Questions tagged [iptables]
Iptables is a module that provides the Linux operating system functions of firewall, NAT and logging of data traveling over a computer network.
1,747
questions
0
votes
0
answers
12
views
Ubuntu forward external IP to internal IP
I have a server ubuntu with 2 external IP on eno1 like IP1 and IP2, and 2 bridge with ip
192.168.122.1
192.168.100.1
Both bridge use IP1, but I want redirect all traffic this way
IP1 > 192.168.122....
- 171
0
votes
0
answers
16
views
docker without sudo on WSL2
According to https://docs.docker.com/engine/security/rootless/ running dockerd-rootless-setuptool.sh install will let you run Docker without sudo, however, when I try to do it, I get this error:
[...
- 5,890
0
votes
0
answers
12
views
iptables packet count for nat table for ACCEPT target is always remained 0
iptables packet count for nat table for ACCEPT target is always remained 0.
I have created a rule in IPTABLE for nat table and POSTROUTING chain iptables -t nat -A POSTROUTING -p icmp --icmp-type 8 -...
- 121
0
votes
0
answers
4
views
Redirect Traffic to Another Interface
Is there any way to redirect incoming traffic coming to udp port 1234 interface ens3 to another interface ens5 without using iptables?
- 15
0
votes
0
answers
9
views
nftables commands for these iptables rules
I have never used nftables before. Can someone help me for nftables commands for these iptables rules?
iptables -t nat -I PREROUTING -i ens3 -p udp --dport 9100 -j DNAT --to 192.168.150.2
iptables -t ...
- 15
0
votes
0
answers
24
views
How to lower CPU usage while using iptables NAT
I have 5 VM's : VM-A,VM-1,VM-2,VM-3,VM-4
I using wireguard to connect VM-A to all other VM's. The traffic transfer rate is around 200Mbps. All the VM's have 5gbps network.
But the CPU is rising to 95%....
- 15
0
votes
0
answers
14
views
Why can't I RDP into my devices behind my router with my wireguard tunnel up
My network setup was working, until I realized that my understanding of the firewall requirements for this assignment (class project) were off and need to alter things. With my new configuration of ...
0
votes
0
answers
29
views
UDP Port forwarding on Windows 10/11
I'm trying to forward TFTP server port from 69 to higher ports to avoid permissions issues.
We're using the following command on the Linux (Ubuntu):
sudo iptables -t nat -A PREROUTING -p udp --dport ...
- 103
0
votes
1
answer
15
views
IPtables does'nt apply this rule
I got many rules like this :
#!/bin/sh
modprobe ip_conntrack
# Initialiser les tables
iptables -t filter -F
#Vider les règles custom
iptables -t filter -X
#Interdire toutes les connexions entrante ...
- 101
0
votes
1
answer
15
views
How to understand `operating system packet filtering layer`?
When I read this document #kube-proxy:
kube-proxy uses the operating system packet filtering layer if there is one and it's available. Otherwise, kube-proxy forwards the traffic itself.
so, what's ...
- 427
1
vote
0
answers
32
views
How to forward all ports on a ipaddress/interface to another ipaddress on another interface
I have tried several pages of iptables information on the net but they all seem to be missing a key piece of information to do what I need to do.
Background:
I work in a factory and am trying to add ...
- 135
1
vote
0
answers
22
views
Isolate Proton game from internet without breaking Steam API
Scenario:
There are two widely suggested ways to force Steam games to run offline. These two ways are to either use unshare in the game's command line options:
unshare -r -n %command%
Or to use ...
- 55
1
vote
1
answer
44
views
Change UDP traffic on the fly. Searching for Network device
I have one specific hardware which generates UDP traffic but due to one single issue inside the UDP data part, another device can't correctly work and skip UDP packets.
Please, can you suggest to me ...
- 111
1
vote
1
answer
32
views
Does IP tables rules takes precedence over /proc/sys configuration?
If I configure both Case 1 and Case 2 in the same Linux server, which case will take precedence over the other?
Case 1 – echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_all
Case 2 – ...
0
votes
0
answers
17
views
IPTables on windows 10
I'm looking for a way to get iptables functionality in windows 10. any tips?
edit:
These iptables rules were used in ubuntu, when I was working on virtualizing a freeBSD with Virtualbox, with the ...
0
votes
1
answer
14
views
Make a remote host have a local IP address with ARP capability(Steam Link)
Currently I have two subnets in the 10.0.0.0/16, which are 10.40.20.0/24, let's say that's A and 10.32.80.0/24, B.
My PC is in the subnet A and what I'm going to do is use Steam Link, Oculus Air Link ...
- 1
0
votes
0
answers
23
views
Should iptables block RST packets for a websocket connection?
I have the following setup for offloading SSL and running home assistant :
Raspberry pi A (model 3, 10.0.0.21 below) is running apache2, NextCloud and iptables.
