Questions tagged [iptables]
iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n
6,579
questions
-1
votes
0
answers
28
views
The Access Target in iptables in Linux
How to limit certain connections on a specific port to a given network, let’s say you want to allow outgoing connections on port 22 to network 192.168.100.0/24 ?
-1
votes
0
answers
23
views
What dose this iptables command do? [closed]
could you please help me:
What does this Linux iptables command will do?
Iptables –A INPUT –P Udp –Dport 53 –J DROP
0
votes
0
answers
12
views
Filtering Amazon servers by IP range AND URL
My server is often attacked by bots hosted on Amazon servers.
So I configured iptables to block the largest ip ranges from Amazon.
My problem is that let's encrypt use also Amazon servers to issue new ...
0
votes
1
answer
34
views
IPTABLES no internet access from lan with default FORWARD rule set to DROP
I'm trying to set up ubuntu server 22.04 (virtualized) as a router with one wan interface (ens18) and several lan interfaces ens19:ens23 & ens1.
Here is what im trying to achieve:
allow ens19:...
0
votes
0
answers
13
views
ipsec package after decrypted can not be recieved by tproxy
My centos6 machine ipaddress is 192.168.56.10 (eth0). I have installed strongswan and a tproxy like v2ray with iptables:
iptables:
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [...
- 1
0
votes
0
answers
26
views
How to use one ip as a proxy to reach another ip in linux? [closed]
I have two linux machines A abd B with IPs 172.31.9.10 and 172.31.9.11. I have docker running in A, and the IP of one of the containers is 172.31.8.9.
In short, 172.31.9.10 can be reached from 172.31....
- 111
1
vote
1
answer
46
views
Packet with same src addr with loop back beening dropped
There are two servers with the same VIP, and when one server curls another server, the reply packet (which has src addr same as lo addr) seems to be dropped by the request server. How can I allow it?
...
- 21
0
votes
0
answers
28
views
Intermittent DNS Resolution Failures with CoreDNS and IPTables
We are using CoreDNS as a sidecar in our service mesh. CoreDNS is listening on port 15053. Both the application and CoreDNS are docker containers running inside an AWS ECS task using awsvpc mode. To ...
0
votes
0
answers
18
views
How to select packets in iptables in nested IPIP tunnel?
I have IPIP tunnel as shown in tcpdump output bellow: IP 192.168.240.112 > 192.168.250.112.
Inside this tunnel, there is a traffic in another IPIP tunnel IP 10.233.86.94.35938 > 10.233.100.199....
- 579
0
votes
0
answers
43
views
Redirect incoming UDP traffic to a local ip adress (iptables?)
tcpdump works as expected on my machine.
tcpdump -i enx00e04c04009e -Uw - | tcpdump -en -r - vlan 201
17:52:51.447340 04:01:30:00:00:16 > 03:00:03:00:04:00, ethertype 802.1Q (0x8100), length 66: ...
- 101
1
vote
1
answer
38
views
What is the INPUT_direct chain in firewalld?
In many firewalld config examples I see mention of the normal INPUT iptables chain, as well as one named INPUT_direct.
e.g.
$ sudo firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 \
# etc....
- 871
1
vote
1
answer
28
views
Forward port to a VM via iptables from same bridge
I have running a proxmox server with two VMs which are connected to the bridge interface vmbr0:
Host: 10.10.10.1 (extern IP: 123.123.123.123)
VM1: 10.10.10.2
VM2: 10.10.10.3
On VM2 a load balancer ...
- 107
0
votes
1
answer
25
views
Logging of "direct" iptables rules with firewalld
I'm using firewalld with the iptables backend. I added "direct" rules for ssh connection limiting:
sudo firewall-cmd --add-port=22/tcp
sudo firewall-cmd --direct --add-rule ipv4 filter ...
- 871
0
votes
0
answers
17
views
iptables prerouting crashed smtp port
I have a very strange problem. First of all. I have 2 servers
VDS server with (for instance) IP 100.11.100.22 (vpn ip: 10.8.0.1)
Server behind the VPN (ip: 10.8.0.7) with iredmail (postfix, devcot, ...
1
vote
1
answer
51
views
Testing rate limiting rules in firewalld
I want to rate limit ssh connections per IP to a server running firewalld.
Suppose my sshd listens on port 2222, and I want to limit ssh connections per IP to 3 per minute. I tried:
sudo firewall-cmd -...
- 871
0
votes
1
answer
53
views
How to forward traffic through Linux box except requests to the box itself?
I have an Ubuntu box with IP forwarding enabled and a very simple iptables configuration to allow all packets from within the LAN to be forwarded:
echo 1 > /proc/sys/net/ipv4/ip_forward
/sbin/...
