Questions tagged [iptables]

Iptables is a module that provides the Linux operating system functions of firewall, NAT and logging of data traveling over a computer network.

Filter by
Sorted by
Tagged with
0 votes
1 answer
12 views

iptables not dropping udp port for exact ip address

My iptables rules are as follows, defined ip and ports are examples: -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -N f2b -A INPUT -p tcp -m multiport --dports 80,443 -j f2b -A INPUT -d 8.8.8.8/...
0 votes
2 answers
1k views

Mitigating TCP reset style attacks

I appear to be a victim of TCP reset attacks with the purpose of preventing me from downloading specific data. I know this is the case at this stage. For the time being I am staying at a hotel and so ...
0 votes
1 answer
31 views

How to set up port forwarding to guest VM using iptables

I am trying to do a proof of concept for port forwarding to a libvirt guest server. The following are the variables I use for generalization: port=500 # Arbitrary port, for proof of ...
0 votes
1 answer
8 views

Pterodactyl Docker Pulling times out when using iptables

When I'm using iptables to block incoming traffic by either: - iptables -A INPUT -j REJECT or - iptables -P INPUT DROP It times out and says nothing and just finish pulling. (takes 1 minute). My ...
0 votes
1 answer
24 views

Block with firewall a dns request containing a certain query

Example let's say I'm with iptables or nftables I want to allow a certain traffic like the following one: iptables -A OUTPUT -d 192.168.1.1 -p udp --dport 53 -j ACCEPT iptables -A INPUT -s 192.168.1.1 ...
0 votes
0 answers
27 views

To allow IPsec NAT-T traffic to pass through, why does the firewall still need to permit ESP when it already allows UDP 4500?

I established an IPsec VPN tunnel between two Juniper SRX routers across NAT, with the NAT being performed by the firewall (a Linux server). When attempting to configure the firewall rules to allow ...
0 votes
3 answers
3k views

Creating a 1:1 NAT with iptables

I am trying to learn a bit about NAT translations in Linux, but I havent seen any proof-of-concept that was boiled down to as basic as possible. Anyway. Here is a drawing of my setup: I have a very ...
0 votes
1 answer
4k views

iptables snat does not change source IP

I am on ubuntu (with IP 10.0.0.1) trying to snat packets going out from port 9090. I want to change the source IP to 10.0.0.2 I have added the following rule through iptables: # iptables -t nat -A ...
0 votes
0 answers
10 views

Blocking DNS server from a router via iptables

I'm trying to block google dns server (8.8.8.8) from my router, so no machine in the network could not access this dns server. here is my iptables table: Chain INPUT (policy ACCEPT) target prot ...
0 votes
1 answer
31 views

How can I block GPSD from communicating out?

I have two computers; one running gpsd and one using gpspipe -w 192.168.90.1 to query the data. GPSD listens on port 2947 and I want to block it with iptables. I've tried so many rules, but I can ...
3 votes
2 answers
6k views

iptables rules to allow devices on VPN to access internet

I have a linux firewall setup as my home network gateway that is correctly leasing IP addresses to devices on my network, and those devices have internet access. I also setup OpenVPN on the same ...
0 votes
2 answers
23 views

What determines if a packet should be routed locally or forwarded?

As seen in the diagram, when the Linux kernel receives a packet, it goes through the prerouting chain, and then a routing decision is made on whether to forward it to somewhere else or deliver it to a ...
0 votes
1 answer
7k views

sysctl: cannot stat /proc/sys/net/ipv4/icmp_echo_ignore_broadcast: No existe el fichero o el directorio

I have a Debian 9 Stretch and I'm configuring as webserver. For this I'm applying rules in iptables and another parameters in /etc/sysctl.conf I would like to apply this rule in FW:(it's inside the ...
0 votes
0 answers
22 views

Route all TCP traffic from port to another host:port

I have a wireguard config, creating a VPN between a remote server (10.0.1.1) and my local machine (10.0.1.2), so that the server can reach the local machine and vice versa. I'd like the server to ...
0 votes
1 answer
22 views

How can I simulate NAT reflection failure with `iptables`?

