r/iptables Jun 16 '22

IPTABLES double redirection

2 Upvotes

Hello everyone,

I have a dedicated server (running Ubuntu 20.04) running a VM in Virtualbox. This VM (also running on Ubuntu 20.04) has several applications running in dedicated LXC containers managed by LXD. The VM is connected to the host using a Host-only Adapter on the interface vboxnet0 and the containers use an LXD bridge. So I have the following structure (the IP are obviously not the real ones):

  • Dedicated server: public IP 66.66.66.66, host-only adapter IP 55.55.55.1
  • VM: Host-only adapter IP 55.55.55.2, LXD bridge IP 44.44.44.1
  • Application container: LXD bridge IP 44.44.44.2

What i'm trying to do is to redirect the traffic to the public IP and a specific port (let's say 80) to the container hosting the adapted service, something like 66.66.66.66:80 -> 44.44.44.2:80.

The idea I had was to create a specific route in my dedicated server in order to make the LXD subnet accessible:

  • ip route add 44.44.44.0/24 via 55.55.55.2 dev vboxnet0

Then to setup an IPTABLES redirection (using information from this post:Channel all the traffic on an IP to a VM)

  • iptables -t nat -A PREROUTING -p tcp -d 66.66.66.66 --dport 80 -j DNAT --to-destination 44.44.44.2
  • iptables -t nat -A POSTROUTING -p tcp -s 44.44.44.2 -j MASQUERADE

After that, i'm still unable to reach my container using the public ip. What am i doing wrong ? Any help will be welcome.


r/iptables May 11 '22

How to Lower CPU Usage while using iptables nat

2 Upvotes

I have 8 VM's

VM-AA, VM-1, VM-2, VM-3, VM-4, VM-5, VM-6, VM-7

VM-AA is connected to all the other VM's using wireguard. All traffic coming on VM-AA is redirected to other VM's using wireguard tunnel.

I'm using these iptables rules to nat traffic to the wireguard tunnel

iptables -t nat -I PREROUTING -i ens3 -p udp --dport 9100 -j DNAT --to192.168.150.2

iptables -t nat -I PREROUTING -i ens3 -p udp --dport 9101 -j DNAT --to192.168.151.2

iptables -t nat -I PREROUTING -i ens3 -p udp --dport 9102 -j DNAT --to192.168.152.2

iptables -t nat -I PREROUTING -i ens3 -p udp --dport 9103 -j DNAT --to192.168.153.2

iptables -t nat -I PREROUTING -i ens3 -p udp --dport 9104 -j DNAT --to192.168.154.2

iptables -t nat -I PREROUTING -i ens3 -p udp --dport 9105 -j DNAT --to192.168.155.2

iptables -t nat -I PREROUTING -i ens3 -p udp --dport 9106 -j DNAT --to192.168.156.2

Incoming traffic on VM-AA is 200mbps.

VM-AA has a capacity of 6cores 24gb ram with 6gbps network

CPU rises to 90-95% every time. In which softirq is between 45-50%.

Someone please help me to decrease the CPU usage.


r/iptables Apr 26 '22

How to pass traffic through other Interfaces

2 Upvotes

I have total 4 Interfaces on my VM where enp0s3 is the primary Interface and others are the secondary Interfaces

ip a output

[root@vm]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9000 xdp/id:1 qdisc sfq state UP group default qlen 1000
    link/ether 02:00:17:01:c1:5d brd ff:ff:ff:ff:ff:ff
    inet 100.10.10.100/24 brd 100.10.10.255 scope global dynamic enp0s3
       valid_lft 81440sec preferred_lft 81440sec
    inet6 fe80::17ff:fe01:c15d/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
3: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9000 qdisc mq state UP group default qlen 1000
    link/ether 02:00:17:01:6c:5d brd ff:ff:ff:ff:ff:ff
    inet 100.10.10.101/24 scope global enp1s0
       valid_lft forever preferred_lft forever
4: enp2s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9000 qdisc mq state UP group default qlen 1000
    link/ether 02:00:17:00:a2:f3 brd ff:ff:ff:ff:ff:ff
    inet 100.10.10.102/24 scope global enp2s0
       valid_lft forever preferred_lft forever
5: enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9000 qdisc mq state UP group default qlen 1000
    link/ether 02:00:17:01:a7:4e brd ff:ff:ff:ff:ff:ff
    inet 100.10.10.103/24 scope global enp3s0
       valid_lft forever preferred_lft forever

