Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [iptables]

iptables allow creation of rules to define packet filtering behavior.

0
votes
0answers
9 views

Changing Destination IP address using iptables and DNAT

I am trying to experiment with DNAT in PREROUTING. I found a tutorial here. It contains the following sentence: This is done in the PREROUTING chain, just as the packet comes in; this means that ...
0
votes
0answers
10 views

iptables-restore - what does `:CHAIN` do?

This is a followup to https://unix.stackexchange.com/a/400203/21615 . When using iptables-restore --noflush, :<chain> <policy> [<packets_count>:<bytes_count>] seems to flush ...
-3
votes
0answers
11 views

I enabled iptables logging from the command line. How do I undo this logging configuration?

I ran sudo iptables -A INPUT -p udp -j LOG --log-prefix "udp:" How do I make it stop?
2
votes
1answer
39 views

Accessing internet hosts from qemu guests behind a bridged network

I am trying to set up a number of qemu quests on the same private network. I want them to not be accessible outside the host but they should be able to access each other and resources from the ...
2
votes
1answer
31 views

ip6table-restore failed in Debian buster/sid

I have the below iptable rule in /etc/iptables/rule.V6 and /etc/iptables/rule.V4 -4 -A INPUT -p icmp -j ACCEPT -6 -A INPUT -p ipv6-icmp -j ACCEPT when I tried to restart the netfilter-persistent, it ...
1
vote
1answer
33 views

iptables-restore failed in Debian buster/sid if it has --multiport option in the rules file

I have /etc/iptables/rule.v4 file contains many rule, the below is the line where I see the issue -A INPUT -p tcp -m multiport --dports 22 -j ACCEPT -A INPUT -p udp -m multiport --dports 16384:32768 -...
3
votes
0answers
24 views

Why fail2ban would ban an IP that is whitelisted (on ignoreip)?

I have fail2ban configured to protect the authentication on a postfix service. The jail is working properly on the ban side, but the ignoreip option seems to be ignored or misconfigured since it bans ...
1
vote
0answers
15 views

Where are iptables rules fetched from while running command 'service iptables save'?

I have created my own file- /etc/sysconfig/iptables-config. On service iptables save my rules are successfully updated and that updates the /etc/sysconfig/iptables file as well. Now even after i ...
1
vote
2answers
47 views

Traffic between subnets VirtualBox

I'm trying to build a prototype of a real network in VirtualBox. I have 3 guest systems: Debian-based router with 3 NICs: enp0s3 Looks outsude.(bridged) enp0s8 LAN1.(gateway to internal ...
0
votes
0answers
15 views

CentOS not recognizing Rackspace verbiage for saving iptables

I'm getting back into the Linux game and have installed CentOS server and am stalled with saving the iptables for Apache operation. The Rackspace guide tells me how to use the service command to save ...
1
vote
1answer
23 views

How do rules with overlap coverage work together in general?

https://serverfault.com/questions/247176/iptables-only-allow-localhost-access#comment224878_247180 iptables -A INPUT -p tcp -s localhost --dport 25 -j ACCEPT iptables -A INPUT -p tcp --dport 25 -j ...
-2
votes
1answer
34 views

What is a chain in iptables?

Iptables is used to set up, maintain, and inspect the tables of IPv4 packet filter rules in the Linux kernel. Several different tables may be defined. Each table contains a number of built-in ...
0
votes
1answer
27 views

How can I configure bidirectional protocol-independent port forwarding?

I am attempting to solve the following problem: I have a system which I will henceforth refer to as "Local" that hosts a service on port 80 and port 443, and depends on sending outgoing requests on ...
0
votes
1answer
25 views

iptables: what happen after a reboot?

Installing NCPA for nagios, I found these instructions iptables -I INPUT -p tcp --destination-port 5693 -j ACCEPT apt-get install -y iptables-persistent Answer yes to saving existing rules Of course,...
0
votes
0answers
29 views

Isolating bridge interfaces from interfaces not connected to them

I am trying to build an emulation platform for emulating an LTE connection using ns-3 and tap interfaces inside a single real host. Since I am a complete beginner at linux networking and routing I ...
0
votes
0answers
42 views

Port forwarding in Linux for UDP doesn't work

I'm trying to apply a port forward rule to forward UDP traffic from my AP on port 53 to a custom DNS server listening to 9053. I tried various calls. None of them worked. I've tried this in Kali. ...
3
votes
2answers
159 views

Has the filtering of all kinds of TCP attacks using iptables become obsolete as they get filtered elsewhere or something else?

