Questions tagged [iptables]
Iptables is a module that provides the Linux operating system functions of firewall, NAT and logging of data traveling over a computer network.
1,900
questions
0
votes
0
answers
13
views
iptables SNAT command does not always create connection tracking flow
After several reconfiguration of iptables SNAT, the connection tracking flow is not created.
The below labeled line numbers shows the commands that I typed.
Line 1: conntrack -F
Line 2: conntrack -D -...
0
votes
0
answers
9
views
Blocking DNS server from a router via iptables
I'm trying to block google dns server (8.8.8.8) from my router, so no machine in the network could not access this dns server.
here is my iptables table:
Chain INPUT (policy ACCEPT)
target prot ...
0
votes
1
answer
31
views
How can I block GPSD from communicating out?
I have two computers; one running gpsd and one using gpspipe -w 192.168.90.1 to query the data.
GPSD listens on port 2947 and I want to block it with iptables. I've tried so many rules, but I can ...
0
votes
2
answers
21
views
What determines if a packet should be routed locally or forwarded?
As seen in the diagram, when the Linux kernel receives a packet, it goes through the prerouting chain, and then a routing decision is made on whether to forward it to somewhere else or deliver it to a ...
0
votes
0
answers
22
views
Route all TCP traffic from port to another host:port
I have a wireguard config, creating a VPN between a remote server (10.0.1.1) and my local machine (10.0.1.2), so that the server can reach the local machine and vice versa.
I'd like the server to ...
0
votes
1
answer
21
views
How can I simulate NAT reflection failure with `iptables`?
Let's say that:
My workstation LAN IP is 192.168.0.101
My WAN IP is 12.34.56.78.
My consumer-grade router is port-forwarding WAN:80 to 192.168.0.101:8080
NAT Reflection / Hairpinning is working
So ...
0
votes
0
answers
21
views
iptables port REDIRECT works locally but not from outside
I have a server that can only listen to port 23006. I want to access it from outside and on port 443.
I have systemctl setup:
$ sudo sysctl --system
* Applying /usr/lib/sysctl.d/50-pid-max.conf ...
* ...
0
votes
0
answers
50
views
ZeroTier not working on router running FreshTomato firmware
0
I can successfully connect to my ZeroTier with the router and join my ZT network with an automatic IP assigned my ZT. However, I can’t ping the router from from any device on my ZT network nor have ...
0
votes
1
answer
34
views
Unable to get Main and Backup Routers to connect to each other
I have two networks and routers (both on Advanced Tomato by Shibby) laid out as such:
Backup Router network (192.168.1.1/24)
WAN - Xfinity
LAN - small number of clients. Importantly, main network ...
0
votes
0
answers
20
views
How to redirect traffic coming from exterior to a proxy chains of 2 proxy?
I'm using redsocks to redirect the incoming non-local traffic to forward it to a socks5 proxy. Unfortunately,redsocks does not support proxy chaining, So I tried to do a turn around by running 2 ...
0
votes
0
answers
49
views
How to proxy all traffic received by Windows using Linux and redsocks?
I have a Windows machine where all of it's traffic is routed through a Linux machine simply by doing changing the Windows route :
route add 0.0.0.0 mask 0.0.0.0 192.168.1.48 where 192.168.1.48 is the ...
0
votes
1
answer
37
views
routing traffic using iptables and l2tp
Internet restrictions in my country have essentially made it impossible for VPNs to work.
As such, I wanted to circumvent this issue by using the following method.
Although "residential" ...
0
votes
0
answers
25
views
No internet connection after setuping OpenConnect server on ArchLinux
ip tuntap add mode tun dev vpn0
ip addr add 192.168.2.2/24 dev vpn0
# systemctl restart ocserv
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 8443 -j ACCEPT
iptables -...
0
votes
1
answer
77
views
openssl s_client -connect errorno=111
Hi I got problem with openssl connection. I have java application which connects from server1 to server2 I made clone of server2 and upgraded it from Debian 9.7 to Debian11. The connection to ...
-4
votes
1
answer
49
views
Block youtube.com via `iptables`
For productivity reasons, I want to block access to YouTube.
What I have tried. I started by running:
dig A youtube.com +short
and then feeding the resulting address(es) to
sudo iptables -A OUTPUT -...
1
vote
0
answers
36
views
How To Add Ip Address manually in debian 12
I have two scripts that I can use to add block ip addresses to iptables. So for a list of let's say 10,000 or more it takes forever. Can I just copy and paste this block of ip address manually? If ...
0
votes
0
answers
36
views
Peers can connect to VPN server but not between themselves (Packet filtered)
I'm new into VPN topic and routing in general, and wanted to learn new thinks while setting up wireguard. However I'm facing an issue that I can't resolve for some time.
