Questions tagged [iptables]

iptables is the userspace command line program used to configure the Linux 2.4.x and 2.6.x IPv4 packet filtering ruleset. It is targeted towards system administrators. Please, when asking a question about iptables, add the output from the following command: iptables -L -v -n

Filter by
Sorted by
Tagged with
0 votes
1 answer
20 views

How to set a firewall between two network namespaces?

So i created a network namespace named client, and another namespace called server. I also create virtual ethernets to connect them. ip netns add client ip netns add server ip link add v-client type ...
user avatar
  • 1
0 votes
0 answers
28 views

How does linux / netfilter / iptables "know" if a packet is meant for itself for to be forwarded

I have setup an ubuntu box as a router manually , using iptables + NAT. But I was wondering, how does the "middle-router" know if the packet is meant for it or to be forwarded? I tested this ...
user avatar
  • 1
1 vote
0 answers
34 views

Redsocks not working with Wireguard, but works with OpenVPN

Summary I use a VPN to route all of my traffic through. Until recently, I used OpenVPN, but then switched to Wireguard. Unfortunately, this broke my redsocks setup, and I can't figure out why. I'm ...
user avatar
  • 121
0 votes
2 answers
39 views

iptables to secure nginx server

Does anyone know iptables well? I have a task and I got a little confused with it because I have a quite poor understanding of networking :) i need to limit access to the server for all outgoing ...
user avatar
0 votes
1 answer
51 views

the iptables chain DOCKER-USER does not seems to work

I use ipset to block IP ranges from many countries on my server (almost the entire world at the exception of France and french speaking countries). I have two rulesets in ipset : badbadworld1 and ...
user avatar
0 votes
0 answers
6 views

iptables mark OUTPUT with multiple routing table, but the source address can't be overwritten

I have an instance with 2 internet connections, eth0: 172.22.0.2 which accept VPN connection from internet and don't have default gateway in main routing table, eth1: 10.255.1.4 have default gateway ...
user avatar
  • 1
0 votes
1 answer
51 views

How to avoid IP & MAC spoofing and block desired ports for Qemu/KVM virtual machines via nft or nftables?

I have a Debian 11 server that is running several Qemu/KVM virtual machines ( not using libvirtd created purely with Qemu commands ), I've created a network bridge and each VM has its own TAP device ...
user avatar
  • 23
0 votes
0 answers
17 views

Netfilter - packet flow for local virtual interface

How looks process and packet flow in Netfilter for packets that are intended for the local process but running on virtual interface - for example in K8s pods. Packet in on physical interface and it's ...
user avatar
0 votes
2 answers
55 views

docker containers with "public" IPs, bridged network

I basically followed this guide: Docker Containers with Public IPs We already have a similar setup working in another location, but I can't get it working in a new environment. Sadly, my predecessor ...
user avatar
  • 3
0 votes
1 answer
18 views

Route lan traffic to specific subnet using a VM with OpenVPN

I have a OpenVPN connection to access private services (service1, service2). To access them, I must connect using an OpenVPN client on "MacMini". I would like use the OpenWRT router (192.168....
user avatar
  • 101
0 votes
0 answers
18 views

How to avoid port duplication when using iptable for DNAT

I configure the iptable output chain DNAT conversion by the following command. iptables -t nat -A OUTPUT -p tcp --dport 5000 -j DNAT --to 10.100.1.10:2048 When I link 10.100.20.4:5000 on the client ...
user avatar
  • 1
0 votes
1 answer
26 views

Get bytes count using iptables when having a Docker host

When I want to count the number of bytes getting out a Linux system through a particular port I can use iptables, adding a specific rule that can be checked whenever I need. For instance lets imagine ...
user avatar
  • 1
0 votes
0 answers
16 views

How can I allowing all established incoming connections without conntrack?

I want to make my iptables accepted all stablished incoming connections, but I don't have conntrack in my system so I can't run: sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT It ...
user avatar
  • 1
0 votes
0 answers
25 views

Fail2Ban blocking everything on every port, no access

I copied the jail.conf to jail.local and used the Default jail to block IPs on every port with the default bantime etc. I also changed "enabled" to true. After restarting the service, I was ...
user avatar
0 votes
1 answer
76 views

How to route a reply packet to the device it coming from?

I have an ipip tunnel, I want all the reply packets coming from ipip device also going through ipip. I have tried the following iptables rules sysctl -w net.ipv4.ip_forward=1 ip rule add fwmark 1 ...
user avatar
0 votes
1 answer
21 views

iptables: force reconnections of existing connection allow new connections

I'm trying to implement a transparent http proxy using iptables. The following rule redirects traffic from port 80 to 8080 (the port the proxy is listening to) # iptables -t nat -A PREROUTING -p tcp --...
user avatar
0 votes
0 answers
25 views

Seperate traffic depending on source IP and relay to veth device

i have a kind of tricky problem i'm trying to solve for a while. The summary is that i need to separate traffic depending on the source ip. I use a software for network simulation that has different ...
user avatar
  • 1
0 votes
0 answers
14 views

Connect Docker Networks to Different Interfaces with Same Gateway/Subnet

[I'm in way over my head, and I'm totally lost. I'm not sure if this is a general networking question, a Linux question, or a Docker question.] I'm building a monitoring solution for my home network. ...
user avatar
-1 votes
0 answers
25 views

How to port forward and keep source ip from VPS using zerotier VPN and iptables?

