Questions tagged [netfilter]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
8
votes
5answers
9k views

Why does SNAT happen in POSTROUTING chain and DNAT in PREROUTING chain?

Why does SNAT(modifies source IP and/or ports) happen in nat table POSTROUTING chain, i.e after routing? And why does DNAT(modifies destination IP ant/or ports) happen in PREROUTING chain? I guess ...
0
votes
1answer
36 views

Get netfilter statistics on the command line

I am finally switching from the old iptables to the new netfilter (specifically using firewalld) to configure my computers and servers but so far I have failed to find any newer alternative to the ...
2
votes
1answer
78 views

Nftables default drop chain problem

I'd like to take a default drop approach to my firewall rules. I've created some rules for testing purposes: table bridge vmbrfilter { chain forward { type filter hook forward priority -...
7
votes
2answers
31k views

forward packets from one interface to another interface using iptables

I have an embeded system with 2 interfaces e0 and m0, whose ips are 10.0.0.20 and 192.168.0.20, respectively. Incoming packets into e0 have an ip of 10.0.0.10 and should be forwarded to m0 interface ...
0
votes
0answers
26 views

ipvlan mode l2 IP address takeover

Let's suppose that I have 2 ipvlan mode l2 network interfaces: A and B, and A is in a network namespace. When B receives a packet, is it possible to distinguish in a netfilter (iptables) rule whether ...
0
votes
0answers
194 views

Linux tc filter add - errors RTNETLINK answers: Operation not supported

I'm working on the network simulation to create some traffic on specific ports , and trying to inject the network delay. I'm using the linux tc utility to do this operations. So i'm new to the tc ...
3
votes
2answers
1k views

How can I transform UDP to TCP with netfilter?

I have a wonderful ISP blocking all UDP traffic (except DNS to its own DNS servers). However, I want to use UDP for my VPN solution. I have root over both VPN endpoints, and both of them are using ...
1
vote
1answer
78 views

marked packets not detected by routing policy database

I have a following mangle table rule in a lab server which marks UDP traffic with 1 if the destination address is 6.6.6.6: $ sudo iptables -t mangle -L PREROUTING 2 -v -n --line-numbers 2 17 ...
5
votes
1answer
5k views

nftables rule: No such file or directory error

I am trying to apply below nftables rule which I adopted from this guide: nft add rule filter INPUT tcp flags != syn counter drop somehow this is ending up with: Error: Could not process rule: No ...
0
votes
0answers
116 views

ufw and iptables-nft not working

I have upgraded to Buster. It's running on a physical server, no VM. The setup is as folows: Kernel modules lsmod | grep nf nf_log_ipv6 16384 5 nf_reject_ipv6 16384 1 ...
2
votes
1answer
7k views

How does iptable work with linux bridge?

Setup: VM1 --- Bridge -- VM2 VM1 and 2 are on same subnet. Bridge has 2 interfaces added to brctl bridge. When I block VM2 ip using uptables -A FORWARD -s (VM1 ip) -j DENY it doesn't work. I ...
1
vote
1answer
3k views

How can I see the kernel logs?

I run Ubuntu 16.04 In the linux kernel there are certain log statement for conditions on packet filtering which I'd like to see if they are actually triggered. One example is: /* Smaller that ...
-1
votes
1answer
52 views

Qemu network traffic filtering with iptables

I need to filter both outcoming and incoming traffic of the guest system on Qemu (Linux). The host system is Linux too. I think iptables is a good tool, but I don't know how to use it here. What ...
0
votes
1answer
50 views

How set MAC address filtering on linux?

I need to block any incoming connection from a MAC address different from a specific one (which is static and well known). This MAC address should generate only non-IP connection: this is the reason ...
2
votes
1answer
639 views

Filtering and queue the packet of a process using iptable

I am trying to queue the packets of a process so I can use libnetfilter_queue to modify them. I know that I should use --pid-owner processid to filter packets of a process and iptables -I <table ...
0
votes
1answer
764 views

Debian update to Buster, iptables throwing an error in

I've just updated my old Debian Jessie server to Buster, and I'm having some issues with iptables. I understand that the backend has been changed with the update, but I have absolutely no knowledge or ...
4
votes
1answer
4k views

