Questions tagged [iptables]

iptables allow creation of rules to define packet filtering behavior.

5
votes
0answers
2k views

ip rule not acting on fwmark

I'm trying to use iptables to load balance web traffic over multiple DSL lines by marking the packets and routing based on the mark. I'm working with CentOS 6.6, Kernel 2.6.32-504.16.2.el6.x86_64, ...
5
votes
0answers
2k views

Routing traffic for specific user to specific interface

I have a Linux box with these interfaces: eth0 Link encap:Ethernet HWaddr 14:da:e9:ef:75:7d inet addr:176.9.85.182 Bcast:176.9.85.191 Mask:255.255.255.224 tun0 Link encap:UNSPEC ...
5
votes
0answers
2k views

iptables hangs at applying rules

I have a set of rules that are supposed to give me the most protection before things like fail2ban and other things are added to the mix. The issue is that although everything checks out in the test, ...
4
votes
0answers
268 views

Routing policy is not working

I have an Access Point with OpenWrt. On other host of the same LAN there is a squid (IP Address 192.168.80.148). I'd like to route packages with destination port 80 to 192.168.80.148. So I have root@...
4
votes
0answers
1k views

iptables and ip forwarding for failover

hi i have an ethernet nic interface with 4 additional virtual interfaces (failovers) all configured with public ip4 (IP-1 to IP-5) / netmask 255.255.255.255 / broadcast addr same as ip: eth0 ->...
4
votes
0answers
903 views

Captive Portal on Raspberry Pi (raspbian) with Bridged Adapter

I am trying to create a captive portal on a Raspberry Pi by following the steps from this GitHub project: https://github.com/thgh/pilon I have 2 network interfaces on the pi. wlan0 TP-Link TL-WN821N ...
4
votes
0answers
4k views

Is it possible to throttle upload bandwidth per `IP` basis using `tc`, `htb` and `iptables` ? (Download limitation not required)

Problem I've searched internet like anything but couldn't find much about limiting upload. The solutions given are not limiting IP basis like this one but LAN as a whole. +-----+ +------...
4
votes
0answers
1k views

iptables: using “conntrack” and “recent” modules to block unsolicited packets

When I only allow RELATED and ESTABLISHED packets, and DROP everything else, my firewall rules work perfectly and I have no problems: ### VARIANT A -A INPUT -i wlan0 -m conntrack --ctstate RELATED,...
4
votes
0answers
2k views

Forward multicast between two LAN segments (Chromecast)

I've found some rules but most are inconclusive. Chromecast uses DIAL and discovers via multicast from what I've understood.. I have an Ethernet-connected computer which I would like to route via my ...
4
votes
0answers
924 views

iptables rule no actions on scapy packets

I wrote this rule to change all udp destination IP addresses to 8.8.8.8 when dport is 53: iptables -t nat -A OUTPUT -p udp -m udp --dport 53 -j DNAT --to-destination 8.8.8.8 The rule worked when I ...
4
votes
0answers
529 views

Packets do not cross IP tables Postrouting when originating from an external IP

I'm trying to reflect traffic from the internet to an internal device that I only want to have local access. I have a host in my DMZ that I'm trying to DNAT traffic to this internal device, and SNAT ...
4
votes
0answers
811 views

tunneling FON traffic via Tor

I would like to tunnel the traffic of my FON router through Tor. For that I added a second network card to a local server and connected the FON router to it. Then I set up a DHCP server and configured ...
3
votes
0answers
39 views

Why fail2ban would ban an IP that is whitelisted (on ignoreip)?

I have fail2ban configured to protect the authentication on a postfix service. The jail is working properly on the ban side, but the ignoreip option seems to be ignored or misconfigured since it bans ...
3
votes
0answers
58 views

Allow iptables communication only between two clients (mac-addresses)

I have a network with two vlans (vlan 7 and vlan 8). i want to block any communication between this two networks except some client mac addresses. I want to allow one client in vlan 7 to communicate ...
3
votes
0answers
240 views

Change destination of TEE'd packets

Because of reasons I can't go into here, I found myself having to duplicate a UDP packet stream (netflow data, if it matters) to a second destination. After some research, I discovered that the TEE ...
3
votes
0answers
248 views

How to disable a processes' internet access but allow localhost?

In Ubuntu 17.04, I've been trying to use IP tables to block a processes' internet connection but allow localhost, particularly 127.0.0.1:5500 (a server the process creates). Whilst the process can't ...
3
votes
0answers
236 views

How to forward MITM traffic through SSH tunnel?