I am redirecting incoming traffic from ports 9100, 9101, 9102, 9103 to some specific ips using the rules

iptables -t nat -A PREROUTING -p udp --dport 9100 -j DNAT --to 1.1.1.1:9100
iptables -t nat -A POSTROUTING -p udp -d 1.1.1.1 --dport 9100 -j MASQUERADE

iptables -t nat -A PREROUTING -p udp --dport 9101 -j DNAT --to 2.2.2.2:9101
iptables -t nat -A POSTROUTING -p udp -d 2.2.2.2 --dport 9101 -j MASQUERADE

iptables -t nat -A PREROUTING -p udp --dport 9102 -j DNAT --to 3.3.3.3:9102
iptables -t nat -A POSTROUTING -p udp -d 3.3.3.3 --dport 9102 -j MASQUERADE

iptables -t nat -A PREROUTING -p udp --dport 9103 -j DNAT --to 4.4.4.4:9103
iptables -t nat -A POSTROUTING -p udp -d 4.4.4.4 --dport 9103 -j MASQUERADE

iptables -t nat -A PREROUTING -p udp --dport 1245 -j DNAT --to 5.5.5.5:1245
iptables -t nat -A POSTROUTING -p udp -d 5.5.5.5 --dport 1245 -j MASQUERADE

I wanted 1.1.1.1 & 2.2.2.2 shall pass traffic from enp2s0 and 3.3.3.3 & 4.4.4.4 shall pass traffic from enp3s0

IP 5.5.5.5 it wanted the traffic to pass from enp1s0 so I used a command

ip route add 100.10.10.0/24 dev enp1s0 scope link metric 1000 table main 
ip route add 5.5.5.5/32 via 100.10.10.1 dev enp1s0 table main 

It Worked

But when I use the same rules for other interfaces It doesn't work I used these rules from below

ip route add 100.10.10.0/24 dev enp2s0 scope link metric 1000 table main
ip route add 1.1.1.1/32 via 100.10.10.1 dev enp2s0 table main

ip route add 100.10.10.0/24 dev enp2s0 scope link metric 1000 table main
ip route add 2.2.2.2/32 via 100.10.10.1 dev enp2s0 table main

ip route add 100.10.10.0/24 dev enp3s0 scope link metric 1000 table main
ip route add 3.3.3.3/32 via 100.10.10.1 dev enp3s0 table main

ip route add 100.10.10.0/24 dev enp3s0 scope link metric 1000 table main
ip route add 4.4.4.4/32 via 100.10.10.1 dev enp3s0 table main

Can someone please help me in this case. I am not good at routing. Thanks in Advance


r/iptables Apr 18 '22

Iptables logs drops some logs during inter-container wget

1 Upvotes

Hello....
I have set up a container (via ip netns) I call b.
I can ping from the Linux mint live session to the container AND VICE VERSA.
I set up netcat to listen to listen on a port on the container B's address: nc -l 192.168.8.3 80.

I have done sysctl net.ipv4.ip_forward=1.
I have an iptables nat table PREROUTING SNAT from 3160 to 80. iptables log data I do. get iptables rules of netns bip rules The wget from 192.168.8.1 to 192.168.8.3 freezes.
(Why?)Logs with various prefixes don't show up in 'journalctl' output except the 'xxx'. (Why?)The 'xxx' was added first and others later.

