Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
The results are in! See what nearly 90,000 developers picked as their most loved, dreaded, and desired coding languages and more in the 2019 Developer Survey.

Questions tagged [iptables]

iptables allow creation of rules to define packet filtering behavior.

5
votes
0answers
742 views

Can I add iptables rule from the inside of a C Linux program only with capabilities or do I need necessarily root?

I need to add an iptables rule from the inside of a C Linux program. How should I do? Do I need root privilege or can I just grant some capabilities? I tried granting CAP_NET_RAW+iep and using popen(...
5
votes
0answers
2k views

ip rule not acting on fwmark

I'm trying to use iptables to load balance web traffic over multiple DSL lines by marking the packets and routing based on the mark. I'm working with CentOS 6.6, Kernel 2.6.32-504.16.2.el6.x86_64, ...
5
votes
0answers
2k views

Routing traffic for specific user to specific interface

I have a Linux box with these interfaces: eth0 Link encap:Ethernet HWaddr 14:da:e9:ef:75:7d inet addr:176.9.85.182 Bcast:176.9.85.191 Mask:255.255.255.224 tun0 Link encap:UNSPEC ...
5
votes
0answers
2k views

iptables hangs at applying rules

I have a set of rules that are supposed to give me the most protection before things like fail2ban and other things are added to the mix. The issue is that although everything checks out in the test, ...
4
votes
0answers
502 views

iptables and cgroups v2 (netfilter's xt_cgroup)

I can't seem to match processes running in cgroup v2 hierarchies with the cgroup module of iptables. I am running Linux 4.13.0 with all required modules: $ grep CGROUP <kernel_config> ...
4
votes
0answers
1k views

LXC NAT forward host port to container

I've installed LXC on a debian/sid and created a jessie/amd64 container sudo apt-get install lxc debootstrap libvirt-clients \ libvirt-daemon-system ebtables dnsmasq sudo lxc-create -...
4
votes
0answers
100 views

How to emulate LAN adresses locally?

I have this situation: a piece of software got hardcoded IP address (let assume it is being 196.10.10.100:20000) to which it binds a socket and sends TCP and UDP traffic to 196.10.10.9:20000 (...
4
votes
0answers
257 views

Routing policy is not working

I have an Access Point with OpenWrt. On other host of the same LAN there is a squid (IP Address 192.168.80.148). I'd like to route packages with destination port 80 to 192.168.80.148. So I have root@...
4
votes
0answers
1k views

iptables and ip forwarding for failover

hi i have an ethernet nic interface with 4 additional virtual interfaces (failovers) all configured with public ip4 (IP-1 to IP-5) / netmask 255.255.255.255 / broadcast addr same as ip: eth0 ->...
4
votes
0answers
886 views

Captive Portal on Raspberry Pi (raspbian) with Bridged Adapter

I am trying to create a captive portal on a Raspberry Pi by following the steps from this GitHub project: https://github.com/thgh/pilon I have 2 network interfaces on the pi. wlan0 TP-Link TL-WN821N ...
4
votes
0answers
4k views

Is it possible to throttle upload bandwidth per `IP` basis using `tc`, `htb` and `iptables` ? (Download limitation not required)

Problem I've searched internet like anything but couldn't find much about limiting upload. The solutions given are not limiting IP basis like this one but LAN as a whole. +-----+ +------...
4
votes
0answers
1k views

iptables: using “conntrack” and “recent” modules to block unsolicited packets

When I only allow RELATED and ESTABLISHED packets, and DROP everything else, my firewall rules work perfectly and I have no problems: ### VARIANT A -A INPUT -i wlan0 -m conntrack --ctstate RELATED,...
4
votes
0answers
2k views

Forward multicast between two LAN segments (Chromecast)

I've found some rules but most are inconclusive. Chromecast uses DIAL and discovers via multicast from what I've understood.. I have an Ethernet-connected computer which I would like to route via my ...
4
votes
0answers
895 views

iptables rule no actions on scapy packets

I wrote this rule to change all udp destination IP addresses to 8.8.8.8 when dport is 53: iptables -t nat -A OUTPUT -p udp -m udp --dport 53 -j DNAT --to-destination 8.8.8.8 The rule worked when I ...
4
votes
0answers
517 views

Packets do not cross IP tables Postrouting when originating from an external IP

I'm trying to reflect traffic from the internet to an internal device that I only want to have local access. I have a host in my DMZ that I'm trying to DNAT traffic to this internal device, and SNAT ...
4
votes
0answers
811 views

tunneling FON traffic via Tor

I would like to tunnel the traffic of my FON router through Tor. For that I added a second network card to a local server and connected the FON router to it. Then I set up a DHCP server and configured ...
3
votes
0answers
30 views

Why fail2ban would ban an IP that is whitelisted (on ignoreip)?

