Questions tagged [iptables]

iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

Filter by
Sorted by
Tagged with
-1 votes
0 answers
35 views

Redirect all HTTP/HTTPS traffic through WireGuard to external HTTP Proxy

I have set up a Wireguard VPN whereby all of my devices connect to a Wireguard peer running on a computer with a public IP address (host). My Wireguard is set up so that clients connect to the host on ...
TopCat's user avatar
  • 1
0 votes
0 answers
44 views

IP6tables does not apply ACCEPT rules

My server is an IPv6 only server, I'm trying to write firewall rules using ip6tables and it looks something like this Chain INPUT (policy ACCEPT) num target prot opt source ...
Bad_Panda's user avatar
  • 123
2 votes
1 answer
245 views

How to set iptables to block incoming requests to the server but still have internet connectivity

I have multiple services that are running on my server. But I do not want them to be exposed to internet. My input chain rules look something like this -P INPUT ACCEPT -P FORWARD DROP -P OUTPUT ACCEPT ...
Bad_Panda's user avatar
  • 123
0 votes
0 answers
44 views

UFW blocks traffic despite there is an allow rule

I have Ubuntu server with OpenVPN server running there. IP addresses as follows: enp1s0: 192.168.3.67/24 tun0: 172.18.37.1/24 OpenVPN is configured so that devices behind the VPN client are ...
Hanz94's user avatar
  • 1
0 votes
0 answers
27 views

Proxmox, iptables connection refused on port 443 from different nodes if forward to LoadBalancer

having some problems with port forwarding on dedicated machine running Proxmox. I have create an LXC-Container for LoadBalancing and forward all incomming request on port 80 and 443 to it. If I am ...
xtrose Media Studio's user avatar
0 votes
0 answers
27 views

VPN netmap multiple sites with same LAN network address

I have some issues applying netmapping to a case for which I could not find much info about on the web. I am trying to set up a VPN network (server ip: 10.1.0.1) where a user (VPN IP: 10.1.0.2) can ...
Daniel's user avatar
  • 1
0 votes
1 answer
26 views

RateLimit is doing weird maths and wrong numbers on kernel

I'm trying to apply a set of rate limit within iptables, and it's doing some weird maths that i'm not able to see on the kernel why this is happen. I tried to execute same code on my local machine, ...
JustDevZero's user avatar
0 votes
0 answers
11 views

Debian Firewall will not forward traffic from interface x to tun0

I want to have a debian system working as a router with openvpn traffic, where all traffic on interface x should be forwarded to openvpn interface y. Following pic shows my network setup, more or less ...
kasper2083's user avatar
0 votes
0 answers
50 views

Trying to understand iptables rules on the tomato router

I am working on configuring a linux machine as a router, and I took /etc/iptables file from the tomato router. I would like to use this file as a starting point for the firewall rules on the linux ...
Cattus's user avatar
  • 1
0 votes
0 answers
31 views

Firewall blocking not the IP-address, but the DNS-name

System: CentOS 7 I noticed on my server that some IP-addresses that I blocked are not actually blocked, but continue to hold connections. I started to look on the iptables-level and saw a strange ...
sivsoft's user avatar
0 votes
1 answer
25 views

No traffic is going through the NAT table in iptables

I have added just some rules to LOG packets going through the OUTPUT chains, but nothing goes through the NAT table at all. It is clear from the counter of NAT table chains here (which the counters ...
Kamran's user avatar
  • 1
0 votes
0 answers
69 views

Hetzner 1 Public IP + Proxmox + OPNSense

I have the following problem, I have a dedicated server in Hetzner with 1 public IP, I must install a Proxmox, a virtual machine with OPNSense to use as a router... and the other virtual machines ...
KatiaSisHost's user avatar
0 votes
0 answers
22 views

limit container connection on specific ip address

I just run a container on 8000:8000 my server 192.168.1.10 so if I run curl 192.168.1.10:8000 from another server (like 192.168.1.50) it will return hello-world from my API. I want to limit the ...
Mahdi's user avatar
  • 1
0 votes
1 answer
52 views

How to save custom rule in ufw? Ubuntu 23.10

I am using ufw and I would like to add a custom rule iptables -I INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT But even following iptable-save Upon reboot, the rule is gone. I also ...
brad's user avatar
  • 125
0 votes
0 answers
20 views

Is iptables NAT forwarding possible bewteen two libvirt VMs?

