New answers tagged iptables
1
vote
Accepted
Blocking traffic from specific countries. How to kill existing connection?
Since several years, the Linux kernel has been having an API to forcibly kill existing IP sockets whatever their state. It can be done with the ss command and its filter syntax:
-K, --kill
Attempts ...
- 11.2k
0
votes
VPN on Linux - IP routing issue
NOTE: In this answer, the network 100.64.10.0/23 represents the public network. It's not particularly relevant but exists only to make the network configuration of these virtual nodes match what you'...
- 43.8k
1
vote
Accepted
LXC container fail to load big iptables rules
You should consider using ipset to keep host/network addresses for block_spam* rules (and likely merge them into just one set), this would be faster. Or just move to nftables and use built in sets.
- 3,415
0
votes
LXC container fail to load big iptables rules
If you look up the sendmsg() man page you'll see that it does not actually have a response indicating that a message was too large. It does however return ENOBUFS if there is not enough space in the ...
- 21.5k
3
votes
Accepted
Creating an IPTABLES chain, whose rules are ignored, unless the packet is from a certain port?
Not "from" but "to". --dports lists destination ports. The rule as you written, means: "if the packet was sent to my service listening on TCP port 25 or 465, process it in the ...
- 11.2k
0
votes
iptables routing all traffic to two different chains?
On mobile and too long for a comment
It seems that you assume that sending a packet to a custom / new chain means that it won’t return from there. That is somewhat incorrect.
The rules in iptables are ...
- 77.4k
1
vote
Filter packets with iptables on a tap interface
If you add a logging rule to your FORWARD table to capture any ICMP traffic...
iptables -I FORWARD -p icmp -j LOG --log-prefix 'FORWARD_ICMP '
...you'll see that the input interface is the bridge, ...
- 43.8k
0
votes
Accepted
fail2ban on host for rootless podman keycloak container
fiddling around with fail2ban and X-Forwarded-For header wouldn't be a satisfying solution. I solved this by using the opnsense API approach.
Quick summary:
created a user (api key) with the ...
- 141
1
vote
fail2ban on host for rootless podman keycloak container
Fail2ban works (by default) at the firewall level which itself works at the IP level.
Given your setup, all traffic is relayed by an external Traefik instance whose IP is the only one contacting ...
- 2,605
0
votes
iptables string matching feasability; possible use with fail2ban
There is no easy solution when your fail2ban and associated logic is running on the back end servers.
I’d think the first step would be to use Apache mod_remoteip ; then the Apache logs on the backend ...
- 77.4k
0
votes
Accepted
Debian + Strongswan: does not pass traffic from the Internet to the tunnel
It was my own fault. I was careless when setting up iptables and wrote eth0 without checking the actual interface name which was ens5 on that VPS. It's a stupid mistake that would not be worth ...
- 1
0
votes
Accepted
Block access to remote mysql database using iptable in ubuntu 20.04
So you have UFW. Better either only use ufw to manage firewall or remove it and use something else, like raw iptables to do that, else you'll encounter all kinds of undesired interference.
At least it ...
- 11.2k
0
votes
Accepted
Wireguard/iptables: ICMP response not forwarded to wg0
After a second thought, the reason that it didn't work was probably AllowedIPs = 0.0.0.0/0 causes the VPN-encapsulated traffics from Server A to B to be routed into the wireguard tunnel.
And the ...
- 747
Top 50 recent answers are included