Questions tagged [iptables]
iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n
6,672
questions
1
vote
0
answers
537
views
Block outgoing connections for docker with iptables while allowing some IPs on Debian
I'm trying to block all outgoing connections for my docker containers while still allowing outgoing traffic to a specific IP and port. However when I block all outgoing ports, all incoming connections ...
- 11
0
votes
1
answer
139
views
iptables not accepting my rule
I am trying to add a rule to my iptables, so that traffic trying to connect on port 9091 is forwarded to a different IP address. When searching I found this answer, which seems to fit my exact use ...
- 17
0
votes
0
answers
31
views
iptables port forwarding rules only work for first response packet
I have the following scenario:
+---------------+ +-------------+ +-------------------------+
| PC | | Linux | | Router ...
- 101
10
votes
5
answers
49k
views
how do I disable the nf_conntrack kernel module in CentOS 5.3 without recompiling the kernel
I'm running CentOS 5.3 and want to disable the nf_conntrack module to improve network performance for haproxy. I'm running iptables with some simple rules. I don't really need the connection ...
- 321
2
votes
1
answer
163
views
Restrict access to Docker container port to ip adresses
There are several docker containers on my server, exposing ports. Now I try to restrict the access to the ports to IP-Adresses being able to insert rules without allowing the policy. I apply IP-Tables ...
- 245
0
votes
1
answer
157
views
How to route all traffic going to specific address to localhost using nft?
I need intercept traffic going to external IP and reroute it to localhost. Its quite simple using iptables, but I could not understand how to make it work through nft. I create table and chain inside ...
- 33.3k
1
vote
2
answers
779
views
why we need different types of base chain in nftables?
I know how hooks work in netfilter but I can't understand why there are different types of chains as described here: base chain types I have two questions
first : why there are different types of ...
- 23
0
votes
1
answer
127
views
How to redirect ssh port to another port by username?
I have sshd: Listen 2222 on server, and what I want to do is:
ssh -p 2222 userA@ip, and server finds userA, then redirects this connect to 6122 port of this server, but I don't want to modify on my ...
- 1
1
vote
1
answer
365
views
Iptables block incoming connections to network interface from subnet
I have a Linux machine that uses Hostapd to serve a WiFi hotspot. I also have a Raspberry Pi that connects to this WiFi hotspot as a DHCP Client. The Linux machine has a Cellular interface and shares ...
- 12.8k
1
vote
0
answers
326
views
Conntrack not showing iptables redirected flow
I have a client and server. At Server I have a redirect rule to redirect all incoming flows to port 15006.
Client IP: 10.20.3.53
ServerIP : 10.20.3.63
I have the following iptables rules on the ...
0
votes
0
answers
229
views
OpenVPN Server on K3s Kubernetes Cluster: No Internet Access
I've set up an OpenVPN server on a K3s Kubernetes cluster. While I can successfully deploy the OpenVPN server pod and connect from a client machine, the client doesn't have internet access through the ...
147
votes
8
answers
578k
views
How can I port forward with iptables?
I want connections coming in on ppp0 on port 8001 to be routed to 192.168.1.200 on eth0 on port 8080.
I've got these two rules
-A PREROUTING -p tcp -m tcp --dport 8001 -j DNAT --to-destination 192....
- 1,757
0
votes
0
answers
84
views
Why does route rule not work when I set mark after the net packet go through the 'forward chain' of iptables?
I want to that all the packets through 'farword chain' redirect to local loopback, so that I can proxy this traffic. I set the route rules of iproute2 (all the packet with mark 1 is routed to local ...
-1
votes
1
answer
97
views
Years old iptables script breaks (-o option no longer exists?)
I've had a script for a while that forwards a port through my Wireguard VPN. Recently, I tried using it and it returned:
Bad argument `wg0'
Try `iptables -h' or 'iptables --help' for more information.
...
- 49.8k
0
votes
0
answers
111
views
Another iptables/ipset issue where connections are not being blocked
The listing at the bottom of this question is the output from "iptables-save" on my Debian system.
I set up an ipset list called "manual-block" to contain addresses of connections ...
- 230
1
vote
1
answer
6k
views
Wireguard - single server with multiple interfaces
I have one raspberry, and there I have ethernet connection to internet eth0 and I have another wireless connection wlan0 that is also conneted to internet via other router.
Is it possible to create ...
CommunityBot
- 1
0
votes
1
answer
499
views
WireGuard portforwarding setup
I need help with the following scenario:
I have a small instance on AWS, which should accept all traffic from ports 1024:65535 and should send it to my local server. The local server shouldn't send ...
