New answers tagged

0

Introductory presentation of Netfilter and conntrack First the mandatory schematic about Packet flow in Netfilter and General Networking: Netfilter is the the packet filtering framework inserting itself over the rest of network stack (represented by "routing decision" and other white round-edged box parts). Netfilter provides hooks and APIs for ...


0

Connection tracking is a separate function of Netfilter, and it is not configured with IPTables. In the picture, there are two conntrack steps in INPUT path and one in OUTPUT path. These steps associate individual packets with existing connections tracked in the connection tracking table, or create new connection tracking entries in the table. Conntrack ...


0

In Centos 7 you can use the following commands iptables -N SIPDOS mkdir -p /var/log/firewall/ touch /var/log/firewall/iptables.log chmod 600 /var/log/firewall/iptables.log chown root:adm /var/log/firewall/iptables.log touch /etc/rsyslog.d/firewall.conf echo -e ":msg, contains, «iptables: » -/var/log/firewall/iptables.log\n& ~ " >>/...


0

This is due to the configuration of the http server on the stick, which you cannot change (at least not permanently and without modifying firmware). One option for you is to run a reverse proxy and rewrite the URL that is returned from the stick. The higher-level question is why do you need three DHCP servers in the first place. Consider disabling one of ...


1

Your MASQUERADE rule is wrong. It needs to specify the outbound interface, otherwise it will try to NAT all traffic. Since you have two interfaces to the Internet, it is OK to specify it twice. Each will apply only to traffic exiting that interface. For example: iptables -t nat -A POSTROUTING -o enp4s0 -j MASQUERADE iptables -t nat -A POSTROUTING -o ...


0

All of this is based on the assumption that the server is running a flavour of Linux. I would use an intermediary box to establish connections to the server so it "holds" the connections. Client A or B would SSH into the middle box or "jumpbox" and connect to a Screen console, which has the open sessions.


5

You're doing what you should be doing. Create the rules, save the rules, then load the rules on each host that should have them. A possible refinement when using iptables for large lists of rules would be IP Sets.


2

The man page for iptables-extensions(8) says: icmp6 (IPv6-specific) This extension can be used if `--protocol ipv6-icmp' or `--protocol icmpv6' is specified. It provides the following option: [!] --icmpv6-type type[/code]|typename This allows specification of the ICMPv6 type, which can be a numeric ...


1

One option is to use ulogd, which uses the iptables ULOG target to receive log events from Netfilter to itself. ulogd can be then configured to use several output destinations for data, for example MySQL, PostgreSQL etc. More information can be found at project homepage.


0

The following iptable config is required: iptables -I INPUT -m state --state NEW -j LOG --log-prefix='[networklogging] ' iptables -I OUTPUT -m state --state NEW -j LOG --log-prefix='[networklogging] ' The log output goes into /var/log/kern.log which could be jumbled up with other things... So referencing: https://askubuntu.com/a/348448/585364 We can log to ...


0

Question: We are unsure if with IPTABLES SNAT and/or DNAT it is possible to pass the "real" source IP to the destination. Answer: Yes, it is possible, and here's how to do it if you're using CSF. Don't rely on CSF's redirect feature, i.e. having a line similar to the following in /etc/csf/csf.redirect: XXX.XXX.XXX.184|2222|10.0.0.100|22|tcp ...


0

I am assuming that your netmask is 255.255.255.0, that is, all three devices are in same subnet. This causes the problem with using only DNAT rule. I'll illustrate the connection flow when a connection is initiated by the attacker and MASQUERADE rule is used: Attacker opens a connection to 192.168.43.216:22. The protected system DNAT rule changes packet ...


1

I ran some experiments here: https://github.com/turtlemonvh/aws-network-experiments Traffic denied by either AWS security group rules and network ACLs behaves identically to traffic encountering an iptables DROP rule (vs REJECT or REJECT --reject-with tcp-reset). No response is sent in either case.


