Questions tagged [iptables]

Iptables is a module that provides the Linux operating system functions of firewall, NAT and logging of data traveling over a computer network.

Filter by
Sorted by
Tagged with
0 votes
0 answers
12 views

Ubuntu forward external IP to internal IP

I have a server ubuntu with 2 external IP on eno1 like IP1 and IP2, and 2 bridge with ip 192.168.122.1 192.168.100.1 Both bridge use IP1, but I want redirect all traffic this way IP1 > 192.168.122....
user avatar
  • 171
0 votes
0 answers
16 views

docker without sudo on WSL2

According to https://docs.docker.com/engine/security/rootless/ running dockerd-rootless-setuptool.sh install will let you run Docker without sudo, however, when I try to do it, I get this error: [...
user avatar
  • 5,890
0 votes
0 answers
12 views

iptables packet count for nat table for ACCEPT target is always remained 0

iptables packet count for nat table for ACCEPT target is always remained 0. I have created a rule in IPTABLE for nat table and POSTROUTING chain iptables -t nat -A POSTROUTING -p icmp --icmp-type 8 -...
user avatar
0 votes
0 answers
4 views

Redirect Traffic to Another Interface

Is there any way to redirect incoming traffic coming to udp port 1234 interface ens3 to another interface ens5 without using iptables?
user avatar
  • 15
0 votes
0 answers
9 views

nftables commands for these iptables rules

I have never used nftables before. Can someone help me for nftables commands for these iptables rules? iptables -t nat -I PREROUTING -i ens3 -p udp --dport 9100 -j DNAT --to 192.168.150.2 iptables -t ...
user avatar
  • 15
0 votes
0 answers
24 views

How to lower CPU usage while using iptables NAT

I have 5 VM's : VM-A,VM-1,VM-2,VM-3,VM-4 I using wireguard to connect VM-A to all other VM's. The traffic transfer rate is around 200Mbps. All the VM's have 5gbps network. But the CPU is rising to 95%....
user avatar
  • 15
0 votes
0 answers
14 views

Why can't I RDP into my devices behind my router with my wireguard tunnel up

My network setup was working, until I realized that my understanding of the firewall requirements for this assignment (class project) were off and need to alter things. With my new configuration of ...
user avatar
0 votes
0 answers
29 views

UDP Port forwarding on Windows 10/11

I'm trying to forward TFTP server port from 69 to higher ports to avoid permissions issues. We're using the following command on the Linux (Ubuntu): sudo iptables -t nat -A PREROUTING -p udp --dport ...
user avatar
  • 103
0 votes
1 answer
15 views

IPtables does'nt apply this rule

I got many rules like this : #!/bin/sh modprobe ip_conntrack # Initialiser les tables iptables -t filter -F #Vider les règles custom iptables -t filter -X #Interdire toutes les connexions entrante ...
user avatar
  • 101
0 votes
1 answer
15 views

How to understand `operating system packet filtering layer`?

When I read this document #kube-proxy: kube-proxy uses the operating system packet filtering layer if there is one and it's available. Otherwise, kube-proxy forwards the traffic itself. so, what's ...
user avatar
  • 427
1 vote
0 answers
32 views

How to forward all ports on a ipaddress/interface to another ipaddress on another interface

I have tried several pages of iptables information on the net but they all seem to be missing a key piece of information to do what I need to do. Background: I work in a factory and am trying to add ...
user avatar
  • 135
1 vote
0 answers
22 views

Isolate Proton game from internet without breaking Steam API

Scenario: There are two widely suggested ways to force Steam games to run offline. These two ways are to either use unshare in the game's command line options: unshare -r -n %command% Or to use ...
user avatar
1 vote
1 answer
44 views

Change UDP traffic on the fly. Searching for Network device

I have one specific hardware which generates UDP traffic but due to one single issue inside the UDP data part, another device can't correctly work and skip UDP packets. Please, can you suggest to me ...
user avatar
  • 111
1 vote
1 answer
32 views

Does IP tables rules takes precedence over /proc/sys configuration?

If I configure both Case 1 and Case 2 in the same Linux server, which case will take precedence over the other? Case 1 – echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_all Case 2 – ...
user avatar
0 votes
0 answers
17 views

IPTables on windows 10

I'm looking for a way to get iptables functionality in windows 10. any tips? edit: These iptables rules were used in ubuntu, when I was working on virtualizing a freeBSD with Virtualbox, with the ...
user avatar
0 votes
1 answer
14 views

Make a remote host have a local IP address with ARP capability(Steam Link)

Currently I have two subnets in the 10.0.0.0/16, which are 10.40.20.0/24, let's say that's A and 10.32.80.0/24, B. My PC is in the subnet A and what I'm going to do is use Steam Link, Oculus Air Link ...
user avatar
  • 1
0 votes
0 answers
23 views

Should iptables block RST packets for a websocket connection?

