As of May 31, 2023, we have updated our Code of Conduct.

Questions tagged [iptables]

Iptables is a module that provides the Linux operating system functions of firewall, NAT and logging of data traveling over a computer network.

Filter by
Sorted by
Tagged with
0 votes
0 answers
15 views

Using iptables-nft/ebtables-nft to intercept specific forwarded/bridged IP packets on a bridge and redirect them to the bridge device itself

With a bridge br0 using eth0 and wlan0 as bridge ports, formerly one could intercept packets arriving on a bridge port with iptables -t mangle -A PREROUTING -m physdev --physdev-in wlan0 --protocol ...
dom's user avatar
  • 1
0 votes
0 answers
17 views

using wireguard peer as default gateway for another peer

Here my config (server wg in docker, peer1, peer2) S = 10.14.88.1 P1 = 10.14.88.2 P2 = 10.14.88.3 [Interface] Address = 10.14.88.1 ListenPort = 51820 PrivateKey = XXX PostUp = iptables -A FORWARD -i %...
a1dude's user avatar
  • 1
1 vote
1 answer
29 views

VPN client cannot access network behind VPN server(wireguard)

I have created a wireguard VPN server, but the clients cannot access some networks behind the server, wireguard-server eno1: 10.10.10.2/24 (GW) eno2: 10.10.11.2/24 wg0: 10.66.66.1/24 I want the ...
Arthurency's user avatar
1 vote
0 answers
18 views

Kali Linux takes way too long to load the GUI after entering the password? IPTABLES

After entering the passward to login, it takes way too long to load GUI. I think the issue is with the firewall, when I enable it the GUI loads way two long to load. More than a minute, if it's ...
Deadlooks's user avatar
1 vote
0 answers
24 views

Mark only the udp traffic above a certain rate using iptables commands

I'm trying to achieve the following scenario: Using the iptables command, mark UDP traffic with destination port 1234 that passes through a Linux router with the recommended DSCP value for Expedited ...
Andres Pasca's user avatar
0 votes
1 answer
27 views

iptables: allow port forwarding destined to the WAN interface but from within the local network

I know this question exist in a dozen forms already but most were about commercial wifi routers etc. I have an Ubuntu 20.04LTS box with a bunch of interfaces set up as a firewall/NAT box, one of the ...
BjornW's user avatar
  • 103
0 votes
0 answers
23 views

TC limit Speed with Multiple Ports

i have an script that works well for single port limitation writen in bash and works with TC but imagine each vpn users connects to server with unique port, how can we set speed limit each ? exp: ...
DjMohsen's user avatar
0 votes
0 answers
20 views

How to set speed limit per IP in IP range in Ubuntu

What I want: I've setup a openvpn-server and want the clients in range of 10.8.0.0/21 limit their speed to 10mbit for each IP as a total limit of 100mbit. wan interface : eth0 openvpn interface : ...
Root's user avatar
  • 65
0 votes
0 answers
24 views

Forwarded packet seemingly, skipping POSTROUTING rules

I have a very simple Wireguard configuration. Client are assigned 10.7.0.0/24 addressed, traffic is forwarded out the primary interface, finally the packets are SNAT'd out of the primary interface on '...
Liam Kelly's user avatar
0 votes
0 answers
47 views

Why do we need multiple iptables?

In man iptables there are 4 tables defined: filter, mangle, nat, raw. And many of them have the same predefined chain. For instance, nat and mangle both have OUTPUT chain. The question is why do we ...
Some Name's user avatar
  • 101
1 vote
0 answers
20 views

RTNETLINK answers: Invalid argument when trying to use avahi-autoipd on Petalinux device

I have an embedded device running PetaLinux that I wish to configure to use avahi-autoipd to use LLA on an interface. I have been trying to do this from the CLI to ensure it works as expected, and I ...
Douglas B's user avatar
  • 111
0 votes
1 answer
43 views