-1
votes
0
answers
21
views
Redirecting traffic from a virtual device to a server in the same VPC
Hi I am trying to monitor traffic from a EC2 genymotion mobile device using PolarProxy.
(more details on the device here: https://aws.amazon.com/marketplace/pp/prodview-k52gyvbrwxl7q). For that from ...
0
votes
0
answers
35
views
NAT pre/output/post routing/forwarding fails a few minutes after a reboot. What would ask the firewall to stop forwarding?
This morning (May 5, 2023), I found that my LAN stopped working on my Ubuntu 18.04 installation. All computers are locked out because the main server FORWARD rules are being ignored.
When I first ...
- 2,160
-1
votes
4
answers
92
views
What is the proper way to block entire TLDs using iptables?
With new TLDs being approved like .zip that could be extremely malicious, it seems prudent to have the ability to block entire TLDs on tap. What is the proper way to do this in iptables?
- 109
0
votes
0
answers
23
views
How to set speed limit per IP in IP range in Ubuntu
What I want:
I've setup a openvpn-server and want the clients in range of 10.8.0.0/21 limit their speed to 10mbit for each IP as a total limit of 100mbit.
wan interface : eth0
openvpn interface : ...
- 101
0
votes
0
answers
31
views
Port forwarding in Ubuntu VPS server, from public ip to a clients
VPS in installed Ubuntu server 20.04 and OpenVPN, I need to forward all the traffic from a specific port of the vps public ip, to the same port of a VPN client.
My Ubuntu VPS ip is 107.172.142.153
And ...
0
votes
0
answers
33
views
Is it possible to route packet from Postrouting back to Prerouting?
I am wondering if I can mark TCP and UDP packets with DSCP, then at Postrouting, if a packet has certain DSCP marking, it will be rerouted back to Prerouting.
The reason I am doing this is because I ...
- 1
0
votes
0
answers
27
views
NetFilter ConnTrack FTP helper alernative fo handle FTPS
I've been using nf_conntrack_ftp module successfully (though rarely), but now I have to deal with TLS-encrypted FTP - this renders that helper useless an I would have to resort to opening the firewall ...
- 198
0
votes
0
answers
31
views
iptable rule to match system service
I have this rule:
sudo iptables -t mangle -A OUTPUT -m owner --uid-owner myuser -j MARK --set-mark 1
But instead of matching with a user, I would like to match with a system service.
Cold you help me?...
0
votes
0
answers
34
views
Why is it not possible to establish a connection between these servers?
I have the problem that my two servers (master, worker) can not connect to each other. However, connections outside e.g. "google.com" are possible. I have already tried to allow all ICMP ...
- 101
0
votes
1
answer
86
views
share two network interfaces on linux
I have a Linux PC (ubuntu 22.04) with a network layout as below:
Internet <-> Router <-> PC <-> edge device <-> Switch <-> APs <-> devices
And with two Lan ...
- 101
0
votes
0
answers
12
views
Iptsbles site to site vpn
I have installed strongswan site-to-site vpn,thats working fine. On server I have configured iptables with this commans iptables -t nat -A POSTROUTING -s 10.9.141.0/24 -d 10.10.27.0/24 -j MASQUERADE.
...
- 13
0
votes
0
answers
19
views
Iptable traversal with docker chains
Using this as a reference and this previous post, I attempted at creating a iptable packet processing flowchart when docker containers on the bridge network are considered. The flowchart is shown ...
- 1
1
vote
1
answer
38
views
Proxmox in Hetzner with 1 IP i loss connection from outside to CT
I have a problem with my installation of proxmox... until yesterday everything was working correctly and today a website that I had hosted there has stopped working, the problem is the following:
I ...
- 121
0
votes
1
answer
27
views
Routing internet traffic via the vpn interface
I have a wifi dongle where I have three interfaces wlan0 (default route), uvpn0(VPN interface) and usb0(interface between the host machine and the dongle).
usb0 Link encap:Ethernet HWaddr DA:CE:...
0
votes
0
answers
30
views
Routing decision after IPSec processing
I have a Linux box running in AWS EC2 with just one interface - eht0.
This interface connected to private subnet 172.16.0.0 and has an IP 10.95.114.69 on it.
All hosts from subnet are reachable from ...
0
votes
1
answer
31
views
Isolating two WireGuard subnets
On an AWS server I am hosting a WireGuard peer with two WireGuard interfaces:
wg0 - 10.0.1.0/24
wg1 - 10.0.2.0/24
There are two groups of clients connecting to the same AWS server but with different ...
- 1
0
votes
0
answers
29
views
DDOS-Deflate won't update iptables
I am using DDoS-Deflate (https://github.com/jgmdev/ddos-deflate) in my CentOS 7 server. I installed it successfully. I use iptables as the firewall. The DDoS-Deflate bash script could detect abnormal ...