Background I am on Debian 10 Buster. I started running a Tor relay on my home IP address. A dedicated full-fledged server is probably not the most energy efficient way, but I want to try it out. And ...
0
votes
0answers
21 views

Docker between-container iptables and fail2ban?

Say I have a public-facing Nginx reverse proxy container (A) that sends traffic to a downstream web service (B). This A container is where TLS connections terminate. The Docker server is also behind ...
0
votes
1answer
23 views

iptable dnat rule not working ubuntu

I'm trying to create a simple iptable rule using the command sample below. But the routing does not work. Any inputs on what is missing as I'm not familiar with iptables. sudo iptables -t nat -A ...
0
votes
0answers
18 views

Port forwarding over OpenVpn

I wanted to host few gameservers on my home network to play with my buddies, the thing is having a public ip is like begging to get DDoS'ed, so what ive done is i have set up a OpenVPN server on a ...
1
vote
1answer
43 views

SSH tunnel with iptables for forwarding

I have a server in my home network (cannot port forward) and a VPS on the WAN. I need requests on a certain port, to, not from, the VPS to be forwarded to my home server. I have an SSH tunnel which ...
1
vote
1answer
28 views

Filter Table Set to Drop all Input packets, but stats accepting all packets

the filter table in my ip tables stats the :INPUT DROP[0:0], but when I type sudo iptables -L, The policy says that it accepts them, I also have a nat table which does accept INPUT, but I even tried ...
0
votes
0answers
9 views

Forward Packet Based on IP

I have four interfaces in the same subnet. eth0 > 192.168.10.10 eth1 > 192.168.10.20 eth2 > 192.168.10.30 eth3 > 192.168.10.40 I want iptables configured to cause the behavior as described below. ...
0
votes
1answer
46 views

Static file to map IP to MAC addresses

I created a mesh network. Sometimes the ARP, IPv4 based applications, or even ping do not correctly respond, any suggestion? Actually, I require to create a file (i.e whatever) that contains IP -> ...
2
votes
2answers
56 views

How can I transform UDP to TCP with netfilter?

I have a wonderful ISP blocking all UDP traffic (except DNS to its own DNS servers). However, I want to use UDP for my VPN solution. I have root over both VPN endpoints, and both of them are using ...
1
vote
1answer
51 views

iptables - forward inbound traffic to internal ip (docker interface)

I have an iptables specific question. I have the following network interfaces defined on my machine: 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 ...
0
votes
0answers
16 views

Redirect traffic between two hosts via iptables

I have 2 hosts: A and B inside 1 local network. (A ---> B) Host A (192.168.1.1) has no access to the telegram server (149.154.167.50:80) Host B (192.168.1.2) has an access (46-Ubuntu x86_64 GNU/Linux, ...
0
votes
1answer
31 views

Trouble setting up Raspbian network bridge

I'm trying to set up a raspberry pi as a network bridge between a wireless access point and a router (the reason for this being that I'd like to connect a device to the AP and use tc on the pi to ...
0
votes
2answers
53 views

How to implement iptables on lxc-container?

I installed lxc-container (fedora 29 amd64) on my ubuntu 18.04 system. The linux container had no firewall command line tools. Therefore I installed iptables into my container and it installed ...
0
votes
1answer
108 views

Forward all traffic to a socks5 proxy port

I followed this answer: Redirect all non-local traffic to a socks proxy root@xxx:~# cat /proc/sys/net/ipv4/ip_forward 1 root@xxx:~# netstat -tapln | grep :4545 | grep LISTEN tcp 0 0 127....
1
vote
1answer
28 views

Web Server access via second interface

I’m trying to access a Web Service (port 8080) on my Raspberry Pi via both of the following interfaces (which have static IPs): Ethernet (eth0, 172.22.0.99, connected to a Netgear router). Wi-Fi (...
0
votes
0answers
20 views

DNAT forwarding based on source

I want to setup two IPSec tunnels using two different Google Cloud VPN gateways -- GW_IP_1 and GW_IP_2 -- with two behind-NAT routers -- R1 and R2. Something like this: GW_IP_1 ---\ ...
1
vote
1answer
96 views

“Not running dhcpcd because /etc/network/interfaces defines some interfaces that will use a DHCP client or static address”

Deployment: VM -- (eth0)RPI(wlan0) -- Router -- ISP ^ ^ ^ ^ DHCP Static DHCP GW NOTE: RPI hostname: gateway • The goal was to make VMs accessible from the outside ...
1
vote
1answer
24 views

Unable to reach ESXi GUI from outside the network, using iptables FORWARD on RPI (Stretch)

Goal: to connect to the VM GUI using browser of PC 2 and PC 1 Here is the topology: VM (ESX Server) <--> (eth0)RPI(wlan0) <--> FunBox Router <--> ISP -- PC 2 ...
0
votes
0answers
14 views