I have fail2ban configured to protect the authentication on a postfix service. The jail is working properly on the ban side, but the ignoreip option seems to be ignored or misconfigured since it bans ...
3
votes
0answers
53 views

Allow iptables communication only between two clients (mac-addresses)

I have a network with two vlans (vlan 7 and vlan 8). i want to block any communication between this two networks except some client mac addresses. I want to allow one client in vlan 7 to communicate ...
3
votes
0answers
194 views

Change destination of TEE'd packets

Because of reasons I can't go into here, I found myself having to duplicate a UDP packet stream (netflow data, if it matters) to a second destination. After some research, I discovered that the TEE ...
3
votes
0answers
228 views

How to disable a processes' internet access but allow localhost?

In Ubuntu 17.04, I've been trying to use IP tables to block a processes' internet connection but allow localhost, particularly 127.0.0.1:5500 (a server the process creates). Whilst the process can't ...
3
votes
0answers
208 views

How to forward MITM traffic through SSH tunnel?

Using the arpspoof command I have created a MITM attack on another device. I would now like to forward the traffic through an SSH tunnel (SOCKS5 Proxy). Heres an example.... Client 1-----MITM----->...
3
votes
0answers
371 views

Route subnet traffic through OpenVPN tunnel

i have a linux machine set up as a gateway between an isolated subnet and the rest of my network. NAT is done via iptables and works fine. # Generated by iptables-save v1.6.1 on Mon Nov 27 10:22:22 ...
3
votes
0answers
324 views

How to configure Linux Mint 18.2 for a Captive WiFi Access Point with no Internet Access

I'm looking for help with a Linux webserver (Mint 18.2) with a WiFi Captive Access Point and NO Internet Access. When a mobile device connects to the WiFi it should automatically rerouted to the local ...
3
votes
0answers
438 views

How to make Linux stop sending IPv6 ICMP redirects?

In case of IPv4 we have net.ipv4.conf.all.send_redirects flag, but it's not available for IPv6. Is there anything better than this? ip6tables -A OUTPUT -p icmpv6 --icmpv6-type redirect -j DROP For ...
3
votes
0answers
126 views

Multi-ISP Subnet Routing

This is my first question at these boards. I have a configuration where 4 subnets all want to communicate with each other, but each subnet needs to access the internet via its own ISP. I have a ...
3
votes
0answers
68 views

System-Level Network Security (Packet Classification and etc.) - SELinux and Libnftnl

I asked the same question in the Security forum, but since no respond did I get, I'm posting it here either. I read that Libnftnl is a userspace library providing a low-level netlink programming ...
3
votes
0answers
329 views

Iptables - Limit Connections per Port

I'm currently interested in setting up a server running a software called shadowsocks- to quickly summarize my problem, shadowsocks authenticates users via a port number and password, and given the ...
3
votes
0answers
134 views

One-to-one virtual IP translation

I've got a bunch of WAN IPs which I want to translate to a bunch of LAN IPs, but only open some ports. None of WAN IPs I want to translate are the primary WAN IP the router uses to connect to the ...
3
votes
0answers
122 views

Per-user DNS settings for VPN

My system's set to send only a particular user's traffic through a vpn (via iptables and --uid-owner). It works fine, but that user's DNS leaks onto the open net. Any way to send only one user's DNS ...
3
votes
0answers
2k views

Why “echo f” in the case of clearing conntrack table doesn't work on debian?

Many people don't clear the conntrack table when they want to reload their firewall rules. When you have some ESTABLISHED connections, all the sessions won't be affected when you add a rule that ...
3
votes
0answers
104 views

No “unreachable” response for an outgoing TCP connection when using fwmark and policy routing

I would like to route locally-generated traffic: to a TCP port "A" of host "H" via the interface "A", to a TCP port "B" of host "H" via the interface "B". Interface "B" is sometimes unavailable. ...
3
votes
0answers
152 views

Configuring a Linux Wi-Fi access point to redirect a one-word URL to http://192.168.42.1:8888

I've created a Wi-Fi access point on a Linux box (thanks to hostapd). I'm trying to make it easy for clients to access the Freenet service that's running on said box. Ideally, the user would be able ...
3
votes
0answers
154 views

Can I use iptables to forward between interfaces without setting /proc/sys/net/ipv4/ip_forward?

