Questions tagged [iptables]

Iptables is a module that provides the Linux operating system functions of firewall, NAT and logging of data traveling over a computer network.

Filter by
Sorted by
Tagged with
0 votes
0 answers
33 views

Linux 6.5 netfilter NAT reuses TCP ports in TIME_WAIT status?

In my understanding, Linux (netfilter)'s NAT doesn't reuse TCP ports in TIME_WAIT status, but seemingly Linux >= 6.5 reuses TCP ports in TIME_WAIT, even if the destination is the same. For example, ...
turgenev's user avatar
1 vote
1 answer
34 views

Unable to forward and receive internet traffic through Raspberry Pi 4 Wifi AP

There are many tutorials out there showing how to set up a Wifi AP using Raspberry Pi 4, all with different configurations. I am trying doing it with my specific setup as following: RPi4 acting as ...
Tristan Tran's user avatar
0 votes
0 answers
34 views

Access remote SSH tunnel from inside docker container

I have a webserver on my MacBook in my home network behind a NAT, serving on port 80. I also have a publicly accessible server running Ubuntu, from which I want to access my local webserver, so I open ...
henk's user avatar
  • 101
0 votes
0 answers
65 views

Add custom UFW rule: ufw limit ... --hitcount 'custom value'

ufw reload reverts to standard all custom limit edits in /etc/ufw/user.rules. I found a hint to write custom rules to /etc/ufw/before.rules (after.rules). If I transfer there next rule from /etc/ufw/...
Daren's user avatar
  • 1
0 votes
3 answers
56 views

iptables not dropping udp port for exact ip address

My iptables rules are as follows: -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -N f2b -A INPUT -p tcp -m multiport --dports 80,443 -j f2b -A INPUT -d (my public facing ip)/32 -p udp -m udp --...
user9503's user avatar
0 votes
1 answer
45 views

How to set up port forwarding to guest VM using iptables

I am trying to do a proof of concept for port forwarding to a libvirt guest server. The following are the variables I use for generalization: port=500 # Arbitrary port, for proof of ...
nc404's user avatar
  • 115
0 votes
1 answer
21 views

Pterodactyl Docker Pulling times out when using iptables

When I'm using iptables to block incoming traffic by either: - iptables -A INPUT -j REJECT or - iptables -P INPUT DROP It times out and says nothing and just finish pulling. (takes 1 minute). My ...
setpopa's user avatar
0 votes
1 answer
54 views

Block with firewall a dns request containing a certain query

Example let's say I'm with iptables or nftables I want to allow a certain traffic like the following one: iptables -A OUTPUT -d 192.168.1.1 -p udp --dport 53 -j ACCEPT iptables -A INPUT -s 192.168.1.1 ...
user3450548's user avatar
0 votes
0 answers
44 views

To allow IPsec NAT-T traffic to pass through, why does the firewall still need to permit ESP when it already allows UDP 4500?

I established an IPsec VPN tunnel between two Juniper SRX routers across NAT, with the NAT being performed by the firewall (a Linux server). When attempting to configure the firewall rules to allow ...
phoebe61g's user avatar
0 votes
0 answers
17 views

Blocking DNS server from a router via iptables

I'm trying to block google dns server (8.8.8.8) from my router, so no machine in the network could not access this dns server. here is my iptables table: Chain INPUT (policy ACCEPT) target prot ...
Dinamo's user avatar
  • 1
0 votes
1 answer
31 views

How can I block GPSD from communicating out?

I have two computers; one running gpsd and one using gpspipe -w 192.168.90.1 to query the data. GPSD listens on port 2947 and I want to block it with iptables. I've tried so many rules, but I can ...
DeepDeadpool's user avatar
0 votes
2 answers
26 views

What determines if a packet should be routed locally or forwarded?

