Questions tagged [iptables]

iptables allow creation of rules to define packet filtering behavior.

Filter by
Sorted by
Tagged with
1
vote
2answers
82 views

nftables preventing services from resolving on IPv6

I've got my server set up with long list of services, and everything is working great... on IPv4. But when I test them against IPv6 nothing is resolving. After disabling nftables everything started ...
1
vote
0answers
125 views

Use macvlan to emulate multiple hardware devices on network

I am trying to use linux's network name spaces to emulate multiple devices on my local network. I want this to appear as actual network devices, not my laptops IP masquerading on the subnet. Is this ...
1
vote
0answers
44 views

iptable rules for double chain vpn

I want to setup multi chain vpn using openvpn. The idea is as the following Client ------- > VPS1 ------------ VPS2 --------- Internet I have the following setup: Windows PC Client VPS1 Debian: ...
1
vote
0answers
61 views

Iptables forward traffic to gost transparent proxy

Gost is a networking module which allows you to treat it as many things including a transparent proxy. On their page regarding transparent proxies you can see that there is a way to write iptables ...
0
votes
0answers
62 views

RHEL 7.7: iptables NOT taking effect after reboot, only after “systemctl restart iptables”

I have a virtual machine running on a RHEL 7.7 machine. I have modified the iptables to forward HTTPS traffic to the virtual machine. This works as expected; however after a reboot, the iptables are ...
1
vote
0answers
115 views

iptables inserts duplicate rules when name localhost is used instead of 127.0.0.1

When I insert a rule into the INPUT chain, it's duplicated twice (that is, along with the original rule, there are three exact copies). Here's the command given: /sbin/iptables -w -I INPUT 20 -m ...
0
votes
0answers
2k views

Error kex_exchange_identification occurs when attempting to ssh over local network because of iptables entry

When I attempt to connect to a machine via open ssh over a local network I get the following error: kex_exchange_identification: read: Connection reset by peer Connection reset by 192.168.1.39 port ...
1
vote
1answer
250 views

iptables not logging to /var/log/messages on centos 7

I am trying to set up IP Tables on CentOS 7 which I've done in the past but for some reason I can't get it to log the dropped packets like I'd expect. In the ip tables config I have the following *...
0
votes
3answers
4k views

how to check iptables status in centos 7.6

When I check iptables status in CentOS Linux release 7.6.1810 (Core) like this: [miao@MeowK8SSlave4 ~]$ service iptables status Redirecting to /bin/systemctl status iptables.service Unit iptables....
1
vote
2answers
42 views

iptables append fails when using state module

I'm trying to set up iptables on a custom linux kernel. I have ran into a little issue where state module seems to be load but i receive an error when i attempt to set a state. Iptables help menu ...
1
vote
1answer
35 views

Routing Linux traffic

I am currently setting up an environment in 2 sites. All servers are Linux based. First site is my office and second site is AWS. I have 2 servers in AWS within a VPC with site to site VPN: Web01 - ...
1
vote
2answers
319 views

is it possible to mention destination interface in iptables while dnat?

I am trying to do dnat using iptables like below iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 9000 -j DNAT --to-destination 10.0.0.1:9000 Is it possible to mention output interface also ...
1
vote
1answer
439 views

Block Outbound SSH Connection on Ubuntu for all ports except 22

I can see on my server where SSH outbound connections are being created in high amount. Will it be possible to block the ssh command for all the users except one specific user. Or Will it be ...
1
vote
0answers
17 views

How can I switch dinamically the output interface in a router depending on input interface?

I have an Ubuntu 18.04 acting as router with 3 interfaces. Two of them end up in the same device (they are used as dual path since depending on the situation one of the paths can be down or viceversa)....
3
votes
1answer
2k views

How do you route traffic from only one user through wireguard?

