Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
The results are in! See what nearly 90,000 developers picked as their most loved, dreaded, and desired coding languages and more in the 2019 Developer Survey.

Questions tagged [netfilter]

The tag has no usage guidance.

0
votes
0answers
20 views

Best way to filter/limit ARP packets on embedded Linux

I have an embedded Linux on some network device. Because this device is pretty important I have to make many network tests (I have a separate device for that). These tests include flooding my device ...
0
votes
0answers
14 views

Keep conntrack state for current ssh connection on netfilter rule flush/reload

When i am reloading netfilter with a new ruleset that drops invalid packets flush ruleset ... ct state invalid counter log prefix "Drop input invalid " drop comment "drop invalid packets" ... over ...
0
votes
1answer
48 views

Changing Destination IP address using iptables and DNAT

I am trying to experiment with DNAT in PREROUTING. I found a tutorial here. It contains the following sentence: This is done in the PREROUTING chain, just as the packet comes in; this means that ...
1
vote
1answer
43 views

iptables-restore failed in Debian buster/sid if it has --multiport option in the rules file

I have /etc/iptables/rule.v4 file contains many rule, the below is the line where I see the issue -A INPUT -p tcp -m multiport --dports 22 -j ACCEPT -A INPUT -p udp -m multiport --dports 16384:32768 -...
0
votes
0answers
20 views

Packet traversal in the Linux networking stack

I am trying to understand the packet traversal in Linux. I found a diagram from link. My linux box has the following routing table: default via 192.168.2.1 dev wlan0 proto static metric 1024 169....
2
votes
2answers
70 views

How can I transform UDP to TCP with netfilter?

I have a wonderful ISP blocking all UDP traffic (except DNS to its own DNS servers). However, I want to use UDP for my VPN solution. I have root over both VPN endpoints, and both of them are using ...
0
votes
1answer
42 views

Is there any way to view nfmark like ctmark?

I understand that iptables --set-mark does not add mark "on" the packets. The MARK target is for associating a mark with the packet in the kernel data structures. The packet itself is not modified. ...
0
votes
1answer
112 views

How does iptable work with linux bridge?

Setup: VM1 --- Bridge -- VM2 VM1 and 2 are on same subnet. Bridge has 2 interfaces added to brctl bridge. When I block VM2 ip using uptables -A FORWARD -s (VM1 ip) -j DENY it doesn't work. I ...
4
votes
0answers
60 views

Multicast ICMPv6 comes back with conntrack state invalid

I was playing arround with the Multicast feature of IPv6. $ ping ff02::2%wlp3s0 This should normally result in an echo-reply from all the routers on your local network segment (Wikipedia - IPv6). So ...
0
votes
0answers
60 views

Show iptables, ebtables etc rules created by libvirt

I'm using libvirt with qemu on a ubuntu bionic system. I'd like to inspect what network filtering rules are actually created in the system for the nwfilter rules when I run a qemu/kvm guest with ...
1
vote
1answer
46 views

iptables blocking local traffic

My local machine IP: 192.168.0.35 What I did: Answer that i tried here!! sudo iptables -t nat -A OUTPUT -p tcp --dport 80 -j DNAT --to-destination 192.168.0.35:80 The error: Now I can not access ...
1
vote
1answer
37 views

iptables Masquerade leave out some local packet?

In openwrt i have config lan forward to wan with masqenabled. And my lan network is 192.168.100.0/24. when some pc ping with other network ip e.g: 192.168.1.15, tcpdump will get some local packet in ...
1
vote
3answers
245 views

in iptables, does MASQUERADE match only on NEW connections (SYN packets)?

I observed that MASQUERADE target does not match on packets in the reply direction (in terms of netfilter conntrack). I've a single simple -t nat -A POSTROUTING -s 10.a.0.0/16 -d 10.b.0.0/16 -j ...
0
votes
1answer
76 views

Masquerade rule with netfilter-persitent

I use netfilter-persistent to manage a firewall. I would like to share a connection between two interfaces using masquerading (example, or another). When I run those operations by invoking iptables ...
2
votes
1answer
34 views

Packet meta class applied, but captured VLAN priority is wrong

My linux home router sits between my ISP (Orange) and my home network. On the WAN side, Orange provide internet in a VLAN tagged 832. Some control messages (ARP, DHCP, ICMPv6 "router discovery" types,...
1
vote
1answer
26 views

How does one use tc to add latency to a ratelimit?

