Questions tagged [netfilter]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
8
votes
4answers
8k views

Why does SNAT happen in POSTROUTING chain and DNAT in PREROUTING chain?

Why does SNAT(modifies source IP and/or ports) happen in nat table POSTROUTING chain, i.e after routing? And why does DNAT(modifies destination IP ant/or ports) happen in PREROUTING chain? I guess ...
7
votes
1answer
3k views

Is there a way to see if process listening on TCP port receives a message?

According to tcpdump, my server receives the following TCP packet: 12:52:29.603233 00:19:e2:9e:df:f0 00:16:3e:6a:25:3f, ethertype IPv4 (0x0800), length 74: 10.10.10.65.38869 192.168.215.82.22: ...
5
votes
2answers
3k views

What are the essential iptables rules for IPv6 to work properly?

I had a problem where I lost connectivity to a server on the IPv6 address after some time and it turned out to be caused by DHCPv6 client packets (port 546) being dropped by the default INPUT policy ...
5
votes
2answers
7k views

How is the IFB device positioned in the packet flow of the Linux kernel

I would like to know the exact position of the following device in the packet flow for ingress traffic shaping: IFB: Intermediate Functional Block I would like to better understand how packets are ...
5
votes
0answers
151 views

Multicast ICMPv6 comes back with conntrack state invalid

I was playing arround with the Multicast feature of IPv6. $ ping ff02::2%wlp3s0 This should normally result in an echo-reply from all the routers on your local network segment (Wikipedia - IPv6). So ...
5
votes
2answers
25k views

forward packets from one interface to another interface using iptables

I have an embeded system with 2 interfaces e0 and m0, whose ips are 10.0.0.20 and 192.168.0.20, respectively. Incoming packets into e0 have an ip of 10.0.0.10 and should be forwarded to m0 interface ...
4
votes
1answer
1k views

Is there a way to do layer 7 filtering in Linux?

The L7-filter project appears to be 15 years old, requires kernel patches with no support for kernels past version 2.6, and most of the pattern files it has appear to have been written in 2003. ...
4
votes
1answer
1k views

How to combine connlimit with IP sets?

connlimit lets me limit the number of connections per client/service. How would I go about to combine such a rule with the IP sets available in more recent versions of the Linux kernel and netfilter?
4
votes
1answer
1k views

IPTables redirect all UDP packets including ESTABLISHED

We currently have some rules setup in IPtables that look like the below: -A PREROUTING -d dstip/32 -p udp -m udp --dport 27035 -m u32 --u32 "0x0>>0x16&0x3c@0x8=0xffffffff&&0x0>&...
4
votes
0answers
1k views

iptables and ip forwarding for failover

hi i have an ethernet nic interface with 4 additional virtual interfaces (failovers) all configured with public ip4 (IP-1 to IP-5) / netmask 255.255.255.255 / broadcast addr same as ip: eth0 ->...
3
votes
2answers
5k views

What is the difference between NAT OUTPUT chain and NAT POSTROUTING chain?

IF Nating is done in OUTPUT chain of the NAT table, then what is the function of SNAT in POSTROUTING
3
votes
1answer
4k views

How --set-mark option works on Netfilter (IPTABLES)?

On Netfilter, you have the option --set-mark for packets that pass through the mangle table. The majority of tutorials and examples over the Internet, say that this just adds a mark on the packet, ...
3
votes
1answer
2k views

When and how to use chain priorities in nftables

When configuring a chain in nftables, one has to provide a priority value. Almost all online examples set a piority of 0; sometimes, a value of 100 gets used with certain hooks (output, postrouting). ...
3
votes
1answer
3k views

nf_register_hook not found in linux kernel 4.13-rc2 and later

I just started learning about netfilter and I was trying to make a simple netfilter module, all the tutorials and HOW TOs register a hook function with nf_register_hook(), but I could not find one in ...
3
votes
1answer
895 views

Hairpinning in linux

I have a router in which I installed a Linux system. I want my router supports NAT hairpinning Does a such feature exists in Kernel Linux? If yes how to activate it? Are there a patch to apply it on ...
3
votes
1answer
6k views

How to list all network connections Centos 7 (Connection tracking)

I have a box with Centos 7 installed. I am trying to configure some iptables rules and playing with the mangle table and markings For example on my router I am able to see established network ...
3
votes
1answer
2k views

understanding “bridge check” hop in packet flow in Linux kernel

According to "Packet flow in Netfilter and General Networking" drawing in Wikipedia Netfilter article: ..one of the first hops in packet flow right after the traffic control and queuing is bridge ...
3
votes
0answers
473 views

