Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [iptables]

iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

0
votes
0answers
15 views

how to have finer control about which ports docker opens in iptables?

I am using UFW for setting my firewall rules. But docker keeps overridding them in iptables openning all ports that have been mapped from the containers to the host. I want to have access only to ...
1
vote
0answers
12 views

Iptables match special characters / SQL injection detection

I want to create an ip6tables rule to detect some well-known SQL injection attempts to web pages. example: string "admin' or '1'='1" This string should be in HTML body or sent via URI: Sending this ...
0
votes
2answers
45 views

IPtables blocking SSH only if using conntrack

Error As you can see, the only difference between the working and the not working configuration is -m conntrack --ctstate NEW,ESTABLISHED,RELATED. If I use -m conntrack --ctstate NEW,ESTABLISHED it ...
0
votes
1answer
21 views

CentOS 7 iptables output does match output of firewall-cmd

Output of iptables -L -v -n does not match firewall-cmd --list-all-zones. Specifically, I'm looking for the forwarding rules I have in place for two virtual machines. They can be clearly seen with ...
0
votes
1answer
31 views

iptables TRACE No chain/target/match by that name

I'm debugging the iptables for a kvm VM running a Buildroot image.When I try to set the following TRACE rule I get the error iptables: No chain/target/match by that name sudo iptables -t raw -A ...
0
votes
0answers
26 views

Origin IP lost when traffic comes from GRE tunnel and goes to docker container

I was having problems with DDoS attacks and had to purchase a DDoS Protection service. The service was installed by the provider, and the filtered traffic comes from a GRE tunnel. Everything is ...
0
votes
0answers
13 views

Is it possible to redirect traffic sent to an additional IP on the machine to a specific port?

I have a machine that acts as a gateway between a network (say N1) for other machines behind it on a different network (N2). I have to use a special application that listen on a specific port. So a ...
0
votes
1answer
14 views

How to let netfilter trigger a userspace hook when logging?

I would like to immediately process certain types of packets if/when they arrive with a custom (bash) script. As NetFilter is kernel space, I understand I need to look for a userspace logging tools ...
-1
votes
0answers
14 views

Iptables not working [on hold]

I have a NanoPi M1 Plus device with Ubuntu OS in it which I am using it as a router. The device is getting the internet via ethernet cable (eth0 interface) and the WiFi AP is provided via interface ...
1
vote
3answers
52 views

Public and private subnet in VPC

IANA established certain blocks of IP as private IP range(shown below) 10.0.0.0 – 10.255.255.255 (255.0.0.0) 172.16.0.0 – 172.31.255.255 (255.255.0.0) 192.168.0.0 – 192.168.255.255 (...
-1
votes
2answers
38 views

Single iptable rule matching /32 and jump

We need to install a single iptables rule that match every source /32 user ip and jump to 'user chain': iptables -A INPUT -s "EVERY_USER-IP/32" -j "USER_IP/32_CHAIN" because we have hundreds of ...
1
vote
1answer
38 views

unable to connect web service running on ec2 using public IP:80

I have this EC2 instance with private IP 172.31.11.204 and public IP 34.205.X.X My web service is running on private IP 172.31.11.204 and on port 31336. Inside EC2, I am able to access the service ...
-1
votes
0answers
30 views

Port redirection in Windows [on hold]

I need to configure windows client to re-direct the specific port for specific remote client. Windows hostA (192.168.1.5) tried to connect to hostB (192.168.1.8) over port 443. But, hostB (192.168.1.8)...
0
votes
1answer
12 views

Fail2Ban Postfix sometimes banning domain names instead of IP addresses in iptables

I'm running an Ubuntu server with Postfix serving as a mail relay. To prevent brute force attacks, I installed Fail2Ban and configured it to look at /var/log/mail.log to ban IPs accordingly. I'm using ...
0
votes
1answer
60 views

Unable to NAT TFTP traffic because iptables is not forwarding the return connection to the client despite TFTP helper creating an expectation

The Problem I have a TFTP server (Machine 'S') and a TFTP client (Machine 'C') on different subnets. They are connected via a router( Machine 'R'). All 3 machines are Debian 9/Stretch. The router is ...
0
votes
0answers
24 views

Securely accessing Juju Kubernetes cluster on remote machine

I have deployed "localhost" Juju (Conjure) Kubernetes cluster to an Ubuntu machine. From that machine, the cluster API is readily accessible with kubectl config generated by conjure-up. Now I want to ...
0
votes
0answers
62 views

fail2ban with docker(host mode networking) is making iptables entry but not stopping connections