I have the following setup for offloading SSL and running home assistant : Raspberry pi A (model 3, 10.0.0.21 below) is running apache2, NextCloud and iptables. Raspberry pi B (model 1, 10.0.0.69 ...
user avatar
  • 101
0 votes
1 answer
47 views

How to pass traffic through other Interfaces

I have total 4 Interfaces on my VM where enp0s3 is the primary Interface and others are the secondary Interfaces ip a output [root@vm]# ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue ...
user avatar
  • 15
0 votes
0 answers
21 views

Wireguard peer as an internet gateway

I have a Debian server with Wireguard installed and want to connect to it from my phone in a way, that Debian server will act as a phone's gateway to the internet. So all internet traffic from the ...
user avatar
0 votes
1 answer
31 views

How to forward openvpn/wireguard to another wirdguard interface without modifying global route table?

I have one wireguard interface wg_vpn, but I don't want it to be global, so I add the line "Table = off" to the wg_vpn.conf to prevent wg-quick to modify the route table. I also have an ...
user avatar
0 votes
0 answers
39 views

Forward traffic from Trojan (server) to OpenVPN (client) on Ubuntu 20

There is server_1 And there is server_2 Server_1 External IP: 1.1.1.1 Eth adapter: eth0 There is a trojan server: { "run_type": "server", "local_addr": "0....
user avatar
0 votes
0 answers
13 views

FirewallD Block Destination IP Address

I currently have a OpenVPN Access Server setup (AlmaLinux 8) I also have 2 OpenVPN clients (also using AlmaLinux 8) connecting to it over the internet that are acting as gateways at each location. (...
user avatar
  • 133
0 votes
0 answers
6 views

OpenVPN multiple gateway issue (server can't access new client gateway's)

By default, OpenVPN gateway is 10.8.0.x, i want to add 10.8.1.x gateway additionally. the problem : Clients with 10.8.0.x and 10.8.1.x ip can ping the server and access via ssh. In addition, clients ...
user avatar
0 votes
0 answers
129 views

iptables v1.8.7 (legacy): unknown option "--to-ports"

I am trying in libreelec, that all traffic is redirected to a docker with tor and privoxy, the problem that when entering the iptables rule returns "iptables v1.8.7 (legacy): unknown option "...
user avatar
1 vote
1 answer
73 views

When I use command [sudo iptables -t nat -A POSTROUTING -j MASQUERADE] in my ubuntu server 20.04, I lose the ability to resolve websites

Im trying to make a router out of ubuntu server for a class assignment. I've been looking at many guides to do so, most of which mention using the command from the title. Without the command, I cannot ...
user avatar
1 vote
0 answers
28 views

Docker networking not working with bridged host interfaces

Here's the setup: (docker host is in between to monitor traffic via ntopng) Router <---> Docker Host <---> PC <192.168.1.1> <192.168.1.20> ...
user avatar
0 votes
0 answers
41 views

Load Balancing using Iptables for UDP

I have 3 VMs. VM-A VM-B VM-C Whenever any incoming traffic comes to udp port 9110 of VM-A, How can I equally divide and redirect that traffic using NAT (MASQUERADE) Like for eg if incoming traffic ...
user avatar
  • 15
1 vote
1 answer
114 views

How to properly forward TCP and UDP traffic between interfaces using iptables?

ServerA eth0 internet interface wg0 vpn interface 10.66.66.1 ServerB wg0 vpn interface 10.66.66.2 How can I forward traffic from eth0 to wg0 10.66.66.2 using iptables? I want to forward the ...
user avatar
0 votes
0 answers
30 views

Oracle Cloud console connection what is the username and password to be used here?

I've been trying out Oracle's Cloud Service after my AWS trial expired, and I've setup a VM.Standard.E2.1.Micro instance with Ubuntu 20.04. I was trying to change the default SSH port from 22 to 4545, ...
user avatar
  • 509
0 votes
0 answers
98 views

Allow Docker Container with MacVLAN network to access Wireguard connected remote

I do have two servers: Server A: a local NAS running RHEL 8.5 (5.17.1 kernel - so it has native wireguard support); local IP 192.168.1.1 Server B: a VPS with debian 11.3 (5.10.0 kernel - also has ...
user avatar
0 votes
1 answer
43 views

How to configure Debian 11 Desktop PC (computer with GUI) as a router (internet sharing)

I have two desktop machines, Windows 10 and Debian 11. These machines both have single 1G ethernet ports on the motherboards as well as an ASUS 10G PCI-e add in card. I don't own a 10G switch to ...
user avatar
  • 1,887
0 votes
1 answer
24 views

Where is the iptables MARK location in TCP package?

