Skip to main content

Questions tagged [netfilter]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
10 views

Mangling packet headers using NFTables affects data received via pcap interface

To solve the problem with bad/martian src ip's in multicast packets, I used something called Stateless NAT: I change src ip in packets to something valid (e.g. 0.0.0.0 ➜ 192.16.0.1). I found two ...
SergA's user avatar
  • 214
0 votes
0 answers
22 views

How to make netfilter (nft) count packets on rule?

I'm trying to create a nft firewall rule on my Linux router that drops first three SYN packets arrived from some source-destination pair, but without success. My objective is try to avoid syn spoof ...
Challado's user avatar
1 vote
1 answer
54 views

Netfilter and forward chain traces ARP but not other packets

I am experimenting with netfilter in a Docker container. I have three containers, one a "router", and two "endpoints". They are each connected via pipework, so an external (host) ...
stevekez's user avatar
0 votes
0 answers
27 views

Many UFW BLOCKs pr minute from numerous ports and numerous IP addresses

My syslog is flooded with numerous attacks of some sort coming from multiple sources. I looked at all the other references in the search feature but none addressed tcp and from numerous sources Feb 16 ...
brad's user avatar
  • 207
0 votes
1 answer
110 views

Matching DSCP portion of ToS or traffic class byte using ebtables

Is it possible to match only the DSCP portion of the IPv4 ToS or IPv6 traffic class byte using ebtables? I see that ebtables has the --ip-tos match option for IPv4 packets and the --ip6-class match ...
Xt531bd's user avatar
  • 101
0 votes
2 answers
89 views

Does Linux TCP stack processing happen before or after netfilter?

The Linux netfilter has multiple hooks at different OSI model layers according to this image. However, the transportation layer protocols like TCP requires additional processing like retransmission ...
William's user avatar
  • 165
0 votes
0 answers
22 views

Can tc or nftables change the SA/TA in 802.11 frame?

I am looking for a way to change the SA/TA on a Wi-Fi frame. I need this because I have a VM (running with QEMU and vmnet-bridged) in a MacBook that connects to a Wi-Fi interface, and a laptop ...
amkgi's user avatar
  • 103
1 vote
1 answer
302 views

nftables: Are chains of multiple types all evaluated for a given hook?

This is a question specifically about nftables chain types in the Linux kernel. I don't understand how they're processed. I've been staring at the kernel code for a while, and it looks to me like an ...
dsedivec's user avatar
  • 113
0 votes
0 answers
84 views

Enable journalctl within Ubuntu container

I've got an Ubuntu 22.04 container running on a MacOS host. Inside the container, I'm fiddling with routing and would like to add some -j LOG rules to iptables to see where my packets are going. ...
Daniel Walker's user avatar
1 vote
1 answer
261 views

MAC address rewriting using tc

I am using tc to change the MAC address of incoming packets on a TAP interface (tap0) as follows where mac_org is the MAC address of a guest in a QEMU virtual machine and mac_new is a different MAC ...
qemvirt's user avatar
  • 13
0 votes
0 answers
22 views

ipset add white_list_net_port 128.0.0.0/1,udp:443-444 error

ipset v7.1, protocol version: 7 When I execute 'ipset add white_list_net_port 128.0.0.0/1,udp:443-444', the system reports 'ipset v7.1: Hash is full, cannot add more elements',white_list_net_port is ...
CnlA's user avatar
  • 1
0 votes
0 answers
141 views

nftables set (verb) with concatenation

Note: This is about using concatentation (.) from a set to use the set verb to modify parts of the packet (e.g. ip daddr set 1.2.3.4). I don't seem to be able to find the specific nomenclature from ...
Synthetic Ascension's user avatar
1 vote
1 answer
354 views

nftables dnat map rule failing silently

I'm working from the answer of this question and man nft in order to create some dnat rules in my nftables config. The relevant config extract is: define src_ip = 192.168.1.128/26 define dst_ip ...
Synthetic Ascension's user avatar
0 votes
0 answers
122 views

nftables - Setting destination MAC still sending ARP requests

I'm trying to run DHCP servers behind a private Docker bridge. I'm at a point where I can reroute the DHCPDISCOVER broadcast packets to the DHCP server behind the Docker bridge and have the DHCP ...
Synthetic Ascension's user avatar
0 votes
0 answers
240 views

nftables - Forward layer 2 broadcast (DHCP) without ingress chain?

I'm currently looking into setting up DHCP servers behind a Docker bridge. My docker bridges are brought up with docker compose. I'm looking for a way to forward incoming DHCPDISCOVER requests to the ...
Synthetic Ascension's user avatar
0 votes
0 answers
34 views

Responses to NF_STOLEN packets aren't hitting NAT rules

I'm currently working on placing DHCP servers within a Docker bridged network. To ensure packets get through I have the following: table netdev filterearly_lan10{ chain ingress { type ...
Synthetic Ascension's user avatar
0 votes
1 answer
35 views

Should the routing table only be applied to outgoing packets (not forwarding)?

