Questions tagged [iptables]
Iptables is a module that provides the Linux operating system functions of firewall, NAT and logging of data traveling over a computer network.
1,904
questions
0
votes
0
answers
36
views
Linux 6.5 netfilter NAT reuses TCP ports in TIME_WAIT status?
In my understanding, Linux (netfilter)'s NAT doesn't reuse TCP ports in TIME_WAIT status, but seemingly Linux >= 6.5 reuses TCP ports in TIME_WAIT, even if the destination is the same.
For example, ...
- 31
1
vote
1
answer
34
views
Unable to forward and receive internet traffic through Raspberry Pi 4 Wifi AP
There are many tutorials out there showing how to set up a Wifi AP using Raspberry Pi 4, all with different configurations. I am trying doing it with my specific setup as following:
RPi4 acting as ...
- 123
0
votes
0
answers
35
views
Access remote SSH tunnel from inside docker container
I have a webserver on my MacBook in my home network behind a NAT, serving on port 80.
I also have a publicly accessible server running Ubuntu, from which I want to access my local webserver, so I open ...
- 101
0
votes
0
answers
65
views
Add custom UFW rule: ufw limit ... --hitcount 'custom value'
ufw reload reverts to standard all custom limit edits in /etc/ufw/user.rules.
I found a hint to write custom rules to /etc/ufw/before.rules (after.rules).
If I transfer there next rule from /etc/ufw/...
- 1
0
votes
3
answers
56
views
iptables not dropping udp port for exact ip address
My iptables rules are as follows:
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N f2b
-A INPUT -p tcp -m multiport --dports 80,443 -j f2b
-A INPUT -d (my public facing ip)/32 -p udp -m udp --...
- 93
0
votes
1
answer
45
views
How to set up port forwarding to guest VM using iptables
I am trying to do a proof of concept for port forwarding to a libvirt guest server.
The following are the variables I use for generalization:
port=500 # Arbitrary port, for proof of ...
- 115
0
votes
1
answer
21
views
Pterodactyl Docker Pulling times out when using iptables
When I'm using iptables to block incoming traffic by either:
- iptables -A INPUT -j REJECT
or
- iptables -P INPUT DROP
It times out and says nothing and just finish pulling. (takes 1 minute).
My ...
- 1
0
votes
1
answer
56
views
Block with firewall a dns request containing a certain query
Example
let's say I'm with iptables or nftables
I want to allow a certain traffic like the following one:
iptables -A OUTPUT -d 192.168.1.1 -p udp --dport 53 -j ACCEPT
iptables -A INPUT -s 192.168.1.1 ...
- 213
0
votes
0
answers
45
views
To allow IPsec NAT-T traffic to pass through, why does the firewall still need to permit ESP when it already allows UDP 4500?
I established an IPsec VPN tunnel between two Juniper SRX routers across NAT, with the NAT being performed by the firewall (a Linux server). When attempting to configure the firewall rules to allow ...
0
votes
0
answers
18
views
Blocking DNS server from a router via iptables
I'm trying to block google dns server (8.8.8.8) from my router, so no machine in the network could not access this dns server.
here is my iptables table:
Chain INPUT (policy ACCEPT)
target prot ...
- 1
0
votes
1
answer
31
views
How can I block GPSD from communicating out?
I have two computers; one running gpsd and one using gpspipe -w 192.168.90.1 to query the data.
GPSD listens on port 2947 and I want to block it with iptables. I've tried so many rules, but I can ...
- 209
0
votes
2
answers
26
views
What determines if a packet should be routed locally or forwarded?
As seen in the diagram, when the Linux kernel receives a packet, it goes through the prerouting chain, and then a routing decision is made on whether to forward it to somewhere else or deliver it to a ...
- 138
0
votes
0
answers
26
views
Route all TCP traffic from port to another host:port
I have a wireguard config, creating a VPN between a remote server (10.0.1.1) and my local machine (10.0.1.2), so that the server can reach the local machine and vice versa.
I'd like the server to ...
- 125
0
votes
1
answer
24
views
How can I simulate NAT reflection failure with `iptables`?
Let's say that:
My workstation LAN IP is 192.168.0.101
My WAN IP is 12.34.56.78.
My consumer-grade router is port-forwarding WAN:80 to 192.168.0.101:8080
NAT Reflection / Hairpinning is working
So ...
- 933
0
votes
2
answers
86
views
iptables port REDIRECT works locally but not from outside
I have a server that can only listen to port 23006. I want to access it from outside and on port 443.
I have systemctl setup:
$ sudo sysctl --system
* Applying /usr/lib/sysctl.d/50-pid-max.conf ...
* ...
- 1
0
votes
0
answers
54
views
ZeroTier not working on router running FreshTomato firmware
0
I can successfully connect to my ZeroTier with the router and join my ZT network with an automatic IP assigned my ZT. However, I can’t ping the router from from any device on my ZT network nor have ...
