debian 11 using the command iptables -A OUTPUT -m owner --gid-owner APIGROUP -j REJECT. Here APIGROUP is a group. ...
user avatar
  • 155
2 votes
0 answers
27 views

IPv4 iptables - known TCP attacks - nowadays irrelevant it seems, please elaborate [duplicate]

Are the below iptables rules made obsolete by recent kernel versions for example? Having zero hits on these for ages, and I do look quite often - before reboots usually. Our endpoint machines are ...
user avatar
1 vote
1 answer
53 views

Route between VPN interface and alias interface

I have the following setup: Windows PC <---> Raspberry Pi <---> PLC (DHCP - Ethernet) (DHCP - eth0) (192.168.0.10 - eth0:0) (...
user avatar
0 votes
1 answer
90 views

Setting up Port forwarding on Ubuntu 21.10 with OpenVPN (homerouter port forwarding not working)

I'm trying to setup port forwarding on my local workstation, since the home router is not capable of doing the port forwarding I went on with privateVPN. The privateVPN is configured on OpenVPN with ...
user avatar
  • 1
0 votes
0 answers
26 views

Using iptables to only allow masquerade LAN hosts to access static internet IP, is this possible?

Is there a way to allow intern LAN hosts to masqueraded to a single static internet IP? I've been playing around with the following script and only blocking the gateway console but my LAN systems ...
user avatar

1
2 3 4 5
49