As in title: Peers can connect ...
1
vote
0
answers
47
views
how to route ocserv traffic to wireguard split tunnel
I want to route ocserv traffic to wireguard split tunnel
here is the net flow
[ (ocserv client) ] =====> [ server A (ocserv + wg server) ] <===== [ server B (wg client) ]
Because wg protocol ...
0
votes
0
answers
20
views
Firewall incoming packets are dropped with VLAN configuration
In my Windows PC, installed scapy tool for sending packets from my system to raspberry Pi board connected to my machine using VLAN.
In my raspberry Pi board, Firewall rules are already configured and ...
0
votes
0
answers
17
views
Add foreign address to IP tables to Docker Image
I am new to Docker. I have a sample website running in a Docker Container and I am trying to access it from another computer on the network.
tcp 0 0 localhost:3000 0.0.0.0:* ...
0
votes
0
answers
31
views
Using (Linux) iptables to drop duplicates?
Is there an easy way to use "iptables" rules to drop duplicate packets on Linux?
If not, I'll have to spend more time figuring out why the problem is happening. In short, it has to do with ...
0
votes
1
answer
85
views
How to force a match of "mark" of iptables to send its traffic to a TPROXY proxy?
I am trying to set up a transparent proxy that works with marked packets generated by a auxiliary program that wraps a process and mark its traffic with a firewall mark.
What this setup does is to ...
2
votes
1
answer
144
views
Preserve incoming interface for answers in openwrt router
I have a Openwrt router with three interfaces:
interface br-lan: IP: 172.16.21.1 in a LAN network (172.16.21.0/24).
interface eth1: IP: 172.16.22.2 a WAN network (172.16.22.0/30) with Internet access....
0
votes
1
answer
158
views
UniFi Dream Machine Special Edition (UDM SE) - iptables NAT PREROUTING not working on own subnet
This is a very confusing situation for me and I feel like there isn't an answer to this. But I'm at a loss after hours of testing, figuring out how things are currently working or not working as I ...
1
vote
1
answer
181
views
IPTables rules and networking with problems 2
My plan is to have a computer that forwards all traffic from internal interface ens19 to openvpn-interface tun0. The system has 2 physical interfaces: ens18 for local network with Internet connection ...
0
votes
0
answers
173
views
reflection nat / hairpin nat with iptables
I try to implement reflection nat on one of my servers. There is a vm running on the server with ip 10.0.0.10.
My iptables look like this:
root@srv8:~# iptables -t nat -L -n -v --line-numbers
Chain ...
1
vote
1
answer
81
views
Stateful forwarding rule in iptables
I have created this bridge device
ip link add dev br0 type bridge
ip addr add 172.16.0.254/16 broadcast 172.16.255.255 dev br0
ip link set br0 up
sysctl -w net.ipv4.conf.br0.forwarding=1
This device ...
0
votes
0
answers
81
views
Ping not leaving linux VM
Firstly, only just learning Linux and networking, so please assume I have minimal knowledge!
Perhaps a week ago I was working on a small python script that involved pinging devices from the Kali Linux ...
1
vote
1
answer
179
views
Unable to open port on debian vps
Trying to open 51820 UDP
I do
iptables -A INPUT -p udp --dport 51820 -j ACCEPT
then iptables -L
I can see
ACCEPT udp -- anywhere anywhere udp dpt:51820
then I do
/sbin/...
1
vote
1
answer
56
views
In Linux how to loop-back the internal traffic that's destined to the server's own NATed public IP?
By internal I mean only the traffic originating within the server itself (not LAN or other servers). I have a cloud VM where the Public IP provided by the cloud vendor is not directly attached to the ...
0
votes
0
answers
39
views
UFW not filtering FORWARD traffic on same (tun0) interface
I have an Ubuntu 22.04 server with OpenVPN running and I want to filter access between clients on the tun0 interface with UFW.
As far as I know this all has to do with the FORWARDING chain within UFW.
...
1
vote
0
answers
75
views
How can I use iptables to forward all traffic through an interface based in gid?
I'm on Debian 12 bookworm
I'm trying to forward all traffic from (and to) users in the group watchers through interface tun9 and prevent them from using enp2s0.
I've set up a tunnel using openvpn with ...
0
votes
0
answers
30
views
setup up ssh connection with 3 Ubuntu machines to bypass a firewall
I have 3 machines, here are the IP addresses of each of them with their ssh port :
first device IP: 192.168.1.2
second device IP" 192.168.1.3 port 22822
third device IP: 192.168.1.4 port 22
I ...
0
votes
0
answers
23
views
triple vpn tunnel to bypass vpn blocks
is it technically possible to setup a VPN tunnel (or port-forwarding,or any other ways) as illustrated with bellow picture ?
