Questions tagged [iptables]
iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n
6,586
questions
0
votes
0
answers
13
views
OpenVPN assign client same ip address as static address on router network
I have an OpenVPN server running on a machine behind my home router, and two clients, one Macbook and one iPhone.
When I'm not using OpenVPN, I can statically assign IP addresses to the Macbook and ...
- 1
0
votes
0
answers
31
views
iptables masquerade traffic from ip range to specific interface
I have an environment where I have multiple network interfaces: eth0 and vpn1.
I am running docker which has an iptables masquerade rule to masquerade traffic from 172.17.0.0/16: -A POSTROUTING -s 172....
- 706
-1
votes
0
answers
31
views
Assign port number dynamically using iptables
I am trying to do the following:
Connect machine A (10.102.44.7) to machine B (10.102.44.13), which are in the same local network. The intention is to route the traffic from a specific process from A ...
- 109
0
votes
0
answers
41
views
Docker containers can't connect to IP on the Internet but the host can
I've been scratching my head about this for a full day now, I'm hoping to get some pointers in the right direction.
From the host I can connect to the Internet just fine, but any container I start ...
- 1
0
votes
0
answers
55
views
NAT forwarding IPTables
Hi I am trying to connect machine A (10.102.44.7) in a local network to machine B (10.102.44.13). Machine B is the one that acts as the gateway to the public network.
I want to forward the traffic ...
- 109
0
votes
1
answer
32
views
Iptables rule to capture DHCP I/O fails
I have stumbled upon a peculiar issue with Iptables. I am not seeking a solution to a problem, but an explanation of some strange behaviour of iptables.
My platform is Ubuntu 22.04.2 LTS with 5.19.0-...
0
votes
0
answers
21
views
Dummy interface on bridge2 does not have internet access via NAT
Dummy interface on bridge2 does not have internet access via NAT
Diagram:
On fresh Ubuntu 22.04:
Added dummy interface:
ip link add dummy0 type dummy
cat << EOF > /etc/systemd/network/10-...
- 103
1
vote
0
answers
49
views
Combine MASQUERADING and NETMAP in iptables POSTROUTING
We have some clients (networks) which are connected via VPN to our server network.
Let's say client has e.g. 192.168.0.1/32 and our server network is on 10.1.0.0/24.
So the issue now with this client ...
- 156
1
vote
1
answer
24
views
Duplicate traffic while spoofing an interface
to sum up my issue, I have a linux router that has 3 network interfaces:
a wlan interface acting as a DHCP server, upon which I manage the device, not in the scope of this question.
a lan interface, ...
- 11
0
votes
1
answer
24
views
iptables rules - Forward/Masquerade sevices using nat table
I need to complete an exercise with iptables on a network (docker containers) configured as follows:
A router host with 2 network interfaces (eth0 <- public 10.9.0.0/24; eth1 <- lan 192.168.60....
- 101
-1
votes
0
answers
45
views
The Access Target in iptables in Linux [closed]
How to limit certain connections on a specific port to a given network, let’s say you want to allow outgoing connections on port 22 to network 192.168.100.0/24 ?
-1
votes
0
answers
29
views
What dose this iptables command do? [closed]
could you please help me:
What does this Linux iptables command will do?
Iptables –A INPUT –P Udp –Dport 53 –J DROP
0
votes
0
answers
20
views
Filtering Amazon servers by IP range AND URL
My server is often attacked by bots hosted on Amazon servers.
So I configured iptables to block the largest ip ranges from Amazon.
My problem is that let's encrypt use also Amazon servers to issue new ...
0
votes
1
answer
37
views
IPTABLES no internet access from lan with default FORWARD rule set to DROP
I'm trying to set up ubuntu server 22.04 (virtualized) as a router with one wan interface (ens18) and several lan interfaces ens19:ens23 & ens1.
Here is what im trying to achieve:
allow ens19:...
0
votes
0
answers
13
views
ipsec package after decrypted can not be recieved by tproxy
My centos6 machine ipaddress is 192.168.56.10 (eth0). I have installed strongswan and a tproxy like v2ray with iptables:
iptables:
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [...
- 1
1
vote
1
answer
57
views
Packet with same src addr with loop back beening dropped
There are two servers with the same VIP, and when one server curls another server, the reply packet (which has src addr same as lo addr) seems to be dropped by the request server. How can I allow it?
...
- 21
0
votes
0
answers
29
views
Intermittent DNS Resolution Failures with CoreDNS and IPTables
We are using CoreDNS as a sidecar in our service mesh. CoreDNS is listening on port 15053. Both the application and CoreDNS are docker containers running inside an AWS ECS task using awsvpc mode. To ...
0
votes
0
answers
24
views
How to select packets in iptables in nested IPIP tunnel?
