Questions tagged [netfilter]
The netfilter tag has no usage guidance.
131
questions
3
votes
1
answer
40
views
What are ARP hardware type 37, opcode 21 and protocol type 0x90bd?
I am currently testing netfilter / nftables / nft. As a starting point, I have made a ruleset that drops nearly everything in and out, and have written the rules so that every dropped packet is logged....
- 2,473
0
votes
1
answer
97
views
netfilter: ipset vs iptables recent module
what exactly are the practical differences between iptables recent module and ipset ?
I know recent module only allows IPs, whereas ipset allows subnets. But other than this, what is the main ...
- 241
2
votes
1
answer
322
views
How do I delete a specific element in a chain in nftables?
Current system:
Distro: Ubuntu 20.04
kernel: 5.4.0-124-generic
nft: nftables v0.9.3 (Topsy)
I am new and learning nftables, Here is my nft ruleset currently:
$sudo nft list ruleset ...
- 456
1
vote
0
answers
210
views
How to install Netfilter / enable conntrack events?
I have come across this repo and struggle to understand these steps.
I believe this is to enable the Netfilter conntrack events, but I'm not sure.
What do I have to run to get these prompts?
----------...
- 187
2
votes
1
answer
140
views
nftables Named Set Update Delay
I have the following in nftables.conf:
table inet nat {
set blocked {
type ipv4_addr
}
chain postrouting {
type nat hook postrouting priority ...
0
votes
1
answer
22
views
Why didn't iptables apply the sames rules?
For some reason, my network encountered "Destination unreachable no route" error, this error happened periodicly, later I found that was a bug of my program.
But during that time, I found a ...
- 31
0
votes
0
answers
63
views
Nftables sepparate rules for different ip on the same interface
I have a server with 2 public IP addresses linked to it. However, both of them are on the same interface (ens3). I think it called IP-aliasing.
ens3:
altname enp0s3
inet <public ip 1>/32 ...
- 31
0
votes
0
answers
84
views
Debian Router (DIY) Website Timeout Problems
I've been setting up a DIY router using Debian. I'm at a point where it's routing traffic to the internet for my client devices. However I'm having trouble accessing websites.
Some websites load ...
1
vote
1
answer
57
views
Where is /etc/nftables/inet-filter?
I am trying to locate the file /etc/nftables/inet-filter which is referenced in the readme for a project I've inherited. When I installed nftables, the only files that existed in etc/nftables were:
. ...
- 23
0
votes
0
answers
213
views
How do I configure Netfilter packet queues with NFTables?
Summary
I would appreciate some guidance in how to configure Netfilter packet filter queues in a Fedora/36-cloud-base virtual machine running in Vagrant, according to a (seemingly outdated) project ...
- 23
3
votes
1
answer
323
views
NFTables Egress Hook?
I'm looking to apply firewall rules on egress to control DHCP output from a Docker container. I don't want the DHCP container to share the host's network stack as adding CAP_NET_ADMIN effectively ...
1
vote
1
answer
133
views
libvirt nwfilter, multiple parameters
It's possible to pass multiple parameters to the "filterref" using "parameter" keyword. Like this:
<filterref filter='no-ip-spoofing'>
<parameter name='IP' value='10.0....
- 23
0
votes
0
answers
75
views
Forward Traffic to virtual box (Genymotion)
I am running an Android virtual machine (Samsung Galaxy S10 & android 10.0 API29) using Genymotion. I have a VPN running there (OpenVPN protocol). Now I am running all this over my Debian based ...
0
votes
2
answers
566
views
During the lifecycle of "iptables", in which step, will kernel take advantage of "route table"?
iptables. I have went though the manual of Iptables and known some basic concepts, e.g. chain, table, hook, rule and targets. In the Linux ecosystem, iptables is a widely used firewall tool that ...
- 164
0
votes
1
answer
154
views
Netfilter: in which situation, NF_IP_FORWARD will be triggered?
Netfilter Hook: NF_IP_FORWARD
There are five netfilter hooks that programs can register with. As packets progress through the stack, they will trigger the kernel modules that have registered with ...
- 164
1
vote
1
answer
1k
views
which layer does Netfilter and IPTables works on in the OSI model?
IPTables are the basic and very commonly used firewall in Linux systems. netfilter provides 5 hooks that programs can register with.
which layer does Netfilter and IPTables works on?
IP Packet level
...
- 164
1
vote
1
answer
126
views
Linux L2 bridge blocks ip packets which are addressed to a listening port on the host
On my Server I have a bunch of vms, connected by a simple L2 linux bridge to an OPNsense VM for firewalling and routing between the vms.
