Questions tagged [iptables]
iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n
6,675
questions
0
votes
0
answers
128
views
Is it possible to route packet from Postrouting back to Prerouting?
I am wondering if I can mark TCP and UDP packets with DSCP, then at Postrouting, if a packet has certain DSCP marking, it will be rerouted back to Prerouting.
The reason I am doing this is because I ...
- 1
0
votes
0
answers
153
views
NetFilter ConnTrack FTP helper alernative fo handle FTPS
I've been using nf_conntrack_ftp module successfully (though rarely), but now I have to deal with TLS-encrypted FTP - this renders that helper useless an I would have to resort to opening the firewall ...
- 308
0
votes
0
answers
35
views
iptable rule to match system service
I have this rule:
sudo iptables -t mangle -A OUTPUT -m owner --uid-owner myuser -j MARK --set-mark 1
But instead of matching with a user, I would like to match with a system service.
Cold you help me?...
0
votes
0
answers
60
views
Why is it not possible to establish a connection between these servers?
I have the problem that my two servers (master, worker) can not connect to each other. However, connections outside e.g. "google.com" are possible. I have already tried to allow all ICMP ...
- 101
0
votes
1
answer
1k
views
share two network interfaces on linux
I have a Linux PC (ubuntu 22.04) with a network layout as below:
Internet <-> Router <-> PC <-> edge device <-> Switch <-> APs <-> devices
And with two Lan ...
- 101
0
votes
0
answers
146
views
Iptsbles site to site vpn
I have installed strongswan site-to-site vpn,thats working fine. On server I have configured iptables with this commans iptables -t nat -A POSTROUTING -s 10.9.141.0/24 -d 10.10.27.0/24 -j MASQUERADE.
...
- 25
0
votes
0
answers
325
views
Iptable traversal with docker chains
Using this as a reference and this previous post, I attempted at creating a iptable packet processing flowchart when docker containers on the bridge network are considered. The flowchart is shown ...
- 3
1
vote
1
answer
303
views
Proxmox in Hetzner with 1 IP i loss connection from outside to CT
I have a problem with my installation of proxmox... until yesterday everything was working correctly and today a website that I had hosted there has stopped working, the problem is the following:
I ...
- 121
0
votes
1
answer
93
views
Routing internet traffic via the vpn interface
I have a wifi dongle where I have three interfaces wlan0 (default route), uvpn0(VPN interface) and usb0(interface between the host machine and the dongle).
usb0 Link encap:Ethernet HWaddr DA:CE:...
0
votes
0
answers
45
views
Routing decision after IPSec processing
I have a Linux box running in AWS EC2 with just one interface - eht0.
This interface connected to private subnet 172.16.0.0 and has an IP 10.95.114.69 on it.
All hosts from subnet are reachable from ...
0
votes
1
answer
394
views
Isolating two WireGuard subnets
On an AWS server I am hosting a WireGuard peer with two WireGuard interfaces:
wg0 - 10.0.1.0/24
wg1 - 10.0.2.0/24
There are two groups of clients connecting to the same AWS server but with different ...
- 1
0
votes
0
answers
102
views
DDOS-Deflate won't update iptables
I am using DDoS-Deflate (https://github.com/jgmdev/ddos-deflate) in my CentOS 7 server. I installed it successfully. I use iptables as the firewall. The DDoS-Deflate bash script could detect abnormal ...
- 111
1
vote
1
answer
2k
views
Allowing a route to/from network when there are multiple networks
I have tough one here but can't seem to figure out the right routing.
I have a server (serverA) that is on two separate networks:
192.168.200.x/24 & 192.168.117.0/26. This server has a hostname (...
1
vote
0
answers
69
views
Allow forwarding only between VPN clients within the same subnet mask
I am using Wireguard (interface wg0) for a VPN on a server, where all connected clients have IPv6 addresses assigned by the server (controlled by AllowedIPs).
Let's say we have three clients:
Client ...
- 279
-3
votes
1
answer
104
views
Redirect OR warn (during initial negotiation) SMTP submitters to use TLS on port 587 - leave 25 explicitly blocked by firewall for better security [closed]
I've managed to find a lot of closely related information, but not an answer truly addressing my question.
I am expanding on my homelab server, and have decided to use a small publicly hosted server ...
- 107
0
votes
0
answers
25
views
Yahoo L3dsr loadbalancer install issue.why I have private key issue?
I need to make a load balancer. But I have to use l3dsr metod because my loadbalancer server and real server are in different locations and subnets.
I does configuration on my load balancer server and ...
0
votes
0
answers
107
views
how to get ssh user traffic usage after session closed
I have openssh service on server side for tunneling and everything is OK. but i need to know how much a user downloaded from the server after every ssh session is closed. some guys suggested NetHogs ...