Environment: Fail2Ban version - 0.9.6 OS - Debian 9. The issue: Fail2ban is putting entries in iptables as expected for the jail defined in jail.local as: [xyz_failure] enabled=true filter=...
-1
votes
2answers
36 views

Setting up firewall using iptables

So, its getting more serious. I set up a "real" server. Before that I already configured firewalls using VMs. Now I got a question about which IP I need to allow, as I want to reject connections by ...
1
vote
1answer
35 views

Duplication of UDP traffic to two ports on localhost

I need to redirect incoming UDP traffic to two services listening different UDP ports on localhost. I tried: iptables -t nat -I PREROUTING -p udp -d 10.11.12.13 --dport 22 -j DNAT --to-destination ...
0
votes
1answer
56 views

Connect over SSH to server running OpenVPN client with ip tables: “Nexthop has invalid gateway”

I tried to follow the solutions listed here for being able to continue SSH connections after connecting to an openvpn client: https://www.linode.com/community/questions/7381/openvpn-client-connected-...
-1
votes
0answers
15 views

Accessing database over OpenVPN

So I have successfuly installed OpenVPN and MongoDB on my server. When I connect to VPN (client side) I have the public IP address of my server. When I want to connect to DB with mongo --host ...
0
votes
0answers
20 views

iptables - drop packets on input, but allow outgoing

I'm running Debian and iptables. I'm creating a proxy server, and would like DROP packets entering with a certain source IP address, but sniff them with pcap. Then afterwards allow to manually send ...
0
votes
1answer
26 views

iptables and limit requests per IP per minute

I'm running Debian and iptables and are trying to limit users to accept my site more than 10 times per minute. This is my original attempt: # Max connection in seconds TIME_PERIOD=60 # Max ...
0
votes
0answers
27 views

Use secondary IP as outgoing IP on SOCKS5 traffic that uses this IP

I have a server that runs OpenVPN on it's primary IP. There is also a second IP I connect to using SSH as a SOCKS5 setup like this: ssh -C2qTnN -D 1337 me@<secondary-ip> I go to whatismyip....
0
votes
0answers
25 views

Iptables -m connlimit trouble

I cannot seem to set -m connlimit and m- recent rules right. Here is an extract from the log: 80: 201.201.201.201 - - [28/Nov/2018:10:04:00 +0200] "GET /test.php" 80: 201.201.201.201 - - [28/Nov/2018:...
-1
votes
1answer
44 views

iptables rules and port scanners blocking

In order to block port scanners on Linux, i have found some rules on iptables to block attacker IP address. These rules work correctly and it blocks the attacker, and logs the attacker ip address in ...
0
votes
1answer
36 views

Forwarding and routing issues using linux bridge

I have two containers running (A and B) inside a Virtual Machine (Ubuntu 18.04). For network simulation purposes I am routing packets from A to B (this part works). What I want to do is to allow A and ...
0
votes
1answer
28 views

blocked ips not showing up in iptables chains

i have used the following rules, to block port-scanners for 24 hours, and unblock scanner ip address after 24 hour, and log the attacker ip address. iptables -A INPUT -m recent --name portscan --...
0
votes
1answer
59 views

How to forward packets at TCP level by using iptables?

Suppose I have two local machines A and B(Ubuntu), and there is also a remote server C. Originally, through RESTful API, I can call GET https://domain_of_C/resources directly from machine A to get ...
1
vote
1answer
26 views

How to configure iptables to pass data from net interface to bridge?

I am building an openstack all-in-one environment in a CentOS7.4 machine. For some reason I have only one network interface(eth0) and one ip address, so I created a linux bridge(br0), and forwarded ...
0
votes
0answers
22 views

Setup iptables to connect LXC container to host tcp load balancer (from container to internet)

I have a LXC container inside a host. A program inside the container is trying to communicate with external nodes using port 9876. If I connect an external ip to the host VM, everything works. I ...
0
votes
0answers
19 views

Iptables block doesn't work [duplicate]

Someone doing DOS attack on our server. "UDP (60 bytes) from 207.180.196.234:60797 to x.x.x.x:9987 on eth0 " Targeting 9987 port ( Our TeamSpeak3 server port ) We are trying everything what we can ...
2
votes
0answers
34 views

