New answers tagged

0 votes

No forward packet with iptables prerouting rule

During conversation https://chat.stackexchange.com/rooms/139576/discussion-on-answer-by-gapsf-no-forward-packet-with-iptables-prerouting-rule: host A has one interface with two IPs from the same ...
  • 340
1 vote
Accepted

iptables ESTABLISHED,RELATED in combination with DNS rules

To me it seems that these HTTP requests are marked as RELATED, and thus implicitly allowed by the RELATED,ESTABLISHED rules This is not the real reason (iptables does not have a conntrack helper for ...
  • 387k
1 vote
Accepted

Is it possible to block Wi-Fi peers from communicating with each other?

802.11 WNICs in AP mode automatically forward frames to other wireless clients based on the destination MAC address. Relayed wireless-to-wireless frames don't necessarily even get passed up from the ...
  • 97.9k
0 votes

Is this firewall completely secure?

The point is, you don't have perfect security, because a system is only as secure as its weakest component. If ssh and/or openvpn can be compromised, someone can hack his way into your server by those ...
  • 188
0 votes

iptables/1.8.2 Failed to initialize nft: Protocol not supported

My errors looked like this: docker: Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running? And if you look in sudo cat /var/log/docker.log you find Running ...
  • 231
0 votes

How Implement login/authorization to captive portal?

To get a captive portal up and running, a multi-step process is required. Before you get started, I'd recommend to set up a name server on your box so that you can handle name resolution there (a ...
  • 188
0 votes
Accepted

Configuring DNAT with multiple ISP interfaces

Rules 300: from <ISP-1 IP> lookup external_p 400: from <ISP-2 IP> lookup external_s works because reply packets have src IP = dst IP of incoming packets (but not the same outgoing ...
  • 340
0 votes
Accepted

Limit Wireguard client access to only a few servers

Like user1686 and A. B suspected, you have an old rule that's accepting all traffic coming in the wg0 interface -- the first rule in your FORWARD chain, before the jump to your WIREGUARD_wg0 chain: [...

Top 50 recent answers are included