I'm building a test VPN setup using two libvirt VMs with StrongSwan IKEv2 but can't get traffic to forward. I can see the client sending traffic to the server using tcpdump but the server doesn't do ...
dbazile's user avatar
-1 votes
0 answers
18 views

wireguard server to wireguard client traffic

I will be brief in the explanation. I have 2 VPS, VPS1 with a wireguard server to which I connect, and I want to connect VPS1 to VPS2 using VPS1 as a client of VPS2 as well. How could I forward all ...
BurstBass BurstBass's user avatar
0 votes
0 answers
20 views

How to 'rename' IPs in a subnet while they go through WireGuard?

first question here, I hope I'm at the right spot. I have successfully configured WireGuard on my Linux server and am able to connect my laptop to it. The laptop is able to access a subnet that's on ...
samvv's user avatar
  • 101
0 votes
1 answer
46 views

I keep receiving login attempt to my server until it gets down

I have a Centos7 server and after years of correctly working, yesterday it started to being unreachable (The server apps I have there were not rechable, the SSH connection gave timeout, etc but the ...
Faabass's user avatar
  • 103
0 votes
2 answers
69 views

Will rapidly changing iptables rules cause issues?

I am writing a script that monitors different metrics (e.g. interface bandwidth usage) and changing iptables rules accordingly. These changes may occur at least 2x per second, up to 4 * number of ...
Aloha's user avatar
  • 286
0 votes
0 answers
56 views

Why is an iptables rule needed on Oracle CN to allow HTTP traffic on port 80, when no reject rule is set and the default policy is set to ACCEPT?

I have an Oracle Cloud Infrastructure Compute Node on the free tier, configured with Ubuntu 22.04 as the operating system. I successfully installed Nginx and added an ingress rule to the subnet to ...
DRA's user avatar
  • 1
0 votes
0 answers
28 views

Linux iptables/UFW - Exclude ONE host from nat

Currently I am using UFW to NAT two IPv4 Subnets to VPN Interfaces like this: extract of /etc/ufw/before.rules: # NAT table rules *nat :POSTROUTING ACCEPT [0:0] -A POSTROUTING -s 192.168.1.0/24 -o ...
user3528657's user avatar
0 votes
0 answers
72 views

firewalld and iptables | fail2ban

I have fail2ban 1.0.2 running on an Almalinux server. Seems to be working as hoped, but I'm puzzled by something. have sshd.local and 00-firewalld.local in jail.d (installed fail2ban and fail2ban-...
Johnny Canuck's user avatar
1 vote
0 answers
31 views

iptables ignores REJECT in custom chain but works in the main chain

I configured a server with fail2ban for the smtp server. Now, fail2ban correctly bans the IPs and I can see them in the iptables chain of fail2ban. However, the kernel seems to ignore the iptables ...
ocirocir's user avatar
  • 113
0 votes
0 answers
38 views

port redirect with vpn

pc1 is a client inside lan with openvpn ip 10.8.0.1 /sbin/ifconfig eth0 Link encap:Ethernet HWaddr 90:09:D0:08:99:15 inet addr:192.168.2.130 Bcast:192.168.2.255 Mask:255.255.255.0 ...
Pol Hallen's user avatar
  • 1,103
0 votes
2 answers
119 views

Forward HTTPS Traffic to a proxy server

I have a smart-dns setup, Using dnsmasq as the dns server, which always resolves to my server ip address, for a given list of domains. I want to configure either a webserver or proxy program to listen ...
loxtic's user avatar
  • 21
0 votes
1 answer
107 views