Can I use iptables to forward between interfaces without setting /proc/sys/net/ipv4/ip_forward? I want a secure default of not forwarding anything and then specifying exactly what should be forwarded....
3
votes
0answers
203 views

Counter MAC spoofing

I use a public wifi. (connect with id/password on an open network) The network is unstable (download stream 500ko/s then drop 0ko/s and stream stop, if a click a later in the stream it's working ...
3
votes
0answers
87 views

iptables not working on mobile broadband

I access the internet using a VPN. With the help of iptables rules all out-going traffic from my machine to the internet is dropped instantly when my VPN connection is abruptly terminated. The ...
3
votes
0answers
405 views

Filtering bridged packets by IP address

I am using a small Ubuntu 12.04 box as a Wi-Fi Access Point. The box has two interfaces which are bridged together as follows: brctl addbr br0 brctl stp br0 off brctl addif br0 wlan0 brctl addif br0 ...
3
votes
0answers
86 views

How to unwrap a tunneled packet in iptables/netfilter and process the tunneled packet

I have a specific question regarding the Linux netfilter/iptables interaction. Let's say I have an IP packet P1 inside of another IP packet P2 (that is, P1 is tunneled). Now, the question is as ...
3
votes
0answers
539 views

Restrict the maximum number of independent IP connection on specific port at the same time

I set up a server as a socks5 proxy. I'd like restrict the maximum number(1 or 5 or 20) independent IP connection on specific port at the same time. I have searched on google, only see some articles ...
3
votes
0answers
668 views

Is iptables able to filter off UNREPLIED connections?

I am a using dd-wrt router and trying to get some per-user metrics, I was wondering about filtering only ESTABLISHED connections or include NEW and RELATED, I have read a lot about this last two, but ...
3
votes
0answers
11k views

Redhat / Centos 7 Firewalld best practice for pptp or L2TP/IPsec rules

Having a quick look at Centos 7, and though I'd spin up a VPN daemon or 3, but immediately discovered the usual packages aren't yet in the core repositories, so had to dig around and found the ...
3
votes
0answers
183 views

Transparent Proxy

I am setting up attempting to set up a transparent proxy on CentOS using Squid. So far I have managed to filter the content and get it working perfectly. The only issue I am having is getting a form ...
3
votes
0answers
1k views

Route all HTTP traffic through polipo

I've set up polipo on my machine to listen to the default port 8123. To test it, I set the in-memory cache to a ridiculously high 2 GB and downloaded a 50 MB file using wget utilizing the proxy. ...
2
votes
0answers
35 views

Kernel modules for iptables ftp forward

I have two ARM devices connected to each other with TCP/IP, one of them is connected to my network, on the other one is FTP server. I'm trying to set up port forwarding to ftp using conntrack and ...
2
votes
0answers
103 views

Routing: multiple interfaces/subnets on same device

I am using a debian based gateway for my network. It has four interfaces: eth0: dynamic (connected to ISP) eth1: ip 192.168.1.1 connected to a switch dnsmasq assigns ip addresses to connected ...
2
votes
0answers
251 views

how to set up proxy pass or iptables for ssh?

I tried to set up a nginx server for my pi's at home. The problem was, the dyndns take too long to update. therefore I can't access my gitolite server. So instead of using dyndns, I set up a ec2 ...
2
votes
0answers
100 views

can't forward port through openVPN using iptables on debian

I am trying to forward a port from public machine to another machine that is connected via VPN. that machine connects to internet via this VPN. I am using openvpn and iptables on debian. the vpn ...
2
votes
0answers
1k views

Opening /proc/modules: No such file or directory when starting iptables service

I have a CentOS release 6.9 (Final) when I try to start service iptables # service iptables start Opening /proc/modules: No such file or directory I tried to install iptables service yum erase ...
2
votes
0answers
147 views

OpenVPN private network routing Docker server not accessing

I have completed the Openvpn server setup and able to connect the VPN server from the client. Also, I have modified Iptables rule to access private network (Docker, MySQL, and Kafka). From VPN client ...
2
votes
0answers
97 views

How to run a process if a machine is not listening on a port?

I've got a machine with an IP bound to an interface that is used solely for port forwarding. I would like these forwards to be up as much as possible. Is it possible for iptables to catch ...
2
votes
0answers
111 views

Solus traffic flow

We install Solus in our host machines and run several containers. I've noted that after installation, solus modify iptables adding to Forward chain Solus_in and Solus_out. In those chains he is adding ...