Questions tagged [iptables]

iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

Filter by
Sorted by
Tagged with
1 vote
2 answers
115 views

LXC container fail to load big iptables rules

I'm facing a strange problem when I try to load a big iptables set of rules on a LXC container (it's working fine on a virtual machine). The container is running Linux Debian 12 bookworm. I'm able to ...
Julien's user avatar
  • 145
0 votes
0 answers
151 views

How to route packets whose destination are in an ipset to a nat interface

I have an interface named em2, which is a nat interface. I want to route all the packets whose destination are in an ipset named test to em2. If I don't use ipset and policy routing, it works well ...
Hoping White's user avatar
0 votes
1 answer
129 views

Creating an IPTABLES chain, whose rules are ignored, unless the packet is from a certain port?

I want to confirm the following. If I create a chain whose first rule is: iptables -I INPUT -p tcp -m multiport --dports 25,465 -j name Does that mean that any further specified rules in the chain, ...
user1993015's user avatar
0 votes
1 answer
81 views

iptables routing all traffic to two different chains?

I'm debugging an iptables setup that I didn't write. This setup is supposed to provide a firewall around some Docker containers (Portainer and Nginx Proxy Manager) running on the router itself, but ...
theta0's user avatar
  • 1
1 vote
1 answer
155 views

Filter packets with iptables on a tap interface

I'm trying to write firewall rules to prevent a guest machine from accessing the internet. The server (Ubuntu server 22.0, using KVM) has a physical connection (enp34s0), which is connected to the ...
Amit's user avatar
  • 11
0 votes
0 answers
34 views

OpenVPN Gateway and Server Routing

Network Layout The above network diagram shows a VPN gateway setup. When the VPN is active I can ping Network 1 from Network 2. I can't however ping Network 2 from any device on Network1, including ...
mcsl's user avatar
  • 1
0 votes
1 answer
95 views

iptables string matching feasability; possible use with fail2ban

We have several Apache 2.4 web servers behind a load balancer and CDN front end - where HTTPS is terminated - we see the client IP in headers from the front end in the back end Apache logs. I'm ...
Special Monkey's user avatar
0 votes
2 answers
345 views

fail2ban on host for rootless podman keycloak container

running on Rocky Linux 9.2 with podman 4.4.1. I got a podman Pod with keycloak + postgresql inside, running rootless. The pod itself with --network 'slirp4netns:port_handler=slirp4netns'. The keycloak ...
Leo's user avatar
  • 141
0 votes
0 answers
63 views

iptables as proxy server for IoT devices similar to socat

I am able to forward incoming TCP traffic from IoT devices hitting a port towards another destination server using socat using this command socat TCP-LISTEN:5050,reuseaddr,fork TCP:some-random-host-in-...
ShamsRKhan's user avatar
0 votes
1 answer
139 views

Block access to remote mysql database using iptable in ubuntu 20.04

I am configuring iptable rules in a Ubuntu 20.04 machine (Client). There is a mysql db in a remote machine (Server). I need to block access from client machine to mysql DB server. These configurations ...
Dhanushka Ekanayake's user avatar
0 votes
1 answer
235 views

Debian + Strongswan: does not pass traffic from the Internet to the tunnel

I'm trying to setup a remote VPN server to access the internet from my home PC. It is on a leased AWS VPS, with Debian and Strongswan. It is meant to receive my traffic via the tunnel, forward it to ...
m. vokhm's user avatar
0 votes
0 answers
137 views

Unable to Block Kubernetes Ports in iptables

I'm currently working on securing my Kubernetes server by blocking certain ports using iptables. I've applied the following rules to drop traffic on specific ports: -A INPUT -p tcp -m tcp --dport ...
Samoed's user avatar
  • 1
0 votes
1 answer
87 views

