Questions tagged [iptables]

iptables allow creation of rules to define packet filtering behavior.

0
votes
2answers
882 views

Local port forwarding using iptables is not working

I am using the following command to forward incoming traffic from port 30 to port 1234. But it's not working. In Wireshark also there is no trace of packets directing to port 1234 are found. sudo ...
1
vote
1answer
242 views

Need to DNAT mac based on vlan and destination IP match.

ebtable rule is not allowing me to specify vlanid and ipv4 protocol in one rule. Also I tried this but the second rule is not getting matched for vlan packet. ebtables -t nat -A PREROUTING --vlan-...
0
votes
2answers
23 views

How to get UFW to read current iptables rules after modification? (Ubuntu)

I am adding a chain using iptables: iptables -N ETDROP When I reboot, this is lost. I read of many ways to make iptables rules permanent... however You must remember, I am using UFW and UFW has ...
1
vote
2answers
1k views

IP packets have wrong source address

I have two 4G modems connecting to a network and sending and receiving data. There is a problem though, as the modems keep getting kicked off the network because the source IP address of the packets ...
0
votes
0answers
30 views

Making my router IPtables better

I recently installed DDWRT and wanted to learn how to set up the firewall properly to deny everything but what I need. Not knowing anything about iptables I copied some stuff (off stackexchange lol) ...
3
votes
1answer
1k views

IPTables redirect all UDP packets including ESTABLISHED

We currently have some rules setup in IPtables that look like the below: -A PREROUTING -d dstip/32 -p udp -m udp --dport 27035 -m u32 --u32 "0x0>>0x16&0x3c@0x8=0xffffffff&&0x0>&...
0
votes
1answer
1k views

iptables - How to allow all connections to the local lan?

What's the simplest way to express "allow all connections to the local lan" for iptables output? Including connections to 192.*, 172.*, 10.*, etc. Can all of this compressed within a single rule?
0
votes
0answers
13 views

how to update iptables docker specific only?

I have got below rules present on a docker container in one server. There is a separate chain called DOCKER iptables -L Chain DOCKER (2 references) ACCEPT tcp -- anywhere 112.13.0.4 ...
0
votes
1answer
35 views

How to route all incoming packets to remote proxy?

I have a Wi-Fi hotspot setup in Kali. Interface wlan0 on 10.10.10.1/24. I setup an Android (10.10.10.2) to proxy requests through Burp on port 10.10.10.1:9999. This is done in the Android's Wi-Fi ...
0
votes
0answers
13 views

How to build iptables kernel module for Yocto?

So I have been having a rough time building the kernel modules for iptables with bitbake. I got the userspace application working, but the net folder is completely missing from my /lib/modules/`uname -...
1
vote
1answer
26 views

iptables with cups - hp printer not visible

I have a linux system on which I need to configure the firewall. Unfortunately scanning the network for printers doesn't work after I set the firewall (without the firewall the the printer is seen). ...
1
vote
1answer
1k views

Editing the iptables file on Asus firmware

I have downloaded the Asus DSL-n14u firmware, extracted the .trx file and located the iptables file, as linked below: https://www.dropbox.com/s/sanz5x2bw0o5xsu/iptables?dl=0 I know the iptables ...
1
vote
0answers
44 views

Forwarding HTTP Request through a VPN and to a local IP [closed]

Hi, what i'm trying to do is explained as follows: I need to retrieve some JSON data from the Arduino (192.168.1.101) making an HTTP request to 80.X.X.X or to the associated DDNS. First, i have a ...
6
votes
1answer
569 views

iptables and cgroups v2 (netfilter's xt_cgroup)

I can't seem to match processes running in cgroup v2 hierarchies with the cgroup module of iptables. I am running Linux 4.13.0 with all required modules: $ grep CGROUP <kernel_config> ...
1
vote
1answer
2k views

docker fails with “iptables: No chain/target/match by that name”

When I try to publish container's ports to the host, docker fails to add iptables rules: $ sudo docker run --rm -p 8080:80 nginx docker: Error response from daemon: driver failed programming external ...
3
votes
2answers
1k views

Iptables not forward traffic

I need to redirect all traffic incoming on port 9750 (the port chat server) to another machine on the same subnet. Ports clients - dynamic. iptables -t nat -A PREROUTING -p tcp -d x.x.x.a --dport ...
2
votes
1answer
1k views

How do you route to secondary interface on the same physical port?