Assuming there is an restricted FW which even VPNs do not work plus "...
0
votes
0
answers
116
views
Synology DSM 7.2 cannot add iptables LOG rule
When trying to add a LOG rule to iptables on Synology DSM 7.2 the following error is thrown:
iptables: No chain/target/match by that name.
Verified that LOG module is loaded, rule is valid, chain is ...
0
votes
0
answers
27
views
Linux/DD-WRT iptables/route/policy based routing - static route wildcard domain to a different gateway
dd-wrt router command:
route add *.googlevideo.com gw (anothergatewayonsubnet)
use to work on old ddwrt
is there anyway to redirect *.googlevideo.com with route add, ip route, iptables to another ...
0
votes
1
answer
341
views
How to configure iptables to allow OpenVPN clients to access internet via the server, if it's run under OpenVZ?
So what I have right now:
A working VPN server that clients can connect to running under ubuntu 22.04
Enabled ip_forward on the server
What I don't have is clients being able to access the Internet, ...
0
votes
1
answer
103
views
iptables how to port forward remote to local
This is the scenario:
I have an encoded file that I cannot change the API URL but I know what it is. Let's suppose it is https://my.api.site.com/v1.
When I run php myfile.php, it connects to the API ...
0
votes
0
answers
23
views
Iptable rules through two firewalls for an rdp connection
Suppose I have a network topology similar to the one above, if i wanted to rdp into a host on the private network from home these are the following iptable rules i have:
Firewall 1:
$IPT -t nat -A ...
0
votes
0
answers
74
views
Setup FreshTomato 2021.2 on R7000 to forward traffic from internet through OpenVPN tunnel
With FreshTomato 2021.2 on R7000, I'm trying to allow port forwarding (80/443) inside OpenVPN client to able to reach a device on my LAN.
Here's the current status of iptables (iptables -S):
-P INPUT ...
-1
votes
1
answer
261
views
IPtables dropping packets I can't see with tcpdump and I don't know why?
My IPtables rules are blocking apt update for example:
root@vpn:~# apt update
Ign:1 https://pkgs.tailscale.com/stable/ubuntu jammy InRelease
Ign:2 http://de.archive.ubuntu.com/ubuntu jammy InRelease
...
0
votes
0
answers
75
views
iptables - port ward and NAT destination address
I have a server running strongswan. I have two clients connecting to this server over IPSec. My encryption domain is 10.1.1.3/32 which is the real address of the server. However, client A wants my ...
0
votes
0
answers
105
views
Iptables redirect outside requests to 127.0.0.1 (VirtualBox)
I have a virtual machine installed with the output:
ifconfig:
enp0s3: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.0.2.15 netmask 255.255.255.0 broadcast 10.0.2.255
inet6 fe80::...
0
votes
1
answer
123
views
VNC Connection to a remote host with reverse ssh tunnel
I have the following setup:
Raspberry Pi with no public IP address
Public "jumpserver"
Currently i have autossh running on the Raspberry to connect to the jumpserver.
Works without ...
0
votes
0
answers
33
views
Packages droped after DNAT from Broadcast to Unicast
I have my normal network (192.168.1.0/24) and IoT network (192.168.2.0/24) seprated on different vlans (devices switch0 and switch0.30 respectively).
My firewall is setup so that clients from the ...
0
votes
1
answer
44
views
Docker exposed ports available from host, but not from other machines in iptables restricted container
I have custom container with VPN inside, with following iptables rules inside container:
# Flush all existing rules and chains
iptables -F
iptables -X
# Set default policies to DROP
iptables -P INPUT ...
0
votes
1
answer
116
views
IPTables rules and networking with problems
I'm using a Fritzbox for normal network and an own installed Router on rpi3 for an own network with openvpn, dnsmasq and iptables. Over the last few years the setup worked good. You can find the ...
0
votes
0
answers
295
views
How to configure iptables to forward all traffic to another host, but let said other host see the real IPs of clients?
I have a server (server a) with a public IP, and another server (server b) which is behind a NAT. I would like server a to pass all traffic (TCP, UDP, ICMP, etc) to server b, so that a client ...
1
vote
0
answers
54
views
How to prevent to lockout from vpn server?
I have a wireguard server on VPS, I am able to connect through ssh. It has to put on port forward ssh command to wireguard client.
iptables -t nat -A PREROUTING -p tcp --dport 22 -j DNAT --to-...
0
votes
1
answer
68
views
Prevent traffic from wlan0 to be routed to the internet via eth0 using iptables
I need to restrict traffic on a debian machine, e.g. using IP tables. Specifically, the server has 3 main network interfaces, eth0, wlan0, and tun0.
eth0 is the normal ethernet connection using which ...