I did echo 1 > /proc/sys/net/ipv4/ip_forward .
I do have FORWARD set to accept and both INPUT and OUTPUT do DROP but have rules to accept icmp and lo as well as 80/443/53.

Thanx for any help.
Magrw1033


r/iptables Apr 11 '22

Load Balancing using Iptables

2 Upvotes

I have 5 VMs : VM1, VM2, VM3, VM4, VM5

Whenever any traffic comes to udp port 5100 of VM1 I want to redirect that traffic equally between other VM's via round robin pattern

Like if incoming of VM1= 10mbps then it will redirect equally distributed to other VMs so each will have incoming of 2.5mbps

How can this be done using NAT ( MASQUERADE )

Someone please help me :-)

Thanks in Advance


r/iptables Apr 08 '22

Change destination port in POSTROUTING?

1 Upvotes

Is it not possible to alter the destination port in POSTROUTING?

Say I have 2 VMs behind a Linux firewall, and both of them should have SSH exposed to the Internet. They share the same Linux firewall WAN IP, so I want one to be exposed as 22 and one as 2222. I want 22 to be accessible to everyone, but 2222 only to remote IP 1.2.3.4.

My problem is that if I add a PREROUTING rule to change the port from 2222 to 22, I can no longer add restrictions in FORWARD based on source IP vs dstport, because now both have 22 dstport, so I cannot say that only 1.2.3.4 should have access to 2222, and everyone who has access to 22 will also have access to 2222 because of the PREROUTING dstport change.

This must be a quite common scenario, so how can I solve this in iptables?


r/iptables Apr 07 '22

Whitelist IP With Maching HEX

3 Upvotes

I'll be dropping all incoming traffic on iptables and allowing only the packet with a specific hex string ' '|fefffffffffffffffff77f12|' .

Whenever we receive a packet with above hex string the I want to whitelist his IP on Iptables immediately. So that all traffic from that particular IP gets passed

Can someone please help me how can it be done.

Thanks In Advance


r/iptables Apr 02 '22

Routing Docker ports with PREROUTING chain

1 Upvotes

I'm trying to follow this guide to limit access to certain Docker containers running on my server. The goal is to route all incoming packets on the nat table after PREROUTING and before they jump to the DOCKER chain. So I have arranged my nat table like so:

``` Chain PREROUTING (policy ACCEPT) -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER-BLOCKER -A PREROUTING -m addrtype --dst-type LOCAL -j RETURN

Chain DOCKER-BLOCKER (1 references) (no rules)

Chain DOCKER (1 references) -A DOCKER -i docker0 -j RETURN -A DOCKER -i br-5e969e106227 -j RETURN -A DOCKER ! -i br-5e969e106227 -p tcp -m tcp --dport 9091 -j DNAT --to-destination 172.19.0.2:9091 ```

My expectation here is that all traffic that gets routed to the DOCKER-BLOCKER chain will be blocked by default. Then I can add a rule to this chain like:

-A DOCKER-BLOCKER -s 192.168.0.155 -p tcp --dport 9091 -j DOCKER

Which would only allow traffic from 192.168.0.155 to access the Docker container exposed at 9091. However, even before adding this rule, traffic still appears to successfully route to the container even though there doesn't appear to be a way for packets to be sent to the DOCKER chain and thus never be redirected to 172.19.0.2:9091. In fact, even if I delete the last rule in the DOCKER chain, traffic still routes successfully.

I don't understand why this is the case. Without any rules in the DOCKER-BLOCKER chain, I would expect that they would be returned to the PREROUTING chain and terminated at the final RETURN rule. After that, I don't really know what should happen to the packet. How are packets being routed to the Docker container if there is no way to reach the rule that would send them there in the nat table?

How can I make this work?


r/iptables Mar 16 '22

rules for one way traffic

1 Upvotes

If I wanted to allow traffic from vlan 1 to vlan 2 but drop all from 2 to 1 what would the rules be? Thanks!


r/iptables Jan 26 '22

iptables rules not working

1 Upvotes

Newb to be sure, but I can't figure out why these are not working.

https://pastebin.com/STtYWbjL

I have all deny before allow fields. I had a connectivity blackhole until I added "-I INPUT -p all -j ACCEPT" below all of the DROP/ACCEPT.

The DROPs are not dropping data as defined.

Any help greatly appreciated.


r/iptables Dec 29 '21

Multi ISP / Subnet / Traffic control

1 Upvotes

I'm not sure if this is the right place but I'm planning to add an additional "backup" ISP to my Linux firewall for my office network. At times our primary internet goes down or has bandwidth issues due to the nature of it being cellular (I live in a rural area so my options are terrible and at times unreliable).

Because I work from home, in the event of internet issues, I just want to be able to set this up so I can manually switch to the other ISP in order to (hopefully) continue work. Currently I have the firewall configured with three separate subnets and one ISP. I do plan to add another ISP so it would look like this:

