Questions tagged [iptables]

iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

Filter by
Sorted by
Tagged with
0 votes
0 answers
13 views

OpenVPN assign client same ip address as static address on router network

I have an OpenVPN server running on a machine behind my home router, and two clients, one Macbook and one iPhone. When I'm not using OpenVPN, I can statically assign IP addresses to the Macbook and ...
jameszp's user avatar
0 votes
0 answers
31 views

iptables masquerade traffic from ip range to specific interface

I have an environment where I have multiple network interfaces: eth0 and vpn1. I am running docker which has an iptables masquerade rule to masquerade traffic from 172.17.0.0/16: -A POSTROUTING -s 172....
F21's user avatar
  • 706
-1 votes
0 answers
31 views

Assign port number dynamically using iptables

I am trying to do the following: Connect machine A (10.102.44.7) to machine B (10.102.44.13), which are in the same local network. The intention is to route the traffic from a specific process from A ...
deadlock's user avatar
  • 109
0 votes
0 answers
41 views

Docker containers can't connect to IP on the Internet but the host can

I've been scratching my head about this for a full day now, I'm hoping to get some pointers in the right direction. From the host I can connect to the Internet just fine, but any container I start ...
bash's user avatar
  • 1
0 votes
0 answers
55 views

NAT forwarding IPTables

Hi I am trying to connect machine A (10.102.44.7) in a local network to machine B (10.102.44.13). Machine B is the one that acts as the gateway to the public network. I want to forward the traffic ...
deadlock's user avatar
  • 109
0 votes
1 answer
32 views

Iptables rule to capture DHCP I/O fails

I have stumbled upon a peculiar issue with Iptables. I am not seeking a solution to a problem, but an explanation of some strange behaviour of iptables. My platform is Ubuntu 22.04.2 LTS with 5.19.0-...
storestyggeulv's user avatar
0 votes
0 answers
21 views

Dummy interface on bridge2 does not have internet access via NAT

Dummy interface on bridge2 does not have internet access via NAT Diagram: On fresh Ubuntu 22.04: Added dummy interface: ip link add dummy0 type dummy cat << EOF > /etc/systemd/network/10-...
MUHAHA's user avatar
  • 103
1 vote
0 answers
49 views

Combine MASQUERADING and NETMAP in iptables POSTROUTING

We have some clients (networks) which are connected via VPN to our server network. Let's say client has e.g. 192.168.0.1/32 and our server network is on 10.1.0.0/24. So the issue now with this client ...
Flo's user avatar
  • 156
1 vote
1 answer
24 views

Duplicate traffic while spoofing an interface

to sum up my issue, I have a linux router that has 3 network interfaces: a wlan interface acting as a DHCP server, upon which I manage the device, not in the scope of this question. a lan interface, ...
Joy's user avatar
  • 11
0 votes
1 answer
24 views

iptables rules - Forward/Masquerade sevices using nat table

I need to complete an exercise with iptables on a network (docker containers) configured as follows: A router host with 2 network interfaces (eth0 <- public 10.9.0.0/24; eth1 <- lan 192.168.60....
Giuseppe's user avatar
  • 101
-1 votes
0 answers
45 views

The Access Target in iptables in Linux [closed]

How to limit certain connections on a specific port to a given network, let’s say you want to allow outgoing connections on port 22 to network 192.168.100.0/24 ?
Tahane hasan's user avatar
-1 votes
0 answers
29 views

What dose this iptables command do? [closed]

could you please help me: What does this Linux iptables command will do? Iptables –A INPUT –P Udp –Dport 53 –J DROP
Tahane hasan's user avatar
0 votes
0 answers
20 views

Filtering Amazon servers by IP range AND URL

My server is often attacked by bots hosted on Amazon servers. So I configured iptables to block the largest ip ranges from Amazon. My problem is that let's encrypt use also Amazon servers to issue new ...
Fabrice Kimmel's user avatar
0 votes
1 answer
37 views