When and how to use chain priorities in nftables

When configuring a chain in nftables, one has to provide a priority value. Almost all online examples set a piority of 0; sometimes, a value of 100 gets used with certain hooks (output, postrouting). ...
0
votes
1answer
17 views

netfilter fails to properly replace destination IP of UDP response package

We have small kuberentes cluster running (CentOS 7, Kuberenetes 1.13 + Flannel) and after some tweaking TCP configuration (see below), we noticed that DNS was not working properly. I don't think that ...
1
vote
1answer
923 views

Check whether iptables or nftables are in use

Given a host that is in an unknown state of configuration, I would like to know if there is an effective way of non-interactively determining if the firewall rule set in place is managed by iptables ...
0
votes
1answer
39 views

How is netfilter able to track the out-of-band data-connections of FTP to be in RELATED state with control-connection?

An article at this URI https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/sect-security_guide-firewalls-iptables_and_connection_tracking RELATED — A packet ...
4
votes
1answer
3k views

How to tag IPTABLES rules?

I am going to use iptables for port forwarding to listen on requests from my LAN on port 8080 and answer with container at port 80, like this: iptables -t nat -A PREROUTING -p tcp -d 192.168.1.15 --...
0
votes
0answers
86 views

Why my system can only do port forwarding when I ssh to it?

I use debian 10 with kernel 4.19 and nftables as port forwarding tool. The rule is like table ip nat { chain prerouting { type nat hook prerouting priority -100; policy accept; ip ...
1
vote
1answer
1k views

nftables meter error: syntax error, unexpected saddr, expecting comma or '}'

I have below nftable rule to add a connection rate meter: nft add rule ip filter input tcp dport @rate_limit meter syn4-meter \{ ip saddr . tcp dport timeout 5m limit rate 20/minute \} counter ...
0
votes
0answers
147 views

How to drop all lldp packets on a specific port using IPTables?

I have lldp packets sent on a specific port (6633) and i need to drop only and only if they are lldp packets, because i have another traffic that cant be dropped, so i can't just drop all traffic on ...
0
votes
0answers
48 views

How ipset timeout works?

Is the expiry checked for every received packet if the ip should be removed from ipset or is there something in the background running every second and removing expired ip addresses?
1
vote
0answers
135 views

firewalld updating ipset entry timeout

I have been trying to figure out how to update the timeout of an ipset entry, with no luck so far, when using native ipset I would just simply use: $ ipset add foo 192.168.0.5 timout N -exist but ...
1
vote
1answer
282 views

Does upset hash:net,port support 0.0.0.0/0

Is there a way to add 0.0.0.0/0 to ipset type hash:net,port? It appears to only support prefix lengths of 1-32 but what if I want an entry in my ipset hash to support all ip traffic on a given port? ...
1
vote
0answers
133 views

Netfilter bypass through Firejail

For isolation, I run Firefox through Xephyr with Openbox. In the Firejail profile, I set net enp2a1 to isolate the network through network namespaces. But I don’t like that a regular user can override ...
1
vote
1answer
45 views

Is it possible to bind to a port that has a entry for DNAT in iptables?

I have added a DNAT entry (in the host) for a port (say 30001) in PREROUTING using iptables $ sudo iptables -t nat -A PREROUTING -p tcp --dport 30001 -j DNAT --to-destination <my guest vm ip>:...
5
votes
2answers
3k views

Is there a way to do layer 7 filtering in Linux?

The L7-filter project appears to be 15 years old, requires kernel patches with no support for kernels past version 2.6, and most of the pattern files it has appear to have been written in 2003. ...
0
votes
0answers
21 views

Use Netfilter to programatically set packet destination and route them

I'm new to iptables and its modules and I would like help in rapping my head around it. The Problem Managing large scale NAT routing. I need to handle more then 100,000 static IPs (and growing) and ...
4
votes
1answer
2k views

IPTables redirect all UDP packets including ESTABLISHED

We currently have some rules setup in IPtables that look like the below: -A PREROUTING -d dstip/32 -p udp -m udp --dport 27035 -m u32 --u32 "0x0>>0x16&0x3c@0x8=0xffffffff&&0x0>&...
1
vote
0answers
46 views

How does Linux route packets destined for another interface? [duplicate]

How are packets routed inside a single linux machine? Imagine the following setup: +--------------------+ | apache on | | 192.168.1.30:80 | | | | ...
0
votes
1answer
41 views

Iptable order of rules with example

I had question about IPtables. Let's start with this example of my book: What rules you would set for a mail server accepting connections for EMSTP (port 465) and IMAP (port 993) having a ...
1
vote
1answer
650 views

Example command to set same DSCP value in the IP header for return packets within the same TCP connection

I have seen connmark or ctinfo could work for this but couldn't find a simple effective command to make it work (Not familiar within this area). The command can be applied to the TCP termination node ...
-1
votes
1answer
285 views

Failing service during boot, which one + solution?

