Questions tagged [netfilter]

The tag has no usage guidance.

41 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5
votes
0answers
151 views

Multicast ICMPv6 comes back with conntrack state invalid

I was playing arround with the Multicast feature of IPv6. $ ping ff02::2%wlp3s0 This should normally result in an echo-reply from all the routers on your local network segment (Wikipedia - IPv6). So ...
5
votes
2answers
25k views

forward packets from one interface to another interface using iptables

I have an embeded system with 2 interfaces e0 and m0, whose ips are 10.0.0.20 and 192.168.0.20, respectively. Incoming packets into e0 have an ip of 10.0.0.10 and should be forwarded to m0 interface ...
4
votes
1answer
1k views

IPTables redirect all UDP packets including ESTABLISHED

We currently have some rules setup in IPtables that look like the below: -A PREROUTING -d dstip/32 -p udp -m udp --dport 27035 -m u32 --u32 "0x0>>0x16&0x3c@0x8=0xffffffff&&0x0>&...
4
votes
0answers
1k views

iptables and ip forwarding for failover

hi i have an ethernet nic interface with 4 additional virtual interfaces (failovers) all configured with public ip4 (IP-1 to IP-5) / netmask 255.255.255.255 / broadcast addr same as ip: eth0 ->...
3
votes
0answers
469 views

Filtering bridged packets by IP address

I am using a small Ubuntu 12.04 box as a Wi-Fi Access Point. The box has two interfaces which are bridged together as follows: brctl addbr br0 brctl stp br0 off brctl addif br0 wlan0 brctl addif br0 ...
3
votes
0answers
93 views

How to unwrap a tunneled packet in iptables/netfilter and process the tunneled packet

I have a specific question regarding the Linux netfilter/iptables interaction. Let's say I have an IP packet P1 inside of another IP packet P2 (that is, P1 is tunneled). Now, the question is as ...
2
votes
0answers
377 views

Match-set via libiptc

Could anyone share any examples that use match-set for iptables via the libiptc library? I have tried using the iptables v1.4.21 and the code from https://bani.com.br/2012/05/programmatically-...
2
votes
0answers
974 views

How is the IMQ device positioned in the packet flow of the Linux kernel

I would like to know the exact position of the following device in the packet flow for ingress traffic shaping: IFB: Intermediate Functional Block I would like to better understand how packets are ...
2
votes
0answers
1k views

iptables: using “conntrack” and “recent” modules to block unsolicited packets

When I only allow RELATED and ESTABLISHED packets, and DROP everything else, my firewall rules work perfectly and I have no problems: ### VARIANT A -A INPUT -i wlan0 -m conntrack --ctstate RELATED,...
2
votes
1answer
299 views

(S/D)NAT over NF hooks

Could someone help on explaining the advantage of iptables NAT over the netfilter hooks. Say suppose, instead of using NAT if we create custom kernel module to bind handler with netfilter for PRE/POST ...
1
vote
0answers
27 views

arptables-nft persistence

Introduction This is on Debian Buster with kernel 4.19.0-6 I've installed iptables-persistent and netfilter-persistent versions 1.0.11 and added a basic rule to arptables-nft to block all LAN ...
1
vote
1answer
168 views

iptables Masquerade leave out some local packet?

In openwrt i have config lan forward to wan with masqenabled. And my lan network is 192.168.100.0/24. when some pc ping with other network ip e.g: 192.168.1.15, tcpdump will get some local packet in ...
1
vote
0answers
307 views

iptables connlimit-above allowing more connections than desired

I'm trying to set a per-ip connection limit on a kubernetes node using iptables connlimit. Since each container on the VM has a different source IP (overlay net), using connlimit should work. I added ...
1
vote
1answer
501 views

Filtering and queue the packet of a process using iptable

I am trying to queue the packets of a process so I can use libnetfilter_queue to modify them. I know that I should use --pid-owner processid to filter packets of a process and iptables -I <table ...
1
vote
0answers
125 views

The correct way of implementing adblocking with uzbl?

I though about running some proxy on localhost, but will I be able to filter https? I've tried to use scripts from wiki, but they are not seem to work. Another idea is to implement adblocking using /...
1
vote
0answers
301 views

Iptables packet src ip not NATed in case of icmp reply and tcp ack

I am using iptables in conjunction with net-filter queue in order to alter packets programmatically. Im using iptables rules over ubuntu lab with 2 NICs eth0 to the internet and eth1 to the LAN I ...
1
vote
0answers
76 views

Log internet access

For a WiFi hotspot I want to record each guest's internet access. Not the full data, only source/dest/timestamp/duration. I didn't found any open source software to do this. Question 1: does someone ...
1
vote
0answers
114 views

packet flow for connections to 127.0.0.0/8 network

I have a following very simple iptables configuration: # iptables -n -v -L INPUT --line-numbers Chain INPUT (policy DROP 21 packets, 1683 bytes) num pkts bytes target prot opt in out ...
1
vote
0answers
353 views

NFTables NAT not caolled

I have tried to switch from IPTables to NFTables. Everything worked fine, except of NATting. This configuration does nothing when I try to run it, the NAT chains are not called: table ip vms { ...
1
vote
1answer
516 views

iptables DNAT+SNAT: unwanted multiplication of the same udp datagram (and malfunction)

trying to figure out my mistake in the following very simple scenario: |peerA|(Aip:Aport) <--> (Bdev:Bip:Bport)|NatNode|(Cdev:Cip:Cport) <--> (Dip:Dport)| peerD (peer A emits datagrams ...
1
vote
0answers
1k views

Change timeout of an entry of ipset with iptables rule

I'm trying to create a set with ipset and using it in some iptables rules. ipset has timeout option to set a countdown timeout to an entry of a set to automatically remove it after a period of time. ...
1
vote
0answers
29 views

What does ipq_ctl do?

