Questions tagged [iptables]

iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

Filter by
Sorted by
Tagged with
1 vote
1 answer
151 views

Filter packets with iptables on a tap interface

I'm trying to write firewall rules to prevent a guest machine from accessing the internet. The server (Ubuntu server 22.0, using KVM) has a physical connection (enp34s0), which is connected to the ...
Amit's user avatar
  • 11
0 votes
0 answers
34 views

OpenVPN Gateway and Server Routing

Network Layout The above network diagram shows a VPN gateway setup. When the VPN is active I can ping Network 1 from Network 2. I can't however ping Network 2 from any device on Network1, including ...
mcsl's user avatar
  • 1
0 votes
1 answer
95 views

iptables string matching feasability; possible use with fail2ban

We have several Apache 2.4 web servers behind a load balancer and CDN front end - where HTTPS is terminated - we see the client IP in headers from the front end in the back end Apache logs. I'm ...
Special Monkey's user avatar
0 votes
2 answers
329 views

fail2ban on host for rootless podman keycloak container

running on Rocky Linux 9.2 with podman 4.4.1. I got a podman Pod with keycloak + postgresql inside, running rootless. The pod itself with --network 'slirp4netns:port_handler=slirp4netns'. The keycloak ...
Leo's user avatar
  • 141
0 votes
0 answers
60 views

iptables as proxy server for IoT devices similar to socat

I am able to forward incoming TCP traffic from IoT devices hitting a port towards another destination server using socat using this command socat TCP-LISTEN:5050,reuseaddr,fork TCP:some-random-host-in-...
ShamsRKhan's user avatar
0 votes
1 answer
137 views

Block access to remote mysql database using iptable in ubuntu 20.04

I am configuring iptable rules in a Ubuntu 20.04 machine (Client). There is a mysql db in a remote machine (Server). I need to block access from client machine to mysql DB server. These configurations ...
Dhanushka Ekanayake's user avatar
0 votes
1 answer
223 views

Debian + Strongswan: does not pass traffic from the Internet to the tunnel

I'm trying to setup a remote VPN server to access the internet from my home PC. It is on a leased AWS VPS, with Debian and Strongswan. It is meant to receive my traffic via the tunnel, forward it to ...
m. vokhm's user avatar
0 votes
0 answers
135 views

Unable to Block Kubernetes Ports in iptables

I'm currently working on securing my Kubernetes server by blocking certain ports using iptables. I've applied the following rules to drop traffic on specific ports: -A INPUT -p tcp -m tcp --dport ...
Samoed's user avatar
  • 1
0 votes
1 answer
82 views

How to forward UDP traffic between two interfaces using iptables

Good morning, I need help to forward traffic in two interfaces on a debian12 server. I have a server with two interfaces like this scheme: INTERNET come on the ens224 | LAN go to the ens192 I want ...
ArnOCP's user avatar
  • 11
0 votes
1 answer
378 views

Wireguard/iptables: ICMP response not forwarded to wg0

Network diagram: Laptop (10.8.0.2) -> (wireguard) -> server A (10.8.0.1, 10.10.0.10) -> server B (10.10.0.20) sequence diagram I've connected my laptop (10.8.0.2) to a server A (10.8.0.1) via ...
xaa29221's user avatar
3 votes
0 answers
132 views

Why is UFW blocking this connection?

I have a problem with a user who is unable to access a Ubuntu 22.04 webserver (he gets ERR_CONNECTION_RESET), apparently due to the firewall blocking his connections. However he IS able to access a ...
Jonathan Potter's user avatar
4 votes
2 answers
1k views

What is the difference BM and KMP algorithms in iptables string search?

Iptables has a string module for searching packet contents. But it forces you to choose between one these algorithms: Boyer-Moore (bm) and Knuth-Pratt-Morris (kmp). I couldn't find any good ...
LatinSuD's user avatar
  • 901
0 votes
2 answers
78 views

IPTables: introduce a policy for a chain so that I can maintain the drop policy/rule without having to delete it when I need to add a new accept rule?

