6
votes
Mikrotik - redirecting YouTube to a local friendly page
If you don't have administrative rights on the client, you can't.
(because it's considered as an attack)
If you have administrative rights on the clients, you can install there your own certificate ...
- 511
6
votes
DNAT from localhost (127.0.0.1)
This works for me, routing traffic from localhost:8081 to 172.17.0.1:80, where 172.17.0.1 is a veth behind the bridge interface named docker0.
sysctl -w net.ipv4.conf.docker0.route_localnet=1
...
- 161
5
votes
DNAT using iptables only works for traffic incoming on eth0
First, let's draw your network topology.
I think this is side effect of the reverse path filter, because the packets are dropped at the routing decision step.
Check the output of nstat -az '...
- 5,222
5
votes
DNAT from localhost (127.0.0.1)
You will have to run the following three commands to make it work:
iptables -t nat -A OUTPUT -p tcp -d 127.0.0.1 --dport 4242 -j DNAT --to 11.22.33.44:5353
sysctl -w net.ipv4.conf.eth0.route_localnet=...
- 51
3
votes
Accepted
Strange behaviour on iptable with nat AND port forwarding
Your issue relates to especialities of the linux connection tracker.
The quick answer: you cannot avoid this delay in your configuration. Only way is avoid this issue is usage the -j SNAT without a ...
- 5,222
3
votes
Squid 3.5: Preventing forwarding loop in intercept mode
I met the similar requirement as well today. After some digging, it looks like this is a feature for Squid to prevent a vulnerable http://www.squid-cache.org/Advisories/SQUID-2011_1.txt.
Reading code ...
- 31
3
votes
port rerouting with iptables not working
This will not work for at least two reasons:
You added a rule with DNAT target in PREROUTING chain and this will not be hit when connecting locally. Intead, you need to add it to your OUTPUT chain in ...
- 36.9k
3
votes
How to DNAT Broadcast Packets
As alternative to AUTAPF, socat can be used.
$ sudo socat UDP4-RECVFROM:139,broadcast,fork UDP4-SENDTO:10.1.1.255:139
Where 10.1.1.255 - broadcast forward target
Basen on [UDP port forwarding with ...
- 714
3
votes
Accepted
DNAT without default route
There are various ways to implement what you want. Draw your network topology.
Simplest way
It requires only single DNAT rule on the S2 (server in the new DC) and additinal routing configuration on ...
- 5,222
2
votes
Accepted
How-to DNAT-forward all IP traffic on Windows 10 from IP1 to IP2?
This may be an old one but there's no answers and 2k views.
The reason why netsh interface portproxy add v4tov4 listenaddress=65.55.44.109 listenport=80 connectaddress=127.0.0.1 connectport=80 doesn't ...
- 136
2
votes
Accepted
nftables natting with source IP
You can do the same rules in nftables this way:
table inet nat {
chain prerouting {
type nat hook prerouting priority dstnat;
iif eno1 ip daddr { <public_ip> } tcp dport 21 ...
- 1,390
1
vote
Accepted
nftables: hairpin / loopback NAT with dynamic IP
Okay I managed to fix this and also simpified my config.
The forward chain doesn't need to explicitly accept traffic for specifics ports, I can just tell it to forward anything that has a dnat rules ...
- 1,238
1
vote
nftables: hairpin / loopback NAT with dynamic IP
What you probably need is a 'FIB EXPRESSION' from nft man page. This is the rule I use for my DNAT (you will need to adjust for your setup):
chain PREROUTING {
type nat hook prerouting ...
- 3,553
1
vote
Accepted
Forward traffic with iptables without exposing real IP/Port
So the first firewall rule I used works:
iptables -t nat -A PREROUTING -p tcp --dport 5555 -j DNAT --to-destination x.x.15.42:23555
The only problem was indeed that the server was telling the client ...
- 21
1
vote
Accepted
Nftables - how not to dnat an ip on interface (DNS)
You just have to add an additional condition to not match for this IP address, thus not performing NAT in the end:
iifname "br0" ip saddr != 192.168.22.5 udp dport 53 counter dnat to 192.168.22.5:53
...
- 12.8k
1
vote
Accepted
Need correct iptable rules for NAT instance to prevent loop back for private subnet EC2 instance outgoing traffic
Your PREROUTING must exclude the local traffic, i.e.
iptables -t nat -A PREROUTING -p tcp ! --source 10.0.1.0/24 --dport 80 -j DNAT --to-destination 10.0.1.126:80
Note the exclamation mark before ...
- 25.5k
1
vote
Accepted
Port 80 mixed up among clients using DNAT
Your provlem is your dnat rule has no destination address filter on it, you need to add '-d 192.168.1.30' to the rule.
- 4,296
1
vote
Accepted
KVM guest can't connect to itself after DNAT
One possible solution is to use SNAT on the HOST to change the source address of packets and forward them back to "ari" VM. It's not the most performant solution but it's simple and good enough for ...
- 3,658
1
vote
Accepted
nftables dnat forwarding is not working properly
Thanks to Роман Иванов for useful nft monitor.
NAT doesn't work because i use this rule at the end of filter forward:
iifname wan0 reject
in chain NAT you need rule:
NAT => PREROUTING
nft add ...
- 378
1
vote
nftables dnat forwarding is not working properly
Here are some steps you can take:
Type nat hook prerouting priority 0; <-Should be -100 (minus hundred) according to NF_IP_PRI_NAT_DST netfilter constant
Use "meta nftrace set 1" in prerouting and ...
- 11
1
vote
Accepted
IPTables -j DNAT doesn't appear to work in a certain case
An ICMP Echo reply packet is part of an established flow. That means, when the kernel received such a packet in a normal case, it was already expecting it (after the initial ICMP Echo request) , so ...
- 12.8k
1
vote
How to DNAT Broadcast Packets
If your goal is to receive the packet back as broadcast again on the destination then you can use L2 VPN. It does not DNAT, but tunnels the original packet to where the tunnel leads and then demarcate ...
- 210
1
vote
Accepted
Forwarding ports from one bridged interface to a guest container on host OS
I would simply set up the public .180 address on the host OS vmbr0 interface, and then make port forwarding on the host OS.
I can't see the point of having the separate VM here. If you really want to ...
- 37.6k
1
vote
iptables/nat/prerouting ignores UDP packets?
Same thing here. As the last thing to check, check the conntrack table. In my case, resetting the tracked connections make the rules work instantly.
apt install conntrack -y
# see current UDP ...
- 268
Only top scored, non community-wiki answers of a minimum length are eligible