IPTABLES no internet access from lan with default FORWARD rule set to DROP

I'm trying to set up ubuntu server 22.04 (virtualized) as a router with one wan interface (ens18) and several lan interfaces ens19:ens23 & ens1. Here is what im trying to achieve: allow ens19:...
INDIVISUM's user avatar
0 votes
0 answers
13 views

ipsec package after decrypted can not be recieved by tproxy

My centos6 machine ipaddress is 192.168.56.10 (eth0). I have installed strongswan and a tproxy like v2ray with iptables: iptables: *mangle :PREROUTING ACCEPT [0:0] :INPUT ACCEPT [0:0] :FORWARD ACCEPT [...
liuliang's user avatar
1 vote
1 answer
57 views

Packet with same src addr with loop back beening dropped

There are two servers with the same VIP, and when one server curls another server, the reply packet (which has src addr same as lo addr) seems to be dropped by the request server. How can I allow it? ...
Cheuk hei Ho's user avatar
0 votes
0 answers
29 views

Intermittent DNS Resolution Failures with CoreDNS and IPTables

We are using CoreDNS as a sidecar in our service mesh. CoreDNS is listening on port 15053. Both the application and CoreDNS are docker containers running inside an AWS ECS task using awsvpc mode. To ...
Alex Mercer's user avatar
0 votes
0 answers
24 views

How to select packets in iptables in nested IPIP tunnel?

I have IPIP tunnel as shown in tcpdump output bellow: IP 192.168.240.112 > 192.168.250.112. Inside this tunnel, there is a traffic in another IPIP tunnel IP 10.233.86.94.35938 > 10.233.100.199....
laimison's user avatar
  • 579
0 votes
0 answers
44 views

Redirect incoming UDP traffic to a local ip adress (iptables?)

tcpdump works as expected on my machine. tcpdump -i enx00e04c04009e -Uw - | tcpdump -en -r - vlan 201 17:52:51.447340 04:01:30:00:00:16 > 03:00:03:00:04:00, ethertype 802.1Q (0x8100), length 66: ...
Aleksandarf's user avatar
1 vote
1 answer
47 views

What is the INPUT_direct chain in firewalld?

In many firewalld config examples I see mention of the normal INPUT iptables chain, as well as one named INPUT_direct. e.g. $ sudo firewall-cmd --direct --add-rule ipv4 filter INPUT_direct 0 \ # etc....
lonix's user avatar
  • 870
1 vote
1 answer
31 views

Forward port to a VM via iptables from same bridge

I have running a proxmox server with two VMs which are connected to the bridge interface vmbr0: Host: 10.10.10.1 (extern IP: 123.123.123.123) VM1: 10.10.10.2 VM2: 10.10.10.3 On VM2 a load balancer ...
ChristophLSA's user avatar
0 votes
1 answer
27 views

Logging of "direct" iptables rules with firewalld

I'm using firewalld with the iptables backend. I added "direct" rules for ssh connection limiting: sudo firewall-cmd --add-port=22/tcp sudo firewall-cmd --direct --add-rule ipv4 filter ...
lonix's user avatar
  • 870
0 votes
0 answers
17 views

iptables prerouting crashed smtp port

I have a very strange problem. First of all. I have 2 servers VDS server with (for instance) IP 100.11.100.22 (vpn ip: 10.8.0.1) Server behind the VPN (ip: 10.8.0.7) with iredmail (postfix, devcot, ...
Kirill Muchow's user avatar
1 vote
1 answer
55 views

Testing rate limiting rules in firewalld

I want to rate limit ssh connections per IP to a server running firewalld. Suppose my sshd listens on port 2222, and I want to limit ssh connections per IP to 3 per minute. I tried: sudo firewall-cmd -...
lonix's user avatar
  • 870
0 votes
1 answer
59 views

How to forward traffic through Linux box except requests to the box itself?