The OPNsense vm is connected via macvtap to the single enp3s0 ...
- 11
3
votes
1
answer
828
views
How do packets flow through the kernel
When it comes to packet filtering/management I never actually know what is going on inside the kernel. There are so many different tools that act on the packets, either from userspace (modifying ...
- 201
0
votes
1
answer
267
views
How can I filter a packet after an iptables MASQUERADE?
I am trying to build a multi-WAN router based on Debian Buster (kernel version 4.19). It has multiple 'LAN-side' network interfaces (e.g. lan0, lan1, ... lanM), and also multiple 'WAN-side' interfaces ...
- 101
0
votes
0
answers
37
views
Updating hostnames in netfilter automatically?
I'd like to accomplish an egress filter on Linux using Netfilter (iptables) and the DNS hostname of the destination. The problem is, writing the rules using the hostname will only resolove the IP ...
- 75
0
votes
0
answers
405
views
Illegal "match" error when applying Linux tc, u32 filters mask
I want apply the following rules for TOS based traffic shaping. All rules works but the final rule which mask the IP header shows illegal "match" error
sudo tc qdisc del dev tun0 root handle ...
1
vote
1
answer
418
views
netfilter: drop packets having IP options
I'd like to add a rule dropping an IPv4 packet with any IP option following the header. I understand that IHL (Internet Header Length) field in he header contains the number of 32-bit words in the ...
- 1,603
0
votes
1
answer
275
views
TCPDUMP w/SNAT Configuration Shows Private IP on ICMP Reply
Problem: TCPDUMP icmp reply inexplicably has the private address. I would expect it to have the public address.
[router.box(1.2.3.4)]$ tcpdump -n -i br1 icmp
10:42:21.689215 IP 1.2.3.4 > 8.8.8.8: ...
- 101
1
vote
1
answer
776
views
What chain types are supported by the nftables NETDEV family?
From the nftables Quick reference:
family refers to a one of the following table types: ip, arp, ip6,
bridge, inet, netdev.
and
type refers to the kind of chain to be created. Possible types are:
...
- 2,473
1
vote
1
answer
145
views
Same iptables rules for two different iptables versions
I use a set of iptables rules that makes use of the mangle table, which contains the rows below, on two different versions of iptables v1.3.8, and v1.4.7.
Iptables v1.3.8 runs on Fedora release 8 ...
- 145
2
votes
0
answers
2k
views
Mark a packets with iptables in order to make a source ip routing
I have a linux machine, which I use as a gateway and firewall.
The linux machine (GW/FIREWALL) is connected to a device which allow internet connection (Router Aggregator), it has 2 IP addresses 172....
- 145
1
vote
1
answer
646
views
Nftables not matching TOS value in IP packets
This is on Ubuntu 20.04.
I am attempting to write a rule for nftables which will match all IP packets received on interface eth1 that have a specific TOS value (0x02). My attempt so far:
sudo nft add ...
- 141
0
votes
1
answer
374
views
Iptables Accept All From Specific Ip And Port
I want to accept all traffic that is coming from an IP address and its specific port to any of my ports.
Here is the configuration:
Details:
I am using Jitsi in a server, and I want to reach Jitsi ...
- 1
1
vote
0
answers
262
views
How can I prevent iptables connlimit counter from resetting each time an iptables rule is added?
Context
In short I'm working over a feature to provide outbound connection count rate and hard limiting per destination host of containers in a container networking solution (see silk-release). An ...
- 11
0
votes
1
answer
204
views
Connect to server behind NAT from LAN using real IP
I have a small network.
It has a firewall connected to the internet (WAN) with real IP and DNS name which also acts as a DHCP server
for the internal network (LAN).
On the firewall machine I've setup ...
- 313
1
vote
1
answer
461
views
Get netfilter statistics on the command line
I am finally switching from the old iptables to the new netfilter (specifically using firewalld) to configure my computers and servers but so far I have failed to find any newer alternative to the ...
- 113
2
votes
1
answer
1k
views
Nftables default drop chain problem
I'd like to take a default drop approach to my firewall rules. I've created some rules for testing purposes:
table bridge vmbrfilter {
chain forward {
type filter hook forward priority -...
0
votes
0
answers
1k
views
Linux tc filter add - errors RTNETLINK answers: Operation not supported
I'm working on the network simulation to create some traffic on specific ports , and trying to inject the network delay. I'm using the linux tc utility to do this operations. So i'm new to the tc ...
