Questions tagged [iptables]

iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

Filter by
Sorted by
Tagged with
-1 votes
0 answers
28 views

The Access Target in iptables in Linux

How to limit certain connections on a specific port to a given network, let’s say you want to allow outgoing connections on port 22 to network 192.168.100.0/24 ?
Tahane hasan's user avatar
-1 votes
0 answers
23 views

What dose this iptables command do? [closed]

could you please help me: What does this Linux iptables command will do? Iptables –A INPUT –P Udp –Dport 53 –J DROP
Tahane hasan's user avatar
0 votes
0 answers
12 views

Filtering Amazon servers by IP range AND URL

My server is often attacked by bots hosted on Amazon servers. So I configured iptables to block the largest ip ranges from Amazon. My problem is that let's encrypt use also Amazon servers to issue new ...
Fabrice Kimmel's user avatar
0 votes
1 answer
34 views

IPTABLES no internet access from lan with default FORWARD rule set to DROP

I'm trying to set up ubuntu server 22.04 (virtualized) as a router with one wan interface (ens18) and several lan interfaces ens19:ens23 & ens1. Here is what im trying to achieve: allow ens19:...
INDIVISUM's user avatar
0 votes
0 answers
13 views

ipsec package after decrypted can not be recieved by tproxy

My centos6 machine ipaddress is 192.168.56.10 (eth0). I have installed strongswan and a tproxy like v2ray with iptables: iptables: *mangle :PREROUTING ACCEPT [0:0] :INPUT ACCEPT [0:0] :FORWARD ACCEPT [...
liuliang's user avatar
0 votes
0 answers
26 views

How to use one ip as a proxy to reach another ip in linux? [closed]

I have two linux machines A abd B with IPs 172.31.9.10 and 172.31.9.11. I have docker running in A, and the IP of one of the containers is 172.31.8.9. In short, 172.31.9.10 can be reached from 172.31....
Alfred's user avatar
  • 111
1 vote
1 answer
46 views

Packet with same src addr with loop back beening dropped

There are two servers with the same VIP, and when one server curls another server, the reply packet (which has src addr same as lo addr) seems to be dropped by the request server. How can I allow it? ...
Cheuk hei Ho's user avatar
0 votes
0 answers
28 views

Intermittent DNS Resolution Failures with CoreDNS and IPTables

We are using CoreDNS as a sidecar in our service mesh. CoreDNS is listening on port 15053. Both the application and CoreDNS are docker containers running inside an AWS ECS task using awsvpc mode. To ...
Alex Mercer's user avatar
0 votes
0 answers
18 views

How to select packets in iptables in nested IPIP tunnel?

I have IPIP tunnel as shown in tcpdump output bellow: IP 192.168.240.112 > 192.168.250.112. Inside this tunnel, there is a traffic in another IPIP tunnel IP 10.233.86.94.35938 > 10.233.100.199....
laimison's user avatar
  • 579
0 votes
0 answers
43 views

Redirect incoming UDP traffic to a local ip adress (iptables?)

tcpdump works as expected on my machine. tcpdump -i enx00e04c04009e -Uw - | tcpdump -en -r - vlan 201 17:52:51.447340 04:01:30:00:00:16 > 03:00:03:00:04:00, ethertype 802.1Q (0x8100), length 66: ...
Aleksandarf's user avatar
1 vote
1 answer
38 views

What is the INPUT_direct chain in firewalld?