I have an Ubuntu box with IP forwarding enabled and a very simple iptables configuration to allow all packets from within the LAN to be forwarded: echo 1 > /proc/sys/net/ipv4/ip_forward /sbin/...
Adam J. Kessel's user avatar
-1 votes
0 answers
22 views

Redirecting traffic from a virtual device to a server in the same VPC

Hi I am trying to monitor traffic from a EC2 genymotion mobile device using PolarProxy. (more details on the device here: https://aws.amazon.com/marketplace/pp/prodview-k52gyvbrwxl7q). For that from ...
Soju jose's user avatar
0 votes
0 answers
35 views

NAT pre/output/post routing/forwarding fails a few minutes after a reboot. What would ask the firewall to stop forwarding?

This morning (May 5, 2023), I found that my LAN stopped working on my Ubuntu 18.04 installation. All computers are locked out because the main server FORWARD rules are being ignored. When I first ...
Alexis Wilke's user avatar
  • 2,190
-1 votes
4 answers
104 views

What is the proper way to block entire TLDs using iptables?

With new TLDs being approved like .zip that could be extremely malicious, it seems prudent to have the ability to block entire TLDs on tap. What is the proper way to do this in iptables?
Anna's user avatar
  • 109
0 votes
0 answers
25 views

How to set speed limit per IP in IP range in Ubuntu

What I want: I've setup a openvpn-server and want the clients in range of 10.8.0.0/21 limit their speed to 10mbit for each IP as a total limit of 100mbit. wan interface : eth0 openvpn interface : ...
Root's user avatar
  • 101
0 votes
0 answers
36 views

Port forwarding in Ubuntu VPS server, from public ip to a clients

VPS in installed Ubuntu server 20.04 and OpenVPN, I need to forward all the traffic from a specific port of the vps public ip, to the same port of a VPN client. My Ubuntu VPS ip is 107.172.142.153 And ...
Firuj Ahmed's user avatar
0 votes
0 answers
35 views

Is it possible to route packet from Postrouting back to Prerouting?

I am wondering if I can mark TCP and UDP packets with DSCP, then at Postrouting, if a packet has certain DSCP marking, it will be rerouted back to Prerouting. The reason I am doing this is because I ...
Chris's user avatar
  • 1
0 votes
0 answers
31 views

NetFilter ConnTrack FTP helper alernative fo handle FTPS

I've been using nf_conntrack_ftp module successfully (though rarely), but now I have to deal with TLS-encrypted FTP - this renders that helper useless an I would have to resort to opening the firewall ...
madman_xxx's user avatar
0 votes
0 answers
31 views

iptable rule to match system service

I have this rule: sudo iptables -t mangle -A OUTPUT -m owner --uid-owner myuser -j MARK --set-mark 1 But instead of matching with a user, I would like to match with a system service. Cold you help me?...
Navid Ahrary's user avatar
0 votes
0 answers
34 views

Why is it not possible to establish a connection between these servers?

I have the problem that my two servers (master, worker) can not connect to each other. However, connections outside e.g. "google.com" are possible. I have already tried to allow all ICMP ...
Jerome Wolff's user avatar
0 votes
1 answer
99 views

share two network interfaces on linux

I have a Linux PC (ubuntu 22.04) with a network layout as below: Internet <-> Router <-> PC <-> edge device <-> Switch <-> APs <-> devices And with two Lan ...
Firouziam's user avatar
  • 101
0 votes
0 answers
14 views

Iptsbles site to site vpn

I have installed strongswan site-to-site vpn,thats working fine. On server I have configured iptables with this commans iptables -t nat -A POSTROUTING -s 10.9.141.0/24 -d 10.10.27.0/24 -j MASQUERADE. ...
Dave's user avatar
  • 13
0 votes
0 answers
20 views

Iptable traversal with docker chains

Using this as a reference and this previous post, I attempted at creating a iptable packet processing flowchart when docker containers on the bridge network are considered. The flowchart is shown ...
akastack's user avatar
1 vote
1 answer
47 views

