39
votes
Accepted
Are IPv4 ports separated from IPv6 ports?
Yes, definitely. In fact, there is even a difference between a port on TCP vs that same port on UDP on the same IPv6 address, which is why you specify -p tcp as well.
IPv4 is a different mechanism ...
- 63.2k
32
votes
Accepted
How to verify if iptables is running or the firewall is activated
There is no such thing as "iptables is running" - there is no dedicated firewall process to monitor.
If the kernel modules are loaded and rules defined (both of which are proven by showing a valid ...
- 20.4k
27
votes
iptables/1.8.2 Failed to initialize nft: Protocol not supported
The solution is here: You need to reboot after a kernel upgrade. The easiest way is of course:
# as root
reboot
- 371
21
votes
Accepted
Linux iptables NAT of an entire /24 subnetwork
From man iptables-extensions:
NETMAP
This target allows you to statically map a whole network of addresses onto another network of addresses. It can only be used from rules in the nat table.
So ...
- 6,096
18
votes
Accepted
What are the IP ranges to block the entire Russian Federation?
7,255 IP address blocks assigned to the Russian Federation
As of June 2018, there are over 7,200 IPv4 address blocks assigned to the Russian Federation. The largest of them, with 524,288 addresses ...
- 1,910
13
votes
Accepted
firewall-cmd - add-forward-port don't work
THE REAL PROBLEM:
The command...
firewall-cmd --permanent --zone=public --direct --add-rule ipv4 filter FORWARD 0 -d 0.0.0.0/0 -j ACCEPT
firewall-cmd --permanent --zone=public --add-forward-port=...
- 1,274
12
votes
Accepted
What are the advantages of ufw, is it really needed?
If you know iptables, if you find iptables -L -v easy enough to read and if you prefer it, then you don't need ufw.
iptables works with the tables of packet filter rules in the Linux kernel. The ...
- 77.3k
12
votes
Are IPv4 ports separated from IPv6 ports?
Yes, they’re entirely separate. In POSIX, you create sockets using the socket(2) system call, and you pass AF_INET or AF_INET6 to it to choose between IPv4 and IPv6, respectively. Such sockets can use ...
- 391
11
votes
How to disable `iptables` automatic reverse DNS lookup?
This is mentioned in the iptables(8) manual page [emphasis mine]:
-L, --list [chain]
List all rules in the selected chain. If no chain is selected, all chains are listed. […] Please note that it is ...
11
votes
iptables/1.8.2 Failed to initialize nft: Protocol not supported
Raspbian certainly followed its Debian upstream there: by default the newer iptables userland tools are using the nftables kernel API instead of the "legacy" iptables kernel API, as told here:
...
- 6,096
10
votes
Accepted
Using Wireguard to essentially give a machine in local network a public address from VPS
Presentation
Here's an answer requiring minimal support from the server itself, but multiple routing tweaks on the WireGuard server and especially on the VPS. I chose to keep OP's setup in place, ...
- 6,096
10
votes
Accepted
Why would `dig` succeed, but `host`, `nslookup`, `curl`, `ping` all fail?
host and nslookup make several separate DNS queries – one for each record type. They want to show you both IPv4 and IPv6 addresses, so they need to make an A query and an AAAA query.
If you run host -...
- 470k
9
votes
How to permanently disable firewall in Red Hat Linux
For version 7 of CentOS or RedHat Enterprise you must use the command systemctl.
For example:
#Check status:
systemctl status firewalld
#Stop firewall:
systemctl stop firewalld
#Disable firewall:...
9
votes
Accepted
Opening a port with firewalld doesn't seem to work
See the firewalld docs:
The permanent option --permanent can be used to set options permanently. These changes are not effective immediately, only after service restart/reload or system reboot. ...
- 106
9
votes
iptables port forwarding with internal SNAT
After some experimenting, I think I've answered my question, so I should post it here in case anyone else finds it useful. Yes, it is possible, and it's fairly simple, just a matter of getting the ...
- 161
9
votes
Are IPv4 ports separated from IPv6 ports?
In short
Yes
Note that application doesn't have to bind to both IPv4 and IPv6 so you could do this even without IP tables.
Look at the ListenAddress directive in your sshd config or other application.
...
- 201
9
votes
Accepted
Iptables Fail to block inbound from specific ip
A packet being routed rather than received by a local process traverses the filter/FORWARD chain and not the filter/INPUT chain, even if this is caused by the use of NAT. So the current blocking rules ...
- 6,096
8
votes
IPTables module ip_tables not found for root
TL;DR
Update your kernel: sudo pacman -S linux
Update your bootloader: bootctl --path=/boot install
Reboot
This morning I ran into this same problem when trying to configure iptables:
[root@office-...
- 351
8
votes
Program to block an IP temporarily with iptables
You need to create an ipset so iptables can match against it.
Note timeout 0 means the default is never expire.
ipset create temp_hosts hash:ip timeout 0
iptables -I INPUT 1 -m set -j DROP --match-...
- 14.3k
8
votes
How to use NAT iptables rules for hostapd
I wrote a firewall for all occasions.
Please read the README and the SCRIPT before using it.
I included the necessary rules for HOSTAP
Essential Parts:
HostAP
iptables -t nat -A POSTROUTING -o eth0 -...
- 205
8
votes
Deny all incoming connections with iptables?
Be aware that the other answers do not cover IPv6! If your system accepts IPv6 traffic, not a single iptables rule will apply to ipv6 traffic.
instead of using iptables / ip6tables directly, i ...
- 1,351
8
votes
Accepted
What do input and output chains in NAT table do?
INPUT and OUTPUT chains are traversed for packets delivered to and sent from applications running on the local machine.
If an application sends out a packet, it traverses
app -> OUTPUT -> ...
- 17.1k
8
votes
OpenVPN connection through SSH tunnel
The simplistic approach to setting up your VPN connection through an SSH tunnel will not work. First problem: you are only tunneling the connection to the VPN server itself, which does not then allow ...
- 3,506
7
votes
How can I check if an iptables rule already exists?
To avoid duplicate rules from your script, add below line.
iptables -C -INPUT -p tcp --dport 8080 --jump ACCEPT || iptables -A -INPUT -p tcp --dport 8080 --jump ACCEPT
First time when above command ...
7
votes
Deleting a IP from blacklist iptables
Sorry, i found the solution after some fiddling around...
ipset list (for listing your blacklist entries)
ipset del (blacklist name) (IP you want gone)
- 151
7
votes
OpenVPN connection through SSH tunnel
I could successfully establish a connection to my Raspberry Pi (with PiVPN)
over TCP and an external VPS. Then I did this:
allow the forwarding to public on your server (VPS/VPN). Change GatewayPorts ...
- 311
7
votes
Iptables forwarding port/s to a external IP transparently (remote end should see the actual source IP)
With only NAT – no. IP packets only have one 'source' field.
If you make iptables keep the original client address (DNAT only), then y.y.y.y will attempt to send replies directly to that original ...
- 470k
6
votes
Limit and limit burst in IPTABLES
--limit: Specifies the rate at what tokens get refilled into the bucket. 4/hour means 4 tokens per hour (1 token every 15 minutes).
--limit-burst: Specifies the maximum amount of tokens that can be ...
- 161
6
votes
Accepted
How to get iptables rules to load at startup?
Preface: Getting IPTables to be persistent between reboots can be maddening since basic processes/procedures seem to vary greatly between Linux distros. So don’t sweat it if this seems confusing; it ...
- 55.9k
Only top scored, non community-wiki answers of a minimum length are eligible