Raspberry pi B (model 1, 10.0.0.69 ...
- 101
0
votes
1
answer
47
views
How to pass traffic through other Interfaces
I have total 4 Interfaces on my VM where enp0s3 is the primary Interface and others are the secondary Interfaces
ip a output
[root@vm]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue ...
- 15
0
votes
0
answers
21
views
Wireguard peer as an internet gateway
I have a Debian server with Wireguard installed and want to connect to it from my phone in a way, that Debian server will act as a phone's gateway to the internet. So all internet traffic from the ...
- 1
0
votes
1
answer
31
views
How to forward openvpn/wireguard to another wirdguard interface without modifying global route table?
I have one wireguard interface wg_vpn， but I don't want it to be global, so I add the line "Table = off" to the wg_vpn.conf to prevent wg-quick to modify the route table.
I also have an ...
- 1
0
votes
0
answers
39
views
Forward traffic from Trojan (server) to OpenVPN (client) on Ubuntu 20
There is server_1
And there is server_2
Server_1
External IP: 1.1.1.1
Eth adapter: eth0
There is a trojan server:
{
"run_type": "server",
"local_addr": "0....
0
votes
0
answers
13
views
FirewallD Block Destination IP Address
I currently have a OpenVPN Access Server setup (AlmaLinux 8)
I also have 2 OpenVPN clients (also using AlmaLinux 8) connecting to it over the internet that are acting as gateways at each location. (...
- 133
0
votes
0
answers
6
views
OpenVPN multiple gateway issue (server can't access new client gateway's)
By default, OpenVPN gateway is 10.8.0.x, i want to add 10.8.1.x gateway additionally.
the problem :
Clients with 10.8.0.x and 10.8.1.x ip can ping the server and access via ssh. In addition, clients ...
0
votes
0
answers
129
views
iptables v1.8.7 (legacy): unknown option "--to-ports"
I am trying in libreelec, that all traffic is redirected to a docker with tor and privoxy, the problem that when entering the iptables rule returns "iptables v1.8.7 (legacy): unknown option "...
- 9
1
vote
1
answer
73
views
When I use command [sudo iptables -t nat -A POSTROUTING -j MASQUERADE] in my ubuntu server 20.04, I lose the ability to resolve websites
Im trying to make a router out of ubuntu server for a class assignment. I've been looking at many guides to do so, most of which mention using the command from the title. Without the command, I cannot ...
1
vote
0
answers
28
views
Docker networking not working with bridged host interfaces
Here's the setup: (docker host is in between to monitor traffic via ntopng)
Router <---> Docker Host <---> PC
<192.168.1.1> <192.168.1.20> ...
- 63
0
votes
0
answers
41
views
Load Balancing using Iptables for UDP
I have 3 VMs.
VM-A VM-B VM-C
Whenever any incoming traffic comes to udp port 9110 of VM-A, How can I equally divide and redirect that traffic using NAT (MASQUERADE)
Like for eg if incoming traffic ...
- 15
1
vote
1
answer
114
views
How to properly forward TCP and UDP traffic between interfaces using iptables?
ServerA
eth0 internet interface
wg0 vpn interface 10.66.66.1
ServerB
wg0 vpn interface 10.66.66.2
How can I forward traffic from eth0 to wg0 10.66.66.2 using iptables?
I want to forward the ...
- 37
0
votes
0
answers
30
views
Oracle Cloud console connection what is the username and password to be used here?
I've been trying out Oracle's Cloud Service after my AWS trial expired, and I've setup a VM.Standard.E2.1.Micro instance with Ubuntu 20.04.
I was trying to change the default SSH port from 22 to 4545, ...
- 509
0
votes
0
answers
98
views
Allow Docker Container with MacVLAN network to access Wireguard connected remote
I do have two servers:
Server A: a local NAS running RHEL 8.5 (5.17.1 kernel - so it has native wireguard support); local IP 192.168.1.1
Server B: a VPS with debian 11.3 (5.10.0 kernel - also has ...
- 1
0
votes
1
answer
43
views
How to configure Debian 11 Desktop PC (computer with GUI) as a router (internet sharing)
I have two desktop machines, Windows 10 and Debian 11. These machines both have single 1G ethernet ports on the motherboards as well as an ASUS 10G PCI-e add in card.
I don't own a 10G switch to ...
- 1,887
0
votes
1
answer
24
views
Where is the iptables MARK location in TCP package?
In my CentOS7 Server, I emptied all the iptables rules, and then add below rule:
iptables -t mangle -N DIVERT
iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT
iptables -t mangle -A ...
- 730
0
votes
0
answers
52
views
VPN Server behind CGNAT
I have 2 homes: home1 is using an ISP with CGNAT, home2 has a public ip address.
I'd like to be able to connect from anywhere to a Wireguard VPN server from home1 (SH1) and use that connection to ...