Fixing route and iptables for an OpenVPN tun0 interface, with a selected and safe routing

I did setup my router to use 3rd party VPNs for maximum security. Since the ISPs that I am using have blocked all known VPN protocols including OpenVPN protocols, therefore I am forced to configure my ...
osiaso 's user avatar
0 votes
0 answers
17 views

in iptables redirect unknown mac clients using --to-destination 192.168.0.30

I have been using iptables to block all unknown mac addresses from the internet gateway by EXT_DEV=wlan0 INT_DEV=eth0 INT_NET=192.168.0.0/20 modprobe ip_conntrack modprobe ip_conntrack_ftp echo 1 > ...
Cor Cool's user avatar
1 vote
1 answer
24 views

How do I mark incoming iptables request from unknown MAC address with mark 99 using conntrack

I have my iptables rules running for years without incident but after allowing all trusted MAC's access by: /sbin/iptables -A INPUT -m mac --mac-source $MAC -j ACCEPT /sbin/iptables -A FORWARD -m mac -...
Cor Cool's user avatar
0 votes
1 answer
209 views

Connect two LANs without NAT in linux

I have a PC with address 192.168.3.2. It's connected to a router 192.168.3.1. Router 192.168.3.1 is connected to another LAN with static address 192.168.88.6 Router at 192.168.8.1 provides an internet ...
dmzkrsk's user avatar
  • 101
0 votes
1 answer
92 views

Add delays to the requests coming from a particular ip address

Is there any way to add delay to the requests coming from a particular server for testing purposes. I have tried checking tc command which adds delay for all the requests. I have also checked if there ...
JustSomeFool's user avatar
0 votes
0 answers
63 views

Cannot Access Tomcat Server from external server

I have found several people with this problem, tried many solutions, but none have worked for me. I have recently setup a new VPS at a hosting company, linux with Centos9. I've installed and run ...
Sports Man's user avatar
0 votes
0 answers
33 views

Create firewalld rule

I have this code that I've been using for years (works fine) which takes external requests coming to the server at the port 9944 and redirects those requests internally to localhost on port 9922. For ...
Samul's user avatar
  • 316
1 vote
1 answer
148 views

iptables v1.8.7 (nf_tables): unknown option "-p"

Try to remove -p option, got iptables v1.8.7 (nf_tables): unknown option "PREROUTING" the command: iptables -t nat -A PREROUTING -p tcp -–dport 80 -j REDIRECT –-to-port 8080 Got iptables v1....
Alex Anonym's user avatar
0 votes
0 answers
52 views

why does this hook in netfilter doesn't get the payload content in the tcp packet?

why does this hook in netfilter doesn't get the payload content in the tcp packet? unsigned int hook_func(void *priv, struct sk_buff *skb, const struct nf_hook_state *state) //这个函数是钩子函数. //...
zhzhy's user avatar
  • 11
0 votes
0 answers
85 views

Configuring Nginx as a reverse proxy for any domain

Currently i have a setup, where dnsmasq is used as a dns server, which resolves an dns lookup, to my own servers IP address. Where SNIPORXY is listening on port 80 and 443 The configuration of the ...
loxtic's user avatar
  • 21
2 votes
2 answers
97 views

Can iptables relate the physical wireguard UDP connection to the tunneled TCP session?

I'm locking down the egress of my Linux box, making OUTPUT chain default deny. My wireguard peers are from the subnet 10.1.0.0/16. Originally I thought I can just -A OUTPUT -d 10.1.0.0/16 -j ACCEPT, ...
ron's user avatar
  • 193
0 votes
0 answers
30 views

Two containers on two hosts in same network: One can access other hosts on network, the other can't, why?