Say I have a chain introduced with iptables -N SERVICES-VPN. But then I want this chain to drop everything... so iptables -A SERVICES-VPN -j DROP. The problem here is that I may need to add rules ...
The Quantum Physicist's user avatar
0 votes
0 answers
86 views

Docker blocking connection from remote for a single specific port?

I have a server with two docker containers, each with their own PostgreSQL databases. One container is mapped to port 32772 and the other to 32771. These two databases used to be acessible by remote ...
JMenezes's user avatar
  • 101
0 votes
0 answers
127 views

IPtables uncommon packet dropping

I'm setting up a basic iptables firewall on a Rocky Linux-based server with kernel version 5.15.103-1. The primary requirement is to establish specific access rules for different groups of servers. ...
user22395539's user avatar
0 votes
0 answers
258 views

Forward local generated Secure Websocket traffic (wss) through an HTTP/HTTPS proxy to reach internet

I have a python webex_bot application (https://github.com/fbradyirl/webex_bot) which uses websockets for webex cloud communication. The problem is that the server in which the bot is being hosted on, ...
panchis's user avatar
0 votes
1 answer
130 views

Iptables duplicate/Mirror incoming UDP traffic from HOST1 to an external HOST2

I need an advice about the following scenario: IoT devices are sending UDP packets to a 18.04 Ubuntu server environment (HOST1) on port 1234. HOST1 processes the UDP packets as per the internal ...
user3132858's user avatar
0 votes
1 answer
86 views

How to make IpTable Rules immutable in linux

I work on Linux and want to add rules to iptable. I want these rules to be immutable anyway (either changed or deleted). What should I do? Note that for me the rules that are running and kept in ...
amirsalimi's user avatar
0 votes
0 answers
47 views

Strongwan S2S VPN to Fortinet

I want to hide my local hosted server behind a public VPS. So i established a VPN between my local firewall(fortinet) and my vps(strongswan). Diagram The VPN is up but no traffic at all. Even in ...
ben's user avatar
  • 1
0 votes
2 answers
89 views

iptables - How do I restrict access to just local devices on the network?

I have asked this question on SuperUser but the only response was from someone who I was unable to understand I have a WireGuard VPN Server running on a Debian 12 host with no problems, listening on a ...
espresso fan's user avatar
1 vote
1 answer
268 views

Iptables blocks loopback interface but why?

I am having trouble understanding why iptables is blocking my loopback interface traffic. Here is the scenario: I set the default policy of the INPUT chain to DROP. I allow traffic to port 8080. My ...
Bongo's user avatar
  • 13
1 vote
1 answer
254 views

Failover load balancing by iptables is possible?

I'm playing around with iptables in my home lab. My first goal is to take my active directory communication into one load balancing virtual IP. I used prerouting chain to do that. For testing purposes,...
Peet's user avatar
  • 21
-1 votes
1 answer
126 views

How to reroute packets to other gateway in LAN?

I have local network 192.168.203.0/24 with 2 gateways: 192.168.203.1 - router that gives access to the internet, 192.168.203.5 - OpenWRT which gives access to other private network through OpenVPN. ...
tmk555's user avatar
  • 1
0 votes
0 answers
60 views

Iptables DNAT with multiple interface

I have 2 Machines: MachineDev ens5: 10.41.12.63 (the default net device) ens8: 10.41.10.111 MachineProxy ens5: 10.40.9.106 (the default net device) ens6: 10.40.2.114 And I want use MachineProxy as ...
YNX's user avatar
  • 101
0 votes
0 answers
49 views

Ubuntu 16.04 router VPN and rdp

I have been running my own home-brew router for a number of years. My ISP provided equipment running in bridge mode so my own router just connects to their gateway using a public static IP. I also use ...
George Townsend's user avatar
0 votes
2 answers
150 views

iptables: IP forwarding restricted to pings. Why?