How to forward UDP traffic between two interfaces using iptables

Good morning, I need help to forward traffic in two interfaces on a debian12 server. I have a server with two interfaces like this scheme: INTERNET come on the ens224 | LAN go to the ens192 I want ...
ArnOCP's user avatar
  • 11
0 votes
1 answer
397 views

Wireguard/iptables: ICMP response not forwarded to wg0

Network diagram: Laptop (10.8.0.2) -> (wireguard) -> server A (10.8.0.1, 10.10.0.10) -> server B (10.10.0.20) sequence diagram I've connected my laptop (10.8.0.2) to a server A (10.8.0.1) via ...
xaa29221's user avatar
3 votes
0 answers
134 views

Why is UFW blocking this connection?

I have a problem with a user who is unable to access a Ubuntu 22.04 webserver (he gets ERR_CONNECTION_RESET), apparently due to the firewall blocking his connections. However he IS able to access a ...
Jonathan Potter's user avatar
5 votes
2 answers
1k views

What is the difference BM and KMP algorithms in iptables string search?

Iptables has a string module for searching packet contents. But it forces you to choose between one these algorithms: Boyer-Moore (bm) and Knuth-Pratt-Morris (kmp). I couldn't find any good ...
LatinSuD's user avatar
  • 911
0 votes
2 answers
83 views

IPTables: introduce a policy for a chain so that I can maintain the drop policy/rule without having to delete it when I need to add a new accept rule?

Say I have a chain introduced with iptables -N SERVICES-VPN. But then I want this chain to drop everything... so iptables -A SERVICES-VPN -j DROP. The problem here is that I may need to add rules ...
The Quantum Physicist's user avatar
0 votes
0 answers
89 views

Docker blocking connection from remote for a single specific port?

I have a server with two docker containers, each with their own PostgreSQL databases. One container is mapped to port 32772 and the other to 32771. These two databases used to be acessible by remote ...
JMenezes's user avatar
  • 101
0 votes
0 answers
135 views

IPtables uncommon packet dropping

I'm setting up a basic iptables firewall on a Rocky Linux-based server with kernel version 5.15.103-1. The primary requirement is to establish specific access rules for different groups of servers. ...
user22395539's user avatar
0 votes
0 answers
263 views

Forward local generated Secure Websocket traffic (wss) through an HTTP/HTTPS proxy to reach internet

I have a python webex_bot application (https://github.com/fbradyirl/webex_bot) which uses websockets for webex cloud communication. The problem is that the server in which the bot is being hosted on, ...
panchis's user avatar
0 votes
1 answer
144 views

Iptables duplicate/Mirror incoming UDP traffic from HOST1 to an external HOST2

I need an advice about the following scenario: IoT devices are sending UDP packets to a 18.04 Ubuntu server environment (HOST1) on port 1234. HOST1 processes the UDP packets as per the internal ...
user3132858's user avatar
0 votes
1 answer
89 views

How to make IpTable Rules immutable in linux

I work on Linux and want to add rules to iptable. I want these rules to be immutable anyway (either changed or deleted). What should I do? Note that for me the rules that are running and kept in ...
amirsalimi's user avatar
0 votes
0 answers
49 views

Strongwan S2S VPN to Fortinet

I want to hide my local hosted server behind a public VPS. So i established a VPN between my local firewall(fortinet) and my vps(strongswan). Diagram The VPN is up but no traffic at all. Even in ...
ben's user avatar
  • 1
0 votes
2 answers
90 views

iptables - How do I restrict access to just local devices on the network?

I have asked this question on SuperUser but the only response was from someone who I was unable to understand I have a WireGuard VPN Server running on a Debian 12 host with no problems, listening on a ...
espresso fan's user avatar
1 vote
1 answer
286 views

Iptables blocks loopback interface but why?

I am having trouble understanding why iptables is blocking my loopback interface traffic. Here is the scenario: I set the default policy of the INPUT chain to DROP. I allow traffic to port 8080. My ...
Bongo's user avatar
  • 13
1 vote
1 answer
264 views

Failover load balancing by iptables is possible?