I have been running into a network issue recently with two containers (on two different hosts) in our network: The container on the one host can ping/access physical hosts on a specific network while ...
heeeresjohnny's user avatar
0 votes
1 answer
118 views

Kubernetes + Calico + CRIO - Pod access issue

I have a Kubernetes cluster (bare metal) with one control-plane and 10 nodes. All the worker nodes are the same: same OS, same kube / crio / iptables / ufw versions. I'm using Calico, the pod CIDR &...
Corentin's user avatar
1 vote
2 answers
165 views

Looping forwarded and locally originating connections through port forwarding rules in firewalld

I have a Debian box running firewalld set up a as gateway NAT/router. This device has two NICS; wan --- public interface, assigned to the external firewalld zone, dynamically assigned IP address using ...
3dg3's user avatar
  • 11
0 votes
1 answer
33 views

Can iptables state miss some packets?

I tried to setup the iptable rules for MTA. As this MTA is meant only for receiving the emails I allowed INPUT packets from any to destination port 25 with state either new or established, and allowed ...
Ayush Gupta's user avatar
0 votes
2 answers
50 views

S2S VPN on AWS EC2 - routing issue for VPC

I'm trying to prepare VPN setup from scratch. I used Terraform + AWS + Strongswan. Basic diagram is attached here: AWS diagram, S2S VPN So I have VPC_left: 172.32.0.0/16 with subnet_left: 172.32....
Frumbar's user avatar
0 votes
1 answer
44 views

SNAT and DNAT port forwarding to a linked subnet

I am having some issues with the classic problem of DNAT/SNAT port forwarding, with the added complexity of multiple networks and subnets being involved. I want to forward a port from a VPS server of ...
John Tate's user avatar
  • 179
0 votes
3 answers
133 views

iptables - route traffic back to origin GRE interface

I'm struggling with iptables and packet marking.I have set up a system with 3 interfaces eno1: 192.168.0.100 gre1: 10.0.0.2 gre2: 10.0.0.6 and there is a local daemon running on eno1 port 1111 (nc -l -...
Joe's user avatar
  • 3
0 votes
0 answers
24 views

Data from NF Tables to IP Tables

I have input data like below for NF Tables: nft add rule filter input tcp flags != syn nft add rule filter input tcp flags &syn!= syn add rule filter output tcp flags & (syn | ack) == syn | ...
Karma Yogi's user avatar
0 votes
0 answers
53 views

How to exclude dnsmasq used by libvirt from Mullvad VPN's "local network sharing" block

I don't use the local network except dnsmasq for libvirt. With blocking local network I have no DNS on my VM. For that reason I want to exclude dnsmasq from the local network sharing block with split ...
clooney's user avatar
0 votes
0 answers
43 views

Parsing TCP flag Data for IP Tables

I have input file which has data like below chain:VARIABLE_IN ip_version:v4 proto:tcp sport:5401 dst_ip:18.159.158.206 dport:5432 decision:a tcpflags:&syn!=syn My code reads above data to form ...
Karma Yogi's user avatar
0 votes
0 answers
109 views

Proxmox cannot route port from network bridge

I set up proxmox instance, all is working fine but i have a problem with port forwarding i have: server A with PUBLIC IP 1.2.3.4 and it's dedicated server (proxmox) server B (VM on server A) in bridge ...
Kaspek's user avatar
  • 1
2 votes
0 answers
162 views

ip6tables does not filter fragmented packets

My final goal is to block all TCP IPv6 fragments with a specified destination IPv6 address (lets say it is one of google.com addresses 2a00:1450:4010:c0e::79). This traffic is forwarded by host from ...
Kamil Zaripov's user avatar
1 vote
1 answer
105 views

fail2ban ignores <HOST> IP address and bans all incoming traffic

I'm trying to enable fail2ban on Centos 7 with Apache. I have an app which writes to the error log a specific string when login fails. responds with the right IP address in the Banned IP list, > ...
Ami Heines's user avatar
0 votes
0 answers
137 views

Pod Stuck in Terminating State Due to iptables 'Chain Already Exists' Error in Kubernetes

I'm facing an unusual issue with a Kubernetes deployment using the Mailu Helm chart, specifically the mailu-front component. After updating the deployment, the newly created pod works fine, but the ...
Artichoke's user avatar
  • 101

1
2 3 4 5
134