Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [iptables]

iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

-1
votes
0answers
6 views

No internet access

I do not have internet access from the 172.16.0.0/24 network, I can reach the gateway (192.168.122.1) through the host PC-1 but there is no internet connection. Through the IOU1 router I have ...
0
votes
0answers
10 views

In iptables, if a packet is ACCEPTed in one table, does it bypass the next table?

If a packet is ACCEPTed from, say, the INPUT chain of the mangle table, will it bypass the INPUT chain of the filter table and go straight to the local process? Or will the INPUT chain of the filter ...
0
votes
0answers
2 views

What processes an IP packet before Netfilter's `NF_IP_PRE_ROUTING` hook?

I am reading the DigitalOcean tutorial titled A Deep Dive into Iptables and Netfilter Architecture. In it, it says that the "NF_IP_PRE_ROUTING ... [Netfiler] hook will be triggered by any incoming ...
0
votes
0answers
5 views

Enable iptables on one interface allow internet connection

In my VPS I have interface eth0:1. I want to enable it to only open for port 80 and 443, internet connection. This is my iptables : iptables -A INPUT -i eth0:1 -p tcp -m multiport --dports 80,443 ...
0
votes
1answer
16 views

How to block both IPv4 and IPv6 with ipset on Ubuntu 16.04?

So I have the following script that blocks IPs: #!/bin/bash # here's your list of IPS CURRENT_BL=/path/to/my/ip_black_list.txt # create/flush recreate the tables iptables -F BLACKHOLE iptables -N ...
0
votes
0answers
24 views

How to multiple interface in iproute2 and iptables

The following is my networking environment, ppp0 is my default internet: enter image description here My iptables: *nat -A PREROUTING -i ppp0 -p tcp -m tcp --dport 80 -j DNAT --to-destination 10.1....
0
votes
0answers
19 views

Is Network address translation (NAT) considered a type of packet mangling?

I am learning about iptables, netfilter and networking in general. I understand that iptables supports 5 different kinds of tables - raw, mangle, nat, filter and security. From what I understand, ...
0
votes
0answers
21 views

iptables - allow only one domain and global SSH access

One of my server providers reports me a server of mine generating suspicious traffic to other IP addresses. I think my server using a DDOS bot and i couldn't find the source of the problem. So I ...
0
votes
1answer
16 views

Redirect all traffic from network adapter through a proxy

I have a Ubuntu 18.04 server and I would like to redirect all traffic from a specific network adapter through a proxy. I think I've could do this somehow through iptables. I've been searching but I ...
0
votes
0answers
7 views

Forcing SYN packet check results in unexpected results

As per the article on nixCraft This iptables rule(s): iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP -A INPUT -j sanity -A sanity -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m ...
2
votes
1answer
15 views

How can I configure an Azure VM to act as a proxy for connecting to SQL Database over a Service Endpoint?

Currently, Azure does not allow for SQL Databases to be accessed through a Service Endpoint over a VPN Gateway. My idea to circumvent this limitation is to set up an Azure VM to function as a proxy so ...
0
votes
1answer
14 views

unknown option “--syn” when apply iptables rules

My system is centos 7,below is my setting rule of iptalbes: -A INPUT -m iprange --src-range 72.188.0.0-72.188.255.255 --syn -m conntrack --ctstate NEW -p tcp -m multiport --dports 22,995,3306 -j ...
0
votes
0answers
6 views

Allowing outgoing connections from Docker Swarm Mode containers with iptables

I'm running a little one-node swarm and I'm trying to secure my containers with iptables. The main reason being that it is very convenient to have some applications/ports that can only be reached by ...
0
votes
0answers
8 views

Libvirt: Port-forward from guest to guest

TL;DR: I want to access port 443 at the host IP address from within a VM on the same host, and have my request forwarded to a different VM on the same host. I am using Libvirt to manage some VMs ...
-1
votes
0answers
13 views

Internal home Powerline nodes and wireless bridges - can I delete all firewall rules? [on hold]

I have some home devices for Powerline ethernet and wireless bridging. They all are behind a main router that blocks out the outside world. On the power line nodes, I see a few things under iptables. ...
1
vote
2answers
19 views

LXC and iptables - how to change source IP address from main IP to different IP address

I have LXC container with mail server and "dedicated" IP address. "Dedicated" means that 25 and 110 port of the IP address are forwarded to 25 and 110 port of the container. This is done with ...
-1
votes
0answers
24 views