- 103
0
votes
0
answers
284
views
NAT Between TUN and Ethernet Network Interfaces
There's a detailed explanation of the setup and my debugging efforts so far, but the main question is at the bottom.
I have a setup like so:
Machine A has two network interfaces: eth0 (192.168.159.60)...
- 117
1
vote
1
answer
249
views
VPN gateway in custom route table fails
My goal is configure a container behave as a router which load balances over a number of VPN connections.
To do this I'm probabilistically marking initiating packets with:
iptables -I PREROUTING -t ...
- 35
0
votes
0
answers
44
views
packet goes up input chain instead of being forwarded
I am trying to see if i can forward traffic through a loopback interface. The primary reason for me to do this is to see if I can force a route lookup as the packet traverses through the loopback ...
- 21
0
votes
0
answers
41
views
Iptables routing port 80 to local lan machine
I have cloud machine with public ip on eth0 and other interface zerotier have local machines with homeassistant https://192.168.0.15:8123. This cloud machine can access https://192.168.0.15:8123 over ...
1
vote
1
answer
1k
views
How to forward WSL2 8080 to Windows host's 8080?
I have:
a Spring Boot application running on Windows on 8080 and
a service running in the Docker container within the WSL2 Ubuntu, and
I'm loking how to enable the Windows host's 8080 to this ...
- 111
0
votes
0
answers
242
views
Best way of configuring a OpenVPN to allow access from the Internet to hosts behind a firewall
I have a Proxmox node with a bunch of VMs connected to a virtual bridged network. I have one VM on that bridged network that I want to connect to a Cloud VPS running OpenVPN. I then want to run an ...
- 1
0
votes
0
answers
175
views
Setting an iptables rule to drop a UDP that contain a string followed by two numbers betwen 10-89 in one rule
anyone knows if is possible to use only one rule to drop any UDP packet that contain a fixed characters followed by any number between 13 and 90.
I tried string, hex-string, had a look at u32 but the ...
- 1
0
votes
1
answer
281
views
Docker connectivity issue due to conflict with iptables-persitent
I have run into a problem with my docker host.
Setup:
Docker installation with multiple containers, serving websites.
Apache server on host is used as reverse proxy.
Symptoms:
All websites show error ...
- 143
1
vote
1
answer
475
views
Redirect active FTP traffic to another server using iptables
Network Scheme - IP addresses are fictitious
Firewall SO: Centos 6
I recently enabled two-factor authentication, using Google Authenticator, and with that transfers via SCP for some users were ...
- 11
0
votes
0
answers
934
views
How do I route ALL VM (qemu-kvm, libvirt) traffic through proxy running in Host?
Host: Ubuntu 20.04
Proxy Client and Server: V2ray
Proxy Client connecting to Server and is available in the host on 127.0.0.110808 for Socks and 127.0.0.1:10809 for http.
VMs: Multiple vms running ...
- 1
0
votes
0
answers
434
views
How can I check if an outgoing connection is blocked by local firewall?
I have a situation, where my server can't connect to an SMTP server, while my PC can. But the same server can connect to another SMTP server. I think that my firewall might be blocking it. How can I ...
- 1
1
vote
1
answer
565
views
Using iptables TPROXY to listen on all ports with outgoing traffic
My issue is that I can't establish an outgoing connection.
I followed this blog post to use TPROXY to redirect any TCP connection to a single listener:
iptables -t mangle -I PREROUTING -i eth0 -p tcp -...
- 26
2
votes
1
answer
4k
views
Drop ALL the TCP connections (ESTABLISHED,RELATED) in Ubuntu
I'm facing a few hosts sending a flood of requests to my webserver (NGINX). I'm trying to block them via iptables, with ipset and a good old DROP rule.
The rule is effective against NEW connections, ...
0
votes
0
answers
221
views
I can't add any rule to iptables / iptables not saving
I want to forward tcp and udp traffic from wireguard ip address (10.66.66.2) to 0.0.0.0, but iptables doesn't want to cooperate.
OS is Oracle Linux 8, I use yum as package manager. Firewall.d is ...
5
votes
1
answer
1k
views
iptables: DROP on an interface does nothing, but works if I don't specify an interface
Setup:
Ubuntu 20.04 on a box with 5 physical ethernet ports (let's call them eth1 - eth5).
I have joined them all to a bridge ("br0") with brctl and they can all ping each other.
What I'm ...
- 165
0
votes
0
answers
84
views
How to abbreviate iptables rules?
I have these example rules from iptables and I want to economize them
lan=enp2s0
iptables -A INPUT -i $lan -p tcp --dport 1234 -j NFLOG --nflog-prefix 'foo'
iptables -A INPUT -i $lan -p tcp --dport ...
