Questions tagged [iptables]
Iptables is a module that provides the Linux operating system functions of firewall, NAT and logging of data traveling over a computer network.
1,903
questions
0
votes
1
answer
12
views
iptables not dropping udp port for exact ip address
My iptables rules are as follows, defined ip and ports are examples:
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N f2b
-A INPUT -p tcp -m multiport --dports 80,443 -j f2b
-A INPUT -d 8.8.8.8/...
0
votes
2
answers
1k
views
Mitigating TCP reset style attacks
I appear to be a victim of TCP reset attacks with the purpose of preventing me from downloading specific data. I know this is the case at this stage.
For the time being I am staying at a hotel and so ...
0
votes
1
answer
31
views
How to set up port forwarding to guest VM using iptables
I am trying to do a proof of concept for port forwarding to a libvirt guest server.
The following are the variables I use for generalization:
port=500 # Arbitrary port, for proof of ...
0
votes
1
answer
8
views
Pterodactyl Docker Pulling times out when using iptables
When I'm using iptables to block incoming traffic by either:
- iptables -A INPUT -j REJECT
or
- iptables -P INPUT DROP
It times out and says nothing and just finish pulling. (takes 1 minute).
My ...
0
votes
1
answer
24
views
Block with firewall a dns request containing a certain query
Example
let's say I'm with iptables or nftables
I want to allow a certain traffic like the following one:
iptables -A OUTPUT -d 192.168.1.1 -p udp --dport 53 -j ACCEPT
iptables -A INPUT -s 192.168.1.1 ...
0
votes
0
answers
27
views
To allow IPsec NAT-T traffic to pass through, why does the firewall still need to permit ESP when it already allows UDP 4500?
I established an IPsec VPN tunnel between two Juniper SRX routers across NAT, with the NAT being performed by the firewall (a Linux server). When attempting to configure the firewall rules to allow ...
0
votes
3
answers
3k
views
Creating a 1:1 NAT with iptables
I am trying to learn a bit about NAT translations in Linux, but I havent seen any proof-of-concept that was boiled down to as basic as possible.
Anyway. Here is a drawing of my setup:
I have a very ...
0
votes
1
answer
4k
views
iptables snat does not change source IP
I am on ubuntu (with IP 10.0.0.1) trying to snat packets going out from port 9090. I want to change the source IP to 10.0.0.2
I have added the following rule through iptables:
# iptables -t nat -A ...
0
votes
0
answers
10
views
Blocking DNS server from a router via iptables
I'm trying to block google dns server (8.8.8.8) from my router, so no machine in the network could not access this dns server.
here is my iptables table:
Chain INPUT (policy ACCEPT)
target prot ...
0
votes
1
answer
31
views
How can I block GPSD from communicating out?
I have two computers; one running gpsd and one using gpspipe -w 192.168.90.1 to query the data.
GPSD listens on port 2947 and I want to block it with iptables. I've tried so many rules, but I can ...
3
votes
2
answers
6k
views
iptables rules to allow devices on VPN to access internet
I have a linux firewall setup as my home network gateway that is correctly leasing IP addresses to devices on my network, and those devices have internet access.
I also setup OpenVPN on the same ...
0
votes
2
answers
23
views
What determines if a packet should be routed locally or forwarded?
As seen in the diagram, when the Linux kernel receives a packet, it goes through the prerouting chain, and then a routing decision is made on whether to forward it to somewhere else or deliver it to a ...
0
votes
1
answer
7k
views
sysctl: cannot stat /proc/sys/net/ipv4/icmp_echo_ignore_broadcast: No existe el fichero o el directorio
I have a Debian 9 Stretch and I'm configuring as webserver. For this I'm applying rules in iptables and another parameters in /etc/sysctl.conf
I would like to apply this rule in FW:(it's inside the ...
0
votes
0
answers
22
views
Route all TCP traffic from port to another host:port
I have a wireguard config, creating a VPN between a remote server (10.0.1.1) and my local machine (10.0.1.2), so that the server can reach the local machine and vice versa.
I'd like the server to ...
0
votes
1
answer
22
views
How can I simulate NAT reflection failure with `iptables`?
Let's say that:
My workstation LAN IP is 192.168.0.101
My WAN IP is 12.34.56.78.
My consumer-grade router is port-forwarding WAN:80 to 192.168.0.101:8080
NAT Reflection / Hairpinning is working
So ...
0
votes
0
answers
21
views
iptables port REDIRECT works locally but not from outside
I have a server that can only listen to port 23006. I want to access it from outside and on port 443.