Let's say that: My workstation LAN IP is 192.168.0.101 My WAN IP is 12.34.56.78. My consumer-grade router is port-forwarding WAN:80 to 192.168.0.101:8080 NAT Reflection / Hairpinning is working So ...
0 votes
0 answers
21 views

iptables port REDIRECT works locally but not from outside

I have a server that can only listen to port 23006. I want to access it from outside and on port 443. I have systemctl setup: $ sudo sysctl --system * Applying /usr/lib/sysctl.d/50-pid-max.conf ... * ...
2 votes
0 answers
1k views

Route based on Source IP Address via 2 gateways on same NIC

In a Linux system, which acts as a gateway on my lan, I would like to route traffic based on source IP addresses. I have 2 network cards and one of these cards has 2 different default gateways. I know ...
0 votes
0 answers
52 views

ZeroTier not working on router running FreshTomato firmware

0 I can successfully connect to my ZeroTier with the router and join my ZT network with an automatic IP assigned my ZT. However, I can’t ping the router from from any device on my ZT network nor have ...
2 votes
5 answers
4k views

Implementing an OpenVPN "kill switch" with iptables

I'm trying to implement a set of iptables rules for OpenVPN: Everything (without exception) goes through OpenVPN If OpenVPN is down or inaccessible everything (without exception) cannot access the ...
61 votes
8 answers
105k views

How can I check if an iptables rule already exists?

I need to add a rule to iptables to block connections to a tcp port from the Internet. Since my script may be called multiple times and there is not a script to delete the rule, I want to check if ...
19 votes
3 answers
66k views

Iptables redirect to localhost?

Suppose I have a network with a server routing all connections from inside the network to the Internet. How can I set up iptables so that instead of routing incoming connections to the Internet, it ...
0 votes
1 answer
35 views

Unable to get Main and Backup Routers to connect to each other

I have two networks and routers (both on Advanced Tomato by Shibby) laid out as such: Backup Router network (192.168.1.1/24) WAN - Xfinity LAN - small number of clients. Importantly, main network ...
0 votes
0 answers
20 views

How to redirect traffic coming from exterior to a proxy chains of 2 proxy?

I'm using redsocks to redirect the incoming non-local traffic to forward it to a socks5 proxy. Unfortunately,redsocks does not support proxy chaining, So I tried to do a turn around by running 2 ...
0 votes
1 answer
4k views

Port forwarding from OpenVPN Client to Public Internet

I need to forward port 44444 of my VPN client to the public internet with my public IP on port 44444, how i can do this? The VPN Server is mine and I have root access. Example how i can do this? ...
1 vote
1 answer
99 views

About network traffic control

I have a satellite internet connection -> a pretty nice 8 processor server with 64gb of ram, running debian 7.7, two lan ports, one connected to the gateway, the other to the wifi router, wifi to ...
1 vote
2 answers
8k views

how to restore iptables after iptables -F?

I used iptables -F on my machine, and what can I do to recover the iptables into the default without rebooting my machine? I restarted the iptables service and it failed, and I can't find iptables ...
0 votes
1 answer
38 views

routing traffic using iptables and l2tp

Internet restrictions in my country have essentially made it impossible for VPNs to work. As such, I wanted to circumvent this issue by using the following method. Although "residential" ...
0 votes
0 answers
63 views

How to proxy all traffic received by Windows using Linux and redsocks?

I have a Windows machine where all of it's traffic is routed through a Linux machine simply by doing changing the Windows route : route add 0.0.0.0 mask 0.0.0.0 192.168.1.48 where 192.168.1.48 is the ...
0 votes
0 answers
27 views

No internet connection after setuping OpenConnect server on ArchLinux

ip tuntap add mode tun dev vpn0 ip addr add 192.168.2.2/24 dev vpn0 # systemctl restart ocserv iptables -A INPUT -p tcp --dport 22 -j ACCEPT iptables -A INPUT -p tcp --dport 8443 -j ACCEPT iptables -...
0 votes
1 answer
141 views

openssl s_client -connect errorno=111

Hi I got problem with openssl connection. I have java application which connects from server1 to server2 I made clone of server2 and upgraded it from Debian 9.7 to Debian11. The connection to ...
2 votes
1 answer
4k views

Docker tunnel traffic on specific port via VPN

Not sure if this is docker specific or a general networking question. I'm running a Debian Jessie server with serveral docker containers. My understanding is that docker creates a virtual interface (...
3 votes
5 answers
7k views

iptables - add rules not as root

One of our servers is being hit daily by a large number of spam bots. They're not able to post any spam, but they still try and end up slowing down the server for real users. To counter this, I have ...
-4 votes
1 answer
52 views

Block youtube.com via `iptables`

For productivity reasons, I want to block access to YouTube. What I have tried. I started by running: dig A youtube.com +short and then feeding the resulting address(es) to sudo iptables -A OUTPUT -...
0 votes
1 answer
4k views