I have IPIP tunnel as shown in tcpdump output bellow: IP 192.168.240.112 > 192.168.250.112.
Inside this tunnel, there is a traffic in another IPIP tunnel IP 10.233.86.94.35938 > 10.233.100.199....
- 579
0
votes
0
answers
44
views
Redirect incoming UDP traffic to a local ip adress (iptables?)
tcpdump works as expected on my machine.
tcpdump -i enx00e04c04009e -Uw - | tcpdump -en -r - vlan 201
17:52:51.447340 04:01:30:00:00:16 > 03:00:03:00:04:00, ethertype 802.1Q (0x8100), length 66: ...
- 101
1
vote
1
answer
47
views
What is the INPUT_direct chain in firewalld?
In many firewalld config examples I see mention of the normal INPUT iptables chain, as well as one named INPUT_direct.
e.g.
$ sudo firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 \
# etc....
- 870
1
vote
1
answer
31
views
Forward port to a VM via iptables from same bridge
I have running a proxmox server with two VMs which are connected to the bridge interface vmbr0:
Host: 10.10.10.1 (extern IP: 123.123.123.123)
VM1: 10.10.10.2
VM2: 10.10.10.3
On VM2 a load balancer ...
- 107
0
votes
1
answer
27
views
Logging of "direct" iptables rules with firewalld
I'm using firewalld with the iptables backend. I added "direct" rules for ssh connection limiting:
sudo firewall-cmd --add-port=22/tcp
sudo firewall-cmd --direct --add-rule ipv4 filter ...
- 870
0
votes
0
answers
17
views
iptables prerouting crashed smtp port
I have a very strange problem. First of all. I have 2 servers
VDS server with (for instance) IP 100.11.100.22 (vpn ip: 10.8.0.1)
Server behind the VPN (ip: 10.8.0.7) with iredmail (postfix, devcot, ...
1
vote
1
answer
55
views
Testing rate limiting rules in firewalld
I want to rate limit ssh connections per IP to a server running firewalld.
Suppose my sshd listens on port 2222, and I want to limit ssh connections per IP to 3 per minute. I tried:
sudo firewall-cmd -...
- 870
0
votes
1
answer
59
views
How to forward traffic through Linux box except requests to the box itself?
I have an Ubuntu box with IP forwarding enabled and a very simple iptables configuration to allow all packets from within the LAN to be forwarded:
echo 1 > /proc/sys/net/ipv4/ip_forward
/sbin/...
-1
votes
0
answers
22
views
Redirecting traffic from a virtual device to a server in the same VPC
Hi I am trying to monitor traffic from a EC2 genymotion mobile device using PolarProxy.
(more details on the device here: https://aws.amazon.com/marketplace/pp/prodview-k52gyvbrwxl7q). For that from ...
0
votes
0
answers
35
views
NAT pre/output/post routing/forwarding fails a few minutes after a reboot. What would ask the firewall to stop forwarding?
This morning (May 5, 2023), I found that my LAN stopped working on my Ubuntu 18.04 installation. All computers are locked out because the main server FORWARD rules are being ignored.
When I first ...
- 2,190
-1
votes
4
answers
104
views
What is the proper way to block entire TLDs using iptables?
With new TLDs being approved like .zip that could be extremely malicious, it seems prudent to have the ability to block entire TLDs on tap. What is the proper way to do this in iptables?
- 109
0
votes
0
answers
25
views
How to set speed limit per IP in IP range in Ubuntu
What I want:
I've setup a openvpn-server and want the clients in range of 10.8.0.0/21 limit their speed to 10mbit for each IP as a total limit of 100mbit.
wan interface : eth0
openvpn interface : ...
- 101
0
votes
0
answers
36
views
Port forwarding in Ubuntu VPS server, from public ip to a clients
VPS in installed Ubuntu server 20.04 and OpenVPN, I need to forward all the traffic from a specific port of the vps public ip, to the same port of a VPN client.
My Ubuntu VPS ip is 107.172.142.153
And ...
0
votes
0
answers
35
views
Is it possible to route packet from Postrouting back to Prerouting?
I am wondering if I can mark TCP and UDP packets with DSCP, then at Postrouting, if a packet has certain DSCP marking, it will be rerouted back to Prerouting.
The reason I am doing this is because I ...
- 1
0
votes
0
answers
31
views
NetFilter ConnTrack FTP helper alernative fo handle FTPS
I've been using nf_conntrack_ftp module successfully (though rarely), but now I have to deal with TLS-encrypted FTP - this renders that helper useless an I would have to resort to opening the firewall ...
- 198
0
votes
0
answers
31
views
iptable rule to match system service
I have this rule:
sudo iptables -t mangle -A OUTPUT -m owner --uid-owner myuser -j MARK --set-mark 1
But instead of matching with a user, I would like to match with a system service.
