Questions tagged [iptables]
iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n
6,674
questions
0
votes
0
answers
13
views
Unable to Connect via Port Knocking on Specific Port
I am trying to set up port knocking on my server to enhance security. I've configured my firewall rules to use port knocking, where I have to connect to specific ports in a specific sequence before ...
1
vote
1
answer
19
views
How to route traffic from physical to virtual interfaces when using MACsec?
The setup:
3 Linux Ubuntu 18.04 virtualized in GNS3 all connected to a Ethernet hub, lets call them VM1, VM2 and VM3, each VM has a physical interface called ens3 and a IP Address from DHCP Server ...
0
votes
0
answers
77
views
Is it possible with CSF firewall, to forward IP traffic transparently?
In /etc/csf/csf.redirect
10.100.100.115|*|10.200.200.186|*|tcp
10.100.100.115|*|10.200.200.186|*|udp
I have the following config, now when I connect to https://10.100.100.115/ (nginx+php) with script ...
0
votes
0
answers
15
views
How to catch process being blocked by outbound iptables fw? [duplicate]
NOTE: Thanks for suggesting answers. I'm having a look at them but the main issue (as stated below) is that outbound iptables hide information from tools like netstat and auditd. I need to look at ...
3
votes
3
answers
1k
views
fail2ban bans IP addresses, yet they still appear in access.log
This is my filter:
[Definition]
failregex = <HOST> .* "POST /customer/account/create.*$
<HOST> .* "GET /customer/account/create.*$
and this the corresponding jail:
[...
0
votes
1
answer
29
views
iptables ssh configuration for specific ip - can't establish connection
For practising purposes, i'm attempting to establish a SSH connection to a Kali virtual machine with an iptables firewall configured to permit only specific SSH connections. Initially, i successfully ...
-1
votes
2
answers
243
views
Unable to access Url from Internet through WireGuard VPN tunnel
I am trying to access a router settings web page from Internet.
I have setup a WireGuard VPN on AWS EC2. The handshake between the router and the WireGuard server looks good, but I am not able to ...
0
votes
2
answers
54
views
Why is https communication not working with iptables?
I'm trying to configure iptables for security settings.
Basically, I set up a whitelist and tried to test it.
I set the following settings to allow ssh, http, and https to my server by allowing input ...
1
vote
0
answers
50
views
In K8s network, why UDP packets are dropped by kernel?
In Azure I have two k8s services: serviceA and serviceB. serviceA's type is LoadBalancer, and set externalTrafficPolicy=Local
Client sends UDP packets to serviceA, serviceA transfer them to serviceB ...
1
vote
1
answer
178
views
Port unreachable when wireguard is connected
I have a server that routes all of its traffic through wireguard. When I start the wireguard, all ports listening on this server's public IP are unavailable - even ssh does not work.
What I want is to ...
-1
votes
1
answer
78
views
fail2ban cannot block ip public, it works only for private ip
My server live behind the reverse proxy nginx, but the ip of the client access shows in the apache log like this, looks normal, there is no x-forward things in the log.
103.221.234.206 - - [28/Feb/...
0
votes
0
answers
22
views
Masquerading from a custom routing table does not work
In Ubuntu 22.04 server, masquerading/NATing from a custom routing table does not work (for VPN clients).
It does work however when I do not route traffic to a custom table (and let it remain in the ...
0
votes
0
answers
192
views
Redirect all HTTP/HTTPS traffic through WireGuard to external HTTP Proxy
I have set up a Wireguard VPN whereby all of my devices connect to a Wireguard peer running on a computer with a public IP address (host).
My Wireguard is set up so that clients connect to the host on ...
0
votes
0
answers
53
views
IP6tables does not apply ACCEPT rules
My server is an IPv6 only server, I'm trying to write firewall rules using ip6tables and it looks something like this
Chain INPUT (policy ACCEPT)
num target prot opt source ...
2
votes
1
answer
318
views
How to set iptables to block incoming requests to the server but still have internet connectivity
I have multiple services that are running on my server. But I do not want them to be exposed to internet. My input chain rules look something like this
-P INPUT ACCEPT
-P FORWARD DROP
-P OUTPUT ACCEPT
...
0
votes
0
answers
57
views
UFW blocks traffic despite there is an allow rule
I have Ubuntu server with OpenVPN server running there.
IP addresses as follows:
enp1s0: 192.168.3.67/24
tun0: 172.18.37.1/24
OpenVPN is configured so that devices behind the VPN client are ...
0
votes
0
answers
55
views
Proxmox, iptables connection refused on port 443 from different nodes if forward to LoadBalancer
having some problems with port forwarding on dedicated machine running Proxmox.
