Questions tagged [iptables]

iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

Filter by
Sorted by
Tagged with
0 votes
0 answers
13 views

Unable to Connect via Port Knocking on Specific Port

I am trying to set up port knocking on my server to enhance security. I've configured my firewall rules to use port knocking, where I have to connect to specific ports in a specific sequence before ...
noobintech's user avatar
1 vote
1 answer
19 views

How to route traffic from physical to virtual interfaces when using MACsec?

The setup: 3 Linux Ubuntu 18.04 virtualized in GNS3 all connected to a Ethernet hub, lets call them VM1, VM2 and VM3, each VM has a physical interface called ens3 and a IP Address from DHCP Server ...
Reinis's user avatar
  • 13
0 votes
0 answers
77 views

Is it possible with CSF firewall, to forward IP traffic transparently?

In /etc/csf/csf.redirect 10.100.100.115|*|10.200.200.186|*|tcp 10.100.100.115|*|10.200.200.186|*|udp I have the following config, now when I connect to https://10.100.100.115/ (nginx+php) with script ...
J Frost's user avatar
0 votes
0 answers
15 views

How to catch process being blocked by outbound iptables fw? [duplicate]

NOTE: Thanks for suggesting answers. I'm having a look at them but the main issue (as stated below) is that outbound iptables hide information from tools like netstat and auditd. I need to look at ...
TommyPeanuts's user avatar
3 votes
3 answers
1k views

fail2ban bans IP addresses, yet they still appear in access.log

This is my filter: [Definition] failregex = <HOST> .* "POST /customer/account/create.*$ <HOST> .* "GET /customer/account/create.*$ and this the corresponding jail: [...
digijay's user avatar
  • 1,215
0 votes
1 answer
29 views

iptables ssh configuration for specific ip - can't establish connection

For practising purposes, i'm attempting to establish a SSH connection to a Kali virtual machine with an iptables firewall configured to permit only specific SSH connections. Initially, i successfully ...
tasstra's user avatar
  • 11
-1 votes
2 answers
243 views

Unable to access Url from Internet through WireGuard VPN tunnel

I am trying to access a router settings web page from Internet. I have setup a WireGuard VPN on AWS EC2. The handshake between the router and the WireGuard server looks good, but I am not able to ...
TechGuy's user avatar
0 votes
2 answers
54 views

Why is https communication not working with iptables?

I'm trying to configure iptables for security settings. Basically, I set up a whitelist and tried to test it. I set the following settings to allow ssh, http, and https to my server by allowing input ...
john_smith's user avatar
1 vote
0 answers
50 views

In K8s network, why UDP packets are dropped by kernel?

In Azure I have two k8s services: serviceA and serviceB. serviceA's type is LoadBalancer, and set externalTrafficPolicy=Local Client sends UDP packets to serviceA, serviceA transfer them to serviceB ...
feiyu_guo's user avatar
1 vote
1 answer
178 views

Port unreachable when wireguard is connected

I have a server that routes all of its traffic through wireguard. When I start the wireguard, all ports listening on this server's public IP are unavailable - even ssh does not work. What I want is to ...
Iuri G.'s user avatar
  • 53
-1 votes
1 answer
78 views

fail2ban cannot block ip public, it works only for private ip

My server live behind the reverse proxy nginx, but the ip of the client access shows in the apache log like this, looks normal, there is no x-forward things in the log. 103.221.234.206 - - [28/Feb/...
Riska K A's user avatar
0 votes
0 answers
22 views

Masquerading from a custom routing table does not work

In Ubuntu 22.04 server, masquerading/NATing from a custom routing table does not work (for VPN clients). It does work however when I do not route traffic to a custom table (and let it remain in the ...
Mustafa Mohiuodin's user avatar
0 votes
0 answers
192 views

Redirect all HTTP/HTTPS traffic through WireGuard to external HTTP Proxy

I have set up a Wireguard VPN whereby all of my devices connect to a Wireguard peer running on a computer with a public IP address (host). My Wireguard is set up so that clients connect to the host on ...
TopCat's user avatar
  • 11
0 votes
0 answers
53 views

