Questions tagged [iptables]
Iptables is a module that provides the Linux operating system functions of firewall, NAT and logging of data traveling over a computer network.
1,836
questions
0
votes
0
answers
15
views
Using iptables-nft/ebtables-nft to intercept specific forwarded/bridged IP packets on a bridge and redirect them to the bridge device itself
With a bridge br0 using eth0 and wlan0 as bridge ports, formerly one could intercept packets arriving on a bridge port with iptables -t mangle -A PREROUTING -m physdev --physdev-in wlan0 --protocol ...
- 1
0
votes
0
answers
17
views
using wireguard peer as default gateway for another peer
Here my config (server wg in docker, peer1, peer2)
S = 10.14.88.1
P1 = 10.14.88.2
P2 = 10.14.88.3
[Interface]
Address = 10.14.88.1
ListenPort = 51820
PrivateKey = XXX
PostUp = iptables -A FORWARD -i %...
- 1
1
vote
1
answer
29
views
VPN client cannot access network behind VPN server(wireguard)
I have created a wireguard VPN server, but the clients cannot access some networks behind the server,
wireguard-server
eno1: 10.10.10.2/24 (GW)
eno2: 10.10.11.2/24
wg0: 10.66.66.1/24
I want the ...
- 13
1
vote
0
answers
18
views
Kali Linux takes way too long to load the GUI after entering the password? IPTABLES
After entering the passward to login, it takes way too long to load GUI.
I think the issue is with the firewall, when I enable it the GUI loads way two long to load. More than a minute, if it's ...
- 11
1
vote
0
answers
24
views
Mark only the udp traffic above a certain rate using iptables commands
I'm trying to achieve the following scenario:
Using the iptables command, mark UDP traffic with destination port 1234 that passes through a Linux router with the recommended DSCP value for Expedited ...
- 11
0
votes
1
answer
27
views
iptables: allow port forwarding destined to the WAN interface but from within the local network
I know this question exist in a dozen forms already but most were about commercial wifi routers etc.
I have an Ubuntu 20.04LTS box with a bunch of interfaces set up as a firewall/NAT box, one of the ...
- 103
0
votes
0
answers
23
views
TC limit Speed with Multiple Ports
i have an script that works well for single port limitation writen in bash and works with TC
but imagine each vpn users connects to server with unique port, how can we set speed limit each ?
exp: ...
- 11
0
votes
0
answers
20
views
How to set speed limit per IP in IP range in Ubuntu
What I want:
I've setup a openvpn-server and want the clients in range of 10.8.0.0/21 limit their speed to 10mbit for each IP as a total limit of 100mbit.
wan interface : eth0
openvpn interface : ...
- 65
0
votes
0
answers
24
views
Forwarded packet seemingly, skipping POSTROUTING rules
I have a very simple Wireguard configuration. Client are assigned 10.7.0.0/24 addressed, traffic is forwarded out the primary interface, finally the packets are SNAT'd out of the primary interface on '...
- 101
0
votes
0
answers
47
views
Why do we need multiple iptables?
In man iptables there are 4 tables defined: filter, mangle, nat, raw. And many of them have the same predefined chain. For instance, nat and mangle both have OUTPUT chain.
The question is why do we ...
- 101
1
vote
0
answers
20
views
RTNETLINK answers: Invalid argument when trying to use avahi-autoipd on Petalinux device
I have an embedded device running PetaLinux that I wish to configure to use avahi-autoipd to use LLA on an interface.
I have been trying to do this from the CLI to ensure it works as expected, and I ...
- 111
0
votes
1
answer
43
views
How to send back TCP packets using iptables
I am trying to demonstrate TCP communication with a Ubuntu 18.04 box (which mocks a QNX setup) that does not have a listener installed. Consider that due to some license issues it might not be ...
2
votes
1
answer
41
views
Redirect OR warn (during initial negotiation?) SMTP submitters to use TLS on port 587 - leave 25 explicitly blocked by firewall for better security
This question went over poorly on S.F., but as I said there I've managed to find a lot of closely related information, but not an answer truly addressing my question.
I am expanding on my homelab ...
- 133
0
votes
0
answers
78
views
How set up iptables for Double VPN (VPN chain) with Wireguard?
I'm currently trying to set up a VPN chain (double vpn) with using Wireguard. I tried to use examples from different articles: https://allanjohn909.medium.com/vpn-chaining-with-wireguard-ec2bd500509e ...
0
votes
1
answer
12
views
Why does it go through netfilter postrouting when visiting local ports?
Environment：
[root@VM-32-4-centos ~]# uname -r
3.10.0-514.26.2.el7.x86_64
I have set log printing in the following chain：
[root@VM-32-4-centos ~]# iptables -A INPUT -p tcp --dport 8000 -j LOG --log-...