I have create an LXC-Container for LoadBalancing and forward all incomming request on port 80 and 443 to it.
If I am ...
0
votes
0
answers
35
views
VPN netmap multiple sites with same LAN network address
I have some issues applying netmapping to a case for which I could not find much info about on the web.
I am trying to set up a VPN network (server ip: 10.1.0.1) where a user (VPN IP: 10.1.0.2) can ...
0
votes
1
answer
26
views
RateLimit is doing weird maths and wrong numbers on kernel
I'm trying to apply a set of rate limit within iptables, and it's doing some weird maths that i'm not able to see on the kernel why this is happen.
I tried to execute same code on my local machine, ...
0
votes
0
answers
32
views
Debian Firewall will not forward traffic from interface x to tun0
I want to have a debian system working as a router with openvpn traffic, where all traffic on interface x should be forwarded to openvpn interface y.
Following pic shows my network setup, more or less ...
0
votes
0
answers
62
views
Trying to understand iptables rules on the tomato router
I am working on configuring a linux machine as a router, and I took /etc/iptables file from the tomato router. I would like to use this file as a starting point for the firewall rules on the linux ...
0
votes
1
answer
58
views
Firewall blocking not the IP-address, but the DNS-name
System: CentOS 7
I noticed on my server that some IP-addresses that I blocked are not actually blocked, but continue to hold connections.
I started to look on the iptables-level and saw a strange ...
0
votes
1
answer
29
views
No traffic is going through the NAT table in iptables
I have added just some rules to LOG packets going through the OUTPUT chains, but nothing goes through the NAT table at all. It is clear from the counter of NAT table chains here (which the counters ...
0
votes
0
answers
190
views
Hetzner 1 Public IP + Proxmox + OPNSense
I have the following problem, I have a dedicated server in Hetzner with 1 public IP, I must install a Proxmox, a virtual machine with OPNSense to use as a router... and the other virtual machines ...
0
votes
0
answers
25
views
limit container connection on specific ip address
I just run a container on 8000:8000 my server 192.168.1.10 so if I run curl 192.168.1.10:8000 from another server (like 192.168.1.50) it will return hello-world from my API.
I want to limit the ...
0
votes
1
answer
83
views
How to save custom rule in ufw? Ubuntu 23.10
I am using ufw and I would like to add a custom rule
iptables -I INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
But even following
iptable-save
Upon reboot, the rule is gone.
I also ...
0
votes
0
answers
21
views
Is iptables NAT forwarding possible bewteen two libvirt VMs?
I'm building a test VPN setup using two libvirt VMs with StrongSwan
IKEv2 but can't get traffic to forward. I can see the client sending
traffic to the server using tcpdump but the server doesn't do
...
0
votes
0
answers
21
views
How to 'rename' IPs in a subnet while they go through WireGuard?
first question here, I hope I'm at the right spot.
I have successfully configured WireGuard on my Linux server and am able to connect my laptop to it. The laptop is able to access a subnet that's on ...
0
votes
1
answer
48
views
I keep receiving login attempt to my server until it gets down
I have a Centos7 server and after years of correctly working, yesterday it started to being unreachable (The server apps I have there were not rechable, the SSH connection gave timeout, etc but the ...
0
votes
2
answers
72
views
Will rapidly changing iptables rules cause issues?
I am writing a script that monitors different metrics (e.g. interface bandwidth usage) and changing iptables rules accordingly. These changes may occur at least 2x per second, up to 4 * number of ...
0
votes
0
answers
72
views
Why is an iptables rule needed on Oracle CN to allow HTTP traffic on port 80, when no reject rule is set and the default policy is set to ACCEPT?
I have an Oracle Cloud Infrastructure Compute Node on the free tier, configured with Ubuntu 22.04 as the operating system. I successfully installed Nginx and added an ingress rule to the subnet to ...
0
votes
0
answers
35
views
Linux iptables/UFW - Exclude ONE host from nat
Currently I am using UFW to NAT two IPv4 Subnets to VPN Interfaces like this:
extract of /etc/ufw/before.rules:
# NAT table rules
*nat
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 192.168.1.0/24 -o ...
1
vote
0
answers
91
views
firewalld and iptables | fail2ban
I have fail2ban 1.0.2 running on an Almalinux server. Seems to be working as hoped, but I'm puzzled by something.
have sshd.local and 00-firewalld.local in jail.d (installed fail2ban and fail2ban-...
1
vote
0
answers
32
views
iptables ignores REJECT in custom chain but works in the main chain
I configured a server with fail2ban for the smtp server. Now, fail2ban correctly bans the IPs and I can see them in the iptables chain of fail2ban. However, the kernel seems to ignore the iptables ...