- 1,451
2
votes
2
answers
3k
views
iptables: redirecting inbound UDP to a different port, and response going out the "public" port
I have an SNMP agent listening on a high-level port (16161) and I want to redirect traffic from the standard SNMP agent port 161. Easy iptables rule:
iptables -t nat -A PREROUTING -p udp --dport 161 -...
- 21
0
votes
2
answers
81
views
Iptables blocking https/http
Have boring problem, my php admin not accesible when iptables runing. Rules:
# iptables -L -v -n | more
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out ...
- 736
0
votes
1
answer
380
views
How to allow kubernetes/calico traffic through iptables?
I have installed kubespray on my host. I want to close all ports on my host except the required ports. I want to add these rules:
iptables -A INPUT -p tcp -m multiport --dports 22,80,443 -j ACCEPT
...
- 51
0
votes
0
answers
369
views
iptables masquerade traffic from ip range to specific interface
I have an environment where I have multiple network interfaces: eth0 and vpn1.
I am running docker which has an iptables masquerade rule to masquerade traffic from 172.17.0.0/16: -A POSTROUTING -s 172....
- 101
0
votes
0
answers
240
views
serverside fetch request timeout when request are to an external domain which has the same IP as origin domain
I'm currently running a SvelteKit app within a container which connects to an API running within aother container. Everything is connecting & going through locally using the container's internal ...
0
votes
2
answers
1k
views
Why can't iptables see rules added using firewalld?
I have a CentOS7 machine, and I use firewalld as my firewall. Recently I added a few rules using firewall-cmd:
# Removing DOCKER-USER CHAIN (it won't exist at first)
firewall-cmd --permanent --direct ...
- 1
0
votes
1
answer
309
views
Wireguard with multiple local subnets using iptables
I'm trying to allow multiple local subnets when using a wireguard VPN. Below is the iptables config from my wireguard config file.
I'm assuming I have to write this in a different way, but I have no ...
- 1
0
votes
0
answers
68
views
Nat Local subnet to another gateway centos7
hi i have a centos 7 with ocserv and iptables installed
i wanted to route all OCserv teraffic to ip tunnel (which established and reachable)
my Server ip is 172.10.1.1
My OCSERV Users Subnet is : 192....
2
votes
1
answer
635
views
Blocking traffic from specific countries. How to kill existing connection?
Using Linux Debian Bookworm.
Problem
I want to block all incoming connections to my server coming from specific countries.
Edit
As someone pointed out in the comments, I really shouldn't be doing this ...
- 12.8k
1
vote
0
answers
391
views
Strange Networking Issue: Ports 80 and 433 Unreachable from Outside, Docker
I'm encountering a perplexing networking issue that has me scratching my head. Here's the situation: I'm unable to access ports 80 and 433 from the outside, but I can forward any other port within ...
0
votes
0
answers
49
views
iptables port forwarding to different local addresses
I would like to forward local traffic to 127.0.0.2:30041 to 127.0.0.2:40041 and 127.0.0.3:30041 to 127.0.0.3:40041.
When I use
sudo iptables -t nat -A OUTPUT -o lo -p udp -m udp --dport 30041 -j ...
- 101
0
votes
1
answer
109
views
VPN on Linux - IP routing issue
I got the following scenario:
an ubuntu server 20.04 lts, for simplicity named A server with the following network interfaces:
loopback
enp1s0 (wan) PUBLIC-IP/23
enp8s0 (lan) 10.9.96.3/20
ppp0 (l2tp) ...
- 44.9k
0
votes
0
answers
43
views
Openvpn forward all traffic not working unless I flush iptables
I want to run an openvpn which forwards all traffic, but it only works when I flush my iptables rules. Can someone tell me which rule(s) are causing the problem?
iptables-save output:
*nat
:PREROUTING ...
- 1
0
votes
0
answers
414
views
Proxying Traffic from Android with iptables
I have a Android device, and I'm trying to redirect HTTPS traffic to another host on my local network.
I've tried defining the proxy in the device network configuration, which works for everything ...
- 101
1
vote
2
answers
124
views
LXC container fail to load big iptables rules
I'm facing a strange problem when I try to load a big iptables set of rules on a LXC container (it's working fine on a virtual machine).
The container is running Linux Debian 12 bookworm.
I'm able to ...
- 3,553
0
votes
0
answers
160
views
How to route packets whose destination are in an ipset to a nat interface
I have an interface named em2, which is a nat interface. I want to route all the packets whose destination are in an ipset named test to em2.
If I don't use ipset and policy routing, it works well
...
- 12.8k
0
votes
1
answer
139
views
Creating an IPTABLES chain, whose rules are ignored, unless the packet is from a certain port?