With a wireguard configuration provided from a VPN company: How do you modify iptables and wg0.conf to route only traffic from the user vpn trough wireguard's interface wg0, leaving all other ...
0
votes
0answers
37 views

IP and port redirection not working

I deployed a CentOS with VirtualBox (with a website inside) in my client's office. In order to give remote assistance, I connect that CentOS with a IPSec VPN in a cloud machine. The requirement is ...
0
votes
1answer
72 views

Ping works, but I get 'No route to host' even though my firewall is off

I want to check if I can connect to Rspamd's Fuzzy port and have a very strange problem - I can ping a the host and get an answer (0% packet loss). But when I try to telnet him, I get "No route to ...
0
votes
0answers
13 views

OpenVPN can access in-vpn IPs bot not Internet

So its an old topic.. After two years of no-problems I upgraded from Ubuntu 18.04 to Ubuntu 20.04 and now the Internet Connection over OpenVPN is not running anymore, so I have IP Forwading Enabled ...
1
vote
1answer
937 views

Check whether iptables or nftables are in use

Given a host that is in an unknown state of configuration, I would like to know if there is an effective way of non-interactively determining if the firewall rule set in place is managed by iptables ...
0
votes
0answers
59 views

How firewall works in Ubuntu 18.04?

I want to know what is my problem. First of all I set VPN server for Wireguard and Shadowsocks that use some ports such as 51820 and 8000. Then I set some rules inside iptables for input and output ...
0
votes
1answer
254 views

OpenVPN portforwarding help for BitTorrent on Ubuntu

I own a VPS running Ubuntu 20.04. It currently has a running OpenVPN service I got going using this guide which uses a script https://www.cyberciti.biz/faq/howto-setup-openvpn-server-on-ubuntu-linux-...
0
votes
1answer
108 views

docker PXE server failed, cannot initialize iptables; needs root, even though already root

I'm trying to setup a PXE boot server on the control node of a multi node mini cluster, then having each node connect to a docker swarm. Following the instructions on this site (https://jpetazzo....
0
votes
1answer
29 views

Raspbian router configuration: cannot ping devices on other side of router?

I've got the following network setup [ISP Router] <---> [Raspbian] <---> [Debian 10 Workstation] Here's some info from my Raspbian "router" iptables has been flushed with iptables -F, ...
0
votes
1answer
38 views

Able to ping two machines however unable to after running a script

I've been trying to fix this for the past few days however I've had no success. This is not my script, it's someone else's I found on GITHUB with some slight modifications I made ( https://github.com/...
0
votes
1answer
41 views

How is netfilter able to track the out-of-band data-connections of FTP to be in RELATED state with control-connection?

An article at this URI https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/sect-security_guide-firewalls-iptables_and_connection_tracking RELATED — A packet ...
1
vote
1answer
128 views

How to block a service (xrdp) from using a specific port?

I'm admin for some devs and they requested that a port on a machine be clear for a specific purpose. When one of the devs went to use that port, it was in use. An netstat -p showed that xrdp/Xnvc was ...
2
votes
1answer
106 views

Port forwarding with iptables and firejail sandbox

I try to run a HTTP server on port 8000 in a firejail sandbox, and make it accessible on all interfaces of the host on port 8888. The whole system can be represented as below: +----------------------...
0
votes
1answer
181 views

Messed up IP table rules and locked myself out while setting firewall on SSH

I was trying to set firewall rules to my website but I messed up with IP table rules and locked out myself. Now, I can't access to the VPS via SSH. When I try it I get that message: ssh: connect to ...
1
vote
1answer
31 views

Remote wake on lan signal doesn't reaches the target machine

I want to trigger a wake up on a target machine, wich is behind a firewall. The signal for this is a magic packet to the 9/udp port. My signal goes through the router and reaches a Debian server with ...
4
votes
3answers
484 views

iptables rule to unblock internet acess, and block it again 3600 seconds later

I do this, from my son's terminal, to sometimes give him internet access (disabled by default): ./unblockinternet.sh <enter password> with this script: su -c "iptables -D OUTPUT -m owner --...
1
vote
1answer
72 views

Is it possible to add a strong external password to iptables on port 22?

I assume the answer to this question is "no", but I would imagine there is some alternative method of achieving this. What I want to do is add a second, even stronger password, for when I login with ...
0
votes
0answers
35 views

Iptables not rewriting all packets

I would like to rewrite the srcaddr of all packets that is going out from an interface. I have the following topoly: Client --- Server --- Website 201.70.145.218 10.221.201....
0
votes
1answer
1k views

Configuring iptables to port forward ssh connection to a server

I have a network topology that looks like so: Internet--------------------Firewall-------------------------Server 0.0.0.0/0-----172.8.45.140 & 192.168.1.1-----192.168.1.2 I need to configure ...
0
votes
0answers
180 views

iptables redirect DNS queries to different port

I want to install a pi-hole in a virtual machine on my workstation at work SETUP Workstation: Debian with virtualbox, corporate IP address Guest: debian with pi-hole installed, NAT network ...
1
vote
1answer
49 views

