Questions tagged [iptables]
iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n
6,671
questions
1
vote
1
answer
151
views
Filter packets with iptables on a tap interface
I'm trying to write firewall rules to prevent a guest machine from accessing the internet.
The server (Ubuntu server 22.0, using KVM) has a physical connection (enp34s0), which is connected to the ...
0
votes
0
answers
34
views
OpenVPN Gateway and Server Routing
Network Layout
The above network diagram shows a VPN gateway setup. When the VPN is active I can ping Network 1 from Network 2. I can't however ping Network 2 from any device on Network1, including ...
0
votes
1
answer
95
views
iptables string matching feasability; possible use with fail2ban
We have several Apache 2.4 web servers behind a load balancer and CDN front end - where HTTPS is terminated - we see the client IP in headers from the front end in the back end Apache logs. I'm ...
0
votes
2
answers
329
views
fail2ban on host for rootless podman keycloak container
running on Rocky Linux 9.2 with podman 4.4.1.
I got a podman Pod with keycloak + postgresql inside, running rootless. The pod itself with --network 'slirp4netns:port_handler=slirp4netns'. The keycloak ...
0
votes
0
answers
60
views
iptables as proxy server for IoT devices similar to socat
I am able to forward incoming TCP traffic from IoT devices hitting a port towards another destination server using socat using this command
socat TCP-LISTEN:5050,reuseaddr,fork TCP:some-random-host-in-...
0
votes
1
answer
137
views
Block access to remote mysql database using iptable in ubuntu 20.04
I am configuring iptable rules in a Ubuntu 20.04 machine (Client). There is a mysql db in a remote machine (Server). I need to block access from client machine to mysql DB server. These configurations ...
0
votes
1
answer
223
views
Debian + Strongswan: does not pass traffic from the Internet to the tunnel
I'm trying to setup a remote VPN server to access the internet from my home PC. It is on a leased AWS VPS, with Debian and Strongswan. It is meant to receive my traffic via the tunnel, forward it to ...
0
votes
0
answers
135
views
Unable to Block Kubernetes Ports in iptables
I'm currently working on securing my Kubernetes server by blocking certain ports using iptables. I've applied the following rules to drop traffic on specific ports:
-A INPUT -p tcp -m tcp --dport ...
0
votes
1
answer
82
views
How to forward UDP traffic between two interfaces using iptables
Good morning,
I need help to forward traffic in two interfaces on a debian12 server.
I have a server with two interfaces like this scheme:
INTERNET come on the ens224
|
LAN go to the ens192
I want ...
0
votes
1
answer
378
views
Wireguard/iptables: ICMP response not forwarded to wg0
Network diagram: Laptop (10.8.0.2) -> (wireguard) -> server A (10.8.0.1, 10.10.0.10) -> server B (10.10.0.20)
sequence diagram
I've connected my laptop (10.8.0.2) to a server A (10.8.0.1) via ...
3
votes
0
answers
132
views
Why is UFW blocking this connection?
I have a problem with a user who is unable to access a Ubuntu 22.04 webserver (he gets ERR_CONNECTION_RESET), apparently due to the firewall blocking his connections. However he IS able to access a ...
4
votes
2
answers
1k
views
What is the difference BM and KMP algorithms in iptables string search?
Iptables has a string module for searching packet contents. But it forces you to choose between one these algorithms: Boyer-Moore (bm) and Knuth-Pratt-Morris (kmp).
I couldn't find any good ...
0
votes
2
answers
78
views
IPTables: introduce a policy for a chain so that I can maintain the drop policy/rule without having to delete it when I need to add a new accept rule?
Say I have a chain introduced with iptables -N SERVICES-VPN.
But then I want this chain to drop everything... so iptables -A SERVICES-VPN -j DROP.
The problem here is that I may need to add rules ...
0
votes
0
answers
86
views
Docker blocking connection from remote for a single specific port?
I have a server with two docker containers, each with their own PostgreSQL databases.
One container is mapped to port 32772 and the other to 32771. These two databases used to be acessible by remote ...
0
votes
0
answers
127
views
IPtables uncommon packet dropping
I'm setting up a basic iptables firewall on a Rocky Linux-based server with kernel version 5.15.103-1. The primary requirement is to establish specific access rules for different groups of servers. ...
0
votes
0
answers
258
views
Forward local generated Secure Websocket traffic (wss) through an HTTP/HTTPS proxy to reach internet
I have a python webex_bot application (https://github.com/fbradyirl/webex_bot) which uses websockets for webex cloud communication. The problem is that the server in which the bot is being hosted on, ...