I want to confirm the following. If I create a chain whose first rule is:
iptables -I INPUT -p tcp -m multiport --dports 25,465 -j name
Does that mean that any further specified rules in the chain, ...
- 103
0
votes
1
answer
84
views
iptables routing all traffic to two different chains?
I'm debugging an iptables setup that I didn't write. This setup is supposed to provide a firewall around some Docker containers (Portainer and Nginx Proxy Manager) running on the router itself, but ...
- 80.3k
1
vote
1
answer
164
views
Filter packets with iptables on a tap interface
I'm trying to write firewall rules to prevent a guest machine from accessing the internet.
The server (Ubuntu server 22.0, using KVM) has a physical connection (enp34s0), which is connected to the ...
- 44.9k
0
votes
2
answers
379
views
fail2ban on host for rootless podman keycloak container
running on Rocky Linux 9.2 with podman 4.4.1.
I got a podman Pod with keycloak + postgresql inside, running rootless. The pod itself with --network 'slirp4netns:port_handler=slirp4netns'. The keycloak ...
- 141
11
votes
4
answers
15k
views
iptables: what does "--src-type LOCAL" mean exactly?
The iptables man page defines it as "a local address" but does this refer only to the 127 range (localhost) or does it include 10, 169, 192 as well ?
- 306
0
votes
0
answers
36
views
OpenVPN Gateway and Server Routing
Network Layout
The above network diagram shows a VPN gateway setup. When the VPN is active I can ping Network 1 from Network 2. I can't however ping Network 2 from any device on Network1, including ...
- 1
0
votes
1
answer
95
views
iptables string matching feasability; possible use with fail2ban
We have several Apache 2.4 web servers behind a load balancer and CDN front end - where HTTPS is terminated - we see the client IP in headers from the front end in the back end Apache logs. I'm ...
- 80.3k
0
votes
1
answer
254
views
Debian + Strongswan: does not pass traffic from the Internet to the tunnel
I'm trying to setup a remote VPN server to access the internet from my home PC. It is on a leased AWS VPS, with Debian and Strongswan. It is meant to receive my traffic via the tunnel, forward it to ...
- 1
0
votes
0
answers
67
views
iptables as proxy server for IoT devices similar to socat
I am able to forward incoming TCP traffic from IoT devices hitting a port towards another destination server using socat using this command
socat TCP-LISTEN:5050,reuseaddr,fork TCP:some-random-host-in-...
0
votes
1
answer
150
views
Block access to remote mysql database using iptable in ubuntu 20.04
I am configuring iptable rules in a Ubuntu 20.04 machine (Client). There is a mysql db in a remote machine (Server). I need to block access from client machine to mysql DB server. These configurations ...
- 12.6k
6
votes
2
answers
8k
views
Make wireguard listen on multiple port
It there a way to make wireguar listen to multiple port ?
Like listenning on 80,53,and 4444.
I'm looking to achieve this without running multiple wire guard separate interface, to prevent having to ...
- 117
2
votes
1
answer
4k
views
Wireguard Client IP Identification
Let's say we have the a Wireguard setup like in the below diagram (see imgur link, couldn't post image without reputation) with the following PostUp & PostDown:
PostUp = iptables -A FORWARD -i wg0 ...
CommunityBot
- 1
0
votes
0
answers
139
views
Unable to Block Kubernetes Ports in iptables
I'm currently working on securing my Kubernetes server by blocking certain ports using iptables. I've applied the following rules to drop traffic on specific ports:
-A INPUT -p tcp -m tcp --dport ...
- 1
0
votes
1
answer
438
views
Wireguard/iptables: ICMP response not forwarded to wg0
Network diagram: Laptop (10.8.0.2) -> (wireguard) -> server A (10.8.0.1, 10.10.0.10) -> server B (10.10.0.20)
sequence diagram
I've connected my laptop (10.8.0.2) to a server A (10.8.0.1) via ...
- 19
8
votes
1
answer
52k
views
Failed to retrieve directory listing in Filezilla connecting to vsftpd
newbie here.
At first I was unable to connect to vsftpd but I added port 21 in iptables (i'm running on Centos 6) and managed to make it work. But now, I can't get past Command: LIST in Filezilla
...
- 80.3k
3
votes
0
answers
142
views
Why is UFW blocking this connection?
I have a problem with a user who is unable to access a Ubuntu 22.04 webserver (he gets ERR_CONNECTION_RESET), apparently due to the firewall blocking his connections. However he IS able to access a ...
- 131
32
votes
5
answers
118k
views
iptables - Target to route packet to specific interface?
My home server has two main interfaces, eth1 (a standard internet connection) and tun0 (an OpenVPN tunnel). I'd like to use iptables to force all packets generated by a local process owned by UID ...
- 134k