I host a home minecraft server. I use zero tier to portforward the VPS to my server using iptables VPS iptables script.sh #!/bin/bash iptables -F iptables -X iptables -t nat -F iptables -t nat -X ...
user avatar
  • 1
0 votes
0 answers
30 views

why allowing established incoming connections doesn't work?

I am trying to allowing all established incoming connections in my iptables using this command: sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT but I get this error message: "...
user avatar
  • 1
0 votes
0 answers
14 views

iptables -j MASQUERADE for a specific network interface: after connecting to a VPN and changing the default route, connection in the peer is lost

I use to forward traffic from my wireless card to network namespaces. I create the network namespace, virtual ethernet interfaces and all the rest: ip netns add nsx ip link add vethx type veth peer ...
user avatar
0 votes
1 answer
28 views

Why do I need extra rules that are the same as the default behavior in the iptables?

I am trying to understand the below iptables config file: *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] # Allow WiFi AP traffic over 80 & 8080 -A INPUT -i p2p0 -p tcp --...
user avatar
  • 1
0 votes
1 answer
26 views

Creating Subnet IP address : IPv4 block sizes must be between a /16 netmask and /28 netmask

I'm new to AWS and I'm looking to create a subnet. Whenever I try the defaults subnets under I get either the error message "IPv4 block sizes must be between a /16 netmask and /28 netmask." ...
user avatar
0 votes
0 answers
25 views

route OpenVPN trough wireguard tunnel

i need to route OpenVPN Traffic/Auth for a Wireguard Firewall through a wireguard tunnel to have a fixed ip address. My Setup: 1x VPS that acts as the wireguard server and fixed ip for the OpenVPN 1x ...
user avatar
  • 101
0 votes
0 answers
10 views

How can I convert this iptables mark-user rule to firewald rich language?

I'm trying to convert the scripts here from raw iptables to firewalld rich rules. For example, these rules: # Mark packets from $VPNUSER iptables -t mangle -A OUTPUT ! --dest $LAN_NETWORK -m owner --...
user avatar
  • 209
0 votes
1 answer
76 views

iptables rules to route a domain through a vpn interface and remaining traffic via default interface

I have a wireguard vpn connection to access certain private services hosted on private ec2 instances. But I want to be able to use my default internet connection for remaining traffic and only route ...
user avatar
0 votes
0 answers
112 views

Ubuntu 22.04 - pinging from routers to other site in a site to site vpn (wireguard)

Here is my Setup... I have two windows VM's are set at 192.168.51.100 and 192.168.52.100. These two windows machines are able to ping each other and each router. I am unable to ping from the routers ...
user avatar
0 votes
0 answers
36 views

Transparent proxy in an external IP address, it works partially (the address received the the proxy is the wrong IP). How could I rewrite the address?

I want to install Tor in my router but I don't want to use its SOCK5 port but its TransPort directly in the machine side and forward the traffic to bridges (to use with virtual machines). The router ...
user avatar
0 votes
0 answers
21 views

How can I make TPROXY option in iptables work when the destination proxy address is a non-local one?

I installed a TPROXY server in my router that forwards the traffic to a SOCKS5 server. The router has the address 192.168.1.1 and my PC has the address 192.168.1.33. Also, I have a local bridge "...
user avatar
-1 votes
0 answers
18 views

IPTABLES Hex to u32

Please help me convert hex to u32 UDP Hex : ffffffff676574696e666f20787878 UDP Hex : 006d5500 UDP Hex : 8fff5ae282ff00010000ffff00000514000100000000000200 UDP Hex : ...
user avatar
0 votes
1 answer
22 views

How can I forward a port from the IP of an network interface to the same IP with iptables?

I need to forward a port in an IP of an interface to the same IP but with a different target port. First I add a bridge and add an IP to it: ip link add br0 type bridge ip link set br0 up ip address ...
user avatar
0 votes
0 answers
14 views

How can I set up a transparent proxy (TPROXY type) across network namespaces?

I want to setup a transparent proxy across network namespaces. I have two network namespaces, "nsx" and "nsy", each one has a veth pair, the pair of "nsx" is pointed to ...
user avatar
0 votes
0 answers
35 views

How to keep IP address when ethernet cable unplugged linux?