User mac Address and IP address

I'm not sure if this question has ever been asked before but, I'm trying to find a way to setup a rule for a Multi-user Id. I do have 7 users using our default user Id = Luma (no we can't create ...
0
votes
1answer
33 views

iptables traversal when connecting to docker client

How can the docker-host reach an exported port without hitting the iptables DNAT-rule? Bonus: Why are the iptables log messages only shown with curl 127.0.0.1:8082 but not with curl localhost:8082? ...
-1
votes
0answers
20 views

How are these ips same in iptables? [closed]

123.30.60.0/24 123.30.60.0/* I found 24 means netmask 255.255.255.0 but can't understand 2 lines above have the same meaning. Please let me know this. Thank you.
0
votes
1answer
24 views

What iptables rules should I add first in the 'ruleset'?

I am setting iptables up the following way: sudo iptables -P INPUT DROP sudo iptables -P FORWARD DROP sudo iptables -P OUTPUT DROP and I want to add the following rules: sudo iptables -A INPUT -m ...
0
votes
0answers
19 views

Do docker and podman iptables rules conflict?

I've installed both Docker and Podman on the same machine. Is that my first problem? Maybe. But my goal is run both and I'd like to continue anyway. My problem is this: there seems to be an iptables ...
1
vote
1answer
21 views

Issue insulating docker containers

I have a question, I have the following iptables config: [root@nd01 ~]# iptables -L INPUT --line-numbers -n Chain INPUT (policy DROP) num target prot opt source destination ...
0
votes
0answers
16 views

Understanding ICMP log [closed]

I am studing IPTABLES and yesterday I was visiting a company and to connect to their network I had to turn of my firewall. It was assigned the local IP to my wireless interface. I got this logs a few ...
0
votes
1answer
28 views

NAT rules for VPN routing to public IP in local network

I'm trying configure a test VPN setup to route pings to an instances public IP. A corporate vendor we are connecting to has reserved all private space on their side. I'm not sure what NAT rules I need ...
0
votes
1answer
42 views

Using iptables to block connections from local network

My network's DHCP address range goes from 192.168.0.100 to 192.168.0.199 and it's subnet mask is 255.255.255.0. I want to use iptables to DROP any INPUT (and OUTPUT too, if possible, as I don't want ...
0
votes
0answers
13 views

Do I have to use iptables or firewallD [closed]

I am new to linux vps. I want to host my blog on Centos 7. Do you think, I have to use Iptables or firewallD for the security purpose? Thanks
0
votes
2answers
27 views

Iptables showing 0:0 in counters

I'm currently logging port 22 connections with iptables: -A INPUT -p tcp -m tcp -m multiport --dports 22,NNN,NNN -m state --state NEW -j LOG --log-prefix "SSH Connection " --log-level 1 and have a ...
0
votes
1answer
46 views

How to restrict external access to ports exposed by Docker containers, while still allowing links to work?

I have a couple services running on a machine in docker containers that need to be available to a specific IP address, and need to be available to containers with links (as defined in a docker-compose ...
0
votes
2answers
18 views

IPTABLES how to port forwarding out from 21 to 2100

I have a script that publishes files via FTP on another server, but the script only allows you to use port 21. On the destination server the only FTP port is 2100. Is possible use IPTABLES on source ...
0
votes
1answer
14 views

How to use masquerade to ip?

I have no experience on making NAT rules. I have a vpn that is using this: # FILE: /etc/ufw/before.rules *nat :POSTROUTING ACCEPT [0:0] -A POSTROUTING -s 10.8.0.0/8 -o ens3 -j MASQUERADE COMMIT ...
0
votes
0answers
9 views

iptables blocks port-forwarded requests to port 80

My iptables rules are: -P INPUT DROP -P FORWARD ACCEPT -P OUTPUT ACCEPT -A INPUT -s 192.168.2.0/24 -p tcp -m tcp --dport 22 -j ACCEPT -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A ...
0
votes
1answer
46 views

Connect through SSH to the VPN Server

I've succesfully set up Softether on a Raspbian RaspberryPi 2, set up a .softether.net address and configured its OpenVPN clone server function. It is connected via eth0 to the router, but if I set ...
0
votes
0answers
20 views

How do alter my routes to allow this scenario to complete a connection

I am trying to work out what route commands need to be executed to update my RHEL7.5 unix TCPIP routing table to support the following configuration. I have a Unix server, running RHEL 7.5. Running ...
-1
votes
1answer
58 views

