6
It is possible to use the kernel’s iptables and nftables simultaneously, apart from NAT, but it requires some attention. The order in which the rules are applied is determined by the hook priority; legacy iptables default is 0, so an nft hook can be set to priority -1 if it should apply before iptables, or 1 if it should apply afterwards.
iptables-nft is ...
2
Which firewall rule is considered if i 'drop' first then later adding 'accept' rule. drop or accept?
The -A flag appends to the set of rules. Using -I inserts a rule either at the beginning of the chain or at the numbered position. Rules are processed in order, so the first rule you added will be processed first and the second will never be actioned.
You can see the full set of rules for your INPUT chain with iptables -nvL INPUT.
Since you're on CentOS you ...
2
Linux Kernel's Process:
Many Kernel's functions like Iptables are processed in the Kernel level as kworker tasks, they are visible on task managers like top. As mentioned on the comments, you can compute the CPU and memory usage by comparing the total ressource usage usage with and without loading the iptables rules. Note that ipset already consumes memory ...
1
When iptables rules are checked they go in order of rules being entered in through all rules. So in my opinion you should first accept traffic from/to 10.0.0.1 and then reject all other traffic from the subnet. When you will have traffic for 10.0.0.1 it will be accepted with the first rule and everything else will be rejected with the second rule. So, I ...
1
I can't reset the iptables and apply a new version of my rules without restarting Docker.
I doubt that is correct.
"diff" rule dump
I am not familiar with the Docker firewall configuration but you could dump the state with iptables-save. You could create a comment for all your rules so that they can easily be filtered.
You could then reset the ...
1
ipset has a subcommand to atomically swap two sets: swap (or -W). This allows to populate a new set, swap it with the older set, and remove the now useless set with the new name. That's better than flushing the set (with ipset flush china) because this would temporarily leave the system exposed, and allows to replace a set with different parameters without ...
1
It does actually works.
Simply I was counting the password attempts, while what hit_count actually counts here is the time you have to start connecting again because you misspelled too many times the password (and this is in turn configurable in /etc/ssh/sshd_config as MaxAuthTries)
1
Looks like you have firewalld installed and enabled. If you don't want a GUI for iptables, you may as well delete this package altogether.
Or you can sudo systemctl disable firewalld.service and reboot.
1
IP packets while within a Linux host have an attribute called packet mark. That is just a number.
These rules accept packets which have been given a packet mark value 0x1068 or 0x4000 (in the PREROUTING chain of the mangle, raw or nat chains).
adding these rules
I assume you found the CATTLE_FORWARD rules in the filter table and the CATTLE_RAW_PREROUTING ...
1
For the IP addresses, if they are private, you do not need to redact them. If you do redact them, please use the IPv4 addresses reserved for documentation so that we have a least a hint about the network topology.
With the information you have given, the answer to your question what is this packet trying to do? is, according to RFC 792:
ICMP type 11 code 0
...
1
Yes, you can. Basically, apt contacts the servers in your package repositories / sources list, see The Debian documentation on apt sources:
$ cat /etc/apt/sources.list
deb http://site.example.com/debian distribution component1 component2 component3
Here are the sites, e.g. site.example.com port 80 above. More could be in the files contained in /etc/apt/...
1
I've deleted my original answer because it was not helpful, as I read too fast and didn't notice we were dealing with containerization. The below comments can be ignored (unless you want to see how to log iptables activity).
Given the name of the interface in your container, you may have more luck with:
iptables -A FORWARD -o docker0 -p tcp --dport 25 -j ...
1
Turns out that the rules I posted were not the culprit, as I've noted in the question update. The actual issue was related to ICMP traffic and in particular several types related directly to IPv6. My ICMP rules were...
add rule inet filter INPUT ct state new icmp type { echo-request, echo-reply } accept
add rule inet filter INPUT ct state new icmpv6 type { ...
Only top voted, non community-wiki answers of a minimum length are eligible