My board has wlan0, ppp0 and eth0 interfaces and I always want to keep my IP address on eth1. How can I do this?
user avatar
1 vote
0 answers
95 views

Module ip_tables not found after upgrade

Since I upgraded recently my Ubuntu server from 20.04 to 22.04 I have an issue with Docker. Docker will not start any more after reboot, because of the ip_tables module. After every reboot of Ubuntu ...
user avatar
  • 11
0 votes
1 answer
35 views

Force outbound traffic over VPN, but still Allow local connections

I have a linux VM running a VPN client and I want to make sure all new, outbound connections to the internet go over the VPN tunnel, while also allowing local network devices to connect to it. This VM ...
user avatar
0 votes
1 answer
22 views

Routing between Wireguard and OpenVPN

I have set up Wireguard peer and OpenVPN server on the same machine. Machine has a public IP so other Wireguard peers and OpenVPN clients can connect to it. For Wireguard I am using subnet: 10.10.6.0/...
user avatar
0 votes
0 answers
31 views

No outgoing traffic allowed by Red Hat 8

I have recently been given access to a VPS with Red Hat 8 installed. I need to enable outgoing traffic in order to install certain things, but currently this doesn't work. Here are some commands that ...
user avatar
  • 101
0 votes
0 answers
33 views

Setting up a transparent proxy across network namespaces: failed to get target destination address

I'm trying to setup a transparent proxy across network namespaces. First I create the network namespaces, virtual ethernet devices and enable forwarding inside one of the namespaces: ip netns add nsx ...
user avatar
0 votes
1 answer
76 views

How can I redirect DNS queries to 127.0.0.53:53 with iptables?

The problem is that I need to forward the incoming DNS query packets (from other computers) to 127.0.0.53 (not 127.0.0.1). I tried to redirect the queries to 127.0.0.1, that worked fine, however it's ...
user avatar
0 votes
1 answer
37 views

Route all traffic from port over non default route

All my traffic goes through a subscription VPN service via a gateway. I now want to have a Site-to-Site OpenVPN connection between two synology NAS, with one sitting behind the VPN gateway, the other ...
user avatar
  • 101
0 votes
1 answer
38 views

Wireguard - single server with multiple interfaces

I have one raspberry, and there I have ethernet connection to internet eth0 and I have another wireless connection wlan0 that is also conneted to internet via other router. Is it possible to create ...
user avatar
0 votes
1 answer
31 views

How to configure iptables against DDOS attacks, or others

I recently had a server hosted on OVH, which I can access via SSH. On this server is installed a data collection tool (Cyber), on Linux and accessible from a Web interface. This tool must be ...
user avatar
  • 1
0 votes
1 answer
36 views

Allow port forwarding through vpn iptables killswitch

I have a debian virtual machine thats connect to a openvpn server. Right now i have a kill switch working well on iptable, and the vpn connection works whithout any trouble. Let's share this ...
user avatar
0 votes
1 answer
52 views

How is it possible for a host-only VM to have internet through a host only network adapter?

For a program I'm installing on the host machine, which requires results from a VM, I need to set my VM (https://utopianknight.com/malware/cuckoo-installation-on-ubuntu-20/) as host-only. Normally, ...
user avatar
1 vote
0 answers
32 views

iptables with multiple routing tables and gateways, same gateway MAC

Centos 8, KVM. Similar questions were asked and I tried their answers without success. I have two public IP addresses IP1 aaa.bbb.ccc.11 and IP2 aaa.bbb.ddd.22 and two network adapters eno1 and eno2. ...
user avatar
  • 111
0 votes
0 answers
63 views

Debugging why the packets get dropped

I've started on stackoverflow, then after some investigation asked on superuser, because it looks like network or kernel (mis)configuration, but probably I need some seasoned network engineer to help:)...
user avatar
  • 103
1 vote
0 answers
16 views

Suricata / Filebeat / ELK - iptables tee - Create virtual hosts

I have an IDS setup as follow: Hardware / interfaces WAN <----(brwan)> ROUTER / AP <(br0)----> LAN \ -----(eth1)>...
user avatar
1 vote
0 answers
57 views

Blocking forwarded traffic with OpenWrt fw3 firewall

I can't find out how to create a fw3 rule which does what I want (block all traffic from 192.168.1.119). I have this in /etc/config/firewall config rule option ...
user avatar
  • 11
0 votes
0 answers
29 views

Is there a way to use Iptables to route a VPN image through a transparent proxy?

I have a docker image which houses a VPN. I'm trying to run that VPN through a transparent proxy (squid) before it reaches the web. The proxy and docker image are on the same AWS instance. The ports ...
user avatar
0 votes
0 answers
17 views

Traffic to Nginx reverse proxy only from CloudNS through Iptables

I am new to the forum and hope that I am right here with my questions. I am configuring my reverse proxy (Nginx). I want to allow only traffic coming from CloudNS (https://www.cloudns.net). I had the ...
user avatar

1
2 3 4 5
128