After reinstalling OpenSuSE Leap 15.5 on a SOHO server, which acts AS a Firewall, the machines on the internal network (169.254.164.0/24) can't reach any hosts on the internet save for pings. But no ...
Neppomuk's user avatar
  • 113
0 votes
0 answers
109 views

Iptables: limit mdns packet per second per ip

I have a network with a lot of MDNS (UDP 5353) traffic on it. To avoid overloading my server, I limit globally the MDNS packets accepted by iptables with this rules: iptables -A INPUT -i eth2 -p udp --...
cyanat's user avatar
  • 31
0 votes
1 answer
173 views

Route an incoming ICMP packet to a different interface/process

I have an interface enp4s0 with several IPs. I get ICMP packets (type 8, echo request) from external device to my device on enp4s0. I'm trying to route only packets sent to 192.168.1.90 into another ...
hudac's user avatar
  • 136
1 vote
1 answer
387 views

How can I utilize a systemd service to modify the DOCKER-USER iptables chain?

I run an ubuntu-lts host with docker. I'd like to modify the DOCKER-USER iptables chain on start-up to add a custom reject rule. The issue I've encountered is that the DOCKER-USER chain does not exist ...
kharderr's user avatar
0 votes
1 answer
510 views

Re-route all incoming traffic to my home computer over the wireguard interface

I have setup a server in AWS with WireGuard server installed on it. I configured the server and the client and the vpn connection is up and running. I am able to ping from my local computer to the ...
Tim B.'s user avatar
  • 117
0 votes
0 answers
221 views

nftables Rules for ProxyChains-over-Tor

I am trying to configure nftables rules for ProxyChains-over-Tor, so that: My system --> Tor SOCKS5 proxy --> HTTP proxy --> Internet My system can only communicate with Tor SOCKS5 proxy Tor ...
user73q3277y23's user avatar
0 votes
1 answer
129 views

iptables block IP range user

I'm trying to block an IP range using iptables -A INPUT -s 185.0.0.0/8 -j DROP This rule works perfectly but will affect all users on the network. I want to make this happen for individual users so ...
Luana's user avatar
  • 29
1 vote
1 answer
274 views

Match specific user's traffic both in OUTPUT and in INPUT to use quota on it

How can I convert: iptables -t mangle -A OUTPUT -m owner --uid-owner root -j MARK --set-mark 1 iptables -A OUTPUT -m owner --uid-owner root -m quota2 --name 10mb_quota --quota 10240000 -j MARK --set-...
Luana's user avatar
  • 29
0 votes
1 answer
135 views

Properly configuring iptables rules behind an openvpn server

hi friends hope everyone is doing well. i got a little misunderstanding of how i should configure iptables v4 rules for an openvpn server. if some wizard can give me a hint it would be great. i'm ...
infoman33's user avatar
1 vote
1 answer
356 views

Bad address translation in Kubernetes UDP service by kube-proxy with iptables

For educational purposes, I made myself a Kubernetes cluster according to Kubernetes the Hard Way guide - except I did it on my own set of local VMs rather than using Google Cloud. Everything seemed ...
ghik's user avatar
  • 121
0 votes
1 answer
167 views

How to handle QoS(traffic control) based on physical interface of virtual bridge?

I have a requirement to limit the traffic rate based on different interfaces of the router, such as controlling the upload speed of ssid1 to 10mbps, download speed to 20mbps, lan1 upload speed to ...
Ryan.Ran's user avatar
0 votes
1 answer
148 views

iptables: Only allow one IP address when rules are updated by other tools

I'm learning about iptables and I want to set up a GNS3 (network emulation) host on a public IP and limit the access to only one IP address. This one IP address should be able to connect with all ...
itsamemarkus's user avatar
0 votes
1 answer
67 views

Does iptables apply all rules in order when an incoming connection is received?