0
votes
1
answer
130
views
Iptables duplicate/Mirror incoming UDP traffic from HOST1 to an external HOST2
I need an advice about the following scenario:
IoT devices are sending UDP packets to a 18.04 Ubuntu server environment (HOST1) on port 1234.
HOST1 processes the UDP packets as per the internal ...
0
votes
1
answer
86
views
How to make IpTable Rules immutable in linux
I work on Linux and want to add rules to iptable. I want these rules to be immutable anyway (either changed or deleted). What should I do? Note that for me the rules that are running and kept in ...
0
votes
0
answers
47
views
Strongwan S2S VPN to Fortinet
I want to hide my local hosted server behind a public VPS. So i established a VPN between my local firewall(fortinet) and my
vps(strongswan).
Diagram
The VPN is up but no traffic at all. Even in ...
0
votes
2
answers
89
views
iptables - How do I restrict access to just local devices on the network?
I have asked this question on SuperUser but the only response was from someone who I was unable to understand
I have a WireGuard VPN Server running on a Debian 12 host with no problems, listening on a ...
1
vote
1
answer
268
views
Iptables blocks loopback interface but why?
I am having trouble understanding why iptables is blocking my loopback interface traffic.
Here is the scenario:
I set the default policy of the INPUT chain to DROP.
I allow traffic to port 8080.
My ...
1
vote
1
answer
254
views
Failover load balancing by iptables is possible?
I'm playing around with iptables in my home lab. My first goal is to take my active directory communication into one load balancing virtual IP. I used prerouting chain to do that. For testing purposes,...
-1
votes
1
answer
126
views
How to reroute packets to other gateway in LAN?
I have local network 192.168.203.0/24 with 2 gateways:
192.168.203.1 - router that gives access to the internet,
192.168.203.5 - OpenWRT which gives access to other private network through OpenVPN.
...
0
votes
0
answers
60
views
Iptables DNAT with multiple interface
I have 2 Machines:
MachineDev
ens5: 10.41.12.63 (the default net device)
ens8: 10.41.10.111
MachineProxy
ens5: 10.40.9.106 (the default net device)
ens6: 10.40.2.114
And I want use MachineProxy as ...
0
votes
0
answers
49
views
Ubuntu 16.04 router VPN and rdp
I have been running my own home-brew router for a number of years. My ISP provided equipment running in bridge mode so my own router just connects to their gateway using a public static IP. I also use ...
0
votes
2
answers
150
views
iptables: IP forwarding restricted to pings. Why?
After reinstalling OpenSuSE Leap 15.5 on a SOHO server, which acts AS a Firewall, the machines on the internal network (169.254.164.0/24) can't reach any hosts on the internet save for pings. But no ...
0
votes
0
answers
109
views
Iptables: limit mdns packet per second per ip
I have a network with a lot of MDNS (UDP 5353) traffic on it.
To avoid overloading my server, I limit globally the MDNS packets accepted by iptables with this rules:
iptables -A INPUT -i eth2 -p udp --...
0
votes
1
answer
173
views
Route an incoming ICMP packet to a different interface/process
I have an interface enp4s0 with several IPs.
I get ICMP packets (type 8, echo request) from external device to my device on enp4s0.
I'm trying to route only packets sent to 192.168.1.90 into another ...
1
vote
1
answer
387
views
How can I utilize a systemd service to modify the DOCKER-USER iptables chain?
I run an ubuntu-lts host with docker. I'd like to modify the DOCKER-USER iptables chain on start-up to add a custom reject rule. The issue I've encountered is that the DOCKER-USER chain does not exist ...
0
votes
1
answer
510
views
Re-route all incoming traffic to my home computer over the wireguard interface
I have setup a server in AWS with WireGuard server installed on it. I configured the server and the client and the vpn connection is up and running. I am able to ping from my local computer to the ...
0
votes
0
answers
221
views
nftables Rules for ProxyChains-over-Tor
I am trying to configure nftables rules for ProxyChains-over-Tor, so that:
My system --> Tor SOCKS5 proxy --> HTTP proxy --> Internet
My system can only communicate with Tor SOCKS5 proxy
Tor ...
0
votes
1
answer
129
views
iptables block IP range user
I'm trying to block an IP range using
iptables -A INPUT -s 185.0.0.0/8 -j DROP
This rule works perfectly but will affect all users on the network.
I want to make this happen for individual users so ...
1
vote
1
answer
274
views
Match specific user's traffic both in OUTPUT and in INPUT to use quota on it
How can I convert:
iptables -t mangle -A OUTPUT -m owner --uid-owner root -j MARK --set-mark 1
iptables -A OUTPUT -m owner --uid-owner root -m quota2 --name 10mb_quota --quota 10240000 -j MARK --set-...