In my CentOS7 Server, I emptied all the iptables rules, and then add below rule: iptables -t mangle -N DIVERT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A ...
user avatar
  • 730
0 votes
0 answers
52 views

VPN Server behind CGNAT

I have 2 homes: home1 is using an ISP with CGNAT, home2 has a public ip address. I'd like to be able to connect from anywhere to a Wireguard VPN server from home1 (SH1) and use that connection to ...
user avatar
  • 101
1 vote
1 answer
82 views

Add a IP to another rule matching hex in iptables linux

iptables -t raw -A PREROUTING -p udp --dport 4578 -m string --hex-string '|fefffffffffffffffff77f12|' How can I whitelist the IP having the above hexx string automatically on Iptables. I'll be ...
user avatar
  • 15
0 votes
0 answers
35 views

How to do "source-MAC based routing" with nftables

(This is a simplified version of this: Can Linux do "source MAC based routing?") I have an appliance that needs to route egress packets back to the MAC interface where the ingress packets ...
user avatar
0 votes
1 answer
26 views

CentOS/RHEL: How to disconnect established connection and prevent subsequent connections until reboot?

I'm trying to test a system that uses multiple interconnected hosts, with one of the hosts randomly selected as the leader and the others being members. The members connect to the leader on a specific ...
user avatar
  • 103
0 votes
0 answers
30 views

UDP packets dropped with `ctstate=INVALID`, but meanwhile its connection `[ASSURED]` in conntrack list

I have my router connecting to a remote VPS as so-called 'VPN' that is based on UDP protocol, then the VPS traffic slows down in few seconds after a new reboot. I can see a huge amount of incoming ...
user avatar
  • 1
0 votes
0 answers
50 views

iptables to nftables for iKEv2 IPSEC VPN server

Can someone please help in converting the below iptable rules to equivalent nftables rules? I have already tried to use iptables-translate, but it is not translating all of my rules... # accept ports ...
user avatar
0 votes
0 answers
38 views

Get ssh access to the Host IP while VPN connection is established

I have my Raspberry PI connected to Internet with real IP address. The network topology is the following: Network scheme On the RPI Wireguard client is setup and traffic forwarded from VPN to ETH1 and ...
user avatar
0 votes
2 answers
33 views

What is the corresponding TCP states for states in iptables? (NEW and ESTABLISHED)

The iptables manual says ESTABLISHED meaning that the packet is associated with a connection which has seen packets in both directions, NEW meaning that the packet has started a new connection, or ...
user avatar
0 votes
0 answers
11 views

OpenVPN only connects over local LAN

I followed this tutorial https://www.youtube.com/watch?v=dwrR18_xO_Q&t=44s It works perfectly in the local network, but not in External network I think something wrong in my dd-wrt iptables. I ...
user avatar
  • 1
0 votes
0 answers
41 views

Using iptables inside an unprivileged (rootless/fakeroot) network namespace results in permission error with `/run/xtables.lock`

I'm using unshare to create an unprivileged network namespace: unshare -Unr This gives us a network namespace that should be capable of using iptables. However upon running it: iptables -L We get: ...
user avatar
0 votes
0 answers
12 views

Another way to implement the depecrated iptables MIRROR target?

According to https://www.linuxtopia.org/Linux_Firewall_iptables/x4448.html, in Linux kernel 2.3 and 2.4 iptables had a MIRROR target that would flip the source and destination of the packet, which is ...
user avatar
0 votes
1 answer
20 views

iptables firewall whitelisting limit

We have a distributed system with many clients connecting to this system. We want the server to be isolated so that only client machines can connect. We are using IPTables as follow: /sbin/iptables -A ...
user avatar
0 votes
2 answers
70 views

Server flooded by DNS attack on port 53

I have been getting flood of traffic on port 53 all day on udp port 53 Sample Output of tcpdump using "tcpdump -n -i eth0 udp port 53" 14:29:48.734275 IP 212.174.17.28.53 > 23.92.19.211....
user avatar
  • 1
0 votes
1 answer
73 views

Relay TCP upload traffic and make download traffic go directly to the client

This is a supplement for iptables SNAT for UDP rule is only applied to some traffic In fact, I have three machines: the client the target server the relay server What's my motivation for doing this? ...
user avatar
  • 13
0 votes
1 answer
96 views

iptables SNAT for UDP rule is only applied to some traffic

I want to use Source NAT to change the local IP address of UDP traffic. However, only locally-generated traffic has the NAT rule applied, replies to traffic generated from remote sources do not have ...
user avatar
  • 13
0 votes
2 answers
44 views

How to allow peers access only to the Internet?

I tried for a long time to find the answer to the question "How to allow peers access only to the Internet?", But I did not find anything. The only thing I understood is that this can be ...
user avatar
  • 3
1 vote
0 answers
72 views

Docker containers cannot communicate using host public IP

I have an Ubuntu server running some apps in Docker (including Nginx Proxy Manager) and some subdomains pointing to the public IP of my server. All my containers are on the same bridge network. One of ...
user avatar
2 votes
0 answers
30 views

Can't access Apache2 on a VPS via public IP of the server from an external computer

root@Client13:/etc/apache2# netstat -anltp | grep "LISTEN " tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 104129/apache2 tcp 0 0 0.0.0.0:22 ...
user avatar
  • 23

1
2 3 4 5
35