In many firewalld config examples I see mention of the normal INPUT iptables chain, as well as one named INPUT_direct. e.g. $ sudo firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 \ # etc....
lonix's user avatar
  • 871
1 vote
1 answer
28 views

Forward port to a VM via iptables from same bridge

I have running a proxmox server with two VMs which are connected to the bridge interface vmbr0: Host: 10.10.10.1 (extern IP: 123.123.123.123) VM1: 10.10.10.2 VM2: 10.10.10.3 On VM2 a load balancer ...
ChristophLSA's user avatar
0 votes
1 answer
25 views

Logging of "direct" iptables rules with firewalld

I'm using firewalld with the iptables backend. I added "direct" rules for ssh connection limiting: sudo firewall-cmd --add-port=22/tcp sudo firewall-cmd --direct --add-rule ipv4 filter ...
lonix's user avatar
  • 871
0 votes
0 answers
17 views

iptables prerouting crashed smtp port

I have a very strange problem. First of all. I have 2 servers VDS server with (for instance) IP 100.11.100.22 (vpn ip: 10.8.0.1) Server behind the VPN (ip: 10.8.0.7) with iredmail (postfix, devcot, ...
Kirill Muchow's user avatar
1 vote
1 answer
51 views

Testing rate limiting rules in firewalld

I want to rate limit ssh connections per IP to a server running firewalld. Suppose my sshd listens on port 2222, and I want to limit ssh connections per IP to 3 per minute. I tried: sudo firewall-cmd -...
lonix's user avatar
  • 871
0 votes
1 answer
53 views

How to forward traffic through Linux box except requests to the box itself?

I have an Ubuntu box with IP forwarding enabled and a very simple iptables configuration to allow all packets from within the LAN to be forwarded: echo 1 > /proc/sys/net/ipv4/ip_forward /sbin/...
Adam J. Kessel's user avatar
-1 votes
0 answers
21 views

Redirecting traffic from a virtual device to a server in the same VPC

Hi I am trying to monitor traffic from a EC2 genymotion mobile device using PolarProxy. (more details on the device here: https://aws.amazon.com/marketplace/pp/prodview-k52gyvbrwxl7q). For that from ...
Soju jose's user avatar
0 votes
0 answers
35 views

NAT pre/output/post routing/forwarding fails a few minutes after a reboot. What would ask the firewall to stop forwarding?

This morning (May 5, 2023), I found that my LAN stopped working on my Ubuntu 18.04 installation. All computers are locked out because the main server FORWARD rules are being ignored. When I first ...
Alexis Wilke's user avatar
  • 2,160
-1 votes
4 answers
92 views

What is the proper way to block entire TLDs using iptables?

With new TLDs being approved like .zip that could be extremely malicious, it seems prudent to have the ability to block entire TLDs on tap. What is the proper way to do this in iptables?
Anna's user avatar
  • 109
0 votes
0 answers
23 views

How to set speed limit per IP in IP range in Ubuntu

What I want: I've setup a openvpn-server and want the clients in range of 10.8.0.0/21 limit their speed to 10mbit for each IP as a total limit of 100mbit. wan interface : eth0 openvpn interface : ...
Root's user avatar
  • 101
0 votes
0 answers
31 views

Port forwarding in Ubuntu VPS server, from public ip to a clients

VPS in installed Ubuntu server 20.04 and OpenVPN, I need to forward all the traffic from a specific port of the vps public ip, to the same port of a VPN client. My Ubuntu VPS ip is 107.172.142.153 And ...
Firuj Ahmed's user avatar
0 votes
0 answers
33 views

Is it possible to route packet from Postrouting back to Prerouting?

I am wondering if I can mark TCP and UDP packets with DSCP, then at Postrouting, if a packet has certain DSCP marking, it will be rerouted back to Prerouting. The reason I am doing this is because I ...
Chris's user avatar
  • 1
0 votes
0 answers
27 views

NetFilter ConnTrack FTP helper alernative fo handle FTPS

I've been using nf_conntrack_ftp module successfully (though rarely), but now I have to deal with TLS-encrypted FTP - this renders that helper useless an I would have to resort to opening the firewall ...
madman_xxx's user avatar
0 votes
0 answers
31 views

iptable rule to match system service

I have this rule: sudo iptables -t mangle -A OUTPUT -m owner --uid-owner myuser -j MARK --set-mark 1 But instead of matching with a user, I would like to match with a system service. Cold you help me?...
Navid Ahrary's user avatar
0 votes
0 answers
34 views

Why is it not possible to establish a connection between these servers?