0

Solved this by adding below script to /opt/shellscripts/curl.sh. This script hits my application URL and checks if 200 response is received. status=$(curl -Is http://www.***.in/customer | head -n 1) echo $status if [[ ${status} != "HTTP/1.1 200 OK" ]] then echo "executing command" eval $(sudo /sbin/iptables -t nat -I ...


0

I found that these answers worked except that it wouldn't work from the host itself to the vm. So I propose an addition of an OUTPUT rule to the answer to route from the host machine to the vm as well. iptables -t nat -I OUTPUT -p tcp -d 192.168.1.161 --dport 22 -j DNAT --to-destination 192.168.122.2:22 iptables -t nat -I PREROUTING -i eno1 -p tcp --dport 22 ...


0

First a big fat disclaimer: THE FOLLOWING IS THE WRONG WAY TO DO WHAT YOU NEED. The following solution is fixing the symptoms and not figuring out the root cause. Anyways: We need 2 things to automate this. A script that checks and fixes the redirection and a scheduler to run it. First the script. Place following as script in /usr/local/sbin/...


0

If you are searching the way to disable all ipv6 then easy way to switch them of on kernel level. net.ipv6.conf.all.disable_ipv6=1 net.ipv6.conf.default.disable_ipv6=1 Add this lines to /etc/sysctl.conf and reboot or sudo sysctl -p to apply new settings


2

On my Ubuntu 20.04 installation the file /lib/modules/5.4.0-40-generic/kernel/net/ipv4/netfilter/ip_tables.ko belongs to the linux-modules package, not linux-modules-extra. Reinstalling linux-modules should do the trick: sudo apt-get install --reinstall linux-modules-5.4.0-42-generic


1

You've got two possible issues here: Will the connection initiator run out of source ports? Will the NAT device fill its connection tracking table? In both cases it's important to note what distinguishes one TCP connection from another, all of: The source IP address The source port The destination IP address The destination port When a Linux machine ...


1

I found a way to hook a python script into the mangle table and alter the packets using that python script. The performance is understandably quite slow but for a testing purpose sufficient. The python3 script looks like this (using scapy and NetfilterQueue): from netfilterqueue import NetfilterQueue as nfqueue from scapy.all import * import os iptablesr = '...


2

You need to use IP addresses in IPTables rules, you cannot use DNS names.


1

Your rule to accept traffic to TCP port 10250 will never match, because it is at the end of the INPUT chain, and appears after the rule to DROP everything. It should be moved up, before the rules that log and drop traffic.


1

If you really want to just allow your "IP address through", you need to allow your IP in and out before setting the default policy. So, before any other iptables commands run something like this: iptables -I INPUT -s 192.168.241.1 -j ACCEPT iptables -I OUTPUT -d 192.168.241.1 -j ACCEPT (Of course substitute 192.168.241.1 for your IP address.) In ...


0

Original poster accepted my earlier answer, but here is a bit more in-depth: I diagnosed and debugged a bit. Here is the what I did first: Installed Ubuntu 14.04 as VMware virtual machine Modified /etc/ssh/sshd_config to read: Port 2022 Rebooted machine Marked down VM IP address, which was 192.168.241.171 Next I took your firewall script and removed the ...


3

Due to my noob reputation I need to ask clarification here. Can you edit your question to contain also INPUT chain default policy? I ask because of this line: RETURN tcp -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x17/0x02 limit: avg 1/sec burst 2 I'm not an expert, but I have never seen this used in top level. Could be only me though. What is said about ...


1

It's hard for me to give an outright answer given the provided data, but my approach would be to: Trim down iptables down to just two rules: Allow a single IP address range (the one you are connecting from), and deny everything else. Be careful to not lock yourself out of the server! Having console access or a backup plan could be a life saver. If you are ...


1

You have two way, one is let docker stop manipulate iptables rules and you take care of it (Personally I do not recommend this way) or use the docker-user chain as you already mention. As per the docker documentation says, the docker and docker-user chain are the first used by iptables for filter, so you can configure as default DROP for standard chain (...


1

Because example.com have to be present in header of most request against server at example.com: If you sent an email, you will put to: john@example.com in the mail header. If you do some HTTP request against example.com, once DNS resolved, minimal request have to contain target host: host example.com example.com has address 123.45.78.89 DNS request is ...