I am trying to get packets forwarded from device A to device C, through device B. I thought all I have to do is on device A say: packets for C must go to B, and then B knows where where C is so all ...
Damian Games's user avatar
0 votes
0 answers
15 views

Create conntrack session without a network

I'm trying to test some conntrack related tooling. The test runs within a single VM without network access. What's the easiest way to create a conntrack session so I can do my test?
Philippe's user avatar
  • 479
0 votes
2 answers
251 views

Can netfilter act as a DHCP relay?

I'm wondering whether instead of using a DHCP relay netfilter (be that tc or nftables) can be used to route DHCP broadcast packets to a Docker container attached to a bridge. The reasoning for this is ...
Synthetic Ascension's user avatar
0 votes
0 answers
428 views

Error: Could not process rule: No such file or directory

I'm trying to configure a tap connection on my host os (devuan 4) on my ARM chromebook because I want to use it with qemu and the guest os that I want to virtualize on top of devuan,using qemu+kvm,...
Marietto's user avatar
  • 549
2 votes
2 answers
901 views

nftables deleting a rule without passing handle (similar to iptables delete)

iptables syntax for delete is much simpler. if we replace the "append" with delete we get command for deletion of the rule. nftable provides similar construct for few rule management aspect ...
Amit Priyadarshi's user avatar
1 vote
0 answers
135 views

What is the theoretically maximum value of nf_conntrack_count?

I have a Linux server with DNAT enabled, and it suffers from packet loss, aka nf_conntrack: table full, dropping packet. Now I need to increase conntrack memory usage by updating the net.netfilter....
daisy's user avatar
  • 54.8k
2 votes
1 answer
100 views

Redirecting locally originated traffic with DNAT in OUTPUT chain not working as expected

I am having a dumb, and I am hoping you lovely people can jumpstart my brain. I am running a service in a local network namespace. The namespace looks like this: # ip -n ns1 addr 1: lo: <LOOPBACK,...
larsks's user avatar
  • 36k
1 vote
1 answer
188 views

Why does it go through netfilter postrouting when visiting local ports?

Environment: [root@VM-32-4-centos ~]# uname -r 3.10.0-514.26.2.el7.x86_64 I have set log printing in the following chain: [root@VM-32-4-centos ~]# iptables -A INPUT -p tcp --dport 8000 -j LOG --log-...
user571080's user avatar
3 votes
1 answer
774 views

In addition to `ip rule`, `ip route`, `iptables`, is there anything else that could affect routing and packet filtering in linux?

Recently I'd like to set CF WARP client on my VPS, but encountered a strange problem. I’m not sure if this is the right place to ask this question, if not I’m very sorry and delete it. Background: I ...
chansey's user avatar
  • 153
0 votes
0 answers
311 views

Unable to parse HTTP packet using netfilter hooks in kernel module

I am trying to parse HTTP packets using netfilter hooks in my kernel module. I came across this code snippet on How to print data from TCP packets which I modified to make it build. However, I am ...
goodman's user avatar
  • 101
1 vote
1 answer
722 views

routing table configured with "ip route" part of the "iptables"?

This question is frequent and has already a lot of answers, but I still don't get it. Is the routing configured with "ip route add .." part of the iptables flow? Is the "routing ...
ptiza_v_nebe's user avatar
3 votes
1 answer
84 views

What are ARP hardware type 37, opcode 21 and protocol type 0x90bd?

I am currently testing netfilter / nftables / nft. As a starting point, I have made a ruleset that drops nearly everything in and out, and have written the rules so that every dropped packet is logged....
Binarus's user avatar
  • 3,430
0 votes
1 answer
805 views

netfilter: ipset vs iptables recent module

what exactly are the practical differences between iptables recent module and ipset ? I know recent module only allows IPs, whereas ipset allows subnets. But other than this, what is the main ...
Martin Vegter's user avatar
3 votes
2 answers
2k views

How do I delete a specific element in a chain in nftables?

Current system: Distro: Ubuntu 20.04 kernel: 5.4.0-124-generic nft: nftables v0.9.3 (Topsy) I am new and learning nftables, Here is my nft ruleset currently: $sudo nft list ruleset ...
Dave's user avatar
  • 621
1 vote
0 answers
765 views

How to install Netfilter / enable conntrack events?

I have come across this repo and struggle to understand these steps. I believe this is to enable the Netfilter conntrack events, but I'm not sure. What do I have to run to get these prompts? ----------...
Houman's user avatar
  • 197
2 votes
1 answer
484 views

nftables Named Set Update Delay

I have the following in nftables.conf: table inet nat { set blocked { type ipv4_addr } chain postrouting { type nat hook postrouting priority ...
Synthetic Ascension's user avatar
0 votes
1 answer
35 views

Why didn't iptables apply the sames rules?

For some reason, my network encountered "Destination unreachable no route" error, this error happened periodicly, later I found that was a bug of my program. But during that time, I found a ...
Jianbo Yan's user avatar
0 votes
0 answers
252 views

Nftables sepparate rules for different ip on the same interface

I have a server with 2 public IP addresses linked to it. However, both of them are on the same interface (ens3). I think it called IP-aliasing. ens3: altname enp0s3 inet <public ip 1>/32 ...
Danil's user avatar
  • 31
1 vote
0 answers
436 views

Is there a way to match bytes at a variable offset in a packet using nftables?