IP6tables does not apply ACCEPT rules

My server is an IPv6 only server, I'm trying to write firewall rules using ip6tables and it looks something like this Chain INPUT (policy ACCEPT) num target prot opt source ...
Bad_Panda's user avatar
  • 123
2 votes
1 answer
318 views

How to set iptables to block incoming requests to the server but still have internet connectivity

I have multiple services that are running on my server. But I do not want them to be exposed to internet. My input chain rules look something like this -P INPUT ACCEPT -P FORWARD DROP -P OUTPUT ACCEPT ...
Bad_Panda's user avatar
  • 123
0 votes
0 answers
57 views

UFW blocks traffic despite there is an allow rule

I have Ubuntu server with OpenVPN server running there. IP addresses as follows: enp1s0: 192.168.3.67/24 tun0: 172.18.37.1/24 OpenVPN is configured so that devices behind the VPN client are ...
Hanz94's user avatar
  • 1
0 votes
0 answers
55 views

Proxmox, iptables connection refused on port 443 from different nodes if forward to LoadBalancer

having some problems with port forwarding on dedicated machine running Proxmox. I have create an LXC-Container for LoadBalancing and forward all incomming request on port 80 and 443 to it. If I am ...
xtrose Media Studio's user avatar
0 votes
0 answers
35 views

VPN netmap multiple sites with same LAN network address

I have some issues applying netmapping to a case for which I could not find much info about on the web. I am trying to set up a VPN network (server ip: 10.1.0.1) where a user (VPN IP: 10.1.0.2) can ...
Daniel's user avatar
  • 1
0 votes
1 answer
26 views

RateLimit is doing weird maths and wrong numbers on kernel

I'm trying to apply a set of rate limit within iptables, and it's doing some weird maths that i'm not able to see on the kernel why this is happen. I tried to execute same code on my local machine, ...
JustDevZero's user avatar
0 votes
0 answers
32 views

Debian Firewall will not forward traffic from interface x to tun0

I want to have a debian system working as a router with openvpn traffic, where all traffic on interface x should be forwarded to openvpn interface y. Following pic shows my network setup, more or less ...
kasper2083's user avatar
0 votes
0 answers
62 views

Trying to understand iptables rules on the tomato router

I am working on configuring a linux machine as a router, and I took /etc/iptables file from the tomato router. I would like to use this file as a starting point for the firewall rules on the linux ...
Cattus's user avatar
  • 1
0 votes
1 answer
58 views

Firewall blocking not the IP-address, but the DNS-name

System: CentOS 7 I noticed on my server that some IP-addresses that I blocked are not actually blocked, but continue to hold connections. I started to look on the iptables-level and saw a strange ...
sivsoft's user avatar
  • 11
0 votes
1 answer
29 views

No traffic is going through the NAT table in iptables

I have added just some rules to LOG packets going through the OUTPUT chains, but nothing goes through the NAT table at all. It is clear from the counter of NAT table chains here (which the counters ...
Kamran's user avatar
  • 1
0 votes
0 answers
190 views

Hetzner 1 Public IP + Proxmox + OPNSense

I have the following problem, I have a dedicated server in Hetzner with 1 public IP, I must install a Proxmox, a virtual machine with OPNSense to use as a router... and the other virtual machines ...
KatiaSisHost's user avatar
0 votes
0 answers
25 views

limit container connection on specific ip address

I just run a container on 8000:8000 my server 192.168.1.10 so if I run curl 192.168.1.10:8000 from another server (like 192.168.1.50) it will return hello-world from my API. I want to limit the ...
Mahdi's user avatar
  • 1
0 votes
1 answer
83 views

How to save custom rule in ufw? Ubuntu 23.10

I am using ufw and I would like to add a custom rule iptables -I INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT But even following iptable-save Upon reboot, the rule is gone. I also ...
brad's user avatar
  • 125
0 votes
0 answers
21 views

Is iptables NAT forwarding possible bewteen two libvirt VMs?