I read that there's another tool for netfilter that allows you to add latency to a ratelimit. Does anyone have an example of this?
1
vote
1answer
760 views

How --set-mark option works on Netfilter (IPTABLES)?

On Netfilter, you have the option --set-mark for packets that pass through the mangle table. The majority of tutorials and examples over the Internet, say that this just adds a mark on the packet, ...
4
votes
1answer
454 views

Is there a way to do layer 7 filtering in Linux?

The L7-filter project appears to be 15 years old, requires kernel patches with no support for kernels past version 2.6, and most of the pattern files it has appear to have been written in 2003. ...
2
votes
1answer
417 views

multicast traffic is able to poke a hole into the netfilter connection tracking system

I have an IPTV solution at home where the ISP sends me hundreds of large UDP datagrams per second from 10.4.4.5 port 10 to 239.3.5.3 port 10, i.e. it is using multicast. My current iptables ...
1
vote
2answers
231 views

Send TCP packet to the same source [closed]

I want to design a system which reduce travel time of packet what is happening in reality is I send a SYN bit from client side, this bit travel through router then to server and server reply SYN+ACK ...
1
vote
0answers
203 views

iptables connlimit-above allowing more connections than desired

I'm trying to set a per-ip connection limit on a kubernetes node using iptables connlimit. Since each container on the VM has a different source IP (overlay net), using connlimit should work. I added ...
5
votes
2answers
1k views

What are the essential iptables rules for IPv6 to work properly?

I had a problem where I lost connectivity to a server on the IPv6 address after some time and it turned out to be caused by DHCPv6 client packets (port 546) being dropped by the default INPUT policy ...
0
votes
0answers
58 views

When are inverse NAT manipulation applied by netfilter/iptables?

If there is a DNAT rule in the PREROUTING chain like this one: iptables -t nat -A PREROUTING -j DNAT --to-destination x.x.x.x All packets reaching the stack from a network interface will first pass ...
0
votes
2answers
302 views

How to establish a man-in-the-middle scenario with ebtables and iptables

For testing and educational purposes I want so set up a man-in-the-middle scenario as follows: Host T is the target host that is to be "cloned" Host M is the man in the middle with interfaces eth0 ...
0
votes
1answer
463 views

How to match both UDP and TCP for given ports in one line with nftables

How can i do this in a single line? tcp dport 53 counter accept comment "accept DNS" udp dport 53 counter accept comment "accept DNS"
0
votes
0answers
112 views

How to use wildcard in a list with nftables

I'd like to use wildcards in a list with nftables. I tried this, but it gives me an error when I'm loading it: iifname {"virbr*", "vboxnet*"} accept oifname {"virbr*", "vboxnet*"} ct state ...
0
votes
1answer
323 views

nftables, add output rule syntax

I'm a bit frustrated by the lack of comprehensive documentation of nftables and currently I'm failing to get even a simple example to work. I'm trying just create a output rule. Here's my only table: ...
0
votes
1answer
2k views

URL Filtering with IP tables

I've been trying to set up URL filtering with Iptables. I have set up two interfaces. Traffic flows in from one interface and flows out from the other. Below are the Iptables I have configured: *...
0
votes
1answer
739 views

blocking YouTube not working for Google Chrome

I have some rules on the FILTER table of Netfilter, which block HTTPS access to some websites: -A FORWARD -s 10.255.255.0/26 -p tcp -m tcp --dport 443 -m string --string "facebook.com" --algo bm -j ...
0
votes
1answer
649 views

When and how to use chain priorities in nftables

When configuring a chain in nftables, one has to provide a priority value. Almost all online examples set a piority of 0; sometimes, a value of 100 gets used with certain hooks (output, postrouting). ...
3
votes
1answer
2k views

nf_register_hook not found in linux kernel 4.13-rc2 and later

I just started learning about netfilter and I was trying to make a simple netfilter module, all the tutorials and HOW TOs register a hook function with nf_register_hook(), but I could not find one in ...
2
votes
1answer
319 views

How to disable implicit source port mapping on outgoing UDP packets sent through NAT in iptables?

iptables is re-writing the source port on my UDP packets that go out of a tun interface. I have NAT rules setup with port X forwarded (details below). When an application behind the NAT receives a ...
0
votes
1answer
489 views

iptable string matching to find application type / application layer protoco

I would like to know is it possible to match the type of applications/application layer protocols using iptables string matching extension?
2
votes
3answers
362 views

removed lib modules folder after every reboot

uname -r: 4.13.0-16-generic (ubuntu 17.10 server) I have a problem that iptables doesn't work after a reboot: iptables-apply /etc/network/iptables [ ok ] Stopping fail2ban (via systemctl): fail2ban....
2
votes
1answer
2k views

Is iptables string matching still supported?