Why is debian closing ports to the internet, but not for the local network

I have a home router which uses NAT for the home network. I have a debian 10 machine on it on IP 192.168.0.60 that is listening to port 5000 via a small web application. I would like to be able to ...
1
vote
1answer
149 views

Traffic Forwarding To Server With iptables

I have a server (10.10.0.100) on the same subnet (10.10.0.0/24) with all the rest of the hosts. I would like that server to received a full copy of all traffic (Windows and Linux machines) on it's ...
4
votes
1answer
5k views

Iptables-legacy with Normal Iptables in Debian Buster

Debian Buster has a mess with iptables. There are two sets running. The first one is called iptables-legacy and the second one is just normal iptables. It took m 2 hours to figure that out because ...
0
votes
1answer
57 views

Route IP to another network without NAT

Hey I came up with the following Problem. At my home I got one public IPv4 and want to add IPs. I own multiple vServers with "as many" IPs I want. So I thought about buying an additional IP and ...
0
votes
0answers
13 views

Iptables 443 woes? Need help editing a rule

I am trying to edit the iptables rule below or at least to increase the limit to 20 or more. How to achieve that? 48 0 0 REJECT tcp -- any any anywhere anywhere ...
0
votes
1answer
208 views

return route for exposed docker port behind openvpn-client

I'm trying to reach a docker container, whose outgoing traffic is routed through vpn, over the remote ip of the server where the containers are running on. If i want to reach the squid server from the ...
0
votes
0answers
57 views

iptables vpn router + killswitch rule set

I'm using raspberry pi as openvpn router with vpn killswitch where all connections are disabled if vpn is down. Everything is working fine except that I can't load any web page on raspberry nor ping ...
0
votes
1answer
464 views

Make permanent changes to iptables rules

I am trying to add some custom rules for the INPUT iptables chain in a permanent way. Since my host is running docker, the number of chains as well as the rules in these chains can change on the fly, ...
0
votes
0answers
6 views

How can I measure load generated by iptables?

No, I don't mean the question with implicit assumption "I have an iptables firewall with thousands of rules", so don't suggest nftables or ipsets as a "solution" answer for a question I didn't ask. ...
0
votes
0answers
83 views

How to correctly configure iptables for Virtualbox bridged adapter?

I have a machine in my network, running headless VMs. I'm using Oracle VirtualBox. The network adapter of the guest OS is given a static IP address, and is both visible from the network and it sees ...
1
vote
1answer
145 views

Why does iptables fail to block Google sites when using Chrome/Chromium?

I have used the following commands, taken from here: # Allow loopback device (internal communication) sudo iptables -A INPUT -i lo -j ACCEPT sudo iptables -A OUTPUT -o lo -j ACCEPT # Allow all local ...
0
votes
2answers
44 views

SSL redirect issues

Have issues trying to redirect port 443 to either port 444 or 445. This is only for the inside of my network; 444 and 445 are dropped at the firewall incoming on the Wan connection. What I am trying ...
0
votes
1answer
135 views

How to block all traffic after repeated connections on one port?

In the manpage for iptables-extensions, there is an example given that shows how to block all traffic from an IP address that tries to connect on port 139: iptables -A FORWARD -m recent --name badguy ...
2
votes
2answers
123 views

How to do this su + sudo in one command?

My son (not sudoer) is logged-in, and from his terminal, I sometimes want to iptables to remove the internet blocking (which will be back again after reboot ;)). son$ su dad <enter password> ...
2
votes
1answer
76 views

Block internet for a specific user, permanently [duplicate]

This works: sudo iptables -A OUTPUT -m owner --uid-owner {USERNAME} -j REJECT to block internet for a specific user. But it's not permanent. What's the easiest way to make this persistent after a ...
0
votes
1answer
175 views

iptables: ! matching multiple ip addresses

I need to redirect packets coming from outside of my network (5.9.0.0), so I try to add this action on one of the computers (it has three interfaces 5.9.30.20, 5.9.20.20, 5.9.10.20), but I get ...

1
3 4
5
6 7
46