Forward traffic between two hosts, first with a few IP, second with 1 IP and lxd containers

I have a task to create connections between host A with a few IP addresses, say: 1.2.3.4, 1.2.3.5, 1.2.3.6, 1.2.3.7 host B with 1 IP 2.3.4.5 On host B there two lxd containers lx1, and lx2. The goal ...
1
vote
1answer
38 views

Firewall software similar to Outpost for linux

I'm corrently using Windows for my machines with Outpost firewall(Agnitum), but want to switch for linux(not sure what disto yet) and would love to know from you what are my options with linux's ...
1
vote
1answer
23 views

NATed traffic being dropped by rule on INPUT chain

I have the following iptables rules: *nat -A POSTROUTING -o wlan0 -j MASQUERADE COMMIT *filter -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -A INPUT -i wlan1 -p tcp -m state --state NEW --...
-1
votes
1answer
45 views

route traffic of all connected wireless clients to one particular IP and port

I've successfully set up access point on my server using wifi-ap snap wakatana@server:~$ sudo wifi-ap.config get debug: false dhcp.lease-time: 12h dhcp.range-start: 10.0.60.2 dhcp.range-stop: 10.0.60....
1
vote
0answers
19 views

Linux is caching routing and IP information for established connection. Asymmetrical routing issue

We have following setup : client (10.10.0.2) balancer (eth1: 10.11.0.3, eth2: 10.12.0.1) web-server (eth1: 10.11.0.4, eth2:10.12.0.2 and eth1:10.11.0.3 see below how) Masquerading router to route 10....
1
vote
1answer
34 views

fail2ban will not ban again after first one expires

I couldn't make fail2ban to block IP address coming up in postfix log on Debian 9. I rewrote the failregex to be like this: NOQUEUE: reject: RCPT from (.*)\[<HOST>\]:(.*) 550 5.7.1 Service ...
0
votes
1answer
23 views

iptables: having a context for rules

I am looking for a way to get a context/status in iptables-rules. I am not talking about he context of a session here (new, established, ...). E.g. Request to port 80 => PASS + ...
0
votes
1answer
37 views

Is there any way to view nfmark like ctmark?

I understand that iptables --set-mark does not add mark "on" the packets. The MARK target is for associating a mark with the packet in the kernel data structures. The packet itself is not modified. ...
0
votes
1answer
68 views

How does iptable work with linux bridge?

Setup: VM1 --- Bridge -- VM2 VM1 and 2 are on same subnet. Bridge has 2 interfaces added to brctl bridge. When I block VM2 ip using uptables -A FORWARD -s (VM1 ip) -j DENY it doesn't work. I ...
0
votes
0answers
18 views

Packet capture with iptables/rsyslogd?

The usual way I know of capturing packets is with iptables/NFLOG/nflog-group and ulogd with libpcap.so built in. It's a simple matter to enable packet capture in the ulogd.conf file and all rules that ...
0
votes
0answers
44 views

Linux iptables forwarding

I've 3 machines : 1 server with LAN card without internet direct access 1 Windows host with WiFi connection for Internet and 1 LAN port 1 linux virtual machine on the Windows host [...
1
vote
0answers
21 views

How to troubleshoot SFTP/TFTP on Linux/Debian 7 Whitebox Switch

I am having issues diagnosing what the root of my problem is (is sftp/tftp not working due to a configuration issue on my local laptop or a configuration issue on my linux system). I have a Debian 7 ...
3
votes
2answers
89 views

Compare domain blocking by iptables vs dnsmasq-/etc/hosts

I now use dnsmasq, with a large /etc/hosts file obtained from Energized packs [https://energized.pro/#packs]. Some of these are quite large. Trying to get info from the dnsmasq team, which is still ...
0
votes
0answers
41 views

iptables prerouting to multiple ports

I want to redirect SNMP traps. Let's say, receive an SNMP trap on UDP port 162, and redirect the package to ports 10162 and 20162 (both of them). How can I achieve this using iptables? I can ...
0
votes
1answer
22 views

Using firewalld on a gateway certain websites are not accessible over HTTPS

I'm building a firewall / gateway on a raspberry PI (Debian 9) I'm using firewalld to create firewall rules. So far, most sites and services are working fine. However there are a few sites that are ...
2
votes
0answers
89 views

Routing: multiple interfaces/subnets on same device

I am using a debian based gateway for my network. It has four interfaces: eth0: dynamic (connected to ISP) eth1: ip 192.168.1.1 connected to a switch dnsmasq assigns ip addresses to connected ...