As seen in the diagram, when the Linux kernel receives a packet, it goes through the prerouting chain, and then a routing decision is made on whether to forward it to somewhere else or deliver it to a ...
discape's user avatar
  • 138
0 votes
0 answers
26 views

Route all TCP traffic from port to another host:port

I have a wireguard config, creating a VPN between a remote server (10.0.1.1) and my local machine (10.0.1.2), so that the server can reach the local machine and vice versa. I'd like the server to ...
winwin's user avatar
  • 125
0 votes
1 answer
24 views

How can I simulate NAT reflection failure with `iptables`?

Let's say that: My workstation LAN IP is 192.168.0.101 My WAN IP is 12.34.56.78. My consumer-grade router is port-forwarding WAN:80 to 192.168.0.101:8080 NAT Reflection / Hairpinning is working So ...
coolaj86's user avatar
  • 933
0 votes
2 answers
86 views

iptables port REDIRECT works locally but not from outside

I have a server that can only listen to port 23006. I want to access it from outside and on port 443. I have systemctl setup: $ sudo sysctl --system * Applying /usr/lib/sysctl.d/50-pid-max.conf ... * ...
Aario's user avatar
  • 1
0 votes
0 answers
54 views

ZeroTier not working on router running FreshTomato firmware

0 I can successfully connect to my ZeroTier with the router and join my ZT network with an automatic IP assigned my ZT. However, I can’t ping the router from from any device on my ZT network nor have ...
Danil Rylo's user avatar
0 votes
1 answer
36 views

Unable to get Main and Backup Routers to connect to each other

I have two networks and routers (both on Advanced Tomato by Shibby) laid out as such: Backup Router network (192.168.1.1/24) WAN - Xfinity LAN - small number of clients. Importantly, main network ...
Ayush's user avatar
  • 1
0 votes
0 answers
27 views

How to redirect traffic coming from exterior to a proxy chains of 2 proxy?

I'm using redsocks to redirect the incoming non-local traffic to forward it to a socks5 proxy. Unfortunately,redsocks does not support proxy chaining, So I tried to do a turn around by running 2 ...
Tiklyt's user avatar
  • 13
0 votes
0 answers
102 views

How to proxy all traffic received by Windows using Linux and redsocks?

I have a Windows machine where all of it's traffic is routed through a Linux machine simply by doing changing the Windows route : route add 0.0.0.0 mask 0.0.0.0 192.168.1.48 where 192.168.1.48 is the ...
Tiklyt's user avatar
  • 13
0 votes
1 answer
40 views

routing traffic using iptables and l2tp

Internet restrictions in my country have essentially made it impossible for VPNs to work. As such, I wanted to circumvent this issue by using the following method. Although "residential" ...
Arian Noshirvani's user avatar
0 votes
0 answers
38 views

No internet connection after setuping OpenConnect server on ArchLinux

ip tuntap add mode tun dev vpn0 ip addr add 192.168.2.2/24 dev vpn0 # systemctl restart ocserv iptables -A INPUT -p tcp --dport 22 -j ACCEPT iptables -A INPUT -p tcp --dport 8443 -j ACCEPT iptables -...
Dmitry Bubnenkov's user avatar
0 votes
1 answer
273 views

openssl s_client -connect errorno=111

Hi I got problem with openssl connection. I have java application which connects from server1 to server2 I made clone of server2 and upgraded it from Debian 9.7 to Debian11. The connection to ...
Yawa86's user avatar
  • 1
-4 votes
1 answer
63 views

Block youtube.com via `iptables`

For productivity reasons, I want to block access to YouTube. What I have tried. I started by running: dig A youtube.com +short and then feeding the resulting address(es) to sudo iptables -A OUTPUT -...
gobbolo22's user avatar
1 vote
1 answer
84 views

How To Add Ip Address manually in debian 12

I have two scripts that I can use to add block ip addresses to iptables. So for a list of let's say 10,000 or more it takes forever. Can I just copy and paste this block of ip address manually? If ...
Dan's user avatar
  • 11
0 votes
0 answers
58 views

Peers can connect to VPN server but not between themselves (Packet filtered)