INTERNET<->(wan)BRIDGED_DEVICE(lan)<->ETH_ROUTER<->LAN Problem: Need to access web server on BRIDGED_DEVICE's LAN from INTERNET via ROUTER (BRIDGED_DEVICE web server cannot be accessed form ...
0
votes
1answer
16 views

iptables MASQUERADE vs SNAT for traffic two hops away

I have successfully used the rule: iptables -t nat -A POSTROUTING -o eno1 -j MASQUERADE to NAT traffic from a local 10.0.2.0 subnet out onto the internet (on the far side of eno1). Traffic from a ...
1
vote
1answer
1k views

iptables - Map port on the host to a port in a Docker container

I am running a Docker container inside AWS Elastic Beanstalk, running Amazon's 'Amazon Linux', which I believe is a CentOS derivative. In my development environment, I'd like to enable debugging on ...
1
vote
4answers
64 views

Making my remote SSH more secure

I recently set up SSH access to a small Ubuntu box which I currently log into both from my local network and from offsite. Currently I just have 2 users that are remoting in, but checking my /var/...
1
vote
2answers
25 views

How to save only specific iptables chains?

I need to configure iptables on a linux machine with running docker containers. If I save iptables rules with iptables-save > /etc/iptables/rules.v4, rules from all chains will be written to file. ...
0
votes
0answers
13 views

Routing from LXC container to another host over VPN

I've got an LXC container 10.10.3.100 on host server 10.10.3.1 On server 10.10.3.1 I have tunnel to another server 10.10.2.1 I've added iptables rule: -A POSTROUTING -s 10.10.0.0/16 -o vmbr1 -j ...
1
vote
1answer
1k views

502 Bad Gateway

I ran the following iptables commands to start pptp server: iptables -A INPUT -i venet0 -p tcp --dport 1723 -j ACCEPT iptables -A INPUT -i venet0 -p gre -j ACCEPT iptables -A FORWARD -i ppp0 -o ...
2
votes
1answer
31 views

OpenVPN clients unable to connect to internet

I'm having some issue getting clients to connect to the internet. It can connect to the internal network, but not the internet. Anyone know what might be wrong? Here are my iptables for the OpenVPN ...
0
votes
1answer
53 views

How do I fix this error: “ipset v6.11: Hash is full, cannot add more elements”

When I run the update script for voipbl manually, I get this error from ipset: ipset v6.11: Hash is full, cannot add more elements. I am running it manually because some IPs that are on the blacklist ...
0
votes
1answer
36 views

Does intrusion detection system(IDS) make sense on a firewalled web-server?

I'm running Apache on a server with stateful firewall where new IPv4/IPv6 ingress connections are allowed only to TCP ports 80 and 443. SSH is allowed from few trusted hosts and only certain ICMP/...
0
votes
1answer
21 views

Cant open a port on Debian

I'm have a Debian installation ~$ cat /etc/os-release PRETTY_NAME="Debian GNU/Linux 9 (stretch)" NAME="Debian GNU/Linux" VERSION_ID="9" VERSION="9 (stretch)" ID=debian HOME_URL="https://www.debian....
1
vote
0answers
16 views

How to chain two proxies, or: How to redirect network traffic from one process, to a local proxy

Here's the scenario: I have a proxy, that when Chrome is setup to map requests to, records the requests from Chrome + the responses from the real server. It records all of this in a special format, so ...
1
vote
1answer
1k views

iptables: route packets to example.com via public proxy

I want to access certain websites via a public proxy and I can't seem to get it right using iptables. Let's say I want to access example.com having ip address 1.2.3.4 via a public proxy at 5.6.7.8:...
0
votes
1answer
1k views

IPTABLES comment: No chain/target/match by that name

Faced with error when adding new rule with 'comment': # iptables -I INPUT 1 --source 66.***.***.78 -j REJECT -m comment --comment "Some" iptables: No chain/target/match by that name. Without comment ...
0
votes
1answer
31 views

How to forward traffic to socks proxy?

Installation is like this: on server1, use ssh -D server1:1080 root@server2 to setup a socks proxy. meanwhile, on server1, there is an IPsec/xauth VPN server running with vpn network 192.168.42.0/24. ...
1
vote
1answer
1k views

Some packets are flagged as INVALID by iptables

I configured a proxypass rule in order to redirect requests from the port 443 to a JBoss server running on port 8080. All works fine except some 503 errors in the Apache log, around 10 per day: In ...
1
vote
2answers
1k views

How can I set up the ULOG target with iptables and MySQL

I'm running CentOS 6.6 32bit as a firewall box using iptables. I want to be able to use the ULOG target to store dropped packets in a MySQL database for statistical analysis. After much Googling I ...
0
votes
1answer
62 views

iptables redirect dns to proxy

Can we redirect DNS (tcp/udp) requests to Squid proxy in non-transparent mode (3128) using iptables? (Would the squid proxy understand this and process it?) example rule to redirect tcp 53 (It could ...
2
votes
1answer
1k views

How to use both syn proxy and connlimit rules with iptables?