I have systemctl setup:
$ sudo sysctl --system
* Applying /usr/lib/sysctl.d/50-pid-max.conf ...
* ...
2
votes
0
answers
1k
views
Route based on Source IP Address via 2 gateways on same NIC
In a Linux system, which acts as a gateway on my lan, I would like to route traffic based on source IP addresses.
I have 2 network cards and one of these cards has 2 different default gateways.
I know ...
0
votes
0
answers
52
views
ZeroTier not working on router running FreshTomato firmware
0
I can successfully connect to my ZeroTier with the router and join my ZT network with an automatic IP assigned my ZT. However, I can’t ping the router from from any device on my ZT network nor have ...
2
votes
5
answers
4k
views
Implementing an OpenVPN "kill switch" with iptables
I'm trying to implement a set of iptables rules for OpenVPN:
Everything (without exception) goes through OpenVPN
If OpenVPN is down or inaccessible everything (without exception) cannot access the ...
61
votes
8
answers
105k
views
How can I check if an iptables rule already exists?
I need to add a rule to iptables to block connections to a tcp port from the Internet.
Since my script may be called multiple times and there is not a script to delete the rule, I want to check if ...
19
votes
3
answers
66k
views
Iptables redirect to localhost?
Suppose I have a network with a server routing all connections from inside the network to the Internet. How can I set up iptables so that instead of routing incoming connections to the Internet, it ...
0
votes
1
answer
35
views
Unable to get Main and Backup Routers to connect to each other
I have two networks and routers (both on Advanced Tomato by Shibby) laid out as such:
Backup Router network (192.168.1.1/24)
WAN - Xfinity
LAN - small number of clients. Importantly, main network ...
0
votes
0
answers
20
views
How to redirect traffic coming from exterior to a proxy chains of 2 proxy?
I'm using redsocks to redirect the incoming non-local traffic to forward it to a socks5 proxy. Unfortunately,redsocks does not support proxy chaining, So I tried to do a turn around by running 2 ...
0
votes
1
answer
4k
views
Port forwarding from OpenVPN Client to Public Internet
I need to forward port 44444 of my VPN client to the public internet with my public IP on port 44444, how i can do this?
The VPN Server is mine and I have root access.
Example how i can do this?
...
1
vote
1
answer
99
views
About network traffic control
I have a satellite internet connection -> a pretty nice 8 processor server with 64gb of ram, running debian 7.7, two lan ports, one connected to the gateway, the other to the wifi router, wifi to ...
1
vote
2
answers
8k
views
how to restore iptables after iptables -F?
I used iptables -F on my machine, and what can I do to recover the iptables into the default without rebooting my machine?
I restarted the iptables service and it failed, and I can't find iptables ...
0
votes
1
answer
38
views
routing traffic using iptables and l2tp
Internet restrictions in my country have essentially made it impossible for VPNs to work.
As such, I wanted to circumvent this issue by using the following method.
Although "residential" ...
0
votes
0
answers
63
views
How to proxy all traffic received by Windows using Linux and redsocks?
I have a Windows machine where all of it's traffic is routed through a Linux machine simply by doing changing the Windows route :
route add 0.0.0.0 mask 0.0.0.0 192.168.1.48 where 192.168.1.48 is the ...
0
votes
0
answers
27
views
No internet connection after setuping OpenConnect server on ArchLinux
ip tuntap add mode tun dev vpn0
ip addr add 192.168.2.2/24 dev vpn0
# systemctl restart ocserv
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 8443 -j ACCEPT
iptables -...
0
votes
1
answer
141
views
openssl s_client -connect errorno=111
Hi I got problem with openssl connection. I have java application which connects from server1 to server2 I made clone of server2 and upgraded it from Debian 9.7 to Debian11. The connection to ...
2
votes
1
answer
4k
views
Docker tunnel traffic on specific port via VPN
Not sure if this is docker specific or a general networking question.
I'm running a Debian Jessie server with serveral docker containers. My understanding is that docker creates a virtual interface (...
3
votes
5
answers
7k
views
iptables - add rules not as root
One of our servers is being hit daily by a large number of spam bots. They're not able to post any spam, but they still try and end up slowing down the server for real users.
To counter this, I have ...
-4
votes
1
answer
52
views
Block youtube.com via `iptables`
For productivity reasons, I want to block access to YouTube.
What I have tried. I started by running:
dig A youtube.com +short
and then feeding the resulting address(es) to
sudo iptables -A OUTPUT -...
