Questions tagged [netfilter]
The netfilter tag has no usage guidance.
91
questions
0
votes
1answer
26 views
Iptable order of rules with example
I had question about IPtables.
Let's start with this example of my book:
What rules you would set for a mail server accepting connections for
EMSTP (port 465) and IMAP (port 993) having a ...
0
votes
1answer
14 views
Example command to set same DSCP value in the IP header for return packets within the same TCP connection
I have seen connmark or ctinfo could work for this but couldn't find a simple effective command to make it work (Not familiar within this area).
The command can be applied to the TCP termination node ...
-1
votes
1answer
26 views
Failing service during boot, which one + solution?
System: Linux Mint 19.3 "Tricia" - Cinnamon (64-bit), based on Ubuntu 18.04, kernel 5.3.0-24-generic
Problem duration: literally for a year or so.
Problem description: since I have too large a ...
1
vote
0answers
22 views
arptables-nft persistence
Introduction
This is on Debian Buster with kernel 4.19.0-6
I've installed iptables-persistent and netfilter-persistent versions 1.0.11
and added a basic rule to arptables-nft to block all LAN ...
1
vote
1answer
67 views
How to clone the output of the MASQUERADE target with a TEE?
The Netfilter's extensions man page states that:
MASQUERADE: This target is only valid in the nat table, in the POSTROUTING chain
QUESTION: How to clone the output of the MASQUERADE target with a ...
0
votes
0answers
37 views
why iptables has 5 tables
Recently, I'm reading Linux Kernel Networking. It says Netfilter has 5 mount points, that is pre_routing, post_routing, local_in, local_out and forward. iptables has 5 tables, mangle, nat, filter, ...
1
vote
1answer
277 views
nftables meter error: syntax error, unexpected saddr, expecting comma or '}'
I have below nftable rule to add a connection rate meter:
nft add rule ip filter input tcp dport @rate_limit meter syn4-meter \{ ip saddr . tcp dport timeout 5m limit rate 20/minute \} counter ...
0
votes
1answer
68 views
Systemtap can not resolve probe point although it is shown in probe list
I'm trying to debug netfilter synproxy module with systemtap.
This is probe point I'm trying to add.
# stap -l 'module("ipt_SYNPROXY").statement("*")' | grep send_client_synack
module("ipt_SYNPROXY")...
1
vote
1answer
623 views
nftables rule: No such file or directory error
I am trying to apply below nftables rule which I adopted from this guide:
nft add rule filter INPUT tcp flags != syn counter drop
somehow this is ending up with:
Error: Could not process rule: No ...
0
votes
0answers
46 views
x_tables: exports duplicate symbol xt_alloc_entry_offsets (owned by kernel)
I have enabled Xtables in my kernel but I get this error whenever I try to modprobe
$ sudo modprobe ip_tables
modprobe: ERROR: could not insert 'ip_tables': Exec format error
dmesg tells me
...
0
votes
0answers
11 views
filter data going through nload ? Purpose : measure bandwidth consumption of a gateway?
I have a LinuxBox that has two functions : an internet gateway and a mail server.
With nload I can monitor the traffic on the internet (WAN) interface, but that shows me both the gateway consumption ...
0
votes
0answers
214 views
How does IPVS-NAT interact with iptables?
I'm using IPVS-NAT to do some load-balancing in Kubernetes (kube-proxy), I would like to understand when do IPVS's hooks get executed, I tried to read about this here: http://www.austintek.com/LVS/LVS-...
0
votes
0answers
9 views
the package In netfiler can send from input chain to postrouting chain direct?
when the packet go to Input Chain in ipvs ,the match packet can be send to postRouting chain,how ? as far as i am concerned,in netfilter ,the packet travers flow is input-> output -> postRouting,...
0
votes
0answers
12 views
Adding IP Header Option With netfiletr
Is there any way to add IP header option (Record Route for example) to outgoing forwarded IP traffic using netfilter functionality( iptables, nft, ...).
Theres's ipv4options patch extension but it ...
0
votes
0answers
16 views
Why is netfilter not applying rule to these packets?
There are 4 servers:
A - partner server with public IP
B - our server with public IP
C - our another server, but in LAN
D - external third party server for testing
I control B, C and D. There is GRE ...
1
vote
1answer
800 views
Best way to filter/limit ARP packets on embedded Linux
I have an embedded Linux on some network device. Because this device is pretty important I have to make many network tests (I have a separate device for that). These tests include flooding my device ...