Proxmox in Hetzner with 1 IP i loss connection from outside to CT

I have a problem with my installation of proxmox... until yesterday everything was working correctly and today a website that I had hosted there has stopped working, the problem is the following: I ...
KatiaSisHost's user avatar
0 votes
1 answer
28 views

Routing internet traffic via the vpn interface

I have a wifi dongle where I have three interfaces wlan0 (default route), uvpn0(VPN interface) and usb0(interface between the host machine and the dongle). usb0 Link encap:Ethernet HWaddr DA:CE:...
Ragavan Kalatharan's user avatar
0 votes
0 answers
35 views

Routing decision after IPSec processing

I have a Linux box running in AWS EC2 with just one interface - eht0. This interface connected to private subnet 172.16.0.0 and has an IP 10.95.114.69 on it. All hosts from subnet are reachable from ...
Kirill Nikitin's user avatar
0 votes
1 answer
32 views

Isolating two WireGuard subnets

On an AWS server I am hosting a WireGuard peer with two WireGuard interfaces: wg0 - 10.0.1.0/24 wg1 - 10.0.2.0/24 There are two groups of clients connecting to the same AWS server but with different ...
Sandbo's user avatar
  • 1
0 votes
0 answers
31 views

DDOS-Deflate won't update iptables

I am using DDoS-Deflate (https://github.com/jgmdev/ddos-deflate) in my CentOS 7 server. I installed it successfully. I use iptables as the firewall. The DDoS-Deflate bash script could detect abnormal ...
Phil's user avatar
  • 111
1 vote
1 answer
60 views

Allowing a route to/from network when there are multiple networks

I have tough one here but can't seem to figure out the right routing. I have a server (serverA) that is on two separate networks: 192.168.200.x/24 & 192.168.117.0/26. This server has a hostname (...
Derek Edwards's user avatar
1 vote
0 answers
27 views

Allow forwarding only between VPN clients within the same subnet mask

I am using Wireguard (interface wg0) for a VPN on a server, where all connected clients have IPv6 addresses assigned by the server (controlled by AllowedIPs). Let's say we have three clients: Client ...
Yeti's user avatar
  • 279
-3 votes
1 answer
75 views

Redirect OR warn (during initial negotiation) SMTP submitters to use TLS on port 587 - leave 25 explicitly blocked by firewall for better security [closed]

I've managed to find a lot of closely related information, but not an answer truly addressing my question. I am expanding on my homelab server, and have decided to use a small publicly hosted server ...
MJHd's user avatar
  • 107
0 votes
0 answers
11 views

Yahoo L3dsr loadbalancer install issue.why I have private key issue?

I need to make a load balancer. But I have to use l3dsr metod because my loadbalancer server and real server are in different locations and subnets. I does configuration on my load balancer server and ...
Ehsan Hosseini's user avatar
0 votes
0 answers
20 views

how to get ssh user traffic usage after session closed

I have openssh service on server side for tunneling and everything is OK. but i need to know how much a user downloaded from the server after every ssh session is closed. some guys suggested NetHogs ...
Mehrdad Dadvand's user avatar
0 votes
0 answers
24 views

NAT Between TUN and Ethernet Network Interfaces

There's a detailed explanation of the setup and my debugging efforts so far, but the main question is at the bottom. I have a setup like so: Machine A has two network interfaces: eth0 (192.168.159.60)...
Jordan's user avatar
  • 117
1 vote
1 answer
62 views

VPN gateway in custom route table fails

My goal is configure a container behave as a router which load balances over a number of VPN connections. To do this I'm probabilistically marking initiating packets with: iptables -I PREROUTING -t ...
simonw's user avatar
  • 35
0 votes
0 answers
17 views

packet goes up input chain instead of being forwarded

I am trying to see if i can forward traffic through a loopback interface. The primary reason for me to do this is to see if I can force a route lookup as the packet traverses through the loopback ...
skp's user avatar
  • 21

1
2 3 4 5
132