0
votes
1
answer
36
views
Unable to get Main and Backup Routers to connect to each other
I have two networks and routers (both on Advanced Tomato by Shibby) laid out as such:
Backup Router network (192.168.1.1/24)
WAN - Xfinity
LAN - small number of clients. Importantly, main network ...
- 1
0
votes
0
answers
27
views
How to redirect traffic coming from exterior to a proxy chains of 2 proxy?
I'm using redsocks to redirect the incoming non-local traffic to forward it to a socks5 proxy. Unfortunately,redsocks does not support proxy chaining, So I tried to do a turn around by running 2 ...
- 13
0
votes
0
answers
102
views
How to proxy all traffic received by Windows using Linux and redsocks?
I have a Windows machine where all of it's traffic is routed through a Linux machine simply by doing changing the Windows route :
route add 0.0.0.0 mask 0.0.0.0 192.168.1.48 where 192.168.1.48 is the ...
- 13
0
votes
1
answer
40
views
routing traffic using iptables and l2tp
Internet restrictions in my country have essentially made it impossible for VPNs to work.
As such, I wanted to circumvent this issue by using the following method.
Although "residential" ...
0
votes
0
answers
39
views
No internet connection after setuping OpenConnect server on ArchLinux
ip tuntap add mode tun dev vpn0
ip addr add 192.168.2.2/24 dev vpn0
# systemctl restart ocserv
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 8443 -j ACCEPT
iptables -...
- 101
0
votes
1
answer
279
views
openssl s_client -connect errorno=111
Hi I got problem with openssl connection. I have java application which connects from server1 to server2 I made clone of server2 and upgraded it from Debian 9.7 to Debian11. The connection to ...
- 1
-4
votes
1
answer
64
views
Block youtube.com via `iptables`
For productivity reasons, I want to block access to YouTube.
What I have tried. I started by running:
dig A youtube.com +short
and then feeding the resulting address(es) to
sudo iptables -A OUTPUT -...
1
vote
1
answer
84
views
How To Add Ip Address manually in debian 12
I have two scripts that I can use to add block ip addresses to iptables. So for a list of let's say 10,000 or more it takes forever. Can I just copy and paste this block of ip address manually? If ...
- 11
0
votes
0
answers
59
views
Peers can connect to VPN server but not between themselves (Packet filtered)
I'm new into VPN topic and routing in general, and wanted to learn new thinks while setting up wireguard. However I'm facing an issue that I can't resolve for some time.
As in title: Peers can connect ...
- 1
1
vote
0
answers
70
views
how to route ocserv traffic to wireguard split tunnel
I want to route ocserv traffic to wireguard split tunnel
here is the net flow
[ (ocserv client) ] =====> [ server A (ocserv + wg server) ] <===== [ server B (wg client) ]
Because wg protocol ...
- 271
0
votes
0
answers
23
views
Firewall incoming packets are dropped with VLAN configuration
In my Windows PC, installed scapy tool for sending packets from my system to raspberry Pi board connected to my machine using VLAN.
In my raspberry Pi board, Firewall rules are already configured and ...
- 393
0
votes
0
answers
23
views
Add foreign address to IP tables to Docker Image
I am new to Docker. I have a sample website running in a Docker Container and I am trying to access it from another computer on the network.
tcp 0 0 localhost:3000 0.0.0.0:* ...
- 113
0
votes
0
answers
42
views
Using (Linux) iptables to drop duplicates?
Is there an easy way to use "iptables" rules to drop duplicate packets on Linux?
If not, I'll have to spend more time figuring out why the problem is happening. In short, it has to do with ...
- 1
0
votes
1
answer
146
views
How to force a match of "mark" of iptables to send its traffic to a TPROXY proxy?
I am trying to set up a transparent proxy that works with marked packets generated by a auxiliary program that wraps a process and mark its traffic with a firewall mark.
What this setup does is to ...
- 101
2
votes
1
answer
156
views
Preserve incoming interface for answers in openwrt router
I have a Openwrt router with three interfaces:
interface br-lan: IP: 172.16.21.1 in a LAN network (172.16.21.0/24).
interface eth1: IP: 172.16.22.2 a WAN network (172.16.22.0/30) with Internet access....
- 31
0
votes
1
answer
276
views
UniFi Dream Machine Special Edition (UDM SE) - iptables NAT PREROUTING not working on own subnet
This is a very confusing situation for me and I feel like there isn't an answer to this. But I'm at a loss after hours of testing, figuring out how things are currently working or not working as I ...
- 3
1
vote
1
answer
191
views
IPTables rules and networking with problems 2
My plan is to have a computer that forwards all traffic from internal interface ens19 to openvpn-interface tun0. The system has 2 physical interfaces: ens18 for local network with Internet connection ...
- 11
0
votes
0
answers
199
views
reflection nat / hairpin nat with iptables
I try to implement reflection nat on one of my servers. There is a vm running on the server with ip 10.0.0.10.