I'm using iptables and fail2ban to secure server connections. Currently I have connections filtered via a router passing only ports for email and webserver access and fail2ban adding restrictions ...
Max's user avatar
  • 3
0 votes
2 answers
543 views

iptable rule for an IP address with "any" subnet mask

I have a requirement to add an iptable rule for lets say src IP 10.10.10.20/any dest IP any. iptables -t filter -A FORWARD_0_IN -p all --ipv4 --source 10.10.10.1/any --destination 10.10.10.2/any -j ...
RootPhoenix's user avatar
0 votes
0 answers
29 views

Graceful connection closing using iptables

I'm developing a transparent HTTP proxy for fault injection testing. The proxy needs to capture all traffic to a HTTP server in order to selectively inject faults. The transparent proxy sets an ...
pablochacin's user avatar
0 votes
0 answers
78 views

Port forwarding with iptables prerouting not work

I have 3 server server A: 5.161.x.x server B: 193.151.x.x server C: 195.96.x.x I want to forward all traffic from server B and C to server A ,i forwarded Server B to server A with this command: ...
Aref Solaimany's user avatar
0 votes
0 answers
88 views

iptables DNAT works for first curl request, then hangs

I want to forward all packets coming to 192.168.1.10:8070 on interface wlan0 to 10.59.99.4:8080 on interface wg0. I added these two rules to iptables: -A PREROUTING -p tcp --destination 192.168.1.10 --...
Ricky434's user avatar
0 votes
1 answer
62 views

open vpn iptables script intermittantly failing

I am new to vpn setup and iptables and i have a basic understanding of networking, but am by no means a networking expert. I am setting up a openvpn router so that i have remote access to the plc's ...
Stevo's user avatar
  • 3
0 votes
1 answer
51 views

Redirect specific traffic over another interface

I have a router (with iptables support) with 2 WAN interfaces (wan0 and wan1) and I am trying to redirect calls of specific IPs (for ex: 8.8.8.8) over second interface (wan1) using ip tables. Traffic ...
mursel.musabasic's user avatar
2 votes
1 answer
215 views

How can I troubleshoot an iptables rule that is preventing internet access from my server?

So I am facing a strange issue, not able to make any sense. Hope someone here can help me understand. I have my iptable rules set like this root@COV0495:~# iptables -S -P INPUT DROP -P FORWARD ACCEPT -...
Rick Roy's user avatar
  • 247
0 votes
0 answers
92 views

iptables PREROUTING DNAT

Server 1: 192.168.0.1 Server 2: 192.168.0.2 Server 3: 192.168.0.3 Server 2 has access to server 3 on port 1521 The task is to make port forwarding from Server1 -> Server2:5501 -> Server3:1521 ...
AlexD's user avatar
  • 1
0 votes
1 answer
410 views

How to configure Keepalived to act as L4 load balancer via direct routing method

Trying to achieve L4 load balancing via Keepalived in front of HAProxy that will act as L7 load balancer. Both Keepalived and HAProxy are on separate machines. I managed to get everything in the below ...
Mo Ali's user avatar
  • 101
0 votes
0 answers
59 views

iptables default deny all, allow IP unrestricted access

I have successfully setup a raspberry pi to function as an access point. I have a pi connected via ethernet to my router, and am able to connect to the pi's wifi network and access other devices on ...
ExecutionByFork's user avatar
0 votes
0 answers
141 views

How to route traffic with Linux

I have a rather simple question, which I thought I knew the answer, but I'm stuck with it. I have two linux boxes: Server A : IP : 10.10.19.1/24 Can contact 10.10.18.0/24 through an IPsec VPN (works ...
DBCL's user avatar
  • 1
0 votes
0 answers
105 views

How do I block port 1234 in localhost without killing the process in MacOS

I have a requirement to close a port without killing the process to test out a certain fallback scenario. I am using MacOS and I am unable to figure out how to do this, can someone please help? I ...
Binary Brain's user avatar