Configure routing for multiple USB modems linux

i am trying to create a custom proxy server. I have a Rasp Pi box with 2 USB LTE modems and LAN cable connected to it. I am trying to get them working together with squid proxy so that i could send ...
1
vote
1answer
12 views

iptables proxy local service to external interface

I'm running a local service bound to localhost:1234 only. Can I write a iptables rule to accept a connection on port 1234 on eth0 (my public interface) and proxy it to lo (my loopback). I cannot alter ...
0
votes
0answers
19 views

IPSEC ESP over NAT/OpenWRT issue

I'm having trouble setting up iptables firewall rules on an OpenWRT router to enable IPSEC pass-through to a server running behind the router, and I think the problem has to do with ESP forwarding. ...
0
votes
0answers
15 views

OpenVPN - How to redirect all http requests?

I have an OpenVPN server on which I'd like to redirect all HTTP requests to a certain web server. In other words, if one client tries to access (for example. Google.com) they should be redirected to ...
3
votes
1answer
24 views

Firewalld kills iptables

I have centos7 with installed firewalld and fail2ban. When i'm start firewalld(service firewalld start) it kills iptables (and starting iptables kills runing firewalld). Can i remove iptables and use ...
0
votes
1answer
28 views

Routing Port 443 traffic from RedHat 7 host to multiple guest KVMs

I have a RedHat 7 server and a couple of Ubuntu KVMs. The guest vms are connected using NAT because we do not have any public IP addresses to spare at this moment. Is it possible to use iptables to ...
-1
votes
1answer
42 views

Run iptables-save before shutdown/reboot

I have installed iptables-persistent on my Ubuntu 18.04 server and search for a solution that I don't need to save the iptables configuration (iptables-save > /etc/iptables/rules.v4) every time before ...
0
votes
0answers
24 views

iptables: How to list a chain as well as its subchains

I want to understand why a kind of specific packets through or not through a chain (OUTPUT for example), but the chain was written in a structured manner which can jump to a lot of sub chains, within ...
1
vote
1answer
30 views

Why does firewall-cmd throws error “ALREADY_ENABLED” but is the port not listed when calling firewall-cmd --list-ports?

Using CentOS 7, I am trying to use firewall-cmd --zone=public --add-port=443/tcp --permanent to add 443 to my allowed ports. Unfortunately this throws error ALREADY_ENABLED: 443:tcp. But when I use ...
0
votes
1answer
15 views

setting upsimple iptables rules to allow ssh, 80, 443 and openvpn

The scenario: I have a raspberry PI, I'd like to: SSH into it from any device in my internal network Reach port 80 and 443 from any device in my internal network Reach port 4567 which is port-mapped ...
1
vote
0answers
68 views

Docker UDP 'response'

Simply put, I have 2 containers for a service in a swarm mode. Container receives udp packets and sends them back to multiple clients, which ip's and ports are stored in db. Load-balancing: packets ...
0
votes
0answers
18 views

OpenVZ Container to respect host node iptable rules

I'm trying to block outbound traffic to certain IP Addresses from within OpenVZ containers. The host node has a list of IP addresses setup using ipset. The host node itself is succesfully blocking ...
0
votes
0answers
16 views

Redirecting UDP to local port, the reply packet not SNATed

I ran dnscrypt-proxy or tor on Linux listning on [::]:1053 to server DNS. I wanted to make all my Linux host's DNS queries transparently use that proxy. This is what I found on Internet how to ...
1
vote
0answers
26 views

Regulate OpenVPN users' access to specific websites

More specifically, I push the route for 5 websites to the clients via the server config. However, I would like to block CLIENTS's access to one of these websites on an ad-hoc basis. In order to ...
1
vote
1answer
47 views

Mirroring Docker Traffic to Different Port in Same Container

I am using docker containers on CentOS to simulate devices on the network and have two tools that are to run inside each of those containers to simulate communication with actual network devices. ...
0
votes
0answers
42 views

Mirrored traffic not reaching iptables logging

I want to log traffic details for every packet using IPTABLES on mirrored traffic coming from a switch on my interface em4 with -j LOG option. I saw a similar scenario here. em4 is in promisc mode. I'...
0
votes
0answers
6 views

Emulate flows from different IPs with a single host

I have two hosts connected to a switch. One of the hosts acts as a simple HTTP server (with server IP=20.0.0.1) and the other host will be the client (with client IP=10.0.0.1). I would like to use ...