I was reading the book Linux Firewalls - Attack Detection and Response (by M. Rash, No Starch Press, 1 Ed., Oct. 2007). In one of its chapter it discusses string matching using iptables. I was ...
1
vote
1answer
3k views

What is the difference between NAT OUTPUT chain and NAT POSTROUTING chain?

IF Nating is done in OUTPUT chain of the NAT table, then what is the function of SNAT in POSTROUTING
0
votes
1answer
1k views

iptables/netfilter: “nf_nat_ftp” is not working well with recent Linux kernels

I'm facing the following issue with Linux kernel 4.10-28-generic, embedded in Ubuntu-16.04.02-LTE. My machine has two ethernet adapters, namely the following ones: enp0s3: 198.168.56.2 (internal ...
3
votes
1answer
3k views

How to list all network connections Centos 7 (Connection tracking)

I have a box with Centos 7 installed. I am trying to configure some iptables rules and playing with the mangle table and markings For example on my router I am able to see established network ...
0
votes
1answer
2k views

How can I see the kernel logs?

I run Ubuntu 16.04 In the linux kernel there are certain log statement for conditions on packet filtering which I'd like to see if they are actually triggered. One example is: /* Smaller that ...
1
vote
1answer
379 views

Filtering and queue the packet of a process using iptable

I am trying to queue the packets of a process so I can use libnetfilter_queue to modify them. I know that I should use --pid-owner processid to filter packets of a process and iptables -I <table ...
0
votes
1answer
442 views

OUTPUT chain rules in iptables

netfilter seems to allow rejected traffic from my INPUT chain to go through my OUTPUT chain. Here are the rules from the INPUT chain that are applied to the packets in question: LOG all -- ...
0
votes
1answer
6k views

tcpdump ip range

I'm using nfsen and I need to apply a filter to get specific ip range and I can't find the syntax. I searched in the doc of nfdump and tcpdump but nothing. For now the netflows captured provides from ...
2
votes
1answer
780 views

How do packets traverse tc/netfilter physical, VLAN and bridge interfaces?

Given the following setup on a router that performs NAT between two networks A and B: eth0 - physical interface - no ip address eth0.1 - VLAN interface for network A - no ip address eth0.2 - VLAN ...
1
vote
1answer
221 views

iptables ERROR target

When I list the iptables rules for filter table with iptables -t filter -L -vvv --line-numbers command, then I see entry numbers from 0 to 124 under the debug output. Last entry is following: Entry ...
1
vote
0answers
101 views

The correct way of implementing adblocking with uzbl?

I though about running some proxy on localhost, but will I be able to filter https? I've tried to use scripts from wiki, but they are not seem to work. Another idea is to implement adblocking using /...
3
votes
1answer
1k views

IPTables redirect all UDP packets including ESTABLISHED

We currently have some rules setup in IPtables that look like the below: -A PREROUTING -d dstip/32 -p udp -m udp --dport 27035 -m u32 --u32 "0x0>>0x16&0x3c@0x8=0xffffffff&&0x0>&...
2
votes
0answers
309 views

Match-set via libiptc

Could anyone share any examples that use match-set for iptables via the libiptc library? I have tried using the iptables v1.4.21 and the code from https://bani.com.br/2012/05/programmatically-...
1
vote
1answer
682 views

-o in iptables is for specifying the interface for OUTPUT, FORWARD, and POSTROUTING Correct?

Reading in detail about iptables / netfilter here, when I read about the -o argument: "Indicates the interface through which the outgoing packets are sent through the INPUT, FORWARD, and ...
1
vote
0answers
198 views

Iptables packet src ip not NATed in case of icmp reply and tcp ack

I am using iptables in conjunction with net-filter queue in order to alter packets programmatically. Im using iptables rules over ubuntu lab with 2 NICs eth0 to the internet and eth1 to the LAN I ...
1
vote
0answers
74 views

Log internet access

For a WiFi hotspot I want to record each guest's internet access. Not the full data, only source/dest/timestamp/duration. I didn't found any open source software to do this. Question 1: does someone ...