Using the arpspoof command I have created a MITM attack on another device. I would now like to forward the traffic through an SSH tunnel (SOCKS5 Proxy). Heres an example.... Client 1-----MITM----->...
3
votes
0answers
385 views

Route subnet traffic through OpenVPN tunnel

i have a linux machine set up as a gateway between an isolated subnet and the rest of my network. NAT is done via iptables and works fine. # Generated by iptables-save v1.6.1 on Mon Nov 27 10:22:22 ...
3
votes
0answers
331 views

How to configure Linux Mint 18.2 for a Captive WiFi Access Point with no Internet Access

I'm looking for help with a Linux webserver (Mint 18.2) with a WiFi Captive Access Point and NO Internet Access. When a mobile device connects to the WiFi it should automatically rerouted to the local ...
3
votes
0answers
1k views

LXC NAT forward host port to container

I've installed LXC on a debian/sid and created a jessie/amd64 container sudo apt-get install lxc debootstrap libvirt-clients \ libvirt-daemon-system ebtables dnsmasq sudo lxc-create -...
3
votes
0answers
100 views

How to emulate LAN adresses locally?

I have this situation: a piece of software got hardcoded IP address (let assume it is being 196.10.10.100:20000) to which it binds a socket and sends TCP and UDP traffic to 196.10.10.9:20000 (...
3
votes
0answers
125 views

Per-user DNS settings for VPN

My system's set to send only a particular user's traffic through a vpn (via iptables and --uid-owner). It works fine, but that user's DNS leaks onto the open net. Any way to send only one user's DNS ...
3
votes
0answers
3k views

Why “echo f” in the case of clearing conntrack table doesn't work on debian?

Many people don't clear the conntrack table when they want to reload their firewall rules. When you have some ESTABLISHED connections, all the sessions won't be affected when you add a rule that ...
3
votes
0answers
152 views

Configuring a Linux Wi-Fi access point to redirect a one-word URL to http://192.168.42.1:8888

I've created a Wi-Fi access point on a Linux box (thanks to hostapd). I'm trying to make it easy for clients to access the Freenet service that's running on said box. Ideally, the user would be able ...
3
votes
0answers
158 views

Can I use iptables to forward between interfaces without setting /proc/sys/net/ipv4/ip_forward?

Can I use iptables to forward between interfaces without setting /proc/sys/net/ipv4/ip_forward? I want a secure default of not forwarding anything and then specifying exactly what should be forwarded....
3
votes
0answers
205 views

Counter MAC spoofing

I use a public wifi. (connect with id/password on an open network) The network is unstable (download stream 500ko/s then drop 0ko/s and stream stop, if a click a later in the stream it's working ...
3
votes
0answers
87 views

iptables not working on mobile broadband

I access the internet using a VPN. With the help of iptables rules all out-going traffic from my machine to the internet is dropped instantly when my VPN connection is abruptly terminated. The ...
3
votes
0answers
423 views

Filtering bridged packets by IP address

I am using a small Ubuntu 12.04 box as a Wi-Fi Access Point. The box has two interfaces which are bridged together as follows: brctl addbr br0 brctl stp br0 off brctl addif br0 wlan0 brctl addif br0 ...
3
votes
0answers
89 views

How to unwrap a tunneled packet in iptables/netfilter and process the tunneled packet

I have a specific question regarding the Linux netfilter/iptables interaction. Let's say I have an IP packet P1 inside of another IP packet P2 (that is, P1 is tunneled). Now, the question is as ...
3
votes
0answers
550 views

Restrict the maximum number of independent IP connection on specific port at the same time

I set up a server as a socks5 proxy. I'd like restrict the maximum number(1 or 5 or 20) independent IP connection on specific port at the same time. I have searched on google, only see some articles ...
3
votes
0answers
687 views

Is iptables able to filter off UNREPLIED connections?