- 111
1
vote
1
answer
56
views
Allowing a route to/from network when there are multiple networks
I have tough one here but can't seem to figure out the right routing.
I have a server (serverA) that is on two separate networks:
192.168.200.x/24 & 192.168.117.0/26. This server has a hostname (...
1
vote
0
answers
24
views
Allow forwarding only between VPN clients within the same subnet mask
I am using Wireguard (interface wg0) for a VPN on a server, where all connected clients have IPv6 addresses assigned by the server (controlled by AllowedIPs).
Let's say we have three clients:
Client ...
- 279
-3
votes
1
answer
73
views
Redirect OR warn (during initial negotiation) SMTP submitters to use TLS on port 587 - leave 25 explicitly blocked by firewall for better security [closed]
I've managed to find a lot of closely related information, but not an answer truly addressing my question.
I am expanding on my homelab server, and have decided to use a small publicly hosted server ...
- 107
0
votes
0
answers
10
views
Yahoo L3dsr loadbalancer install issue.why I have private key issue?
I need to make a load balancer. But I have to use l3dsr metod because my loadbalancer server and real server are in different locations and subnets.
I does configuration on my load balancer server and ...
0
votes
0
answers
19
views
how to get ssh user traffic usage after session closed
I have openssh service on server side for tunneling and everything is OK. but i need to know how much a user downloaded from the server after every ssh session is closed. some guys suggested NetHogs ...
- 103
0
votes
0
answers
21
views
NAT Between TUN and Ethernet Network Interfaces
There's a detailed explanation of the setup and my debugging efforts so far, but the main question is at the bottom.
I have a setup like so:
Machine A has two network interfaces: eth0 (192.168.159.60)...
- 117
1
vote
1
answer
60
views
VPN gateway in custom route table fails
My goal is configure a container behave as a router which load balances over a number of VPN connections.
To do this I'm probabilistically marking initiating packets with:
iptables -I PREROUTING -t ...
- 35
0
votes
0
answers
16
views
packet goes up input chain instead of being forwarded
I am trying to see if i can forward traffic through a loopback interface. The primary reason for me to do this is to see if I can force a route lookup as the packet traverses through the loopback ...
- 21
0
votes
0
answers
61
views
How to forward WSL2 8080 to Windows host's 8080?
I have:
a Spring Boot application running on Windows on 8080 and
a service running in the Docker container within the WSL2 Ubuntu, and
I'm loking how to enable the Windows host's 8080 to this ...
- 101
0
votes
0
answers
45
views
Best way of configuring a OpenVPN to allow access from the Internet to hosts behind a firewall
I have a Proxmox node with a bunch of VMs connected to a virtual bridged network. I have one VM on that bridged network that I want to connect to a Cloud VPS running OpenVPN. I then want to run an ...
- 1
0
votes
0
answers
69
views
Setting an iptables rule to drop a UDP that contain a string followed by two numbers betwen 10-89 in one rule
anyone knows if is possible to use only one rule to drop any UDP packet that contain a fixed characters followed by any number between 13 and 90.
I tried string, hex-string, had a look at u32 but the ...
- 1
0
votes
1
answer
36
views
Docker connectivity issue due to conflict with iptables-persitent
I have run into a problem with my docker host.
Setup:
Docker installation with multiple containers, serving websites.
Apache server on host is used as reverse proxy.
Symptoms:
All websites show error ...
- 143
1
vote
1
answer
58
views
Redirect active FTP traffic to another server using iptables
Network Scheme - IP addresses are fictitious
Firewall SO: Centos 6
I recently enabled two-factor authentication, using Google Authenticator, and with that transfers via SCP for some users were ...
- 11
0
votes
0
answers
105
views
How do I route ALL VM (qemu-kvm, libvirt) traffic through proxy running in Host?
Host: Ubuntu 20.04
Proxy Client and Server: V2ray
Proxy Client connecting to Server and is available in the host on 127.0.0.110808 for Socks and 127.0.0.1:10809 for http.
VMs: Multiple vms running ...
- 1
0
votes
0
answers
69
views
How can I check if an outgoing connection is blocked by local firewall?
I have a situation, where my server can't connect to an SMTP server, while my PC can. But the same server can connect to another SMTP server. I think that my firewall might be blocking it. How can I ...
- 1
0
votes
0
answers
23
views
can't block a domain which is redirected by aws
This is my first year at university and This is also my first time trying to configure a server.
They want me to block some https-web. I was able to block all websites with iptables except one.
I'm ...
- 1
1
vote
1
answer
105
views
Using iptables TPROXY to listen on all ports with outgoing traffic
My issue is that I can't establish an outgoing connection.
I followed this blog post to use TPROXY to redirect any TCP connection to a single listener:
iptables -t mangle -I PREROUTING -i eth0 -p tcp -...
- 26