Questions tagged [netfilter]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
12 views

Forward Traffic to virtual box (Genymotion)

I am running an Android virtual machine (Samsung Galaxy S10 & android 10.0 API29) using Genymotion. I have a VPN running there (OpenVPN protocol). Now I am running all this over my Debian based ...
user avatar
0 votes
2 answers
35 views

During the lifecycle of "iptables", in which step, will kernel take advantage of "route table"?

iptables. I have went though the manual of Iptables and known some basic concepts, e.g. chain, table, hook, rule and targets. In the Linux ecosystem, iptables is a widely used firewall tool that ...
user avatar
  • 115
0 votes
1 answer
40 views

Netfilter: in which situation, NF_IP_FORWARD will be triggered?

Netfilter Hook: NF_IP_FORWARD There are five netfilter hooks that programs can register with. As packets progress through the stack, they will trigger the kernel modules that have registered with ...
user avatar
  • 115
0 votes
1 answer
76 views

which layer does Netfilter and IPTables works on in the OSI model?

IPTables are the basic and very commonly used firewall in Linux systems. netfilter provides 5 hooks that programs can register with. which layer does Netfilter and IPTables works on? IP Packet level ...
user avatar
  • 115
0 votes
0 answers
48 views

Configuring NAT for the TAP interface

I am trying to configure NAT with nftables for the TAP interface as follows: table ip vm_nat { chain vm_prerouting { type nat hook prerouting priority dstnat; } chain ...
user avatar
0 votes
0 answers
18 views

UFW Block message (level 4) on command line even with console loglevel 1 or 0

I didn't want to ask because I'm afraid of downvotes ... but the next step of research would be reading the code of netfilter. Eventually some of you discovered such issues or has an idea where to ...
user avatar
1 vote
1 answer
35 views

Linux L2 bridge blocks ip packets which are addressed to a listening port on the host

On my Server I have a bunch of vms, connected by a simple L2 linux bridge to an OPNsense VM for firewalling and routing between the vms. The OPNsense vm is connected via macvtap to the single enp3s0 ...
user avatar
  • 11
1 vote
1 answer
50 views

How do packets flow through the kernel

When it comes to packet filtering/management I never actually know what is going on inside the kernel. There are so many different tools that act on the packets, either from userspace (modifying ...
user avatar
  • 181
0 votes
1 answer
61 views

How can I filter a packet after an iptables MASQUERADE?

I am trying to build a multi-WAN router based on Debian Buster (kernel version 4.19). It has multiple 'LAN-side' network interfaces (e.g. lan0, lan1, ... lanM), and also multiple 'WAN-side' interfaces ...
user avatar
  • 101
0 votes
0 answers
25 views

Updating hostnames in netfilter automatically?

I'd like to accomplish an egress filter on Linux using Netfilter (iptables) and the DNS hostname of the destination. The problem is, writing the rules using the hostname will only resolove the IP ...
user avatar
0 votes
0 answers
143 views

Illegal "match" error when applying Linux tc, u32 filters mask

I want apply the following rules for TOS based traffic shaping. All rules works but the final rule which mask the IP header shows illegal "match" error sudo tc qdisc del dev tun0 root handle ...
user avatar
1 vote
1 answer
86 views

netfilter: drop packets having IP options

I'd like to add a rule dropping an IPv4 packet with any IP option following the header. I understand that IHL (Internet Header Length) field in he header contains the number of 32-bit words in the ...
user avatar
  • 1,409
0 votes
0 answers
13 views

Best approach to internally load-balance tcp flows to dummy interfaces for traffic capture?

Background - I would like to horizontally scale a packet capture and analysis tool running on a Linux appliance. The capture uses two processes to capture and process the captured traffic. The raw ...
user avatar
0 votes
1 answer
99 views

TCPDUMP w/SNAT Configuration Shows Private IP on ICMP Reply

Problem: TCPDUMP icmp reply inexplicably has the private address. I would expect it to have the public address. [router.box(1.2.3.4)]$ tcpdump -n -i br1 icmp 10:42:21.689215 IP 1.2.3.4 > 8.8.8.8: ...
user avatar
  • 101
1 vote
1 answer
268 views

What chain types are supported by the nftables NETDEV family?