The iptables xt_bpf extension can be used to access auxiliary packet data, such as payload length. The xt_u32 extension can do it to some extent as well. I know that nftables supports a length meta ...
forest's user avatar
  • 2,695
0 votes
0 answers
138 views

Debian Router (DIY) Website Timeout Problems

I've been setting up a DIY router using Debian. I'm at a point where it's routing traffic to the internet for my client devices. However I'm having trouble accessing websites. Some websites load ...
Synthetic Ascension's user avatar
1 vote
1 answer
216 views

Where is /etc/nftables/inet-filter?

I am trying to locate the file /etc/nftables/inet-filter which is referenced in the readme for a project I've inherited. When I installed nftables, the only files that existed in etc/nftables were: . ...
wwillfred's user avatar
3 votes
1 answer
1k views

NFTables Egress Hook?

I'm looking to apply firewall rules on egress to control DHCP output from a Docker container. I don't want the DHCP container to share the host's network stack as adding CAP_NET_ADMIN effectively ...
Synthetic Ascension's user avatar
1 vote
1 answer
309 views

libvirt nwfilter, multiple parameters

It's possible to pass multiple parameters to the "filterref" using "parameter" keyword. Like this: <filterref filter='no-ip-spoofing'> <parameter name='IP' value='10.0....
LovingFox's user avatar
0 votes
0 answers
158 views

Forward Traffic to virtual box (Genymotion)

I am running an Android virtual machine (Samsung Galaxy S10 & android 10.0 API29) using Genymotion. I have a VPN running there (OpenVPN protocol). Now I am running all this over my Debian based ...
lucky thandel's user avatar
1 vote
2 answers
2k views

During the lifecycle of "iptables", in which step, will kernel take advantage of "route table"?

iptables. I have went though the manual of Iptables and known some basic concepts, e.g. chain, table, hook, rule and targets. In the Linux ecosystem, iptables is a widely used firewall tool that ...
Ryan Lyu's user avatar
  • 194
0 votes
1 answer
397 views

Netfilter: in which situation, NF_IP_FORWARD will be triggered?

Netfilter Hook: NF_IP_FORWARD There are five netfilter hooks that programs can register with. As packets progress through the stack, they will trigger the kernel modules that have registered with ...
Ryan Lyu's user avatar
  • 194
1 vote
1 answer
2k views

which layer does Netfilter and IPTables works on in the OSI model?

IPTables are the basic and very commonly used firewall in Linux systems. netfilter provides 5 hooks that programs can register with. which layer does Netfilter and IPTables works on? IP Packet level ...
Ryan Lyu's user avatar
  • 194
1 vote
1 answer
287 views

Linux L2 bridge blocks ip packets which are addressed to a listening port on the host

On my Server I have a bunch of vms, connected by a simple L2 linux bridge to an OPNsense VM for firewalling and routing between the vms. The OPNsense vm is connected via macvtap to the single enp3s0 ...
Lny2x's user avatar
  • 11
6 votes
2 answers
3k views

How do packets flow through the kernel

When it comes to packet filtering/management I never actually know what is going on inside the kernel. There are so many different tools that act on the packets, either from userspace (modifying ...
AFP_555's user avatar
  • 301
0 votes
1 answer
550 views

How can I filter a packet after an iptables MASQUERADE?

I am trying to build a multi-WAN router based on Debian Buster (kernel version 4.19). It has multiple 'LAN-side' network interfaces (e.g. lan0, lan1, ... lanM), and also multiple 'WAN-side' interfaces ...
Avijit's user avatar
  • 101
0 votes
0 answers
65 views

Updating hostnames in netfilter automatically?

I'd like to accomplish an egress filter on Linux using Netfilter (iptables) and the DNS hostname of the destination. The problem is, writing the rules using the hostname will only resolove the IP ...
Nstevens's user avatar
  • 205
0 votes
0 answers
835 views

Illegal "match" error when applying Linux tc, u32 filters mask

I want apply the following rules for TOS based traffic shaping. All rules works but the final rule which mask the IP header shows illegal "match" error sudo tc qdisc del dev tun0 root handle ...
Javad Rahimi's user avatar
1 vote
1 answer
1k views

netfilter: drop packets having IP options

I'd like to add a rule dropping an IPv4 packet with any IP option following the header. I understand that IHL (Internet Header Length) field in he header contains the number of 32-bit words in the ...
Mark's user avatar
  • 1,823
0 votes
1 answer
679 views

TCPDUMP w/SNAT Configuration Shows Private IP on ICMP Reply

Problem: TCPDUMP icmp reply inexplicably has the private address. I would expect it to have the public address. [router.box(1.2.3.4)]$ tcpdump -n -i br1 icmp 10:42:21.689215 IP 1.2.3.4 > 8.8.8.8: ...
sccrthlt's user avatar
  • 101