Filtering bridged packets by IP address

I am using a small Ubuntu 12.04 box as a Wi-Fi Access Point. The box has two interfaces which are bridged together as follows: brctl addbr br0 brctl stp br0 off brctl addif br0 wlan0 brctl addif br0 ...
3
votes
0answers
93 views

How to unwrap a tunneled packet in iptables/netfilter and process the tunneled packet

I have a specific question regarding the Linux netfilter/iptables interaction. Let's say I have an IP packet P1 inside of another IP packet P2 (that is, P1 is tunneled). Now, the question is as ...
2
votes
2answers
577 views

How can I transform UDP to TCP with netfilter?

I have a wonderful ISP blocking all UDP traffic (except DNS to its own DNS servers). However, I want to use UDP for my VPN solution. I have root over both VPN endpoints, and both of them are using ...
2
votes
1answer
392 views

Masquerade rule with netfilter-persistent

I use netfilter-persistent to manage a firewall. I would like to share a connection between two interfaces using masquerading (example, or another). When I run those operations by invoking iptables ...
2
votes
1answer
3k views

Is iptables string matching still supported?

I was reading the book Linux Firewalls - Attack Detection and Response (by M. Rash, No Starch Press, 1 Ed., Oct. 2007). In one of its chapter it discusses string matching using iptables. I was ...
2
votes
3answers
796 views

removed lib modules folder after every reboot

uname -r: 4.13.0-16-generic (ubuntu 17.10 server) I have a problem that iptables doesn't work after a reboot: iptables-apply /etc/network/iptables [ ok ] Stopping fail2ban (via systemctl): fail2ban....
2
votes
1answer
1k views

multicast traffic is able to poke a hole into the netfilter connection tracking system

I have an IPTV solution at home where the ISP sends me hundreds of large UDP datagrams per second from 10.4.4.5 port 10 to 239.3.5.3 port 10, i.e. it is using multicast. My current iptables ...
2
votes
1answer
2k views

How to match both UDP and TCP for given ports in one line with nftables

How can i do this in a single line? tcp dport 53 counter accept comment "accept DNS" udp dport 53 counter accept comment "accept DNS"
2
votes
1answer
535 views

How to disable implicit source port mapping on outgoing UDP packets sent through NAT in iptables?

iptables is re-writing the source port on my UDP packets that go out of a tun interface. I have NAT rules setup with port X forwarded (details below). When an application behind the NAT receives a ...
2
votes
1answer
167 views

How does Netfilter understand that packet is RELATED?

conntrack match module --ctstate argument supports RELATED packet state. How does Netfilter know that for example in case of active FTP a connection from FTP server data port(TCP port 20) to the ...
2
votes
1answer
1k views

iptables DNAT: 'No chain/target/match by that name'

I am trying to use DNAT on a new custom Linux target, but I get an error with the following basic command: #iptables -t nat -A PREROUTING -d 10.110.0.250 -p tcp --dport 9090 -j DNAT --to 10.110.0.239:...
2
votes
1answer
1k views

How do packets traverse tc/netfilter physical, VLAN and bridge interfaces?

Given the following setup on a router that performs NAT between two networks A and B: eth0 - physical interface - no ip address eth0.1 - VLAN interface for network A - no ip address eth0.2 - VLAN ...
2
votes
1answer
215 views

Shorewall to protect interfaces that are not yet defined

I am planning to use Shorewall to filter traffic that originates from a virtual interface created by OpenVPN (lets call it tap0). If OpenVPN did not successfully create this interface before ...
2
votes
2answers
2k views

Impossible to browse web after configuring iptables

I'm trying to configure iptables on my ubuntu computer. These are my rules: Chain INPUT (policy DROP) target prot opt source destination ACCEPT tcp -- anywhere ...
2
votes
1answer
106 views

Packet meta class applied, but captured VLAN priority is wrong

My linux home router sits between my ISP (Orange) and my home network. On the WAN side, Orange provide internet in a VLAN tagged 832. Some control messages (ARP, DHCP, ICMPv6 "router discovery" types,...
2
votes
0answers
377 views

Match-set via libiptc

Could anyone share any examples that use match-set for iptables via the libiptc library? I have tried using the iptables v1.4.21 and the code from https://bani.com.br/2012/05/programmatically-...
2
votes
0answers
978 views