- 101
1
vote
1
answer
82
views
Add a IP to another rule matching hex in iptables linux
iptables -t raw -A PREROUTING -p udp --dport 4578 -m string --hex-string '|fefffffffffffffffff77f12|'
How can I whitelist the IP having the above hexx string automatically on Iptables.
I'll be ...
- 15
0
votes
0
answers
35
views
How to do "source-MAC based routing" with nftables
(This is a simplified version of this: Can Linux do "source MAC based routing?")
I have an appliance that needs to route egress packets back to the MAC interface where the ingress packets ...
- 703
0
votes
1
answer
26
views
CentOS/RHEL: How to disconnect established connection and prevent subsequent connections until reboot?
I'm trying to test a system that uses multiple interconnected hosts, with one of the hosts randomly selected as the leader and the others being members. The members connect to the leader on a specific ...
- 103
0
votes
0
answers
30
views
UDP packets dropped with `ctstate=INVALID`, but meanwhile its connection `[ASSURED]` in conntrack list
I have my router connecting to a remote VPS as so-called 'VPN' that is based on UDP protocol, then the VPS traffic slows down in few seconds after a new reboot.
I can see a huge amount of incoming ...
- 1
0
votes
0
answers
50
views
iptables to nftables for iKEv2 IPSEC VPN server
Can someone please help in converting the below iptable rules to equivalent nftables rules?
I have already tried to use iptables-translate, but it is not translating all of my rules...
# accept ports ...
- 101
0
votes
0
answers
38
views
Get ssh access to the Host IP while VPN connection is established
I have my Raspberry PI connected to Internet with real IP address.
The network topology is the following:
Network scheme
On the RPI Wireguard client is setup and traffic forwarded from VPN to ETH1 and ...
- 1
0
votes
2
answers
33
views
What is the corresponding TCP states for states in iptables? (NEW and ESTABLISHED)
The iptables manual says
ESTABLISHED meaning that the packet is associated with a connection which has seen packets in both directions, NEW meaning that the packet has started a new connection, or ...
0
votes
0
answers
11
views
OpenVPN only connects over local LAN
I followed this tutorial
https://www.youtube.com/watch?v=dwrR18_xO_Q&t=44s
It works perfectly in the local network, but not in External network
I think something wrong in my dd-wrt iptables.
I ...
- 1
0
votes
0
answers
41
views
Using iptables inside an unprivileged (rootless/fakeroot) network namespace results in permission error with `/run/xtables.lock`
I'm using unshare to create an unprivileged network namespace:
unshare -Unr
This gives us a network namespace that should be capable of using iptables.
However upon running it:
iptables -L
We get:
...
- 359
0
votes
0
answers
12
views
Another way to implement the depecrated iptables MIRROR target?
According to https://www.linuxtopia.org/Linux_Firewall_iptables/x4448.html, in Linux kernel 2.3 and 2.4 iptables had a MIRROR target that would flip the source and destination of the packet, which is ...
- 703
0
votes
1
answer
20
views
iptables firewall whitelisting limit
We have a distributed system with many clients connecting to this system.
We want the server to be isolated so that only client machines can connect.
We are using IPTables as follow:
/sbin/iptables -A ...
- 1
0
votes
2
answers
70
views
Server flooded by DNS attack on port 53
I have been getting flood of traffic on port 53 all day on udp port 53
Sample Output of tcpdump using "tcpdump -n -i eth0 udp port 53"
14:29:48.734275 IP 212.174.17.28.53 > 23.92.19.211....
- 1
0
votes
1
answer
73
views
Relay TCP upload traffic and make download traffic go directly to the client
This is a supplement for iptables SNAT for UDP rule is only applied to some traffic
In fact, I have three machines:
the client
the target server
the relay server
What's my motivation for doing this?
...
- 13
0
votes
1
answer
96
views
iptables SNAT for UDP rule is only applied to some traffic
I want to use Source NAT to change the local IP address of UDP traffic. However, only locally-generated traffic has the NAT rule applied, replies to traffic generated from remote sources do not have ...
- 13
0
votes
2
answers
44
views
How to allow peers access only to the Internet?
I tried for a long time to find the answer to the question "How to allow peers access only to the Internet?", But I did not find anything. The only thing I understood is that this can be ...
- 3
1
vote
0
answers
72
views
Docker containers cannot communicate using host public IP
I have an Ubuntu server running some apps in Docker (including Nginx Proxy Manager) and some subdomains pointing to the public IP of my server. All my containers are on the same bridge network. One of ...
- 11
2
votes
0
answers
30
views
Can't access Apache2 on a VPS via public IP of the server from an external computer
root@Client13:/etc/apache2# netstat -anltp | grep "LISTEN "
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 104129/apache2
tcp 0 0 0.0.0.0:22 ...
- 23