I am a using dd-wrt router and trying to get some per-user metrics, I was wondering about filtering only ESTABLISHED connections or include NEW and RELATED, I have read a lot about this last two, but ...
3
votes
0answers
11k views

Redhat / Centos 7 Firewalld best practice for pptp or L2TP/IPsec rules

Having a quick look at Centos 7, and though I'd spin up a VPN daemon or 3, but immediately discovered the usual packages aren't yet in the core repositories, so had to dig around and found the ...
3
votes
0answers
184 views

Transparent Proxy

I am setting up attempting to set up a transparent proxy on CentOS using Squid. So far I have managed to filter the content and get it working perfectly. The only issue I am having is getting a form ...
3
votes
0answers
1k views

Route all HTTP traffic through polipo

I've set up polipo on my machine to listen to the default port 8123. To test it, I set the in-memory cache to a ridiculously high 2 GB and downloaded a 50 MB file using wget utilizing the proxy. ...
2
votes
0answers
35 views

Simulate network on a single machine

I'm trying to simulate a network on a single machine. I have multiple nodes that communicate through tcp sockets. I tried to create one dummy interface for each node like this: ip link add name ...
2
votes
0answers
35 views

How to forward all packets to another subnet?

I am trying to send a copy of all packets to another ip that is not the same subnet. Let's say I want to send a copy of all traffic from 10.0.1.100 to 10.0.2.100. I have another IP, 10.0.1.101 that ...
2
votes
0answers
60 views

Kernel modules for iptables ftp forward

I have two ARM devices connected to each other with TCP/IP, one of them is connected to my network, on the other one is FTP server. I'm trying to set up port forwarding to ftp using conntrack and ...
2
votes
0answers
140 views

Routing: multiple interfaces/subnets on same device

I am using a debian based gateway for my network. It has four interfaces: eth0: dynamic (connected to ISP) eth1: ip 192.168.1.1 connected to a switch dnsmasq assigns ip addresses to connected ...
2
votes
0answers
266 views

how to set up proxy pass or iptables for ssh?

I tried to set up a nginx server for my pi's at home. The problem was, the dyndns take too long to update. therefore I can't access my gitolite server. So instead of using dyndns, I set up a ec2 ...
2
votes
0answers
108 views

can't forward port through openVPN using iptables on debian

I am trying to forward a port from public machine to another machine that is connected via VPN. that machine connects to internet via this VPN. I am using openvpn and iptables on debian. the vpn ...
2
votes
0answers
1k views

Opening /proc/modules: No such file or directory when starting iptables service

I have a CentOS release 6.9 (Final) when I try to start service iptables # service iptables start Opening /proc/modules: No such file or directory I tried to install iptables service yum erase ...
2
votes
0answers
154 views

OpenVPN private network routing Docker server not accessing

I have completed the Openvpn server setup and able to connect the VPN server from the client. Also, I have modified Iptables rule to access private network (Docker, MySQL, and Kafka). From VPN client ...
2
votes
0answers
100 views

How to run a process if a machine is not listening on a port?

I've got a machine with an IP bound to an interface that is used solely for port forwarding. I would like these forwards to be up as much as possible. Is it possible for iptables to catch ...
2
votes
0answers
118 views

Solus traffic flow

We install Solus in our host machines and run several containers. I've noted that after installation, solus modify iptables adding to Forward chain Solus_in and Solus_out. In those chains he is adding ...
2
votes
0answers
465 views

How to make Linux stop sending IPv6 ICMP redirects?

In case of IPv4 we have net.ipv4.conf.all.send_redirects flag, but it's not available for IPv6. Is there anything better than this? ip6tables -A OUTPUT -p icmpv6 --icmpv6-type redirect -j DROP For ...
2
votes
0answers
91 views

Does Linux still enforce a connection tracking limit?

We've recently upgraded to Ubuntu 16.04 (kernel 4.4) and I've noticed some new behavior regarding net.netfilter.nf_conntrack_max. In the past (with 12.04 running 3.2) if you hit nf_conntrack_max you ...
2
votes
0answers
829 views

iptables script to block all internet access except for desired applications

CONTEXT: I wanted to have a shell script that would block all Inbound/Outbound traffic to my computer, UNLESS I decide I want to use the browser or some other application, in which case I would ...
2
votes
0answers
61 views

ip6tables rule to allow unrecognized next-header

I have a compliance test that is requiring me to respond to unrecognized next-headers per RFC 2460. I am running a debian 3.16 kernel. My current firewall implementation is dropping these frames per ...
2
votes
0answers
378 views

Temporary DNS resolve to local ip (for temporary http redirect)

So here is my high level goal: I have Linux running on a small device that acts as a Wifi-Hotspot for wireless clients. It also runs a web server (nginx) for configuration and I would like to ...
2
votes
0answers
128 views

Multi-ISP Subnet Routing

This is my first question at these boards. I have a configuration where 4 subnets all want to communicate with each other, but each subnet needs to access the internet via its own ISP. I have a ...