How to send back TCP packets using iptables

I am trying to demonstrate TCP communication with a Ubuntu 18.04 box (which mocks a QNX setup) that does not have a listener installed. Consider that due to some license issues it might not be ...
kingvittu's user avatar
2 votes
1 answer
41 views

Redirect OR warn (during initial negotiation?) SMTP submitters to use TLS on port 587 - leave 25 explicitly blocked by firewall for better security

This question went over poorly on S.F., but as I said there I've managed to find a lot of closely related information, but not an answer truly addressing my question. I am expanding on my homelab ...
MJHd's user avatar
  • 133
0 votes
0 answers
78 views

How set up iptables for Double VPN (VPN chain) with Wireguard?

I'm currently trying to set up a VPN chain (double vpn) with using Wireguard. I tried to use examples from different articles: https://allanjohn909.medium.com/vpn-chaining-with-wireguard-ec2bd500509e ...
AncientStarWay's user avatar
0 votes
1 answer
12 views

Why does it go through netfilter postrouting when visiting local ports?

Environment: [root@VM-32-4-centos ~]# uname -r 3.10.0-514.26.2.el7.x86_64 I have set log printing in the following chain: [root@VM-32-4-centos ~]# iptables -A INPUT -p tcp --dport 8000 -j LOG --log-...
user1795323's user avatar
0 votes
0 answers
28 views

connect to ssh via iptable tunnel

there is two server A (1.1.1.1) and B(2.2.2.2) I defined an iptable PREROUTING like this sudo iptables -t nat -A PREROUTING -p tcp --dport 1111 -j DNAT --to-destination 2.2.2.2:22 sudo iptables -t nat ...
Mehran's user avatar
  • 101
0 votes
1 answer
34 views

Forwarding packets using iptables without hiding source ip

I have a debian router with a wan interface (eth0) and a lan interface (eth1). I have configured it to masquerade certain packets from eth0 to eth1, but i want to keep the source ip instead of ...
sfs's user avatar
  • 33
0 votes
1 answer
75 views

iptables nat table does not work as expected?

I aim to have some iptables rules to observe the flow of network traffic through iptables rules. However, iptables does not seem to work as I expected. It appears that packets which are the response ...
Sobhan Safdariyan's user avatar
2 votes
0 answers
32 views

iptables to protect an off-grid device

Let's say I have two device at home: One is not connected to the ethernet as I don't want to be hackable. The other is a classic computer with Internet access. I'd like to get the status of the off-...
Manitoba's user avatar
  • 177
1 vote
0 answers
26 views

Trying to setup iptables properly

I have dummy0 interface on my machine. I need to forward its port 10456 towards loopback port 10456 which is forwarded via ngrok to some remote endpoint (very convinient). I have never done any ...
Euler-Maskerony's user avatar
2 votes
2 answers
54 views

IPs not blocking with iptables/fail2ban "already banned" messages

I am using old iptables v1.4.7 in conjunction with fail2ban. I am however seeing "already banned" messages in the logs and can't figure out why they still reach my server and are not being ...
Questionz's user avatar
3 votes
1 answer
48 views

Why a packet is sent with a wrong source IP address when setting fwmark using iptables mangle to change routing table?

I want to route a traffic from a specific program through a WireGuard VPN. I set the wireguard interface, config, routings, etc. To do routing through the VPN only for a single program, I run the ...
g00dds's user avatar
  • 43
3 votes
1 answer
81 views

Iptables configuration for NAT with KVM

I have a server with a public ip (142.0.0.142). This server hosts a KVM virtual machine (192.168.100.10) and redirects the HTTP/S traffic to this VM. I followed those instructions to configure a "...
Costent's user avatar
  • 35
0 votes
1 answer
35 views

Implement iptables that drops ACK packet but accepts it for a client

I have an IoT-device (called Device A in image below) that communicates with my server through a router. However, once in a while my IoT device gets a WDT and restarts and from my investigation it ...
andypandy's user avatar
1 vote
2 answers
288 views

How iptables "--clamp-mss-to-pmtu" calculates PMTU?