0
votes
0answers
46 views
Keep conntrack state for current ssh connection on netfilter rule flush/reload
When i am reloading netfilter with a new ruleset that drops invalid packets
flush ruleset
...
ct state invalid counter log prefix "Drop input invalid " drop comment "drop invalid packets"
...
over ...
0
votes
1answer
1k views
Changing Destination IP address using iptables and DNAT
I am trying to experiment with DNAT in PREROUTING. I found a tutorial here. It contains the following sentence:
This is done in the PREROUTING chain, just as the packet comes in; this means that ...
1
vote
1answer
552 views
iptables-restore failed in Debian buster/sid if it has --multiport option in the rules file
I have /etc/iptables/rule.v4 file contains many rule, the below is the line where I see the issue
-A INPUT -p tcp -m multiport --dports 22 -j ACCEPT
-A INPUT -p udp -m multiport --dports 16384:32768 -...
0
votes
0answers
113 views
Packet traversal in the Linux networking stack
I am trying to understand the packet traversal in Linux. I found a diagram from link.
My linux box has the following routing table:
default via 192.168.2.1 dev wlan0 proto static metric 1024
169....
2
votes
2answers
527 views
How can I transform UDP to TCP with netfilter?
I have a wonderful ISP blocking all UDP traffic (except DNS to its own DNS servers).
However, I want to use UDP for my VPN solution. I have root over both VPN endpoints, and both of them are using ...
asked Feb 27 '19 at 12:12
peterh - Reinstate Monica
5,89512 gold badges40 silver badges66 bronze badges
0
votes
1answer
267 views
Is there any way to view nfmark like ctmark?
I understand that iptables --set-mark does not add mark "on" the packets. The MARK target is for associating a mark with the packet in the kernel data structures. The packet itself is not modified. ...
1
vote
1answer
2k views
How does iptable work with linux bridge?
Setup:
VM1 --- Bridge -- VM2
VM1 and 2 are on same subnet. Bridge has 2 interfaces added to brctl bridge.
When I block VM2 ip using uptables -A FORWARD -s (VM1 ip) -j DENY
it doesn't work.
I ...
5
votes
0answers
144 views
Multicast ICMPv6 comes back with conntrack state invalid
I was playing arround with the Multicast feature of IPv6.
$ ping ff02::2%wlp3s0
This should normally result in an echo-reply from all the routers on your local network segment (Wikipedia - IPv6).
So ...
1
vote
1answer
85 views
iptables blocking local traffic
My local machine IP: 192.168.0.35
What I did: Answer that i tried here!!
sudo iptables -t nat -A OUTPUT -p tcp --dport 80 -j DNAT --to-destination 192.168.0.35:80
The error:
Now I can not access ...
1
vote
1answer
156 views
iptables Masquerade leave out some local packet?
In openwrt i have config lan forward to wan with masqenabled. And my lan network is 192.168.100.0/24. when some pc ping with other network ip e.g: 192.168.1.15, tcpdump will get some local packet in ...
1
vote
3answers
1k views
in iptables, does MASQUERADE match only on NEW connections (SYN packets)?
I observed that MASQUERADE target does not match on packets in the reply direction (in terms of netfilter conntrack).
I've a single simple -t nat -A POSTROUTING -s 10.a.0.0/16 -d 10.b.0.0/16 -j ...
2
votes
1answer
365 views
Masquerade rule with netfilter-persistent
I use netfilter-persistent to manage a firewall.
I would like to share a connection between two interfaces using masquerading (example, or another). When I run those operations by invoking iptables ...
2
votes
1answer
98 views
Packet meta class applied, but captured VLAN priority is wrong
My linux home router sits between my ISP (Orange) and my home network.
On the WAN side, Orange provide internet in a VLAN tagged 832.
Some control messages (ARP, DHCP, ICMPv6 "router discovery" types,...
1
vote
1answer
74 views
How does one use tc to add latency to a ratelimit?
I read that there's another tool for netfilter that allows you to add latency to a ratelimit.
Does anyone have an example of this?
3
votes
1answer
4k views
How --set-mark option works on Netfilter (IPTABLES)?
On Netfilter, you have the option --set-mark for packets that pass through the mangle table.
The majority of tutorials and examples over the Internet, say that this just adds a mark on the packet, ...
4
votes
1answer
1k views
Is there a way to do layer 7 filtering in Linux?
The L7-filter project appears to be 15 years old, requires kernel patches with no support for kernels past version 2.6, and most of the pattern files it has appear to have been written in 2003.
...