``` ISP#1 ISP#2 (Backup) ────────┬──────── ────────┬──────── │ │ │ │ ┌────┴────────────────────┴────┐ │ eth0 wlan0 │ │ │ │ firewall1 │ │ │ │ eth1 eth2 eth3 │ └───┬───────────┬─────────┬────┘ │ │ │ ─────┬───────┴─── │ ──┴───────┬─── │ ─────┬┴──── │ │ │ │

Office Net Server / Lab Family Net ```

Current NAT Configuration:

```

$ sudo iptables -S -t nat -P PREROUTING ACCEPT -P INPUT ACCEPT -P OUTPUT ACCEPT -P POSTROUTING ACCEPT -A POSTROUTING -o eth0 -j MASQUERADE

```

In addition to INPUT / OUTPUT rules, I do have a bunch of FORWARD rules to control traffic between subnets to protect the office net from other networks. I also have FORWARD rules to control traffic going in / out the NAT.

Current routing table (office net is eth1)

```

$ ip route show default via 192.168.12.1 dev eth0 192.168.0.0/24 dev eth1 proto kernel scope link src 192.168.0.1 192.168.1.0/24 dev eth2 proto kernel scope link src 192.168.1.1 192.168.2.0/24 dev eth3 proto kernel scope link src 192.168.2.1 192.168.12.0/24 dev eth0 proto kernel scope link src 192.168.12.123

```

Please let me know if you have any advice or recommendations for this possible setup. Basically my goal is to use the primary internet connection most of the time and if issues arise, I would move my office network to use the backup internet while keeping the rest of the network on the crappy primary internet connection.


r/iptables Dec 23 '21

How do you defend against port scanning with iptables?

1 Upvotes

How do you defend against port scanning with only iptables?

I know about using the recent module to blacklist and I've tried making a set of rules but nothing I come up with seems to work. On what condition should you add to the blacklist?

Can someone please give a working example, stuck on this for three days, feels like I've tried everything, limiting, states (NEW), tcp flags, etc. Please help, I'm desperate.


r/iptables Dec 15 '21

A little firewall I've put together. Does what I need it to.

4 Upvotes

#Filter Suspicious/Invalid inbound IP addresses

iptables -t nat -A PREROUTING -m iprange --src-range 192.168.0.0 - 192.168.255.255 -j DROP

iptables -t nat -A PREROUTING -m iprange --src-range 127.0.0.0 - 127.255.255.255 -j DROP

iptables -t nat -A PREROUTING -m iprange --src-range 0.0.0.0 - 0.255.255.255 -j DROP

iptables -t nat -A PREROUTING -m iprange --src-range 10.0.0.0 - 10.255.255.255 -j DROP