I have seen in many places this iptables rule iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu to deal with Path MTU Discovery issues. From my understanding, PMTU may ...
coherence73's user avatar
0 votes
1 answer
16 views

Streaming data and firewall on Chromebook Linux

I'm trying to use a custom python app that needs to expose a port (5000) on my Google chromebook and it's not working. The python package is python-osc. How do I check if a firewall in Linux is ...
tom's user avatar
  • 101
0 votes
0 answers
139 views

OpenConnect Server not connecting to internet using ufw ip forwarding

I want to create an OpenConnect VPN server. I followed this tutorial step by step however, while I'm able to connect to the open connect server using a client, the problem is that I don't have any ...
ARK1375's user avatar
  • 51
1 vote
0 answers
81 views

How do I programmatically block websites on an ASUS router via iptables?

I'm running an ASUS RT-AX88U-4168; the router's web admin allows me to configure rules that block all traffic to certain websites. I'm trying to recreate that same ability via the router command line [...
JTB's user avatar
  • 11
0 votes
0 answers
16 views

RHEL 7.9 : Control the tables order of the iptables-save output command

I'm facing an issue where I have to control the output of iptables-save. It look like the table's order (*filter, *nat) output is kinda random. For exemple here we have filter table in first, but we ...
user1787890's user avatar
1 vote
1 answer
149 views

Using VPS to give Public IP to on home network

As my provider does not give me a public IPv4 Address, I am using a VPS combined with a Wireguard tunnel to make my homeserver reachable from the Internet (via Ipv4 and Ipv6). On my homeserver, the ...
turbothorsten's user avatar
2 votes
1 answer
733 views

Routing WireGuard peer's traffic via another peer

I want to use the RPi in my house as a WireGuard VPN. Unfortunately, my ISP mandates a CGNAT. My plan was to have the RPi connect as a WireGuard peer to my server (with a static IP). I would then ...
Tbsc's user avatar
  • 23
0 votes
0 answers
45 views

Why isn't my wireguard working properly?

I have an AWS debian ec2 that I want to use as a vpn server, I installed wireguard and created the following server config [Interface] Address = 10.8.0.1/24 ListenPort = 51820 PrivateKey = <...
user avatar
0 votes
1 answer
31 views

tcpdump shows traffic even for down interface

Using Debian Buster and having configured VLAN interface online, I wonder that tcpdump shows any traffic send to the external IP address? Having a server on Hetzner and want to configure VLAN traffic ...
Tom Freudenberg's user avatar
0 votes
0 answers
64 views

Port forwarding between Host and QEMU VM

I am accessing a host using a SSH over a VPN. That host have a VM on QEMU which I deploy using virt-manager. The host and VM are able to communicate. The VM have a Apache Webserver running. I am able ...
Nifty's user avatar
  • 3
0 votes
0 answers
32 views

How I can forward a windows remote desktop connection?

I have this issue, my internet supplier only enables all ports for one local IP address, this IP is hooked to a home server that runs nginx and some web services, I need to redirect traffic for port ...
Sebastian Casal's user avatar
1 vote
0 answers
25 views

How to configure DNAT on linux PC so that windows PC destination address can NAT to external linux server?

Topology: Windows PC (Eg.,20.0.0.2) <---> enp6s0 20.0.0.1 [Ubunthu 20.04 as NAT] enp8s0 172.30.18.95<-->eth1 - Linux PC {172.30.18.90} Requirement: I want to ftp 30.0.0.1 from windows PC, ...
neosbin's user avatar
  • 11
0 votes
0 answers
32 views

Route incoming packets on interface through another interface

I think I have a simple scenario that I cannot manage to make it work: I have a router (Edgerouter-X) whose eth0 is connected to my home LAN (192.168.0.0/24) which is connected to the internet. The ...
MikeBlonde's user avatar
0 votes
0 answers
81 views

Issues with Wireguard routing from a single NIC

I am having issues with Wireguard seemingly not routing everything. Basically I have a ubuntu box at home, where I have installed Wireguard. I want to be able to connect to that box and access both ...
Netspud2K's user avatar
  • 144
0 votes
0 answers
120 views

Allowing specific docker container to be accessed using VPN only

I am trying to make a server which can only be accessed using VPN (using docker). For Example-> Lets say I have a django server running on docker and it also hosts a openVPN container. I have to ...
XotEmBotZ's user avatar
0 votes
0 answers
144 views

How can you route traffic from a QEMU VM to a Wireguard interface on Linux?

