0

What i am trying to do is to DROP any packets to specific UDP port, except those one from my secured subnet 10.8.0.0/24.

iptables -t nat -A --src 10.8.0.0/24 -p udp --destination-port 63210 -j ACCEPT

I get this error: Bad argument: 10.8.0.0/24

I don't understand why this does not work...

  • Why this command says IP is bad argument?
  • How to DROP any other packets, outside subnet?
  • Should i use NAT table?
  • How to achieve this?

I've found solution like this:

UPDATE

iptables -N xchain
iptables -A xchain --source 10.8.0.0/24 -j ACCEPT
iptables -A xchain -j DROP
iptables -I INPUT -p udp --dport 63210 -j xchain

After applying this, i cannot access port from ANY ip...

PROBLEM I have OpenVPN server set on tun0 interface, forwarding packets to eth0 like this:

iptables -I FORWARD -i tun0 -o eth0 \
         -s 10.8.0.0/24 -m conntrack --ctstate NEW -j ACCEPT

iptables -I FORWARD -m conntrack --ctstate RELATED,ESTABLISHED \
         -j ACCEPT

iptables -t nat -I POSTROUTING -o eth0 \
          -s 10.8.0.0/24 -j MASQUERADE

Question is, how to catch tun0 traffic and filter it, instead of eth0, where IPs getting real.

  • There's not enough information here. What do you mean that the first command "does not work"? Please edit your question to show the error message, and tell us what traffic passes that shouldn't, or doesn't pass that should. – Andrew Schulman Feb 19 '15 at 16:51
  • @AndrewSchulman updated the question. – Croll Feb 19 '15 at 16:57
0

In first example you are using "--src" which is incorrect swich, you should either use --source or -s.

In second example, you are creating new chain named "xchain", and you are filtering packets there. But, if you don't point packets from other chains to go traverse xchain, those filters will never get matched.

Also, you've send packets from INPUT chain to xchain:

# iptables -I INPUT -j xchain

This rule will only send packets whose destination is the host running the iptables to xchain. If your host is a router for network, you should also send packets from FILTER chain:

# iptables -I FILTER -j xchain

Note: I've changed your -A to -I, which puts rule at the top of the rule list, which means it will most certainly get traversed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.