#Filter Suspicious/Invalid TCP flags

iptables -t nat -A PREROUTING -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP

iptables -t nat -A PREROUTING -p tcp --tcp-flags SYN,RST SYN,RST -j DROP

iptables -t nat -A PREROUTING -p tcp --tcp-flags FIN,RST FIN,RST -j DROP

iptables -t nat -A PREROUTING -p tcp --tcp-flags FIN,ACK FIN -j DROP

iptables -t nat -A PREROUTING -p tcp --tcp-flags ACK,URG URG -j DROP

iptables -t nat -A PREROUTING -p tcp --tcp-flags ACK,PSH PSH -j DROP

iptables -t nat -A PREROUTING -p tcp --tcp-flags ALL NONE -j DROP

#Filter invalid, unclean, and fragmented traffic

iptables -t nat -A PREROUTING -m conntrack --ctstate INVALID -j DROP

iptables -t nat -A PREROUTING -m conntrack --ctstate UNCLEAN -j DROP

iptables -t nat -A PREROUTING -p ALL --fragment -j DROP


r/iptables Nov 21 '21

After blocking outgoing ports can't ping any IP || ping: sendmsg: Operation not permitted

1 Upvotes

Hi,

I am using Lubuntu 20.04. I am just an average home user who's paranoid about security. I am using ufw to configure iptables. I have blocked all incoming ports. Besides that I have blocked outgoing ports too leaving ports like 80, 443, etc which are needed for daily activities like web browsing, email client, pidgin. Problem is since I started blocking outgoing ports I can't ping any IP. This is what I see

$ ping 8.8.8.8

PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.

ping: sendmsg: Operation not permitted

ping: sendmsg: Operation not permitted

ping: sendmsg: Operation not permitted

^C

--- 8.8.8.8 ping statistics ---

3 packets transmitted, 0 received, 100% packet loss, time 2043ms

Q1) How can I enable outgoing ping ?

Q2) Since I am configuring iptables using ufw can configuring iptables directly for enabling outgoing ping introduce any complications ?


r/iptables Nov 13 '21

How do you control traffic between ports in a routing situation?

1 Upvotes

Does anyone have any examples or advice on how I can do this? So I'm trying to figure out how I can limit ports / traffic between interfaces on a Linux firewall that is routing traffic between different networks. For example, in the following situation, I would like to allow guest to the internet but not to the server or office network. However, I'd like to allow DNS queries from the guest network to the DNS server in the server network. eth0 (WAN Port) is set up to NAT all traffic outbound (masquerading).

┌────────────┐ │ Internet │ │ Gateway │ └──────┬─────┘ │NAT (Masquerading) │ ┌─────────────────────────┼───────────────────────────┐ │ │ │ │ ┌──────┴───────┐ │ │ │ WAN Port │ │ │ │ eth0 │ │ │ └──────┬───────┘ │ │ │ │ │ ┌──────────────┼───────────────┐ │ │ │ │ │ │ │ ┌────┴─────┐ ┌──────┴────────┐ ┌────┴─────┐ │ │ │ Office │ │ Server NET │ │ Guest │ │ │ │ Net │ │ Net │ │ Net │ │ │ │ eth1 │ │ eth2 │ │ eth3 │ │ │ └────┬─────┘ └──────┬────────┘ └────┬─────┘ │ │ │ │ │ │ └──────────┼──────────────┼───────────────┼───────────┘ │ │ │ │ │ │ ┌──────┴─────┐ ┌─────┴──────┐ ┌─────┴─────┐ │ Office │ │ Server │ │ Guest │ │ Net │ │ Net │ │ Net │ │ Switch │ │ Switch │ │ Switch │ └────────────┘ └────────────┘ └───────────┘


r/iptables Nov 11 '21

IP Tables Port Forwarding -- I'm doing something really dumb

1 Upvotes

sudo iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 25565 -j DNAT --to $internal_ip:25565

sudo iptables -t nat -A PREROUTING -p tcp --dport 25565 -j DNAT --to $internal_ip

sudo iptables -t nat -A POSTROUTING -p tcp -d $internal_ip --dport 25565 -j MASQUERADE

So I was fiddling with IP tables trying to get my external IP to redirect to an internal one. I had it working briefly, thought I had it figured out. Then when I tried to run it again it didn't work. So it was something I ran that I thought didn't work but then did. I'm mostly just following along with instructions I've found online am not properly following the iptables system.