I'm new into VPN topic and routing in general, and wanted to learn new thinks while setting up wireguard. However I'm facing an issue that I can't resolve for some time. As in title: Peers can connect ...
Jawor's user avatar
  • 1
1 vote
0 answers
70 views

how to route ocserv traffic to wireguard split tunnel

I want to route ocserv traffic to wireguard split tunnel here is the net flow [ (ocserv client) ] =====> [ server A (ocserv + wg server) ] <===== [ server B (wg client) ] Because wg protocol ...
Shakiba Moshiri's user avatar
0 votes
0 answers
23 views

Firewall incoming packets are dropped with VLAN configuration

In my Windows PC, installed scapy tool for sending packets from my system to raspberry Pi board connected to my machine using VLAN. In my raspberry Pi board, Firewall rules are already configured and ...
Karma Yogi's user avatar
0 votes
0 answers
23 views

Add foreign address to IP tables to Docker Image

I am new to Docker. I have a sample website running in a Docker Container and I am trying to access it from another computer on the network. tcp 0 0 localhost:3000 0.0.0.0:* ...
mike628's user avatar
  • 113
0 votes
0 answers
42 views

Using (Linux) iptables to drop duplicates?

Is there an easy way to use "iptables" rules to drop duplicate packets on Linux? If not, I'll have to spend more time figuring out why the problem is happening. In short, it has to do with ...
DOStiger's user avatar
0 votes
1 answer
145 views

How to force a match of "mark" of iptables to send its traffic to a TPROXY proxy?

I am trying to set up a transparent proxy that works with marked packets generated by a auxiliary program that wraps a process and mark its traffic with a firewall mark. What this setup does is to ...
alpominth's user avatar
  • 101
2 votes
1 answer
156 views

Preserve incoming interface for answers in openwrt router

I have a Openwrt router with three interfaces: interface br-lan: IP: 172.16.21.1 in a LAN network (172.16.21.0/24). interface eth1: IP: 172.16.22.2 a WAN network (172.16.22.0/30) with Internet access....
Maxfer's user avatar
  • 31
0 votes
1 answer
274 views

UniFi Dream Machine Special Edition (UDM SE) - iptables NAT PREROUTING not working on own subnet

This is a very confusing situation for me and I feel like there isn't an answer to this. But I'm at a loss after hours of testing, figuring out how things are currently working or not working as I ...
Fonkin's user avatar
  • 3
1 vote
1 answer
191 views

IPTables rules and networking with problems 2

My plan is to have a computer that forwards all traffic from internal interface ens19 to openvpn-interface tun0. The system has 2 physical interfaces: ens18 for local network with Internet connection ...
kasper2083's user avatar
0 votes
0 answers
198 views

reflection nat / hairpin nat with iptables

I try to implement reflection nat on one of my servers. There is a vm running on the server with ip 10.0.0.10. My iptables look like this: root@srv8:~# iptables -t nat -L -n -v --line-numbers Chain ...
C. Hediger's user avatar
1 vote
1 answer
108 views

Stateful forwarding rule in iptables

I have created this bridge device ip link add dev br0 type bridge ip addr add 172.16.0.254/16 broadcast 172.16.255.255 dev br0 ip link set br0 up sysctl -w net.ipv4.conf.br0.forwarding=1 This device ...
dbergloev's user avatar
0 votes
0 answers
97 views

Ping not leaving linux VM

Firstly, only just learning Linux and networking, so please assume I have minimal knowledge! Perhaps a week ago I was working on a small python script that involved pinging devices from the Kali Linux ...
RunRenegade's user avatar
1 vote
1 answer
223 views

Unable to open port on debian vps

Trying to open 51820 UDP I do iptables -A INPUT -p udp --dport 51820 -j ACCEPT then iptables -L I can see ACCEPT udp -- anywhere anywhere udp dpt:51820 then I do /sbin/...
jotyhista's user avatar
1 vote
1 answer
77 views

In Linux how to loop-back the internal traffic that's destined to the server's own NATed public IP?