- 398
1
vote
2
answers
2k
views
iptables v1.8.7 (nf_tables): unknown option "--tcp-flags"
# iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1300
iptables v1.8.7 (nf_tables): unknown option "--tcp-flags"
Try `iptables -h' or 'iptables --help'...
- 31
0
votes
1
answer
358
views
iptables - port 25 not getting traffic even though default policy is ACCEPT and all rules are flushed
I am having a problem that's driving me up the wall. I have a server, where after several attempts at various iptable rules, I have flushed iptable rules and set default policy to accept.
The output ...
- 121
0
votes
1
answer
188
views
How to route traffic from source IP to gateway on another subnet?
I have the following network setup:
2 LANs; 1 local and 1 remote, connected site-to-site via WireGuard.
192.168.0.0/24 -> local
192.168.2.0/24 -> remote
192.168.0.0/24 has a gateway 192.168.0....
0
votes
0
answers
58
views
iptables per-user split tunnel leaking udp packets
I followed the guide here:
https://gist.github.com/GAS85/4e40ece16ffa748e7138b9aa4c37ca52
I've added a couple more rules for local traffic, but my setup is still leaking udp packets, on ports not ...
- 482
0
votes
1
answer
1k
views
Redirecting OpenVPN client traffic through a SOCKS proxy using Redsocks and iptables on Ubuntu
I am trying to redirect all traffic from an OpenVPN tunnel to a SOCKS proxy using Redsocks and iptables on my Ubuntu server. While locally generated traffic is being routed through Redsocks without ...
0
votes
1
answer
373
views
iptables port forwarding is not working
I have a domestic server, and there are two public IPs on this server:
One is domestic IP: 1.1.1.1
One is the IP of Hong Kong: 2.2.2.2
The default route of the server is to go out from the Hong Kong ...
0
votes
2
answers
695
views
How can I route traffic back through the interface it came through for Docker
Currently I have a setup with 1 physical NIC with a public IP address, a standard docker environment and a GRE tunnel & bridge. If I run a container on a port, lets say 80, I'll be able to connect ...
0
votes
0
answers
229
views
Communication between docker containers in different bridge
I have a docker setup with containers in two different bridge.
I understand there is isolation between containers so they can't communicate with each others.
But my container A in bridge 1 expose port ...
- 9,653
0
votes
1
answer
395
views
iptables: packets and bytes counters for nat
When listing the NAT rules, are the packets and byte counters reporting only inbound packets, or inbound and outbound packets?
I am trying to determine how many TCP connections were made. A connection ...
- 141
0
votes
1
answer
62
views
Cannot 'sudo apt install <something>' after IPtables configuration
I'm trying to install some of the packages on Debian VM which is connected to another Debian machine (router). On the router default policy for FORWARD chain is DROP. I added rules for http(80), https(...
- 1
0
votes
1
answer
201
views
Having trouble with ipset behaviour
Have a script to populates ipsets and then I do:
/sbin/iptables -I INPUT -m set --match-set ipsum src -j DROP
Now not sure how this works out for other ports but I know that if I want the addresses ...
0
votes
2
answers
203
views
How to exclude a domain from being routed through tor using iptables
I'm running a tor router on a Raspberry Pi with following iptables rules (wlan0: internal net with clients / wlan1: Internet):
:INPUT DROP [12:3771]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [544:242321]
-A ...
- 11
0
votes
2
answers
325
views
How to apply DROP rule immediately (iptables/conntrack)
An external IP is connecting to my mailserver VM every second and I just want to block this IP immediately without dropping existing connections.
So I apply a DROP rule.
I even reloaded all the ...
- 135
0
votes
0
answers
2k
views
High CPU usage by ksoftirqd
We use GCP for running Kubernetes and for communication with our services in different locations using VM masquerading by iptables. The first time we faced an issue with performance when we use only ...
google-compute-engine
0
votes
2
answers
202
views
Limiting routing only from specific ip
Currently I run an openvpn server that pushes a route on per client basis (different clients receive different routes and static ips).
ccd/client1
push "route 172.16.236.0 255.255.255.0"
...
- 3
0
votes
1
answer
64
views
Is there a way in iptables to shortcut to the localhost instead of using an ip address?
I have the following fules that I would like enforced.. However, if the ip address of my machine changes, I would like to keep the rules enforced. These current rules will get out dated in the event ...
- 482
1
vote
1
answer
3k
views
iptables: How to forward UDP and TCP port to server behind wireguard VPN connection
So I have VPS (KVM) server running Debian bullseye with a public IP. That server is also running a wireguard server. At home, I have another server (behind NAT) with a wireguard client that is ...
- 41