0
votes
1
answer
4k
views
No route to host for port 6379
I'm getting a "no route to host" error when I'm connecting a remote server to my Redis instance on another server.
Redis is definitely running and listening on port 6379. I can connect to it locally.
...
3
votes
2
answers
7k
views
DD-WRT firewall rule configuration
I'm using DD-WRT on my linksys router.
I want to limit each user on my network to 200 connections at any given time. Does anyone know the rules I enter the firewall in DD-WRT admit panel.
I tried ...
4
votes
1
answer
9k
views
Linux ip route / ip rule with fwmark and iptables -j MARK --set-mark
I just need to re-route all user traffic directly to specified gateway (different from the default one) and bypass all VPN and other routing rules.
Let's start it from scratch (reboot the system),
No ...
1
vote
0
answers
42
views
How To Add Ip Address manually in debian 12
I have two scripts that I can use to add block ip addresses to iptables. So for a list of let's say 10,000 or more it takes forever. Can I just copy and paste this block of ip address manually? If ...
1
vote
0
answers
324
views
Kali Hotspot with Internet access thru proxy
I have a question.
My Kali laptop is only have access to the internet with a proxy (username, password, serverip an Port). Now i configured a Hotspot with Hostapd and I want to use the Internet with ...
1
vote
0
answers
55
views
how to route ocserv traffic to wireguard split tunnel
I want to route ocserv traffic to wireguard split tunnel
here is the net flow
[ (ocserv client) ] =====> [ server A (ocserv + wg server) ] <===== [ server B (wg client) ]
Because wg protocol ...
0
votes
0
answers
44
views
Peers can connect to VPN server but not between themselves (Packet filtered)
I'm new into VPN topic and routing in general, and wanted to learn new thinks while setting up wireguard. However I'm facing an issue that I can't resolve for some time.
As in title: Peers can connect ...
1
vote
3
answers
4k
views
iptables SNAT/DNAT explain behaviour
I am new to iptables and I want to understand how iptables nat is working.
I have a linux machine with a lxc container.
The machine network configuration is as follows: eth0 interface which connects ...
1
vote
1
answer
4k
views
How do I install iptables-translate?
I'm on a CentOS 7 machine. I'd like to try the use of nftables. Many sites reference iptables-translate as a helpful tool for translating from iptables to nftables rules. I've installed the nftables....
3
votes
1
answer
5k
views
Match multiple strings in iptables
I have 2 strings, and i wish to queue the packet if it contains both the strings ( something like ("jsh"&&"gjhyg")), i tried following ways, but they don't seem to work:
sudo iptables -A ...
0
votes
0
answers
21
views
Firewall incoming packets are dropped with VLAN configuration
In my Windows PC, installed scapy tool for sending packets from my system to raspberry Pi board connected to my machine using VLAN.
In my raspberry Pi board, Firewall rules are already configured and ...
1
vote
2
answers
2k
views
How to rate limit using iptables Ubuntu
I'm trying to solve the question how to rate limit access for IP to our Ubuntu server. I would love to block if someone requests too much frequently our API endpoint, or in general if hits too much ...
0
votes
0
answers
20
views
Add foreign address to IP tables to Docker Image
I am new to Docker. I have a sample website running in a Docker Container and I am trying to access it from another computer on the network.
tcp 0 0 localhost:3000 0.0.0.0:* ...
0
votes
0
answers
35
views
Using (Linux) iptables to drop duplicates?
Is there an easy way to use "iptables" rules to drop duplicate packets on Linux?
If not, I'll have to spend more time figuring out why the problem is happening. In short, it has to do with ...
0
votes
1
answer
105
views
How to force a match of "mark" of iptables to send its traffic to a TPROXY proxy?
I am trying to set up a transparent proxy that works with marked packets generated by a auxiliary program that wraps a process and mark its traffic with a firewall mark.
What this setup does is to ...
2
votes
1
answer
148
views
Preserve incoming interface for answers in openwrt router
I have a Openwrt router with three interfaces:
interface br-lan: IP: 172.16.21.1 in a LAN network (172.16.21.0/24).
interface eth1: IP: 172.16.22.2 a WAN network (172.16.22.0/30) with Internet access....
0
votes
1
answer
192
views
UniFi Dream Machine Special Edition (UDM SE) - iptables NAT PREROUTING not working on own subnet
This is a very confusing situation for me and I feel like there isn't an answer to this. But I'm at a loss after hours of testing, figuring out how things are currently working or not working as I ...