From the nftables Quick reference: family refers to a one of the following table types: ip, arp, ip6, bridge, inet, netdev. and type refers to the kind of chain to be created. Possible types are: ...
user avatar
  • 2,191
1 vote
1 answer
66 views

Same iptables rules for two different iptables versions

I use a set of iptables rules that makes use of the mangle table, which contains the rows below, on two different versions of iptables v1.3.8, and v1.4.7. Iptables v1.3.8 runs on Fedora release 8 ...
user avatar
  • 135
1 vote
0 answers
460 views

Mark a packets with iptables in order to make a source ip routing

I have a linux machine, which I use as a gateway and firewall. The linux machine (GW/FIREWALL) is connected to a device which allow internet connection (Router Aggregator), it has 2 IP addresses 172....
user avatar
  • 135
1 vote
1 answer
230 views

Nftables not matching TOS value in IP packets

This is on Ubuntu 20.04. I am attempting to write a rule for nftables which will match all IP packets received on interface eth1 that have a specific TOS value (0x02). My attempt so far: sudo nft add ...
user avatar
0 votes
1 answer
111 views

Iptables Accept All From Specific Ip And Port

I want to accept all traffic that is coming from an IP address and its specific port to any of my ports. Here is the configuration: Details: I am using Jitsi in a server, and I want to reach Jitsi ...
user avatar
  • 1
1 vote
0 answers
117 views

How can I prevent iptables connlimit counter from resetting each time an iptables rule is added?

Context In short I'm working over a feature to provide outbound connection count rate and hard limiting per destination host of containers in a container networking solution (see silk-release). An ...
user avatar
0 votes
1 answer
123 views

Connect to server behind NAT from LAN using real IP

I have a small network. It has a firewall connected to the internet (WAN) with real IP and DNS name which also acts as a DHCP server for the internal network (LAN). On the firewall machine I've setup ...
user avatar
  • 293
0 votes
1 answer
158 views

Get netfilter statistics on the command line

I am finally switching from the old iptables to the new netfilter (specifically using firewalld) to configure my computers and servers but so far I have failed to find any newer alternative to the ...
user avatar
  • 103
2 votes
1 answer
434 views

Nftables default drop chain problem

I'd like to take a default drop approach to my firewall rules. I've created some rules for testing purposes: table bridge vmbrfilter { chain forward { type filter hook forward priority -...
user avatar
0 votes
0 answers
924 views

Linux tc filter add - errors RTNETLINK answers: Operation not supported

I'm working on the network simulation to create some traffic on specific ports , and trying to inject the network delay. I'm using the linux tc utility to do this operations. So i'm new to the tc ...
user avatar
1 vote
1 answer
649 views

marked packets not detected by routing policy database

I have a following mangle table rule in a lab server which marks UDP traffic with 1 if the destination address is 6.6.6.6: $ sudo iptables -t mangle -L PREROUTING 2 -v -n --line-numbers 2 17 ...
user avatar
  • 6,248
0 votes
1 answer
140 views

Qemu network traffic filtering with iptables

I need to filter both outcoming and incoming traffic of the guest system on Qemu (Linux). The host system is Linux too. I think iptables is a good tool, but I don't know how to use it here. What ...
user avatar
  • 109
0 votes
1 answer
470 views

How set MAC address filtering on linux?

I need to block any incoming connection from a MAC address different from a specific one (which is static and well known). This MAC address should generate only non-IP connection: this is the reason ...
user avatar
  • 21
0 votes
1 answer
1k views

Debian update to Buster, iptables throwing an error in

I've just updated my old Debian Jessie server to Buster, and I'm having some issues with iptables. I understand that the backend has been changed with the update, but I have absolutely no knowledge or ...
user avatar
0 votes
1 answer
31 views

netfilter fails to properly replace destination IP of UDP response package

We have small kuberentes cluster running (CentOS 7, Kuberenetes 1.13 + Flannel) and after some tweaking TCP configuration (see below), we noticed that DNS was not working properly. I don't think that ...
user avatar
  • 131
1 vote
1 answer
4k views

Check whether iptables or nftables are in use

Given a host that is in an unknown state of configuration, I would like to know if there is an effective way of non-interactively determining if the firewall rule set in place is managed by iptables ...
user avatar
  • 1,651
1 vote
1 answer
134 views

How is netfilter able to track the out-of-band data-connections of FTP to be in RELATED state with control-connection?

An article at this URI https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/sect-security_guide-firewalls-iptables_and_connection_tracking RELATED — A packet ...
user avatar
0 votes
0 answers
106 views

Why my system can only do port forwarding when I ssh to it?

I use debian 10 with kernel 4.19 and nftables as port forwarding tool. The rule is like table ip nat { chain prerouting { type nat hook prerouting priority -100; policy accept; ip ...
user avatar
0 votes
0 answers
314 views

How to drop all lldp packets on a specific port using IPTables?