I have the problem that my two servers (master, worker) can not connect to each other. However, connections outside e.g. "google.com" are possible. I have already tried to allow all ICMP ...
Jerome Wolff's user avatar
0 votes
1 answer
86 views

share two network interfaces on linux

I have a Linux PC (ubuntu 22.04) with a network layout as below: Internet <-> Router <-> PC <-> edge device <-> Switch <-> APs <-> devices And with two Lan ...
Firouziam's user avatar
  • 101
0 votes
0 answers
12 views

Iptsbles site to site vpn

I have installed strongswan site-to-site vpn,thats working fine. On server I have configured iptables with this commans iptables -t nat -A POSTROUTING -s 10.9.141.0/24 -d 10.10.27.0/24 -j MASQUERADE. ...
Dave's user avatar
  • 13
0 votes
0 answers
19 views

Iptable traversal with docker chains

Using this as a reference and this previous post, I attempted at creating a iptable packet processing flowchart when docker containers on the bridge network are considered. The flowchart is shown ...
akastack's user avatar
1 vote
1 answer
38 views

Proxmox in Hetzner with 1 IP i loss connection from outside to CT

I have a problem with my installation of proxmox... until yesterday everything was working correctly and today a website that I had hosted there has stopped working, the problem is the following: I ...
KatiaSisHost's user avatar
0 votes
1 answer
27 views

Routing internet traffic via the vpn interface

I have a wifi dongle where I have three interfaces wlan0 (default route), uvpn0(VPN interface) and usb0(interface between the host machine and the dongle). usb0 Link encap:Ethernet HWaddr DA:CE:...
Ragavan Kalatharan's user avatar
0 votes
0 answers
30 views

Routing decision after IPSec processing

I have a Linux box running in AWS EC2 with just one interface - eht0. This interface connected to private subnet 172.16.0.0 and has an IP 10.95.114.69 on it. All hosts from subnet are reachable from ...
Kirill Nikitin's user avatar
0 votes
1 answer
31 views

Isolating two WireGuard subnets

On an AWS server I am hosting a WireGuard peer with two WireGuard interfaces: wg0 - 10.0.1.0/24 wg1 - 10.0.2.0/24 There are two groups of clients connecting to the same AWS server but with different ...
Sandbo's user avatar
  • 1
0 votes
0 answers
29 views

DDOS-Deflate won't update iptables

I am using DDoS-Deflate (https://github.com/jgmdev/ddos-deflate) in my CentOS 7 server. I installed it successfully. I use iptables as the firewall. The DDoS-Deflate bash script could detect abnormal ...
Phil's user avatar
  • 111
1 vote
1 answer
56 views

Allowing a route to/from network when there are multiple networks

I have tough one here but can't seem to figure out the right routing. I have a server (serverA) that is on two separate networks: 192.168.200.x/24 & 192.168.117.0/26. This server has a hostname (...
Derek Edwards's user avatar
1 vote
0 answers
24 views

Allow forwarding only between VPN clients within the same subnet mask

I am using Wireguard (interface wg0) for a VPN on a server, where all connected clients have IPv6 addresses assigned by the server (controlled by AllowedIPs). Let's say we have three clients: Client ...
Yeti's user avatar
  • 279
-3 votes
1 answer
73 views

Redirect OR warn (during initial negotiation) SMTP submitters to use TLS on port 587 - leave 25 explicitly blocked by firewall for better security [closed]

I've managed to find a lot of closely related information, but not an answer truly addressing my question. I am expanding on my homelab server, and have decided to use a small publicly hosted server ...
MJHd's user avatar
  • 107
0 votes
0 answers
10 views

Yahoo L3dsr loadbalancer install issue.why I have private key issue?