System: Linux Mint 19.3 "Tricia" - Cinnamon (64-bit), based on Ubuntu 18.04, kernel 5.3.0-24-generic Problem duration: literally for a year or so. Problem description: since I have too large a ...
1
vote
0answers
176 views

arptables-nft persistence

Introduction This is on Debian Buster with kernel 4.19.0-6 I've installed iptables-persistent and netfilter-persistent versions 1.0.11 and added a basic rule to arptables-nft to block all LAN ...
1
vote
1answer
317 views

How to clone the output of the MASQUERADE target with a TEE?

The Netfilter's extensions man page states that: MASQUERADE: This target is only valid in the nat table, in the POSTROUTING chain QUESTION: How to clone the output of the MASQUERADE target with a ...
0
votes
1answer
266 views

Systemtap can not resolve probe point although it is shown in probe list

I'm trying to debug netfilter synproxy module with systemtap. This is probe point I'm trying to add. # stap -l 'module("ipt_SYNPROXY").statement("*")' | grep send_client_synack module("ipt_SYNPROXY")...
2
votes
1answer
1k views

Masquerade rule with netfilter-persistent

I use netfilter-persistent to manage a firewall. I would like to share a connection between two interfaces using masquerading (example, or another). When I run those operations by invoking iptables ...
5
votes
2answers
8k views

What is the difference between NAT OUTPUT chain and NAT POSTROUTING chain?

IF Nating is done in OUTPUT chain of the NAT table, then what is the function of SNAT in POSTROUTING
3
votes
1answer
4k views

Best way to filter/limit ARP packets on embedded Linux

I have an embedded Linux on some network device. Because this device is pretty important I have to make many network tests (I have a separate device for that). These tests include flooding my device ...
2
votes
2answers
2k views

Impossible to browse web after configuring iptables

I'm trying to configure iptables on my ubuntu computer. These are my rules: Chain INPUT (policy DROP) target prot opt source destination ACCEPT tcp -- anywhere ...
2
votes
1answer
4k views

Is iptables string matching still supported?

I was reading the book Linux Firewalls - Attack Detection and Response (by M. Rash, No Starch Press, 1 Ed., Oct. 2007). In one of its chapter it discusses string matching using iptables. I was ...
3
votes
3answers
2k views

removed lib modules folder after every reboot

uname -r: 4.13.0-16-generic (ubuntu 17.10 server) I have a problem that iptables doesn't work after a reboot: iptables-apply /etc/network/iptables [ ok ] Stopping fail2ban (via systemctl): fail2ban....
0
votes
1answer
3k views

Changing Destination IP address using iptables and DNAT

I am trying to experiment with DNAT in PREROUTING. I found a tutorial here. It contains the following sentence: This is done in the PREROUTING chain, just as the packet comes in; this means that ...
1
vote
1answer
2k views

iptables-restore failed in Debian buster/sid if it has --multiport option in the rules file

I have /etc/iptables/rule.v4 file contains many rule, the below is the line where I see the issue -A INPUT -p tcp -m multiport --dports 22 -j ACCEPT -A INPUT -p udp -m multiport --dports 16384:32768 -...
0
votes
0answers
207 views

Packet traversal in the Linux networking stack

I am trying to understand the packet traversal in Linux. I found a diagram from link. My linux box has the following routing table: default via 192.168.2.1 dev wlan0 proto static metric 1024 169....
1
vote
1answer
1k views

Is there any way to view nfmark like ctmark?

I understand that iptables --set-mark does not add mark "on" the packets. The MARK target is for associating a mark with the packet in the kernel data structures. The packet itself is not modified. ...
-1
votes
1answer
2k views

Why is /proc/net/nf_conntrack empty?

On my RHEL 6.5 I expected /proc/net/nf_conntrack to contain the latest/current connections but it is completely empty: [root@plop ~]# cat /proc/net/nf_conntrack [root@plop ~]# Can you help me ...