2
votes
1answer
972 views
multicast traffic is able to poke a hole into the netfilter connection tracking system
I have an IPTV solution at home where the ISP sends me hundreds of large UDP datagrams per second from 10.4.4.5 port 10 to 239.3.5.3 port 10, i.e. it is using multicast. My current iptables ...
1
vote
2answers
438 views
Send TCP packet to the same source [closed]
I want to design a system which reduce travel time of packet what is happening in reality is I send a SYN bit from client side, this bit travel through router then to server and server reply SYN+ACK ...
1
vote
0answers
301 views
iptables connlimit-above allowing more connections than desired
I'm trying to set a per-ip connection limit on a kubernetes node using iptables connlimit. Since each container on the VM has a different source IP (overlay net), using connlimit should work. I added ...
5
votes
2answers
3k views
What are the essential iptables rules for IPv6 to work properly?
I had a problem where I lost connectivity to a server on the IPv6 address after some time and it turned out to be caused by DHCPv6 client packets (port 546) being dropped by the default INPUT policy ...
0
votes
0answers
120 views
When are inverse NAT manipulation applied by netfilter/iptables?
If there is a DNAT rule in the PREROUTING chain like this one:
iptables -t nat -A PREROUTING -j DNAT --to-destination x.x.x.x
All packets reaching the stack from a network interface will first pass ...
1
vote
2answers
706 views
How to establish a man-in-the-middle scenario with ebtables and iptables
For testing and educational purposes I want so set up a man-in-the-middle scenario as follows:
Host T is the target host that is to be "cloned"
Host M is the man in the middle with interfaces eth0 ...
2
votes
1answer
2k views
How to match both UDP and TCP for given ports in one line with nftables
How can i do this in a single line?
tcp dport 53 counter accept comment "accept DNS"
udp dport 53 counter accept comment "accept DNS"
0
votes
1answer
522 views
nftables, add output rule syntax
I'm a bit frustrated by the lack of comprehensive documentation of nftables and currently I'm failing to get even a simple example to work. I'm trying just create a output rule. Here's my only table:
...
0
votes
1answer
3k views
URL Filtering with IP tables
I've been trying to set up URL filtering with Iptables. I have set up two interfaces. Traffic flows in from one interface and flows out from the other.
Below are the Iptables I have configured:
*...
0
votes
1answer
1k views
blocking YouTube not working for Google Chrome
I have some rules on the FILTER table of Netfilter, which block HTTPS access to some websites:
-A FORWARD -s 10.255.255.0/26 -p tcp -m tcp --dport 443 -m string --string "facebook.com" --algo bm -j ...
3
votes
1answer
2k views
When and how to use chain priorities in nftables
When configuring a chain in nftables, one has to provide a priority value. Almost all online examples set a piority of 0; sometimes, a value of 100 gets used with certain hooks (output, postrouting).
...
3
votes
1answer
3k views
nf_register_hook not found in linux kernel 4.13-rc2 and later
I just started learning about netfilter and I was trying to make a simple netfilter module, all the tutorials and HOW TOs register a hook function with nf_register_hook(), but I could not find one in ...
2
votes
1answer
522 views
How to disable implicit source port mapping on outgoing UDP packets sent through NAT in iptables?
iptables is re-writing the source port on my UDP packets that go out of a tun interface. I have NAT rules setup with port X forwarded (details below). When an application behind the NAT receives a ...
0
votes
1answer
580 views
iptable string matching to find application type / application layer protoco
I would like to know is it possible to match the type of applications/application layer protocols using iptables string matching extension?
2
votes
3answers
747 views
removed lib modules folder after every reboot
uname -r: 4.13.0-16-generic (ubuntu 17.10 server)
I have a problem that iptables doesn't work after a reboot:
iptables-apply /etc/network/iptables
[ ok ] Stopping fail2ban (via systemctl): fail2ban....
2
votes
1answer
3k views
Is iptables string matching still supported?
I was reading the book Linux Firewalls - Attack Detection and Response (by M. Rash, No Starch Press, 1 Ed., Oct. 2007). In one of its chapter it discusses string matching using iptables. I was ...
3
votes
2answers
5k views
What is the difference between NAT OUTPUT chain and NAT POSTROUTING chain?
IF Nating is done in OUTPUT chain of the NAT table, then what is the function of SNAT in POSTROUTING
1
vote
1answer
2k views
iptables/netfilter: “nf_nat_ftp” is not working well with recent Linux kernels
I'm facing the following issue with Linux kernel 4.10-28-generic, embedded in Ubuntu-16.04.02-LTE.
My machine has two ethernet adapters, namely the following ones:
enp0s3: 198.168.56.2 (internal ...