0

If you are using Docker containers to run your application but fail2ban on the host you may run into this issue: https://github.com/fail2ban/fail2ban/issues/2292 Borrowing from the workarounds there, this might be fixable by configuring in you jail.local the line: [YOUR-JAIL-NAME] chain = DOCKER-USER ... Or for Kubernetes chain = KUBE-FIREWALL See for more ...


0

In my opinion you're overthinking this a bit since docker comes with some sane default configuration which it also manages automatically. E.g. in the default setup containers are not accessible via external network but they can connect to the internet themselves. Therefore you should just EXPOSE the relevant ports of your containers on the host's external IP ...


0

For firehol fw with WireGuard listening on default 51820 redirect4 to 51820 inface eth0 proto udp dport 53


2

Easiest solution for the SSH access with MASQUERADE setup is to add a port forwarding rule on 2.2.2.2: iptables -t nat -I PREROUTING -i eth0 -p tcp --dport 222 -j DNAT --to-destination 1.1.1.1:22 Then you can use ssh -p 222 user@2.2.2.2 to connect to 1.1.1.1. If this solution is not enough, then you need a more complex setup. The MASQUERADE solution above ...


2

If you use -m string --string example, it will match all IP packets where the payload contains the string example. If you go to a page via HTTP and the page contains word example, the page is shown only partially, because your rule drops the packet that contains the word example. The rule can also break many other protocols that use plain-text. It can also ...


2

You cannot search for example.com in the URL as most websites now work via HTTPS exclusively. Yes, in your example iptables will resolve example.com on a first invocation and in case its IP address changes this rule will no longer work but you could solve it by running e.g. a cron script which resolves example.com and if there's a new IP address it then gets ...


1

Because it is a pattern for strings. Yes, you got your aim. But! If you try to search anything ingluding "example" by google.com you cannt too. Be careful use this setting.


0

There are multiple reasons for the system to drop packet silently, but this case is really simple: what do you see as a result of ip r g 34.73.148.195? Since you don't have any route via enp10s0 except for the 10.8.10.0/24, you could disable rp_filter ...or add some/the right default route: ip r a default via 10.8.10.1 dev enp10s0 metric 50 After all, this ...


4

The DNAT looks good, but SNAT I think I'd go -A POSTROUTING -p tcp -m tcp --dport 5000 -j SNAT --to-source 172.21.26.237 instead of -A POSTROUTING -p tcp -m tcp --dport 8888 -j SNAT --to-source 172.21.26.237 I mean since PREROUTING changes the port from 8888 to 5000, it doesn't make sense to expect 8888 anywhere behind that stage.


0

Before a packet gets to the INPUT chain of the FILTER table, it needs to go through the following tables/chains: table-chain raw-PREROUTING mangle-PREROUTING nat-PREROUTING mangle-INPUT by default, i.e. if you are ommitting the --table argument, then you are looking at the FILTER table. Furthermore, before it gets to filter-INPUT, a routing decision is ...


1

Use source nat instead, because wrong source ip goes into tunnel while masquarade: tun_ip=$(ip a | grep tunsnx | grep inet | awk '{print $2;}') iptables -t nat -A POSTROUTING -o tunsnx -s y.y.y.y/24 -j SNAT --to $tun_ip


0

From your question, I assume that these iptables-rules are supposed to be installed on the docker-host. You a missing a central point here: the firewall-rules are only valid for the host itself, not the containers! Let's assume, your docker0 interface has the ip range 172.16.0.0/16. The host interface address is 172.16.0.1, and your first container might ...


0

I think I found a working solution, but I'm not sure if there is a better way. With the things I tried I had to also declare the established connections for the DOCKER-USER set adding this two lines in comparison with my question: iptables -A DOCKER-USER -i docker0 -j ACCEPT > iptables -A DOCKER-USER -o docker0 -j ACCEPT > iptables -A DOCKER-USER -m ...


Top 50 recent answers are included