By internal I mean only the traffic originating within the server itself (not LAN or other servers). I have a cloud VM where the Public IP provided by the cloud vendor is not directly attached to the ...
eee's user avatar
  • 25
0 votes
0 answers
46 views

UFW not filtering FORWARD traffic on same (tun0) interface

I have an Ubuntu 22.04 server with OpenVPN running and I want to filter access between clients on the tun0 interface with UFW. As far as I know this all has to do with the FORWARDING chain within UFW. ...
Erres's user avatar
  • 1
1 vote
0 answers
90 views

How can I use iptables to forward all traffic through an interface based in gid?

I'm on Debian 12 bookworm I'm trying to forward all traffic from (and to) users in the group watchers through interface tun9 and prevent them from using enp2s0. I've set up a tunnel using openvpn with ...
Jim's user avatar
  • 201
0 votes
0 answers
36 views

setup up ssh connection with 3 Ubuntu machines to bypass a firewall

I have 3 machines, here are the IP addresses of each of them with their ssh port : first device IP: 192.168.1.2 second device IP" 192.168.1.3 port 22822 third device IP: 192.168.1.4 port 22 I ...
nulltogeek's user avatar
0 votes
0 answers
32 views

triple vpn tunnel to bypass vpn blocks

is it technically possible to setup a VPN tunnel (or port-forwarding,or any other ways) as illustrated with bellow picture ? Assuming there is an restricted FW which even VPNs do not work plus "...
Shakiba Moshiri's user avatar
0 votes
0 answers
141 views

Synology DSM 7.2 cannot add iptables LOG rule

When trying to add a LOG rule to iptables on Synology DSM 7.2 the following error is thrown: iptables: No chain/target/match by that name. Verified that LOG module is loaded, rule is valid, chain is ...
user1859673's user avatar
0 votes
0 answers
40 views

Linux/DD-WRT iptables/route/policy based routing - static route wildcard domain to a different gateway

dd-wrt router command: route add *.googlevideo.com gw (anothergatewayonsubnet) use to work on old ddwrt is there anyway to redirect *.googlevideo.com with route add, ip route, iptables to another ...
user3265051's user avatar
0 votes
1 answer
441 views

How to configure iptables to allow OpenVPN clients to access internet via the server, if it's run under OpenVZ?

So what I have right now: A working VPN server that clients can connect to running under ubuntu 22.04 Enabled ip_forward on the server What I don't have is clients being able to access the Internet, ...
Vindicar's user avatar
  • 101
0 votes
1 answer
113 views

iptables how to port forward remote to local

This is the scenario: I have an encoded file that I cannot change the API URL but I know what it is. Let's suppose it is https://my.api.site.com/v1. When I run php myfile.php, it connects to the API ...
Saeed's user avatar
  • 403
0 votes
0 answers
27 views

Iptable rules through two firewalls for an rdp connection

Suppose I have a network topology similar to the one above, if i wanted to rdp into a host on the private network from home these are the following iptable rules i have: Firewall 1: $IPT -t nat -A ...
someman112's user avatar
0 votes
0 answers
87 views

Setup FreshTomato 2021.2 on R7000 to forward traffic from internet through OpenVPN tunnel

With FreshTomato 2021.2 on R7000, I'm trying to allow port forwarding (80/443) inside OpenVPN client to able to reach a device on my LAN. Here's the current status of iptables (iptables -S): -P INPUT ...
smallfrenchy's user avatar
-1 votes
1 answer
289 views

IPtables dropping packets I can't see with tcpdump and I don't know why?

My IPtables rules are blocking apt update for example: root@vpn:~# apt update Ign:1 https://pkgs.tailscale.com/stable/ubuntu jammy InRelease Ign:2 http://de.archive.ubuntu.com/ubuntu jammy InRelease ...
Hige Mynx's user avatar
0 votes
0 answers
88 views

iptables - port ward and NAT destination address

I have a server running strongswan. I have two clients connecting to this server over IPSec. My encryption domain is 10.1.1.3/32 which is the real address of the server. However, client A wants my ...
user618886's user avatar

1
2 3 4 5
39