New answers tagged

0 votes

How to block internet access to certain programs on Linux

nftables can set firewall rules based on cgroups (it can be bound to each program), the syntax: socket cgroupv2 level NUM PATH PATH: 'PATH' is the one in /sys/fs/cgroup, note that the 'PATH' is ...
user avatar
  • 1
0 votes

Allow only a list of IP's on iptables

If you are running firewalld you can utilize the rich rules. Example :- firewall-cmd --add-rich-rule='rule family=ipv4 source address=192.168.1.101/32 service name=telnet limit value=1/m accept' You ...
user avatar
1 vote

iptables match output rule for supplementary groups

Support for supplementary groups was added in ea6cc2fd in 2019: netfilter: xt_owner: Add supplementary groups option The XT_OWNER_SUPPL_GROUPS flag causes GIDs specified with XT_OWNER_GID to be also ...
user avatar
  • 111
0 votes

Why do I need extra rules that are the same as the default behavior in the iptables?

Rules are processed in order. Without the ACCEPT rules on p2p0 the relevant packets would match on the subsequent rules and be dropped, regardless of the default for the INPUT chain. -m tcp loads the ...
user avatar
  • 1,591
1 vote

Creating Subnet IP address : IPv4 block sizes must be between a /16 netmask and /28 netmask

The image attached has the answer. You've already defined a huge subnet 172.31.0.0/20 the second subnet you tried to create 172.31.0.0/16 falls within that. You probably got VPC and subnets confused. ...
user avatar
  • 29.8k
1 vote

iptables rules to route a domain through a vpn interface and remaining traffic via default interface

You need to set up your routing on your client in the way you want. In your case, you need to set up default route via your normal internet connection, and then route the IP addresses you want via the ...
user avatar
0 votes

Routing between Wireguard and OpenVPN

You generally need to do three things: 1. Add routes for the OpenVPN network to the WireGuard clients. In each WireGuard client config, you probably already have an entry like the following to allow ...
user avatar
0 votes

How can I forward a port from the IP of an network interface to the same IP with iptables?

I discovered how: iptables -t nat -I OUTPUT -p tcp -o lo -d 10.0.0.1 --dport 1111 -j DNAT --to-destination 10.0.0.1:9050 iptables -t nat -I PREROUTING -d 10.0.0.1 -p tcp --dport 1111 -j DNAT --to-...
user avatar
0 votes

Force outbound traffic over VPN, but still Allow local connections

Sounds like you are in FUD. By default on Linux OpenVPN does NOT override LAN routes (i.e. route with prefix length > 0), even with redirect-gateway or equivalent. (It's more of a Linux nature than ...
user avatar
  • 705
0 votes
Accepted

Route all traffic from port over non default route

As @Tom Yan suggested adding multihome to the server config worked! The Synology OpenVPN server config can be edit with: sudo vi /usr/syno/etc/packages/VPNCenter/openvpn/openvpn.conf just add ...
user avatar
  • 101
1 vote
Accepted

How can I redirect DNS queries to 127.0.0.53:53 with iptables?

I wouldn't try to use systemd resolved as DNS server for your network. Simply run dnsmasq, which loads the contents of /etc/hosts so that local hostnames which do not appear in the global DNS can be ...
user avatar
  • 1,137
0 votes

Wireguard - single server with multiple interfaces

Just had a quick browse of their documentation and it seems this is possible by using the via keyword when adding the routes. You can see the specifics in "The Classic Solutions" section of ...
user avatar
  • 1
0 votes

How to configure iptables against DDOS attacks, or others

### 1: Drop invalid packets ### /sbin/iptables -t mangle -A PREROUTING -m conntrack --ctstate INVALID -j DROP ### 2: Drop TCP packets that are new and are not SYN ### /sbin/iptables -t mangle -A ...
user avatar
  • 374
0 votes

How to tunnel all traffic through shadowsocks with v2ray plugin?

It's been a long time so you probably either solved this or lost interest. This is how I managed to do it https://dev.to/jadolg/tunneling-all-your-internet-connections-through-a-socks-proxy-4f5i ...
user avatar
0 votes

Allow port forwarding through vpn iptables killswitch

I need to make some assumptions to answer your question, but you are missing a critical point here. You can only modify connections with a DNAT rule which arrive at your server: _______________ ...
user avatar
  • 1,849
1 vote

How is it possible for a host-only VM to have internet through a host only network adapter?

Normally to understand things we split networking to the layers (in the OSI meaning) and abstract away from the unrelated details belonging to other layers. In layer 1 (physical), we have a host which ...
user avatar
0 votes

can't run iptables-legacy using cli - centos8

I had a very similar issue. In my case the iptables-legacy was set by a Docker container and the binary file only existed when the container was running. Did you try finding the binary via: find / -...
user avatar

Top 50 recent answers are included