0
votes
0
answers
28
views
connect to ssh via iptable tunnel
there is two server A (1.1.1.1) and B(2.2.2.2)
I defined an iptable PREROUTING like this
sudo iptables -t nat -A PREROUTING -p tcp --dport 1111 -j DNAT --to-destination 2.2.2.2:22
sudo iptables -t nat ...
- 101
0
votes
1
answer
34
views
Forwarding packets using iptables without hiding source ip
I have a debian router with a wan interface (eth0) and a lan interface (eth1). I have configured it to masquerade certain packets from eth0 to eth1, but i want to keep the source ip instead of ...
- 33
0
votes
1
answer
75
views
iptables nat table does not work as expected?
I aim to have some iptables rules to observe the flow of network traffic through iptables rules. However, iptables does not seem to work as I expected. It appears that packets which are the response ...
2
votes
0
answers
32
views
iptables to protect an off-grid device
Let's say I have two device at home:
One is not connected to the ethernet as I don't want to be hackable.
The other is a classic computer with Internet access.
I'd like to get the status of the off-...
- 177
1
vote
0
answers
26
views
Trying to setup iptables properly
I have dummy0 interface on my machine. I need to forward its port 10456 towards loopback port 10456 which is forwarded via ngrok to some remote endpoint (very convinient). I have never done any ...
2
votes
2
answers
54
views
IPs not blocking with iptables/fail2ban "already banned" messages
I am using old iptables v1.4.7 in conjunction with fail2ban. I am however seeing "already banned" messages in the logs and can't figure out why they still reach my server and are not being ...
- 23
3
votes
1
answer
48
views
Why a packet is sent with a wrong source IP address when setting fwmark using iptables mangle to change routing table?
I want to route a traffic from a specific program through a WireGuard VPN.
I set the wireguard interface, config, routings, etc.
To do routing through the VPN only for a single program, I run the ...
- 43
3
votes
1
answer
81
views
Iptables configuration for NAT with KVM
I have a server with a public ip (142.0.0.142). This server hosts a KVM virtual machine (192.168.100.10) and redirects the HTTP/S traffic to this VM.
I followed those instructions to configure a "...
- 35
0
votes
1
answer
35
views
Implement iptables that drops ACK packet but accepts it for a client
I have an IoT-device (called Device A in image below) that communicates with my server through a router. However, once in a while my IoT device gets a WDT and restarts and from my investigation it ...
1
vote
2
answers
288
views
How iptables "--clamp-mss-to-pmtu" calculates PMTU?
I have seen in many places this iptables rule iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu to deal with Path MTU Discovery issues.
From my understanding, PMTU may ...
- 13
0
votes
1
answer
16
views
Streaming data and firewall on Chromebook Linux
I'm trying to use a custom python app that needs to expose a port (5000) on my Google chromebook and it's not working. The python package is python-osc. How do I check if a firewall in Linux is ...
- 101
0
votes
0
answers
139
views
OpenConnect Server not connecting to internet using ufw ip forwarding
I want to create an OpenConnect VPN server. I followed this tutorial step by step however, while I'm able to connect to the open connect server using a client, the problem is that I don't have any ...
- 51
1
vote
0
answers
81
views
How do I programmatically block websites on an ASUS router via iptables?
I'm running an ASUS RT-AX88U-4168; the router's web admin allows me to configure rules that block all traffic to certain websites. I'm trying to recreate that same ability via the router command line [...
- 11
0
votes
0
answers
16
views
RHEL 7.9 : Control the tables order of the iptables-save output command
I'm facing an issue where I have to control the output of iptables-save.
It look like the table's order (*filter, *nat) output is kinda random.
For exemple here we have filter table in first, but we ...
1
vote
1
answer
149
views
Using VPS to give Public IP to on home network
As my provider does not give me a public IPv4 Address, I am using a VPS combined with a Wireguard tunnel to make my homeserver reachable from the Internet (via Ipv4 and Ipv6).
On my homeserver, the ...
2
votes
1
answer
733
views
Routing WireGuard peer's traffic via another peer
I want to use the RPi in my house as a WireGuard VPN. Unfortunately, my ISP mandates a CGNAT. My plan was to have the RPi connect as a WireGuard peer to my server (with a static IP). I would then ...
- 23
0
votes
0
answers
45
views
Why isn't my wireguard working properly?
I have an AWS debian ec2 that I want to use as a vpn server, I installed wireguard and created the following server config
[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = <...
anon
0
votes
1
answer
31
views
tcpdump shows traffic even for down interface
Using Debian Buster and having configured VLAN interface online, I wonder that tcpdump shows any traffic send to the external IP address?
Having a server on Hetzner and want to configure VLAN traffic ...