I'm building a test VPN setup using two libvirt VMs with StrongSwan IKEv2 but can't get traffic to forward. I can see the client sending traffic to the server using tcpdump but the server doesn't do ...
dbazile's user avatar
0 votes
0 answers
21 views

How to 'rename' IPs in a subnet while they go through WireGuard?

first question here, I hope I'm at the right spot. I have successfully configured WireGuard on my Linux server and am able to connect my laptop to it. The laptop is able to access a subnet that's on ...
samvv's user avatar
  • 101
0 votes
1 answer
48 views

I keep receiving login attempt to my server until it gets down

I have a Centos7 server and after years of correctly working, yesterday it started to being unreachable (The server apps I have there were not rechable, the SSH connection gave timeout, etc but the ...
Faabass's user avatar
  • 103
0 votes
2 answers
72 views

Will rapidly changing iptables rules cause issues?

I am writing a script that monitors different metrics (e.g. interface bandwidth usage) and changing iptables rules accordingly. These changes may occur at least 2x per second, up to 4 * number of ...
Aloha's user avatar
  • 286
0 votes
0 answers
72 views

Why is an iptables rule needed on Oracle CN to allow HTTP traffic on port 80, when no reject rule is set and the default policy is set to ACCEPT?

I have an Oracle Cloud Infrastructure Compute Node on the free tier, configured with Ubuntu 22.04 as the operating system. I successfully installed Nginx and added an ingress rule to the subnet to ...
DRA's user avatar
  • 1
0 votes
0 answers
35 views

Linux iptables/UFW - Exclude ONE host from nat

Currently I am using UFW to NAT two IPv4 Subnets to VPN Interfaces like this: extract of /etc/ufw/before.rules: # NAT table rules *nat :POSTROUTING ACCEPT [0:0] -A POSTROUTING -s 192.168.1.0/24 -o ...
user3528657's user avatar
1 vote
0 answers
91 views

firewalld and iptables | fail2ban

I have fail2ban 1.0.2 running on an Almalinux server. Seems to be working as hoped, but I'm puzzled by something. have sshd.local and 00-firewalld.local in jail.d (installed fail2ban and fail2ban-...
Johnny Canuck's user avatar
1 vote
0 answers
32 views

iptables ignores REJECT in custom chain but works in the main chain

I configured a server with fail2ban for the smtp server. Now, fail2ban correctly bans the IPs and I can see them in the iptables chain of fail2ban. However, the kernel seems to ignore the iptables ...
ocirocir's user avatar
  • 113
0 votes
0 answers
41 views

port redirect with vpn

pc1 is a client inside lan with openvpn ip 10.8.0.1 /sbin/ifconfig eth0 Link encap:Ethernet HWaddr 90:09:D0:08:99:15 inet addr:192.168.2.130 Bcast:192.168.2.255 Mask:255.255.255.0 ...
Pol Hallen's user avatar
  • 1,113
0 votes
2 answers
177 views

Forward HTTPS Traffic to a proxy server

I have a smart-dns setup, Using dnsmasq as the dns server, which always resolves to my server ip address, for a given list of domains. I want to configure either a webserver or proxy program to listen ...
loxtic's user avatar
  • 21
0 votes
1 answer
181 views

Fixing route and iptables for an OpenVPN tun0 interface, with a selected and safe routing

I did setup my router to use 3rd party VPNs for maximum security. Since the ISPs that I am using have blocked all known VPN protocols including OpenVPN protocols, therefore I am forced to configure my ...
osiaso 's user avatar
0 votes
0 answers
17 views

in iptables redirect unknown mac clients using --to-destination 192.168.0.30

I have been using iptables to block all unknown mac addresses from the internet gateway by EXT_DEV=wlan0 INT_DEV=eth0 INT_NET=192.168.0.0/20 modprobe ip_conntrack modprobe ip_conntrack_ftp echo 1 > ...
Cor Cool's user avatar
1 vote
1 answer
30 views