Cold you help me?...
0
votes
0
answers
34
views
Why is it not possible to establish a connection between these servers?
I have the problem that my two servers (master, worker) can not connect to each other. However, connections outside e.g. "google.com" are possible. I have already tried to allow all ICMP ...
- 101
0
votes
1
answer
99
views
share two network interfaces on linux
I have a Linux PC (ubuntu 22.04) with a network layout as below:
Internet <-> Router <-> PC <-> edge device <-> Switch <-> APs <-> devices
And with two Lan ...
- 101
0
votes
0
answers
14
views
Iptsbles site to site vpn
I have installed strongswan site-to-site vpn,thats working fine. On server I have configured iptables with this commans iptables -t nat -A POSTROUTING -s 10.9.141.0/24 -d 10.10.27.0/24 -j MASQUERADE.
...
- 13
0
votes
0
answers
20
views
Iptable traversal with docker chains
Using this as a reference and this previous post, I attempted at creating a iptable packet processing flowchart when docker containers on the bridge network are considered. The flowchart is shown ...
- 1
1
vote
1
answer
47
views
Proxmox in Hetzner with 1 IP i loss connection from outside to CT
I have a problem with my installation of proxmox... until yesterday everything was working correctly and today a website that I had hosted there has stopped working, the problem is the following:
I ...
- 121
0
votes
1
answer
28
views
Routing internet traffic via the vpn interface
I have a wifi dongle where I have three interfaces wlan0 (default route), uvpn0(VPN interface) and usb0(interface between the host machine and the dongle).
usb0 Link encap:Ethernet HWaddr DA:CE:...
0
votes
0
answers
35
views
Routing decision after IPSec processing
I have a Linux box running in AWS EC2 with just one interface - eht0.
This interface connected to private subnet 172.16.0.0 and has an IP 10.95.114.69 on it.
All hosts from subnet are reachable from ...
0
votes
1
answer
32
views
Isolating two WireGuard subnets
On an AWS server I am hosting a WireGuard peer with two WireGuard interfaces:
wg0 - 10.0.1.0/24
wg1 - 10.0.2.0/24
There are two groups of clients connecting to the same AWS server but with different ...
- 1
0
votes
0
answers
31
views
DDOS-Deflate won't update iptables
I am using DDoS-Deflate (https://github.com/jgmdev/ddos-deflate) in my CentOS 7 server. I installed it successfully. I use iptables as the firewall. The DDoS-Deflate bash script could detect abnormal ...
- 111
1
vote
1
answer
60
views
Allowing a route to/from network when there are multiple networks
I have tough one here but can't seem to figure out the right routing.
I have a server (serverA) that is on two separate networks:
192.168.200.x/24 & 192.168.117.0/26. This server has a hostname (...
1
vote
0
answers
27
views
Allow forwarding only between VPN clients within the same subnet mask
I am using Wireguard (interface wg0) for a VPN on a server, where all connected clients have IPv6 addresses assigned by the server (controlled by AllowedIPs).
Let's say we have three clients:
Client ...
- 279
-3
votes
1
answer
75
views
Redirect OR warn (during initial negotiation) SMTP submitters to use TLS on port 587 - leave 25 explicitly blocked by firewall for better security [closed]
I've managed to find a lot of closely related information, but not an answer truly addressing my question.
I am expanding on my homelab server, and have decided to use a small publicly hosted server ...
- 107
0
votes
0
answers
11
views
Yahoo L3dsr loadbalancer install issue.why I have private key issue?
I need to make a load balancer. But I have to use l3dsr metod because my loadbalancer server and real server are in different locations and subnets.
I does configuration on my load balancer server and ...
0
votes
0
answers
20
views
how to get ssh user traffic usage after session closed
I have openssh service on server side for tunneling and everything is OK. but i need to know how much a user downloaded from the server after every ssh session is closed. some guys suggested NetHogs ...
- 103
0
votes
0
answers
24
views
NAT Between TUN and Ethernet Network Interfaces
There's a detailed explanation of the setup and my debugging efforts so far, but the main question is at the bottom.
I have a setup like so:
Machine A has two network interfaces: eth0 (192.168.159.60)...
- 117
1
vote
1
answer
62
views
VPN gateway in custom route table fails
My goal is configure a container behave as a router which load balances over a number of VPN connections.
To do this I'm probabilistically marking initiating packets with:
iptables -I PREROUTING -t ...
- 35
0
votes
0
answers
17
views
packet goes up input chain instead of being forwarded
I am trying to see if i can forward traffic through a loopback interface. The primary reason for me to do this is to see if I can force a route lookup as the packet traverses through the loopback ...
- 21