- 263
0
votes
0
answers
64
views
Port forwarding between Host and QEMU VM
I am accessing a host using a SSH over a VPN. That host have a VM on QEMU which I deploy using virt-manager. The host and VM are able to communicate. The VM have a Apache Webserver running. I am able ...
- 3
0
votes
0
answers
32
views
How I can forward a windows remote desktop connection?
I have this issue, my internet supplier only enables all ports for one local IP address, this IP is hooked to a home server that runs nginx and some web services, I need to redirect traffic for port ...
1
vote
0
answers
25
views
How to configure DNAT on linux PC so that windows PC destination address can NAT to external linux server?
Topology:
Windows PC (Eg.,20.0.0.2) <---> enp6s0 20.0.0.1 [Ubunthu 20.04 as NAT] enp8s0 172.30.18.95<-->eth1 - Linux PC {172.30.18.90}
Requirement:
I want to ftp 30.0.0.1 from windows PC, ...
- 11
0
votes
0
answers
32
views
Route incoming packets on interface through another interface
I think I have a simple scenario that I cannot manage to make it work:
I have a router (Edgerouter-X) whose eth0 is connected to my home LAN (192.168.0.0/24) which is connected to the internet. The ...
0
votes
0
answers
81
views
Issues with Wireguard routing from a single NIC
I am having issues with Wireguard seemingly not routing everything. Basically I have a ubuntu box at home, where I have installed Wireguard.
I want to be able to connect to that box and access both ...
- 144
0
votes
0
answers
120
views
Allowing specific docker container to be accessed using VPN only
I am trying to make a server which can only be accessed using VPN (using docker).
For Example->
Lets say I have a django server running on docker and it also hosts a openVPN container. I have to ...
0
votes
0
answers
144
views
How can you route traffic from a QEMU VM to a Wireguard interface on Linux?
I am developing a CTF platform and I need to separate and isolate my VM's from each other. My problem lies in how Qemu VM connects to a bride (let's call it br0) which in turn somehow has to forward ...
1
vote
0
answers
35
views
Port forwarding from within container
For the past two years I have been using Windscribes port forwarding service to access a few services within my LAN from an external IP. Because I am behind a NAT this has been the best solution and ...
- 53
0
votes
0
answers
93
views
VPS behind NAT can't connect to its external IP from local network
I have a VPS behind NAT with ports open using iptables.
I have a software installed on the VPS and it can't connect to its public IP. I also tried to check it with Telnet.
Output:
root@vps:~# telnet ...
Gamel
1
vote
0
answers
445
views
How to add WireGuard container to internal Docker network to add internet connectivity?
I have two Docker networks:
public which is a normal bridge network with access to the host upstream network
private which is a bridge, internal: true and hosts a fleet of containers
networks:
...
- 257
-1
votes
3
answers
80
views
Whitelist all USA traffic, blacklist all non USA traffic, can this be done by a country code instead of by IPs?
I've read a dozen guides to using iptables, fail2ban and csf.
The commonality seems to be:
1) generate a list of IP rangess for the country you want
2) write a bash/python script to run the allow ...
- 153
0
votes
0
answers
39
views
one iptables PREROUTING rule not work while other one works
I have a linux device with two iptables rules in it. And the behaviors are interesting.
root@xxx:~# iptables -t nat -nvL PREROUTING
Chain PREROUTING (policy ACCEPT 4 packets, 812 bytes)
pkts bytes ...
- 101
0
votes
0
answers
84
views
Proxy server with squid and multiple 4G routers
A particular Raspberry Pi 4 is connected to wlan0 (192.168.10.174) on a 4G router (192.168.10.1) and has a 4G mobile connection.
Already on interface eth0 (192.168.1.41), is my local network router (...
2
votes
2
answers
425
views
Change all rules in iptables when changing IP address
I have a network gateway system using iptables to allow/deny traffic to/from an internal network. I have to manually add and remove rules in iptables depending on the requirements of the entities in ...
0
votes
0
answers
34
views
Can connect VM 1 to VM 2 across a router, but not VM 2 to VM 1?
EDIT: I just want to say, i found a solution. That is to set up the same routing i did in VM1, to VM2 using: route add 'gateway of first vm' MASK 255.255.255.0 'ip of second vm'. It works now. Maybe i ...
0
votes
0
answers
36
views
Ipsec Site-to-Site: I can ssh to the Target Network but not ssh from the target network, Iptables Troubleshooting
Since this is my very first Question here im still a bit green :)
Following Scenario:
Ipsec Connection with strongswan on a debian system between two Sites with each 4 Subnets
site A:
10.0.0.0/24
10.0....
- 1
2
votes
1
answer
458
views
How can I port forward multiple ports on a single IP address when WAN IP is not accessible outside the country
Thailand (and other countries) have a government sanctioned firewall/gateway(s) which routes all your traffic through it. As a result any LAN ports forwarded to your WAN IP, are available within ...
- 123