My iptables look like this:
root@srv8:~# iptables -t nat -L -n -v --line-numbers
Chain ...
- 227
1
vote
1
answer
108
views
Stateful forwarding rule in iptables
I have created this bridge device
ip link add dev br0 type bridge
ip addr add 172.16.0.254/16 broadcast 172.16.255.255 dev br0
ip link set br0 up
sysctl -w net.ipv4.conf.br0.forwarding=1
This device ...
- 65
0
votes
0
answers
97
views
Ping not leaving linux VM
Firstly, only just learning Linux and networking, so please assume I have minimal knowledge!
Perhaps a week ago I was working on a small python script that involved pinging devices from the Kali Linux ...
1
vote
1
answer
223
views
Unable to open port on debian vps
Trying to open 51820 UDP
I do
iptables -A INPUT -p udp --dport 51820 -j ACCEPT
then iptables -L
I can see
ACCEPT udp -- anywhere anywhere udp dpt:51820
then I do
/sbin/...
- 55
1
vote
1
answer
78
views
In Linux how to loop-back the internal traffic that's destined to the server's own NATed public IP?
By internal I mean only the traffic originating within the server itself (not LAN or other servers). I have a cloud VM where the Public IP provided by the cloud vendor is not directly attached to the ...
- 25
0
votes
0
answers
46
views
UFW not filtering FORWARD traffic on same (tun0) interface
I have an Ubuntu 22.04 server with OpenVPN running and I want to filter access between clients on the tun0 interface with UFW.
As far as I know this all has to do with the FORWARDING chain within UFW.
...
- 1
1
vote
0
answers
91
views
How can I use iptables to forward all traffic through an interface based in gid?
I'm on Debian 12 bookworm
I'm trying to forward all traffic from (and to) users in the group watchers through interface tun9 and prevent them from using enp2s0.
I've set up a tunnel using openvpn with ...
- 201
0
votes
0
answers
36
views
setup up ssh connection with 3 Ubuntu machines to bypass a firewall
I have 3 machines, here are the IP addresses of each of them with their ssh port :
first device IP: 192.168.1.2
second device IP" 192.168.1.3 port 22822
third device IP: 192.168.1.4 port 22
I ...
0
votes
0
answers
32
views
triple vpn tunnel to bypass vpn blocks
is it technically possible to setup a VPN tunnel (or port-forwarding,or any other ways) as illustrated with bellow picture ?
Assuming there is an restricted FW which even VPNs do not work plus "...
- 271
0
votes
0
answers
141
views
Synology DSM 7.2 cannot add iptables LOG rule
When trying to add a LOG rule to iptables on Synology DSM 7.2 the following error is thrown:
iptables: No chain/target/match by that name.
Verified that LOG module is loaded, rule is valid, chain is ...
0
votes
0
answers
40
views
Linux/DD-WRT iptables/route/policy based routing - static route wildcard domain to a different gateway
dd-wrt router command:
route add *.googlevideo.com gw (anothergatewayonsubnet)
use to work on old ddwrt
is there anyway to redirect *.googlevideo.com with route add, ip route, iptables to another ...
- 119
0
votes
1
answer
442
views
How to configure iptables to allow OpenVPN clients to access internet via the server, if it's run under OpenVZ?
So what I have right now:
A working VPN server that clients can connect to running under ubuntu 22.04
Enabled ip_forward on the server
What I don't have is clients being able to access the Internet, ...
- 101
0
votes
1
answer
114
views
iptables how to port forward remote to local
This is the scenario:
I have an encoded file that I cannot change the API URL but I know what it is. Let's suppose it is https://my.api.site.com/v1.
When I run php myfile.php, it connects to the API ...
- 403
0
votes
0
answers
27
views
Iptable rules through two firewalls for an rdp connection
Suppose I have a network topology similar to the one above, if i wanted to rdp into a host on the private network from home these are the following iptable rules i have:
Firewall 1:
$IPT -t nat -A ...
- 101
0
votes
0
answers
87
views
Setup FreshTomato 2021.2 on R7000 to forward traffic from internet through OpenVPN tunnel
With FreshTomato 2021.2 on R7000, I'm trying to allow port forwarding (80/443) inside OpenVPN client to able to reach a device on my LAN.
Here's the current status of iptables (iptables -S):
-P INPUT ...
-1
votes
1
answer
290
views
IPtables dropping packets I can't see with tcpdump and I don't know why?
My IPtables rules are blocking apt update for example:
root@vpn:~# apt update
Ign:1 https://pkgs.tailscale.com/stable/ubuntu jammy InRelease
Ign:2 http://de.archive.ubuntu.com/ubuntu jammy InRelease
...
- 11
0
votes
0
answers
88
views
iptables - port ward and NAT destination address
I have a server running strongswan. I have two clients connecting to this server over IPSec. My encryption domain is 10.1.1.3/32 which is the real address of the server. However, client A wants my ...
- 101