0
votes
1
answer
135
views
Properly configuring iptables rules behind an openvpn server
hi friends hope everyone is doing well.
i got a little misunderstanding of how i should configure iptables v4 rules for an openvpn server.
if some wizard can give me a hint it would be great.
i'm ...
1
vote
1
answer
356
views
Bad address translation in Kubernetes UDP service by kube-proxy with iptables
For educational purposes, I made myself a Kubernetes cluster according to Kubernetes the Hard Way guide - except I did it on my own set of local VMs rather than using Google Cloud.
Everything seemed ...
0
votes
1
answer
167
views
How to handle QoS(traffic control) based on physical interface of virtual bridge?
I have a requirement to limit the traffic rate based on different interfaces of the router, such as controlling the upload speed of ssid1 to 10mbps, download speed to 20mbps, lan1 upload speed to ...
0
votes
1
answer
148
views
iptables: Only allow one IP address when rules are updated by other tools
I'm learning about iptables and I want to set up a GNS3 (network emulation) host on a public IP and limit the access to only one IP address.
This one IP address should be able to connect with all ...
0
votes
1
answer
67
views
Does iptables apply all rules in order when an incoming connection is received?
I'm using iptables and fail2ban to secure server connections. Currently I have connections filtered via a router passing only ports for email and webserver access and fail2ban adding restrictions ...
0
votes
2
answers
543
views
iptable rule for an IP address with "any" subnet mask
I have a requirement to add an iptable rule for lets say src IP 10.10.10.20/any dest IP any.
iptables -t filter -A FORWARD_0_IN -p all --ipv4 --source 10.10.10.1/any --destination 10.10.10.2/any -j ...
0
votes
0
answers
29
views
Graceful connection closing using iptables
I'm developing a transparent HTTP proxy for fault injection testing. The proxy needs to capture all traffic to a HTTP server in order to selectively inject faults.
The transparent proxy sets an ...
0
votes
0
answers
78
views
Port forwarding with iptables prerouting not work
I have 3 server
server A: 5.161.x.x
server B: 193.151.x.x
server C: 195.96.x.x
I want to forward all traffic from server B and C to server A
,i forwarded Server B to server A with this command:
...
0
votes
0
answers
88
views
iptables DNAT works for first curl request, then hangs
I want to forward all packets coming to 192.168.1.10:8070 on interface wlan0 to 10.59.99.4:8080 on interface wg0.
I added these two rules to iptables:
-A PREROUTING -p tcp --destination 192.168.1.10 --...
0
votes
1
answer
62
views
open vpn iptables script intermittantly failing
I am new to vpn setup and iptables and i have a basic understanding of networking, but am by no means a networking expert.
I am setting up a openvpn router so that i have remote access to the plc's ...
0
votes
1
answer
51
views
Redirect specific traffic over another interface
I have a router (with iptables support) with 2 WAN interfaces (wan0 and wan1) and I am trying to redirect calls of specific IPs (for ex: 8.8.8.8) over second interface (wan1) using ip tables. Traffic ...
2
votes
1
answer
215
views
How can I troubleshoot an iptables rule that is preventing internet access from my server?
So I am facing a strange issue, not able to make any sense. Hope someone here can help me understand. I have my iptable rules set like this
root@COV0495:~# iptables -S
-P INPUT DROP
-P FORWARD ACCEPT
-...
0
votes
0
answers
92
views
iptables PREROUTING DNAT
Server 1: 192.168.0.1
Server 2: 192.168.0.2
Server 3: 192.168.0.3
Server 2 has access to server 3 on port 1521 The task is to make port forwarding from Server1 -> Server2:5501 -> Server3:1521
...
0
votes
1
answer
410
views
How to configure Keepalived to act as L4 load balancer via direct routing method
Trying to achieve L4 load balancing via Keepalived in front of HAProxy that will act as L7 load balancer. Both Keepalived and HAProxy are on separate machines. I managed to get everything in the below ...
0
votes
0
answers
59
views
iptables default deny all, allow IP unrestricted access
I have successfully setup a raspberry pi to function as an access point. I have a pi connected via ethernet to my router, and am able to connect to the pi's wifi network and access other devices on ...
0
votes
0
answers
141
views
How to route traffic with Linux
I have a rather simple question, which I thought I knew the answer, but I'm stuck with it.
I have two linux boxes:
Server A :
IP : 10.10.19.1/24
Can contact 10.10.18.0/24 through an IPsec VPN (works ...
0
votes
0
answers
105
views
How do I block port 1234 in localhost without killing the process in MacOS
I have a requirement to close a port without killing the process to test out a certain fallback scenario. I am using MacOS and I am unable to figure out how to do this, can someone please help?
I ...