I have lldp packets sent on a specific port (6633) and i need to drop only and only if they are lldp packets, because i have another traffic that cant be dropped, so i can't just drop all traffic on ...
user avatar
1 vote
0 answers
276 views

firewalld updating ipset entry timeout

I have been trying to figure out how to update the timeout of an ipset entry, with no luck so far, when using native ipset I would just simply use: $ ipset add foo 192.168.0.5 timout N -exist but ...
user avatar
1 vote
1 answer
633 views

Does upset hash:net,port support 0.0.0.0/0

Is there a way to add 0.0.0.0/0 to ipset type hash:net,port? It appears to only support prefix lengths of 1-32 but what if I want an entry in my ipset hash to support all ip traffic on a given port? ...
user avatar
  • 13
1 vote
0 answers
294 views

Netfilter bypass through Firejail

For isolation, I run Firefox through Xephyr with Openbox. In the Firejail profile, I set net enp2a1 to isolate the network through network namespaces. But I don’t like that a regular user can override ...
user avatar
  • 465
1 vote
1 answer
154 views

Is it possible to bind to a port that has a entry for DNAT in iptables?

I have added a DNAT entry (in the host) for a port (say 30001) in PREROUTING using iptables $ sudo iptables -t nat -A PREROUTING -p tcp --dport 30001 -j DNAT --to-destination <my guest vm ip>:...
user avatar
0 votes
0 answers
30 views

Use Netfilter to programatically set packet destination and route them

I'm new to iptables and its modules and I would like help in rapping my head around it. The Problem Managing large scale NAT routing. I need to handle more then 100,000 static IPs (and growing) and ...
user avatar
  • 101
1 vote
0 answers
50 views

How does Linux route packets destined for another interface? [duplicate]

How are packets routed inside a single linux machine? Imagine the following setup: +--------------------+ | apache on | | 192.168.1.30:80 | | | | ...
user avatar
1 vote
1 answer
166 views

Iptable order of rules with example

I had question about IPtables. Let's start with this example of my book: What rules you would set for a mail server accepting connections for EMSTP (port 465) and IMAP (port 993) having a ...
user avatar
  • 113
2 votes
1 answer
1k views

Example command to set same DSCP value in the IP header for return packets within the same TCP connection

I have seen connmark or ctinfo could work for this but couldn't find a simple effective command to make it work (Not familiar within this area). The command can be applied to the TCP termination node ...
user avatar
-1 votes
1 answer
553 views

Failing service during boot, which one + solution?

System: Linux Mint 19.3 "Tricia" - Cinnamon (64-bit), based on Ubuntu 18.04, kernel 5.3.0-24-generic Problem duration: literally for a year or so. Problem description: since I have too large a ...
user avatar
2 votes
0 answers
302 views

arptables-nft persistence

Introduction This is on Debian Buster with kernel 4.19.0-6 I've installed iptables-persistent and netfilter-persistent versions 1.0.11 and added a basic rule to arptables-nft to block all LAN ...
user avatar
  • 41
1 vote
1 answer
556 views

How to clone the output of the MASQUERADE target with a TEE?

The Netfilter's extensions man page states that: MASQUERADE: This target is only valid in the nat table, in the POSTROUTING chain QUESTION: How to clone the output of the MASQUERADE target with a ...
user avatar
1 vote
1 answer
3k views

nftables meter error: syntax error, unexpected saddr, expecting comma or '}'

I have below nftable rule to add a connection rate meter: nft add rule ip filter input tcp dport @rate_limit meter syn4-meter \{ ip saddr . tcp dport timeout 5m limit rate 20/minute \} counter ...
user avatar
0 votes
1 answer
444 views

Systemtap can not resolve probe point although it is shown in probe list

I'm trying to debug netfilter synproxy module with systemtap. This is probe point I'm trying to add. # stap -l 'module("ipt_SYNPROXY").statement("*")' | grep send_client_synack module("ipt_SYNPROXY")...
user avatar
  • 897
8 votes
3 answers
10k views

nftables rule: No such file or directory error

I am trying to apply below nftables rule which I adopted from this guide: nft add rule filter INPUT tcp flags != syn counter drop somehow this is ending up with: Error: Could not process rule: No ...
user avatar
4 votes
1 answer
6k views

Best way to filter/limit ARP packets on embedded Linux

I have an embedded Linux on some network device. Because this device is pretty important I have to make many network tests (I have a separate device for that). These tests include flooding my device ...
user avatar
  • 43
0 votes
1 answer
4k views

Changing Destination IP address using iptables and DNAT

I am trying to experiment with DNAT in PREROUTING. I found a tutorial here. It contains the following sentence: This is done in the PREROUTING chain, just as the packet comes in; this means that ...
user avatar
  • 1,263
1 vote
1 answer
2k views

iptables-restore failed in Debian buster/sid if it has --multiport option in the rules file

I have /etc/iptables/rule.v4 file contains many rule, the below is the line where I see the issue -A INPUT -p tcp -m multiport --dports 22 -j ACCEPT -A INPUT -p udp -m multiport --dports 16384:32768 -...
user avatar
  • 159