My iptables rules are:

-A INPUT -s -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -s -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -s -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i tun0 -j ACCEPT
-A INPUT -s -p tcp -m tcp --dport 139 -j ACCEPT
-A INPUT -s -p tcp -m tcp --dport 445 -j ACCEPT
-A INPUT -p udp -m udp --dport 4567 -j ACCEPT
-A FORWARD -s -i tun0 -o eth0 -m conntrack --ctstate NEW -j ACCEPT

I want to renew a TLS certificates using Let's Encrypt and for that I need port 80 to be open, so I forwarded it in my router.

However, when checking the logs (I temporarily added a rule with j LOG for the INPUT chain), I can see that port 80 is being hit with the remote address as source IP (which, of course, is outside my local network) and according to my iptables rules, only can access my webserver.

How do I do this? Do I need to change my firewall rules everytime I want to update my TLS certificate?

I am a little surprised, as well, because I thought that using NAT, the source IP would be my router's IP and not the actual remote IP making the request...

  • 1
    What you are seeing is normal and expected. If you saw the source IP as your router, it would be broken. – Michael Hampton Feb 11 at 14:41
  • 1
    What Michael said. You're using DNAT (destination NAT), not SNAT (source NAT). Alternatively, if the router was actively proxying the requests, then you would see the router's own IP.Configure your webserver to only allow access to /.well-known/ to IP addresses outside your local network. – wurtel Feb 11 at 15:57
  • Okay, thank you guys! – user3813234 Feb 15 at 20:37

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.