4
votes
Accepted
How to allow only one way traffic with wireguard
Given PC-s: A, B, C. A should be able to reach (ping, telnet, etc) B and C, B should be able to reach C, but not backwards.
That is not one-way traffic. To make a telnet connection, you have to send ...
- 470k
4
votes
Preserve incoming interface for answers in openwrt router
Marks set via -j MARK are specific to the packet, so if you mark an incoming packet, this has no effect on outgoing responses by default. You need to set a connection mark – in other words, store the ...
- 470k
3
votes
Using Wireguard to forward traffic from public facing VPS to private server
Your analysis is correct: it's not working with containerized services because connections to containers are forwarded (as if they were on another host) instead of bound to a local port on the backend ...
- 699
3
votes
Accepted
Access remote SSH tunnel from inside docker container
After a 2 week deep dive into networks in general, docker networking in particular and how docker interacts with iptables, I now feel confident to answer my own question:
First of all, this has ...
- 171
3
votes
Accepted
Block with firewall a dns request containing a certain query
iptables does not understand DNS natively, but it should be possible using string match:
-p udp --dport 53 -m string --algo kmp --hex-string "|0A|wetransfer|03|com|00|" --icase
Note that ...
- 470k
2
votes
Isolate Proton game from internet without breaking Steam API
After some time of testing, I was able to make it work.
I used the iptables way, you have to create a no-internet group, add the user to that group, in iptables add rule:
iptables -A OUTPUT ! -o lo -m ...
- 51
2
votes
Prevent Internet access when VPN fails
There are multiple ways to handle this depending on some nuances in your setup.
I am assuming here that you are worried about the vpn failing and not the end clients connecting to tje wrong ssid (or ...
- 71.6k
2
votes
Accepted
unable to connect to WSL container by it's ip address
"actively refused it" typically means TCP RST, sent by the responding system to indicate that no service is listening on that address:port.
Listening sockets aren't bound only to a (...
- 470k
2
votes
Accepted
IPtables dropping packets I can't see with tcpdump and I don't know why?
You probably need the following rule:
-A INPUT -i lo -j ACCEPT
This is likely because you have the systemd-resolved local DNS stub listener listed as the (only) nameserver in your /etc/resolv.conf.
...
- 10.3k
1
vote
Accepted
What type of NAT does iptables MASQUERADE implement?
In the example of Symmetric NAT from the linked question:
echo "1" >/proc/sys/net/ipv4/ip_forward
iptables --flush
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE --random
iptables -...
- 8,729
1
vote
How to allow only one way traffic with wireguard
The solution based on grawity_u1686's insights:
Iptables:
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
11 ...
- 13
1
vote
Any updates ways to block wildcard outgoing traffic to a domain?
I would personally install unbound have these blocked on a DNS level by returning a NX ... that would require to have localhost as your only resolver and block queries to external DNS servers as well. ...
- 1,673
1
vote
Cannot reach web server in vm from bare metal using DNS after iptables rules forward packets to virtual bridge
Traffics originated from the host itself is governed by the OUTPUT chain, so you need the following rule additionally:
iptables -t nat -I OUTPUT -p tcp --dport 9080 -j DNAT --to-destination 192.168....
- 10.3k
1
vote
Accepted
Communication between 2 internal NICs when using ip tables to route internrt
PC1 and PC2 can't see each other's session (I think they need to be on the same subnet).
If that's the requirement (i.e. the games rely on LAN discovery and won't let you enter the IP address ...
- 470k
1
vote
Accepted
Unable to forward and receive internet traffic through Raspberry Pi 4 Wifi AP
In your dnsmasq configuration, you have the following line:
dhc-option=option:router,192.168.1.1
…but also the following IP pool for DHCP clients:
dhcp-range=192.168.220.50,192.168.220.150,12h
With ...
- 64.3k
1
vote
Accepted
How can I block GPSD from communicating out?
I need to make it so nothing goes out on port 2947 at all,
To start with, as far as firewall rules go, GPSD isn't "communicating out" because it's not initiating the connection – gpspipe is....
- 470k
1
vote
Accepted
What determines if a packet should be routed locally or forwarded?
How does the routing table affect the routing decision?
Internally, it's all made according to the routing table. Linux has an additional routing table, the local table, that has special routes for ...
- 470k
1
vote
How can I simulate NAT reflection failure with `iptables`?
Add an ordinary 'DROP' rule that blocks 'INPUT' packets from your router's IP address to this port.
Due to the way hairpinning "solves" the underlying problem, all hairpinned connections ...
- 470k
1
vote
How to force a match of "mark" of iptables to send its traffic to a TPROXY proxy?
I discovered what was wrong.
When TPROXY traffic in iptables comes from marked packets matched with "-m mark", the packets needs to be re-marked with the firewall mark of another routing ...
- 111
1
vote
Accepted
In Linux how to loop-back the internal traffic that's destined to the server's own NATed public IP?
Add identical NAT rules to the server's own firewall. You need to place them in the 'OUTPUT' chain instead of the usual 'PREROUTING' (however, still in the 'nat' table). For example, in nftables:
...
- 470k
1
vote
Accepted
iptables how to port forward remote to local
Try this:
iptables -I OUTPUT -o lo -t nat -p tcp --dport 443 -j DNAT --to 127.0.0.1:9999
This will intercept traffic destined for locahost on port 443 and NAT it to port 9999. You do not need to ...
- 71.6k
1
vote
Accepted
How to SSH Out from a Subnet
Okay, so apparently for some reason, you would like to use 192.168.1.1:2222 to "represent" 192.168.0.132:22, even when you can really just ssh the latter directly on/from VM2/VM3.
As I ...
- 10.3k
1
vote
Accepted
How iptables SNAT deal with src port dilemma between port translation fr local ip and DNAT rule that forwards all traffic to the same local ip?
Existing conntrack states (the "NAPT records") always have priority over any -t nat rules.
If you remember, the -t nat table is only visited by one packet per connection – that's because any ...
- 470k
1
vote
Implementing an OpenVPN "kill switch" with iptables
A short solution
Add an empty group tunnel
Run OpenVPN within this group (with sg tunnel or Group=tunnel for systemd unit)
Use the following rules
# Local traffic is allowed
iptables -A INPUT -i lo ...
- 111
1
vote
Is there any other way to get IPTables to filter IP addresses based on geolocation in Ubuntu 12.0.4.5 (LTS)
Building on Giacomo's answer from 2015....
Now in 2023, MaxMind now requires you to go through a login process and generate a (free) license key in order to download the CSV files automatically. ...
- 121
1
vote
How can I check if an iptables rule already exists?
I had this same problem, so I created a small function for bash shell script to handle adding rules only if they do not exists.
Note: This is a preventative measure to avoid duplicates rather than a ...
- 121
Only top scored, non community-wiki answers of a minimum length are eligible