This looks like you can't connect to the Kubernetes API server. This could be for many reasons
The kubernetes API server is not running
The API server is not listening on TCP/8080
The API server is not listening on the loopback address of 127.0.0.1
The API server is not listening with HTTP (but with HTTPS)
A local firewall (such as iptables) is blocking the ...
I fully agree with dirk's remark: using a network namespace gets routing easier, without special cases. But here's an answer I hope is different than usual, which requires Linux kernel >= 4.10.
About the failing attempt: POSTROUTING as the name implies, is done after the routing decision was done. This chain can never alter a route. What should be used for ...
First, some reminders:
-p argument is to specificy protocols like TCP, UDP, ICMP ... not higher level protocol like IMAP.
OUTPUT and INPUT chains are for the packets outgoing from the machine and incoming to the machine. If you want to filter packets that are forwarded (when your machine act as a gateway), you must use the FORWARD chain. To distinguish IN ...
You can't put different types of elements in the same set with the ipset command. But you can use different sets, one for each type (full list available with ipset help):
ipset create blocklistip hash:ip
ipset create blocklistipport hash:ip,port
ipset add blocklistip 192.0.2.3
ipset add blocklistipport 192.0.2.2,80
Wireguard's cryptokey routing is an additional layer of routing based on the key, beyond the kernel's standard network stack routing. So while the routes are correct, there's something that will prevent your setup to work correctly with your settings on wg_term_1:
I solved this by adding the below iptable rule to the machine where the cloned packet is sent to:
sudo iptables -t nat -A PREROUTING -p udp --dport 9003 -j NETMAP --to xx.xx.xxx.xx
What this does, is it changes the destination IP of any UDP packet destined to port 9003 to the private IP address.
I have encountered the same problem once, i think you are setting up a local web server using virtual machine. If this is what you are doing please check the firewall configuration of your web server.
If you are able to access Apache server from the same machine and getting error while accessing the same from remote machine then kindly Allow apache in ...
iptables' documentation about NFQUEUE tells:
By default, if no userspace program is listening on an NFQUEUE, then
all packets that are to be queued are dropped. When this option
is used, the NFQUEUE rule behaves like ACCEPT instead, and the packet
will move on to the next table.
So that means that you are supposed to be running ...
iptables -t mangle -A PREROUTING -m dscp --dscp-class AF12 -j CONNMARK --set-xmark 12
iptables -t mangle -A POSTROUTING -m connmark --mark 12 -j DSCP --set-dscp-class AF12
(not 100% dynamic as the DSCP value need to be known in advance in order to get a match)
The most frequent occurrence of this for me is firewall issue.
check outbound ports from your work station (router)
does your server have limited port access?
if you white listed your IP address check to see if your ip address has changed
Part of the answer to your question is in my answer that you linked:
if you want to move an already running process to the cgroup, well...
you can't! (...) iptables (...) doesn't match when the cgroup is switched
Well, iptables matches sometimes in this case, like in your cgroup v1 log rule.
Still, iptables seems to always match for the moved process ...
This error is covered in their forums here: https://discourse.elm-lang.org/t/cannot-install-any-elm-packages/3084
Copying answers for archival:
At the end of the error message it says the URL doesn’t exist. So this looks like a networking issue. Maybe test if you can reach the same URL from the same box using curl or wget or a browser. Maybe it’s ...
This isn't particularly nice, but if you DNAT the traffic from somewhere in PREROUTING to a blackhole address (pick some reserved network address like 192.0.2.1 from https://en.wikipedia.org/wiki/Reserved_IP_addresses ) then you can reject/drop in FORWARD in the filter table. This way you only need one rule there and hopefully better avoid it being ...