How do I mark incoming iptables request from unknown MAC address with mark 99 using conntrack

I have my iptables rules running for years without incident but after allowing all trusted MAC's access by: /sbin/iptables -A INPUT -m mac --mac-source $MAC -j ACCEPT /sbin/iptables -A FORWARD -m mac -...
Cor Cool's user avatar
0 votes
1 answer
219 views

Connect two LANs without NAT in linux

I have a PC with address 192.168.3.2. It's connected to a router 192.168.3.1. Router 192.168.3.1 is connected to another LAN with static address 192.168.88.6 Router at 192.168.8.1 provides an internet ...
dmzkrsk's user avatar
  • 101
0 votes
1 answer
166 views

Add delays to the requests coming from a particular ip address

Is there any way to add delay to the requests coming from a particular server for testing purposes. I have tried checking tc command which adds delay for all the requests. I have also checked if there ...
JustSomeFool's user avatar
0 votes
0 answers
81 views

Cannot Access Tomcat Server from external server

I have found several people with this problem, tried many solutions, but none have worked for me. I have recently setup a new VPS at a hosting company, linux with Centos9. I've installed and run ...
Sports Man's user avatar
0 votes
0 answers
34 views

Create firewalld rule

I have this code that I've been using for years (works fine) which takes external requests coming to the server at the port 9944 and redirects those requests internally to localhost on port 9922. For ...
Samul's user avatar
  • 316
1 vote
1 answer
204 views

iptables v1.8.7 (nf_tables): unknown option "-p"

Try to remove -p option, got iptables v1.8.7 (nf_tables): unknown option "PREROUTING" the command: iptables -t nat -A PREROUTING -p tcp -–dport 80 -j REDIRECT –-to-port 8080 Got iptables v1....
Alex Anonym's user avatar
0 votes
0 answers
56 views

why does this hook in netfilter doesn't get the payload content in the tcp packet?

why does this hook in netfilter doesn't get the payload content in the tcp packet? unsigned int hook_func(void *priv, struct sk_buff *skb, const struct nf_hook_state *state) //这个函数是钩子函数. //...
zhzhy's user avatar
  • 11
0 votes
0 answers
114 views

Configuring Nginx as a reverse proxy for any domain

Currently i have a setup, where dnsmasq is used as a dns server, which resolves an dns lookup, to my own servers IP address. Where SNIPORXY is listening on port 80 and 443 The configuration of the ...
loxtic's user avatar
  • 21
2 votes
2 answers
114 views

Can iptables relate the physical wireguard UDP connection to the tunneled TCP session?

I'm locking down the egress of my Linux box, making OUTPUT chain default deny. My wireguard peers are from the subnet 10.1.0.0/16. Originally I thought I can just -A OUTPUT -d 10.1.0.0/16 -j ACCEPT, ...
ron's user avatar
  • 203
0 votes
0 answers
37 views

Two containers on two hosts in same network: One can access other hosts on network, the other can't, why?

I have been running into a network issue recently with two containers (on two different hosts) in our network: The container on the one host can ping/access physical hosts on a specific network while ...
heeeresjohnny's user avatar
0 votes
1 answer
156 views

Kubernetes + Calico + CRIO - Pod access issue

I have a Kubernetes cluster (bare metal) with one control-plane and 10 nodes. All the worker nodes are the same: same OS, same kube / crio / iptables / ufw versions. I'm using Calico, the pod CIDR &...
Corentin's user avatar
1 vote
2 answers
200 views

Looping forwarded and locally originating connections through port forwarding rules in firewalld

I have a Debian box running firewalld set up a as gateway NAT/router. This device has two NICS; wan --- public interface, assigned to the external firewalld zone, dynamically assigned IP address using ...
3dg3's user avatar
  • 11

1
2 3 4 5
134