I need to make a load balancer. But I have to use l3dsr metod because my loadbalancer server and real server are in different locations and subnets. I does configuration on my load balancer server and ...
Ehsan Hosseini's user avatar
0 votes
0 answers
19 views

how to get ssh user traffic usage after session closed

I have openssh service on server side for tunneling and everything is OK. but i need to know how much a user downloaded from the server after every ssh session is closed. some guys suggested NetHogs ...
Mehrdad Dadvand's user avatar
0 votes
0 answers
21 views

NAT Between TUN and Ethernet Network Interfaces

There's a detailed explanation of the setup and my debugging efforts so far, but the main question is at the bottom. I have a setup like so: Machine A has two network interfaces: eth0 (192.168.159.60)...
Jordan's user avatar
  • 117
1 vote
1 answer
60 views

VPN gateway in custom route table fails

My goal is configure a container behave as a router which load balances over a number of VPN connections. To do this I'm probabilistically marking initiating packets with: iptables -I PREROUTING -t ...
simonw's user avatar
  • 35
0 votes
0 answers
16 views

packet goes up input chain instead of being forwarded

I am trying to see if i can forward traffic through a loopback interface. The primary reason for me to do this is to see if I can force a route lookup as the packet traverses through the loopback ...
skp's user avatar
  • 21
0 votes
0 answers
61 views

How to forward WSL2 8080 to Windows host's 8080?

I have: a Spring Boot application running on Windows on 8080 and a service running in the Docker container within the WSL2 Ubuntu, and I'm loking how to enable the Windows host's 8080 to this ...
imy's user avatar
  • 101
0 votes
0 answers
45 views

Best way of configuring a OpenVPN to allow access from the Internet to hosts behind a firewall

I have a Proxmox node with a bunch of VMs connected to a virtual bridged network. I have one VM on that bridged network that I want to connect to a Cloud VPS running OpenVPN. I then want to run an ...
obevan's user avatar
  • 1
0 votes
0 answers
69 views

Setting an iptables rule to drop a UDP that contain a string followed by two numbers betwen 10-89 in one rule

anyone knows if is possible to use only one rule to drop any UDP packet that contain a fixed characters followed by any number between 13 and 90. I tried string, hex-string, had a look at u32 but the ...
crixu's user avatar
  • 1
0 votes
1 answer
36 views

Docker connectivity issue due to conflict with iptables-persitent

I have run into a problem with my docker host. Setup: Docker installation with multiple containers, serving websites. Apache server on host is used as reverse proxy. Symptoms: All websites show error ...
Bojan Hrnkas's user avatar
1 vote
1 answer
58 views

Redirect active FTP traffic to another server using iptables

Network Scheme - IP addresses are fictitious Firewall SO: Centos 6 I recently enabled two-factor authentication, using Google Authenticator, and with that transfers via SCP for some users were ...
euduca's user avatar
  • 11
0 votes
0 answers
105 views

How do I route ALL VM (qemu-kvm, libvirt) traffic through proxy running in Host?

Host: Ubuntu 20.04 Proxy Client and Server: V2ray Proxy Client connecting to Server and is available in the host on 127.0.0.110808 for Socks and 127.0.0.1:10809 for http. VMs: Multiple vms running ...
Malvo's user avatar
  • 1
0 votes
0 answers
69 views

How can I check if an outgoing connection is blocked by local firewall?

I have a situation, where my server can't connect to an SMTP server, while my PC can. But the same server can connect to another SMTP server. I think that my firewall might be blocking it. How can I ...
Genom's user avatar
  • 1
0 votes
0 answers
23 views

can't block a domain which is redirected by aws

This is my first year at university and This is also my first time trying to configure a server. They want me to block some https-web. I was able to block all websites with iptables except one. I'm ...
endiku's user avatar
  • 1
1 vote
1 answer
105 views

Using iptables TPROXY to listen on all ports with outgoing traffic

My issue is that I can't establish an outgoing connection. I followed this blog post to use TPROXY to redirect any TCP connection to a single listener: iptables -t mangle -I PREROUTING -i eth0 -p tcp -...
Glaslos's user avatar
  • 26

1
2 3 4 5
132