How to get TOR hidden service to work with iptables

I'm running an Arch Linux server which acts as a TOR relay and I would like it to act as a hidden service as well (I want to provide .onion access to my services, I know running a relay next to a HS ...
0
votes
2answers
37 views

Allow GRE (IP protocol 47) over Linux router NAT for a subnet

I have network setup as shown below: The VPN server running is windows 2012 server default VPN, which uses GRE protocol. I am able to have VPN connection to that remote vpn server, from my intranet ...
1
vote
1answer
39 views

Should a private virtual LAN be filtered

I'm a dev trying to learn others things and my current objective is to create a "virtual" lan on an ESXi host. I've created a VM which work as the LAN gateway to the WAN and some VM that are ...
0
votes
1answer
91 views

Connection refused when accessing container from local network through reverse proxy

I am running Proxmox VE on a root server. There are several virtual containers, on of them acts as a reverse proxy who does TLS termination. On the proxmox machine iptables handles port forwarding ...
-2
votes
0answers
17 views

Why the default Kubernetes endpoint IPTABLES rule does not work?

I have a Cluster with six Nodes and one master in the same network, I'm using Weave to networking. One Node has a problem, it's not able to reach the Kubernetes API in the Master Node through the ...
2
votes
0answers
33 views

Forwarding Fragments with IPTables / FirewallD

I have a linux (openSuse Leap 15.0) computer that's connected to a cable modem using PPoE (hopefully not relevant to this. EDIT the ppp0 interface has an mtu of 1492 but the eth0 interface it is "...
0
votes
0answers
36 views

Conntrack is blocking UDP NAT

I'm working on an application that should relay udp packets from one host to another according to some rules. It is basically NAT. I negotiate UDP ports with both hosts and after that I need to ...
0
votes
1answer
34 views

How to deny all ports to localhost, from localhost, except one, using iptables?

I have an issue with iptables where I'm unable to connect to localhost from localhost. Basically, I want all incoming packets, except those with a destination for SSH and port 9000 to be dropped. ...
0
votes
1answer
19 views

iptables redirect ip: port to another destination

I would like to know if it is possible to direct all connections that goes to IP X to another ip I can do this with the code below but are all ports I would like to do this only with port 80 and 443 ...
0
votes
0answers
45 views

Iptables drop 127.0.0.1 traffic to docker

I have a problem with docker and iptables. When i apply simple iptables rules local traffic to docker is dropped. I up the kibana docker image which exposes the port 5601 I have also a websever on ...
1
vote
1answer
34 views

Route internet traffic through one nic and local traffic through a second nic

I am trying to route traffic through a specific interface based on its destination. OS is CentOS 7. I am setting up a mini MPI farm where I have 2 slave workers and one master. The master and slaves ...
1
vote
1answer
24 views

Block only port from being accessed outside except localhost

On Centos 6 machine, how can I block port 8888 from being accessed except by localhost/127.0.0.1 only using iptables? Actually, I have another port that I want to listen on 8000 instead of 8888. ...
0
votes
0answers
18 views

Redirect port 8888 on zone public to be redirected to same port on zone “external” and IP address 127.0.0.1

I've an application which is running locally on 127.0.0.1 and port 8888 in addition to openvpn which is installed and using eth1 interface The active zones on firewall firewall-cmd: public (...
0
votes
1answer
40 views

IPTables default policy

I am slightly confused about IPtables default policy. Let's talk about the mangle table. let's say ACCEPT is the default policy on each chain. PREROUTING ACCEPT INPUT ACCEPT FORWARD ACCEPT OUTPUT ...
0
votes
2answers
30 views

Openvpn: Subnets for different groups - Destination host unreachable

I would like to configure an Openvpn instance which is able to restrict access depending on the subnet of a client. As an example with two client groups/subnets A and B, users of net A can connect to ...
0
votes
1answer
25 views

IPsec: Can ping hosts of other network with the firewall but not with hosts behind the firewall

I have a endian firewall and a established IPsec tunnel. The firewall is in the network 192.168.100.0/24 and has the address 192.168.100.1. The hosts that I try to ping are in the network 10.4.0.0/32 ...
0
votes
0answers
49 views

Exposing minikube service using iptables

I have minikube Load balancer service running on kvm based minikube node. I have below network routes, Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use ...
1
vote
1answer
51 views

CentOS iptables NAT, client cannot connect to WAN from LAN

I have the following configuration: 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 ...