I am developing a CTF platform and I need to separate and isolate my VM's from each other. My problem lies in how Qemu VM connects to a bride (let's call it br0) which in turn somehow has to forward ...
privateConvo's user avatar
1 vote
0 answers
35 views

Port forwarding from within container

For the past two years I have been using Windscribes port forwarding service to access a few services within my LAN from an external IP. Because I am behind a NAT this has been the best solution and ...
Denny's user avatar
  • 53
0 votes
0 answers
93 views

VPS behind NAT can't connect to its external IP from local network

I have a VPS behind NAT with ports open using iptables. I have a software installed on the VPS and it can't connect to its public IP. I also tried to check it with Telnet. Output: root@vps:~# telnet ...
user avatar
1 vote
0 answers
445 views

How to add WireGuard container to internal Docker network to add internet connectivity?

I have two Docker networks: public which is a normal bridge network with access to the host upstream network private which is a bridge, internal: true and hosts a fleet of containers networks: ...
Paya's user avatar
  • 257
-1 votes
3 answers
80 views

Whitelist all USA traffic, blacklist all non USA traffic, can this be done by a country code instead of by IPs?

I've read a dozen guides to using iptables, fail2ban and csf. The commonality seems to be: 1) generate a list of IP rangess for the country you want 2) write a bash/python script to run the allow ...
user10841084108's user avatar
0 votes
0 answers
39 views

one iptables PREROUTING rule not work while other one works

I have a linux device with two iptables rules in it. And the behaviors are interesting. root@xxx:~# iptables -t nat -nvL PREROUTING Chain PREROUTING (policy ACCEPT 4 packets, 812 bytes) pkts bytes ...
nathan's user avatar
  • 101
0 votes
0 answers
84 views

Proxy server with squid and multiple 4G routers

A particular Raspberry Pi 4 is connected to wlan0 (192.168.10.174) on a 4G router (192.168.10.1) and has a 4G mobile connection. Already on interface eth0 (192.168.1.41), is my local network router (...
Herbert Goes's user avatar
2 votes
2 answers
425 views

Change all rules in iptables when changing IP address

I have a network gateway system using iptables to allow/deny traffic to/from an internal network. I have to manually add and remove rules in iptables depending on the requirements of the entities in ...
Hans Petter Taugbøl Kragset's user avatar
0 votes
0 answers
34 views

Can connect VM 1 to VM 2 across a router, but not VM 2 to VM 1?

EDIT: I just want to say, i found a solution. That is to set up the same routing i did in VM1, to VM2 using: route add 'gateway of first vm' MASK 255.255.255.0 'ip of second vm'. It works now. Maybe i ...
babypuncher666's user avatar
0 votes
0 answers
36 views

Ipsec Site-to-Site: I can ssh to the Target Network but not ssh from the target network, Iptables Troubleshooting

Since this is my very first Question here im still a bit green :) Following Scenario: Ipsec Connection with strongswan on a debian system between two Sites with each 4 Subnets site A: 10.0.0.0/24 10.0....
Haraiko's user avatar
2 votes
1 answer
458 views

How can I port forward multiple ports on a single IP address when WAN IP is not accessible outside the country

Thailand (and other countries) have a government sanctioned firewall/gateway(s) which routes all your traffic through it. As a result any LAN ports forwarded to your WAN IP, are available within ...
Rafael Lambelin's user avatar

1
2 3 4 5
37