How is the IMQ device positioned in the packet flow of the Linux kernel

I would like to know the exact position of the following device in the packet flow for ingress traffic shaping: IFB: Intermediate Functional Block I would like to better understand how packets are ...
2
votes
0answers
1k views

iptables: using “conntrack” and “recent” modules to block unsolicited packets

When I only allow RELATED and ESTABLISHED packets, and DROP everything else, my firewall rules work perfectly and I have no problems: ### VARIANT A -A INPUT -i wlan0 -m conntrack --ctstate RELATED,...
2
votes
1answer
300 views

(S/D)NAT over NF hooks

Could someone help on explaining the advantage of iptables NAT over the netfilter hooks. Say suppose, instead of using NAT if we create custom kernel module to bind handler with netfilter for PRE/POST ...
1
vote
1answer
2k views

How does iptable work with linux bridge?

Setup: VM1 --- Bridge -- VM2 VM1 and 2 are on same subnet. Bridge has 2 interfaces added to brctl bridge. When I block VM2 ip using uptables -A FORWARD -s (VM1 ip) -j DENY it doesn't work. I ...
1
vote
3answers
1k views

in iptables, does MASQUERADE match only on NEW connections (SYN packets)?

I observed that MASQUERADE target does not match on packets in the reply direction (in terms of netfilter conntrack). I've a single simple -t nat -A POSTROUTING -s 10.a.0.0/16 -d 10.b.0.0/16 -j ...
1
vote
1answer
2k views

iptables/netfilter: “nf_nat_ftp” is not working well with recent Linux kernels

I'm facing the following issue with Linux kernel 4.10-28-generic, embedded in Ubuntu-16.04.02-LTE. My machine has two ethernet adapters, namely the following ones: enp0s3: 198.168.56.2 (internal ...
1
vote
1answer
1k views

-o in iptables is for specifying the interface for OUTPUT, FORWARD, and POSTROUTING Correct?

Reading in detail about iptables / netfilter here, when I read about the -o argument: "Indicates the interface through which the outgoing packets are sent through the INPUT, FORWARD, and ...
1
vote
1answer
4k views

How to match properly against an IP set of type 'hash:ip,port'?

My current setup is that I have a server with several IPv4 addresses. Let's ignore the IPv6 part for now, as the symptoms are identical there. In the firewall rules I'd like to match against HTTP ...
1
vote
1answer
855 views

nftables rule: No such file or directory error

I am trying to apply below nftables rule which I adopted from this guide: nft add rule filter INPUT tcp flags != syn counter drop somehow this is ending up with: Error: Could not process rule: No ...
1
vote
1answer
634 views

iptables-restore failed in Debian buster/sid if it has --multiport option in the rules file

I have /etc/iptables/rule.v4 file contains many rule, the below is the line where I see the issue -A INPUT -p tcp -m multiport --dports 22 -j ACCEPT -A INPUT -p udp -m multiport --dports 16384:32768 -...
1
vote
1answer
90 views

How to clone the output of the MASQUERADE target with a TEE?

The Netfilter's extensions man page states that: MASQUERADE: This target is only valid in the nat table, in the POSTROUTING chain QUESTION: How to clone the output of the MASQUERADE target with a ...
1
vote
1answer
945 views

Best way to filter/limit ARP packets on embedded Linux

I have an embedded Linux on some network device. Because this device is pretty important I have to make many network tests (I have a separate device for that). These tests include flooding my device ...
1
vote
1answer
84 views

How does one use tc to add latency to a ratelimit?

I read that there's another tool for netfilter that allows you to add latency to a ratelimit. Does anyone have an example of this?
1
vote
2answers
743 views

How to establish a man-in-the-middle scenario with ebtables and iptables

For testing and educational purposes I want so set up a man-in-the-middle scenario as follows: Host T is the target host that is to be "cloned" Host M is the man in the middle with interfaces eth0 ...
1
vote
1answer
292 views

iptables ERROR target

When I list the iptables rules for filter table with iptables -t filter -L -vvv --line-numbers command, then I see entry numbers from 0 to 124 under the debug output. Last entry is following: Entry ...
1
vote
0answers
42 views

How does Linux route packets destined for another interface? [duplicate]

How are packets routed inside a single linux machine? Imagine the following setup: +--------------------+ | apache on | | 192.168.1.30:80 | | | | ...
1
vote
0answers
28 views

arptables-nft persistence

Introduction This is on Debian Buster with kernel 4.19.0-6 I've installed iptables-persistent and netfilter-persistent versions 1.0.11 and added a basic rule to arptables-nft to block all LAN ...