I'm in the process of writing some rust bindings to libipq, and I came across an undocumented function in libipq.h: int ipq_ctl(const struct ipq_handle *h, int request, ...);. However, this doesn't ...
1
vote
0answers
237 views

Using a VPN client as a VPN gateway

I would like host 1 to use host 2 as a gateway to the remote host 3. I have scoured the web looking for a solution, but it doesn't seem to work for me. VPN client software is ike (shrewSoft VPN) is ...
0
votes
0answers
14 views

How does Linux route packets destined for another interface?

How are packets routed inside a single linux machine? Imagine the following setup: +--------------------+ | apache on | | 192.168.1.30:80 | | | | ...
0
votes
0answers
19 views

List all registered netfilter hooks, even those not registered by iptables of nftables

As far as I understand, kernel modules can register a handler function to the netfilter hooks using nf_register_net_hook(), from Digital Ocean: A Deep Dive into Iptables and Netfilter Architecture. Q:...
0
votes
0answers
39 views

why iptables has 5 tables

Recently, I'm reading Linux Kernel Networking. It says Netfilter has 5 mount points, that is pre_routing, post_routing, local_in, local_out and forward. iptables has 5 tables, mangle, nat, filter, ...
0
votes
0answers
48 views

x_tables: exports duplicate symbol xt_alloc_entry_offsets (owned by kernel)

I have enabled Xtables in my kernel but I get this error whenever I try to modprobe $ sudo modprobe ip_tables modprobe: ERROR: could not insert 'ip_tables': Exec format error dmesg tells me ...
0
votes
0answers
12 views

filter data going through nload ? Purpose : measure bandwidth consumption of a gateway?

I have a LinuxBox that has two functions : an internet gateway and a mail server. With nload I can monitor the traffic on the internet (WAN) interface, but that shows me both the gateway consumption ...
0
votes
0answers
234 views

How does IPVS-NAT interact with iptables?

I'm using IPVS-NAT to do some load-balancing in Kubernetes (kube-proxy), I would like to understand when do IPVS's hooks get executed, I tried to read about this here: http://www.austintek.com/LVS/LVS-...
0
votes
0answers
9 views

the package In netfiler can send from input chain to postrouting chain direct?

when the packet go to Input Chain in ipvs ,the match packet can be send to postRouting chain,how ? as far as i am concerned,in netfilter ,the packet travers flow is input-> output -> postRouting,...
0
votes
0answers
13 views

Adding IP Header Option With netfiletr

Is there any way to add IP header option (Record Route for example) to outgoing forwarded IP traffic using netfilter functionality( iptables, nft, ...). Theres's ipv4options patch extension but it ...
0
votes
0answers
16 views

Why is netfilter not applying rule to these packets?

There are 4 servers: A - partner server with public IP B - our server with public IP C - our another server, but in LAN D - external third party server for testing I control B, C and D. There is GRE ...
0
votes
0answers
46 views

Keep conntrack state for current ssh connection on netfilter rule flush/reload

When i am reloading netfilter with a new ruleset that drops invalid packets flush ruleset ... ct state invalid counter log prefix "Drop input invalid " drop comment "drop invalid packets" ... over ...
0
votes
0answers
126 views

Packet traversal in the Linux networking stack

I am trying to understand the packet traversal in Linux. I found a diagram from link. My linux box has the following routing table: default via 192.168.2.1 dev wlan0 proto static metric 1024 169....
0
votes
0answers
121 views

When are inverse NAT manipulation applied by netfilter/iptables?

If there is a DNAT rule in the PREROUTING chain like this one: iptables -t nat -A PREROUTING -j DNAT --to-destination x.x.x.x All packets reaching the stack from a network interface will first pass ...
0
votes
1answer
591 views

iptable string matching to find application type / application layer protoco

I would like to know is it possible to match the type of applications/application layer protocols using iptables string matching extension?
0
votes
1answer
2k views

How can I see the kernel logs?

I run Ubuntu 16.04 In the linux kernel there are certain log statement for conditions on packet filtering which I'd like to see if they are actually triggered. One example is: /* Smaller that ...
0
votes
1answer
498 views

OUTPUT chain rules in iptables

netfilter seems to allow rejected traffic from my INPUT chain to go through my OUTPUT chain. Here are the rules from the INPUT chain that are applied to the packets in question: LOG all -- ...
0
votes
0answers
73 views

What is wrong with this particular iptables command?

On an older router, I was using this command: iptables -t mangle -I PREROUTING -i br0 -s 192.168.157.0/24 -j MARK --set-mark 7 That router died (red led of death), and now I'm forced to try to ...
0
votes
1answer
695 views

Execute Terminal Command in Linux Kernel Hook

How do I execute the following command from a loadable Linux kernel hook: echo 5 > /sys/kernel/debug/ieee80211/phy0/ath9k/AggregationLimit
-1
votes
1answer
2k views

Why is /proc/net/nf_conntrack empty?

On my RHEL 6.5 I expected /proc/net/nf_conntrack to contain the latest/current connections but it is completely empty: [root@plop ~]# cat /proc/net/nf_conntrack [root@plop ~]# Can you help me ...