No route to host for port 6379

I'm getting a "no route to host" error when I'm connecting a remote server to my Redis instance on another server. Redis is definitely running and listening on port 6379. I can connect to it locally. ...
3 votes
2 answers
7k views

DD-WRT firewall rule configuration

I'm using DD-WRT on my linksys router. I want to limit each user on my network to 200 connections at any given time. Does anyone know the rules I enter the firewall in DD-WRT admit panel. I tried ...
4 votes
1 answer
9k views

Linux ip route / ip rule with fwmark and iptables -j MARK --set-mark

I just need to re-route all user traffic directly to specified gateway (different from the default one) and bypass all VPN and other routing rules. Let's start it from scratch (reboot the system), No ...
1 vote
0 answers
42 views

How To Add Ip Address manually in debian 12

I have two scripts that I can use to add block ip addresses to iptables. So for a list of let's say 10,000 or more it takes forever. Can I just copy and paste this block of ip address manually? If ...
1 vote
0 answers
324 views

Kali Hotspot with Internet access thru proxy

I have a question. My Kali laptop is only have access to the internet with a proxy (username, password, serverip an Port). Now i configured a Hotspot with Hostapd and I want to use the Internet with ...
1 vote
0 answers
55 views

how to route ocserv traffic to wireguard split tunnel

I want to route ocserv traffic to wireguard split tunnel here is the net flow [ (ocserv client) ] =====> [ server A (ocserv + wg server) ] <===== [ server B (wg client) ] Because wg protocol ...
0 votes
0 answers
44 views

Peers can connect to VPN server but not between themselves (Packet filtered)

I'm new into VPN topic and routing in general, and wanted to learn new thinks while setting up wireguard. However I'm facing an issue that I can't resolve for some time. As in title: Peers can connect ...
1 vote
3 answers
4k views

iptables SNAT/DNAT explain behaviour

I am new to iptables and I want to understand how iptables nat is working. I have a linux machine with a lxc container. The machine network configuration is as follows: eth0 interface which connects ...
1 vote
1 answer
4k views

How do I install iptables-translate?

I'm on a CentOS 7 machine. I'd like to try the use of nftables. Many sites reference iptables-translate as a helpful tool for translating from iptables to nftables rules. I've installed the nftables....
3 votes
1 answer
5k views

Match multiple strings in iptables

I have 2 strings, and i wish to queue the packet if it contains both the strings ( something like ("jsh"&&"gjhyg")), i tried following ways, but they don't seem to work: sudo iptables -A ...
0 votes
0 answers
21 views

Firewall incoming packets are dropped with VLAN configuration

In my Windows PC, installed scapy tool for sending packets from my system to raspberry Pi board connected to my machine using VLAN. In my raspberry Pi board, Firewall rules are already configured and ...
1 vote
2 answers
2k views

How to rate limit using iptables Ubuntu

I'm trying to solve the question how to rate limit access for IP to our Ubuntu server. I would love to block if someone requests too much frequently our API endpoint, or in general if hits too much ...
0 votes
0 answers
20 views

Add foreign address to IP tables to Docker Image

I am new to Docker. I have a sample website running in a Docker Container and I am trying to access it from another computer on the network. tcp 0 0 localhost:3000 0.0.0.0:* ...
0 votes
0 answers
35 views

Using (Linux) iptables to drop duplicates?

Is there an easy way to use "iptables" rules to drop duplicate packets on Linux? If not, I'll have to spend more time figuring out why the problem is happening. In short, it has to do with ...
0 votes
1 answer
105 views

How to force a match of "mark" of iptables to send its traffic to a TPROXY proxy?

I am trying to set up a transparent proxy that works with marked packets generated by a auxiliary program that wraps a process and mark its traffic with a firewall mark. What this setup does is to ...
2 votes
1 answer
148 views

Preserve incoming interface for answers in openwrt router

I have a Openwrt router with three interfaces: interface br-lan: IP: 172.16.21.1 in a LAN network (172.16.21.0/24). interface eth1: IP: 172.16.22.2 a WAN network (172.16.22.0/30) with Internet access....
0 votes
1 answer
192 views

UniFi Dream Machine Special Edition (UDM SE) - iptables NAT PREROUTING not working on own subnet

This is a very confusing situation for me and I feel like there isn't an answer to this. But I'm at a loss after hours of testing, figuring out how things are currently working or not working as I ...

1
2 3 4 5
39