- 1
1
vote
1
answer
1k
views
marked packets not detected by routing policy database
I have a following mangle table rule in a lab server which marks UDP traffic with 1 if the destination address is 6.6.6.6:
$ sudo iptables -t mangle -L PREROUTING 2 -v -n --line-numbers
2 17 ...
- 7,132
0
votes
1
answer
213
views
Qemu network traffic filtering with iptables
I need to filter both outcoming and incoming traffic of the guest system on Qemu (Linux). The host system is Linux too. I think iptables is a good tool, but I don't know how to use it here. What ...
- 109
0
votes
1
answer
1k
views
How set MAC address filtering on linux?
I need to block any incoming connection from a MAC address different from a specific one (which is static and well known).
This MAC address should generate only non-IP connection: this is the reason ...
- 41
0
votes
1
answer
2k
views
Debian update to Buster, iptables throwing an error in
I've just updated my old Debian Jessie server to Buster, and I'm having some issues with iptables.
I understand that the backend has been changed with the update, but I have absolutely no knowledge or ...
- 1
0
votes
1
answer
38
views
netfilter fails to properly replace destination IP of UDP response package
We have small kuberentes cluster running (CentOS 7, Kuberenetes 1.13 + Flannel) and after some tweaking TCP configuration (see below), we noticed that DNS was not working properly.
I don't think that ...
- 131
6
votes
1
answer
7k
views
Check whether iptables or nftables are in use
Given a host that is in an unknown state of configuration, I would like to know if there is an effective way of non-interactively determining if the firewall rule set in place is managed by iptables ...
- 1,771
1
vote
1
answer
244
views
How is netfilter able to track the out-of-band data-connections of FTP to be in RELATED state with control-connection?
An article at this URI https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/sect-security_guide-firewalls-iptables_and_connection_tracking
RELATED — A packet ...
- 139
0
votes
0
answers
118
views
Why my system can only do port forwarding when I ssh to it?
I use debian 10 with kernel 4.19 and nftables as port forwarding tool. The rule is like
table ip nat {
chain prerouting {
type nat hook prerouting priority -100; policy accept;
ip ...
- 423
0
votes
0
answers
463
views
How to drop all lldp packets on a specific port using IPTables?
I have lldp packets sent on a specific port (6633) and i need to drop only and only if they are lldp packets, because i have another traffic that cant be dropped, so i can't just drop all traffic on ...
1
vote
0
answers
346
views
firewalld updating ipset entry timeout
I have been trying to figure out how to update the timeout of an ipset entry, with no luck so far, when using native ipset I would just simply use:
$ ipset add foo 192.168.0.5 timout N -exist
but ...
- 11
1
vote
1
answer
908
views
Does upset hash:net,port support 0.0.0.0/0
Is there a way to add 0.0.0.0/0 to ipset type hash:net,port? It appears to only support prefix lengths of 1-32 but what if I want an entry in my ipset hash to support all ip traffic on a given port? ...
- 13
1
vote
0
answers
421
views
Netfilter bypass through Firejail
For isolation, I run Firefox through Xephyr with Openbox. In the Firejail profile, I set net enp2a1 to isolate the network through network namespaces. But I don’t like that a regular user can override ...
- 435
1
vote
1
answer
328
views
Is it possible to bind to a port that has a entry for DNAT in iptables?
I have added a DNAT entry (in the host) for a port (say 30001) in PREROUTING using iptables
$ sudo iptables -t nat -A PREROUTING -p tcp --dport 30001 -j DNAT --to-destination <my guest vm ip>:...
0
votes
0
answers
46
views
Use Netfilter to programatically set packet destination and route them
I'm new to iptables and its modules and I would like help in rapping my head around it.
The Problem
Managing large scale NAT routing. I need to handle more then 100,000 static IPs (and growing) and ...
- 101
1
vote
0
answers
50
views
How does Linux route packets destined for another interface? [duplicate]
How are packets routed inside a single linux machine? Imagine the following setup:
+--------------------+
| apache on |
| 192.168.1.30:80 |
| | |
...
- 258
1
vote
1
answer
537
views
Iptable order of rules with example
I had question about IPtables.
Let's start with this example of my book:
What rules you would set for a mail server accepting connections for
EMSTP (port 465) and IMAP (port 993) having a ...
- 113
2
votes
1
answer
2k
views
Example command to set same DSCP value in the IP header for return packets within the same TCP connection
I have seen connmark or ctinfo could work for this but couldn't find a simple effective command to make it work (Not familiar within this area).
The command can be applied to the TCP termination node ...
- 41