I'm playing around with iptables in my home lab. My first goal is to take my active directory communication into one load balancing virtual IP. I used prerouting chain to do that. For testing purposes,...
Peet's user avatar
  • 21
-1 votes
1 answer
131 views

How to reroute packets to other gateway in LAN?

I have local network 192.168.203.0/24 with 2 gateways: 192.168.203.1 - router that gives access to the internet, 192.168.203.5 - OpenWRT which gives access to other private network through OpenVPN. ...
tmk555's user avatar
  • 1
0 votes
0 answers
60 views

Iptables DNAT with multiple interface

I have 2 Machines: MachineDev ens5: 10.41.12.63 (the default net device) ens8: 10.41.10.111 MachineProxy ens5: 10.40.9.106 (the default net device) ens6: 10.40.2.114 And I want use MachineProxy as ...
YNX's user avatar
  • 101
0 votes
0 answers
50 views

Ubuntu 16.04 router VPN and rdp

I have been running my own home-brew router for a number of years. My ISP provided equipment running in bridge mode so my own router just connects to their gateway using a public static IP. I also use ...
George Townsend's user avatar
0 votes
2 answers
153 views

iptables: IP forwarding restricted to pings. Why?

After reinstalling OpenSuSE Leap 15.5 on a SOHO server, which acts AS a Firewall, the machines on the internal network (169.254.164.0/24) can't reach any hosts on the internet save for pings. But no ...
Neppomuk's user avatar
  • 113
0 votes
0 answers
113 views

Iptables: limit mdns packet per second per ip

I have a network with a lot of MDNS (UDP 5353) traffic on it. To avoid overloading my server, I limit globally the MDNS packets accepted by iptables with this rules: iptables -A INPUT -i eth2 -p udp --...
cyanat's user avatar
  • 31
0 votes
1 answer
185 views

Route an incoming ICMP packet to a different interface/process

I have an interface enp4s0 with several IPs. I get ICMP packets (type 8, echo request) from external device to my device on enp4s0. I'm trying to route only packets sent to 192.168.1.90 into another ...
hudac's user avatar
  • 136
1 vote
1 answer
411 views

How can I utilize a systemd service to modify the DOCKER-USER iptables chain?

I run an ubuntu-lts host with docker. I'd like to modify the DOCKER-USER iptables chain on start-up to add a custom reject rule. The issue I've encountered is that the DOCKER-USER chain does not exist ...
kharderr's user avatar
0 votes
1 answer
548 views

Re-route all incoming traffic to my home computer over the wireguard interface

I have setup a server in AWS with WireGuard server installed on it. I configured the server and the client and the vpn connection is up and running. I am able to ping from my local computer to the ...
Tim B.'s user avatar
  • 117
0 votes
0 answers
229 views

nftables Rules for ProxyChains-over-Tor

I am trying to configure nftables rules for ProxyChains-over-Tor, so that: My system --> Tor SOCKS5 proxy --> HTTP proxy --> Internet My system can only communicate with Tor SOCKS5 proxy Tor ...
user73q3277y23's user avatar
0 votes
1 answer
130 views

iptables block IP range user

I'm trying to block an IP range using iptables -A INPUT -s 185.0.0.0/8 -j DROP This rule works perfectly but will affect all users on the network. I want to make this happen for individual users so ...
Luana's user avatar
  • 29
1 vote
1 answer
289 views

Match specific user's traffic both in OUTPUT and in INPUT to use quota on it

How can I convert: iptables -t mangle -A OUTPUT -m owner --uid-owner root -j MARK --set-mark 1 iptables -A OUTPUT -m owner --uid-owner root -m quota2 --name 10mb_quota --quota 10240000 -j MARK --set-...
Luana's user avatar
  • 29
0 votes
1 answer
138 views

Properly configuring iptables rules behind an openvpn server

hi friends hope everyone is doing well. i got a little misunderstanding of how i should configure iptables v4 rules for an openvpn server. if some wizard can give me a hint it would be great. i'm ...
infoman33's user avatar
1 vote
1 answer
367 views

Bad address translation in Kubernetes UDP service by kube-proxy with iptables

For educational purposes, I made myself a Kubernetes cluster according to Kubernetes the Hard Way guide - except I did it on my own set of local VMs rather than using Google Cloud. Everything seemed ...
ghik's user avatar
  • 121
0 votes
1 answer
172 views

How to handle QoS(traffic control) based on physical interface of virtual bridge?