I want to write both syn proxy and connlimit rules. I want to send packets to syn proxy first because of performance issue. Here is rule sample. #syn proxy rule iptables -t raw -A PREROUTING -i ...
0
votes
1answer
31 views

Conntrack and dynamic ipset/iptables rules

I don't understand some basic concepts of conntrack module. First of all, I'm sure it's enabled in my system (Ubuntu 18.04), modinfo shows info about nf_conntrack and /proc/modules file tells ...
-3
votes
0answers
36 views

How to intercept DNS and prompt before completion of each query [duplicate]

A gateway is to block all traffic except DNS, intercept DNS and prompt the user before completion of each DNS query. If the user's answer is yes, complete the DNS query and add an iptables rule to ...
0
votes
1answer
24 views

Why would my router reject forwarded packets to itself?

The first rule in the FORWARD chain is interesting to me. Why would this be a necessary rule if the policy is to DROP? root@tomato:/tmp/home/root# iptables -L --line-numbers Chain INPUT (policy DROP) ...
1
vote
0answers
18 views

How to stop mangled output packets from using default route?

I have a router. It has a few interfaces. One of them is the VPN called vpn0, one is the default route to the physical interface, called out0 and an input interface in0. Packets from in0 with ...
7
votes
3answers
2k views

Setting traffic class on return packets

I have a network topology: Server <-> router1 <-> router2 <-> router3 <-> edgeRouter <-> "internet" All routers are linux based, and support iptables. The server sets ...
2
votes
0answers
35 views

Simulate network on a single machine

I'm trying to simulate a network on a single machine. I have multiple nodes that communicate through tcp sockets. I tried to create one dummy interface for each node like this: ip link add name ...
1
vote
1answer
56 views

Why ip_forward is disable by default? any side effect?

I need to forward an interface and I wonder why is disable by default? There is any security issue when I enable it? Is there any side effect when I enable it?
0
votes
0answers
14 views

Is the default state of iptables reflected in UFW?

When checking the firewall status using ufw status, does this reflect the current status of iptables or what is currently set in ufw? For example, lets say the default state of iptables blocks all ...
-1
votes
0answers
6 views

psad keeps removing and adding bad IP even though bad IP set in auto_dl

I've set a bad IP to auto_dl with DL 5. This IP keeps hammering my server. So, I thought it'd be a good idea to put it in this file. Unfortunately, I've got this: # systemctl status psad mai 28 15:58:...
0
votes
0answers
15 views

Why is netfilter not applying rule to these packets?

There are 4 servers: A - partner server with public IP B - our server with public IP C - our another server, but in LAN D - external third party server for testing I control B, C and D. There is GRE ...
1
vote
1answer
181 views

How to catch conntrack markers correctly?

Server with DHCP (iface eth0 172.5.1.1/24) gives internet via openvpn tunnel(iface tun0 10.8.1.6) to lan clients. I need to mark tcp connections from exact lan client, for example 172.5.1.123 ...
1
vote
1answer
25 views

why iptables marked but not route as my except

I want to control the route packets of my browser using domain name , let traffic packets within special domain names through VPN ,and other traffic packets without special domain names through ...
0
votes
0answers
27 views

Why is my FWKNOP SSH set up not working?

I'm learning about port knocking and SPA. I'm following along with a guide, everything seems to be working fine until I close down my ports on my server. I am running two ubuntu servers on VirtualBox ...
2
votes
2answers
4k views

Drop packets with PREROUTING in iptables

The filter table is best place to drop packets, agreed. But, out of the box, Docker bypasses INPUT filter rules with PREROUTING to its own FORWARD rules making Docker containers world-accessible. ...
1
vote
1answer
30 views

Firewall Blocking NATed Traffic Suddenly after adding a NIC

I have home a server that used to have one NIC, but I added a second one to give a dedicated link to the TV tuner. I went from having eth0 (the onboard NIC) to enp7s0 (the new NIC) and enp9s1 (the ...