0
votes
0
answers
41
views
port redirect with vpn
pc1 is a client inside lan with openvpn ip 10.8.0.1
/sbin/ifconfig
eth0 Link encap:Ethernet HWaddr 90:09:D0:08:99:15
inet addr:192.168.2.130 Bcast:192.168.2.255 Mask:255.255.255.0
...
0
votes
2
answers
177
views
Forward HTTPS Traffic to a proxy server
I have a smart-dns setup, Using dnsmasq as the dns server, which always resolves to my server ip address, for a given list of domains.
I want to configure either a webserver or proxy program to listen ...
0
votes
1
answer
181
views
Fixing route and iptables for an OpenVPN tun0 interface, with a selected and safe routing
I did setup my router to use 3rd party VPNs for maximum security.
Since the ISPs that I am using have blocked all known VPN protocols including OpenVPN protocols, therefore I am forced to configure my ...
0
votes
0
answers
17
views
in iptables redirect unknown mac clients using --to-destination 192.168.0.30
I have been using iptables to block all unknown mac addresses from the internet gateway by
EXT_DEV=wlan0
INT_DEV=eth0
INT_NET=192.168.0.0/20
modprobe ip_conntrack
modprobe ip_conntrack_ftp
echo 1 > ...
1
vote
1
answer
30
views
How do I mark incoming iptables request from unknown MAC address with mark 99 using conntrack
I have my iptables rules running for years without incident but after allowing all trusted MAC's access by:
/sbin/iptables -A INPUT -m mac --mac-source $MAC -j ACCEPT
/sbin/iptables -A FORWARD -m mac -...
0
votes
1
answer
219
views
Connect two LANs without NAT in linux
I have a PC with address 192.168.3.2. It's connected to a router 192.168.3.1.
Router 192.168.3.1 is connected to another LAN with static address 192.168.88.6
Router at 192.168.8.1 provides an internet ...
0
votes
1
answer
166
views
Add delays to the requests coming from a particular ip address
Is there any way to add delay to the requests coming from a particular server for testing purposes. I have tried checking tc command which adds delay for all the requests. I have also checked if there ...
0
votes
0
answers
81
views
Cannot Access Tomcat Server from external server
I have found several people with this problem, tried many solutions, but none have worked for me.
I have recently setup a new VPS at a hosting company, linux with Centos9.
I've installed and run ...
0
votes
0
answers
34
views
Create firewalld rule
I have this code that I've been using for years (works fine) which takes external requests coming to the server at the port 9944 and redirects those requests internally to localhost on port 9922.
For ...
1
vote
1
answer
204
views
iptables v1.8.7 (nf_tables): unknown option "-p"
Try to remove -p option, got
iptables v1.8.7 (nf_tables): unknown option "PREROUTING"
the command:
iptables -t nat -A PREROUTING -p tcp -–dport 80 -j REDIRECT –-to-port 8080
Got
iptables v1....
0
votes
0
answers
56
views
why does this hook in netfilter doesn't get the payload content in the tcp packet?
why does this hook in netfilter doesn't get the payload content in the tcp packet?
unsigned int hook_func(void *priv, struct sk_buff *skb, const struct nf_hook_state *state)
//这个函数是钩子函数.
//...
0
votes
0
answers
114
views
Configuring Nginx as a reverse proxy for any domain
Currently i have a setup, where dnsmasq is used as a dns server, which resolves an dns lookup, to my own servers IP address. Where SNIPORXY is listening on port 80 and 443 The configuration of the ...
2
votes
2
answers
114
views
Can iptables relate the physical wireguard UDP connection to the tunneled TCP session?
I'm locking down the egress of my Linux box, making OUTPUT chain default deny.
My wireguard peers are from the subnet 10.1.0.0/16. Originally I thought I can just -A OUTPUT -d 10.1.0.0/16 -j ACCEPT, ...
0
votes
0
answers
37
views
Two containers on two hosts in same network: One can access other hosts on network, the other can't, why?
I have been running into a network issue recently with two containers (on two different hosts) in our network:
The container on the one host can ping/access physical hosts on a specific network while ...
0
votes
1
answer
156
views
Kubernetes + Calico + CRIO - Pod access issue
I have a Kubernetes cluster (bare metal) with one control-plane and 10 nodes. All the worker nodes are the same: same OS, same kube / crio / iptables / ufw versions.
I'm using Calico, the pod CIDR &...
1
vote
2
answers
200
views
Looping forwarded and locally originating connections through port forwarding rules in firewalld
I have a Debian box running firewalld set up a as gateway NAT/router. This device has two NICS; wan --- public interface, assigned to the external firewalld zone, dynamically assigned IP address using ...