I have a requirement to limit the traffic rate based on different interfaces of the router, such as controlling the upload speed of ssid1 to 10mbps, download speed to 20mbps, lan1 upload speed to ...
Ryan.Ran's user avatar
0 votes
1 answer
150 views

iptables: Only allow one IP address when rules are updated by other tools

I'm learning about iptables and I want to set up a GNS3 (network emulation) host on a public IP and limit the access to only one IP address. This one IP address should be able to connect with all ...
itsamemarkus's user avatar
0 votes
1 answer
68 views

Does iptables apply all rules in order when an incoming connection is received?

I'm using iptables and fail2ban to secure server connections. Currently I have connections filtered via a router passing only ports for email and webserver access and fail2ban adding restrictions ...
Max's user avatar
  • 3
0 votes
2 answers
576 views

iptable rule for an IP address with "any" subnet mask

I have a requirement to add an iptable rule for lets say src IP 10.10.10.20/any dest IP any. iptables -t filter -A FORWARD_0_IN -p all --ipv4 --source 10.10.10.1/any --destination 10.10.10.2/any -j ...
RootPhoenix's user avatar
0 votes
0 answers
29 views

Graceful connection closing using iptables

I'm developing a transparent HTTP proxy for fault injection testing. The proxy needs to capture all traffic to a HTTP server in order to selectively inject faults. The transparent proxy sets an ...
pablochacin's user avatar
0 votes
0 answers
84 views

Port forwarding with iptables prerouting not work

I have 3 server server A: 5.161.x.x server B: 193.151.x.x server C: 195.96.x.x I want to forward all traffic from server B and C to server A ,i forwarded Server B to server A with this command: ...
Aref Solaimany's user avatar
0 votes
0 answers
90 views

iptables DNAT works for first curl request, then hangs

I want to forward all packets coming to 192.168.1.10:8070 on interface wlan0 to 10.59.99.4:8080 on interface wg0. I added these two rules to iptables: -A PREROUTING -p tcp --destination 192.168.1.10 --...
Ricky434's user avatar
0 votes
1 answer
62 views

open vpn iptables script intermittantly failing

I am new to vpn setup and iptables and i have a basic understanding of networking, but am by no means a networking expert. I am setting up a openvpn router so that i have remote access to the plc's ...
Stevo's user avatar
  • 3
0 votes
1 answer
51 views

Redirect specific traffic over another interface

I have a router (with iptables support) with 2 WAN interfaces (wan0 and wan1) and I am trying to redirect calls of specific IPs (for ex: 8.8.8.8) over second interface (wan1) using ip tables. Traffic ...
mursel.musabasic's user avatar
2 votes
1 answer
220 views

How can I troubleshoot an iptables rule that is preventing internet access from my server?

So I am facing a strange issue, not able to make any sense. Hope someone here can help me understand. I have my iptable rules set like this root@COV0495:~# iptables -S -P INPUT DROP -P FORWARD ACCEPT -...
Rick Roy's user avatar
  • 247
0 votes
0 answers
98 views

iptables PREROUTING DNAT

Server 1: 192.168.0.1 Server 2: 192.168.0.2 Server 3: 192.168.0.3 Server 2 has access to server 3 on port 1521 The task is to make port forwarding from Server1 -> Server2:5501 -> Server3:1521 ...
AlexD's user avatar
  • 1