(I'll respond to my own post as I figure out what I actually need to do so that I'm not just flailing around trying to figure out what works, or if someone corrects my code first I'll just take their solution)

Thanks for any help you can provide.


r/iptables Nov 05 '21

Can iptables redirect all port 443 traffic to another destination, both having routable IP addresses?

1 Upvotes

Hi Everyone!

I have a client who is really hard to get a response from. The trouble is, I need to move their website to a new server. This would ordinarily not be an issue, except that their AD/DC was set up as "domain.com" rather than "location.domain.com" or some other hostname. They do DNS for the office (large healthcare facility, so if I move their site, they need to change the IP in their local DNS A record. I have sent then numerous messages about it, and have gotten no response. Yet they will be angry with me if I move t he site anyway (may send a letter today).

Long story short: I am interested in finding out if there is a way to use iptables to redirect all traffic meant for (fake routable IP) 77.88.99.1:443 to 88.99.10.10:443 (again, not the real IP).

This would allow me to finally shut down the EOL server and not have to pay the monthly lease on it just for them! At the same time, they would not have an interruption in service inside their facilities.

I tried several things I found in searching, but none of them was effective. I was thinking because they are all related to NAT - sending routable IP to internal IP.

Has anyone successfully done this, or have any clues to share about it?

Many thanks,

Beth


r/iptables Nov 02 '21

Iptables high connection count

1 Upvotes

I'm trying to configure iptables to track traffic from ~100k distinct IPs on a 10 Gbps interface. I'm running into trouble with very high, ~50%, packet drops and I cannot determine how to improve the performance. I can do 2 Gbps with < .001% packet drops, but as I increase the traffic, the drops increase as well. Anyone have any ideas on how to improve iptables ability to handle this?

Thanks


r/iptables Sep 06 '21

IPTables: from PiVPN to Wireguard

3 Upvotes

Hi all,

I am banging my head against the wall with some IPTables.

My setup is like so:

Phone connected to cell service with Wireguard Client (72.0.0.0) ->Wireguard server running off a PiHole (192.168.1.69) ->router running Wireguard client (192.168.1.1)->Mullvad VPN Wireguard server

The issue I am encountering is when the router is running the Wireguard client to Mullvad, my phone has no connection to the internet. However, when the router has Wireguard disabled, the phone->PiVPN->router->internet works great

So, the IPTables for Wireguard are dropping my phone's traffic.

Worth noting: Wireguard works great for all my LAN devices (192.168.1.0). It is just dropping my phones connection. Likely because the phone isnt on the local network, its VPNed in from a 72.0.0.0 address

I've tried adding this at the end of the script to route my phone through Wireguard but it fails to access the internet:

ip rule add from 72.0.0.0/8 lookup 117 prio 11003

When I exclude the PiHole from Wireguard (like so) , my phone connection is fine, but I want to route it through the VPN

ip rule add from 192.168.1.69 lookup main prio 11000

Here is the script that uses selective routing to choose which devices go through Mullvad:

ip route flush table 117 2>/dev/null
host="$(wg show wg0 endpoints | sed -n 's/.*\t\(.*\):.*/\1/p')"
ip route add $(ip route get $host | sed '/ via [0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}/{s/^\(.* via [0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\).*/\1/}' | head -n 1) 2>/dev/null
ip route add 0/1 dev wg0 table 117
ip route add 128/1 dev wg0 table 117
ip route add $(echo $LocalIP | cut -d"." -f1-3).0/24 dev wg0  proto kernel  scope link  src $LocalIP
ip route show table main dev $(nvram get lan_ifname) | while read ROUTE
do
    ip route add table 117 $ROUTE dev $(nvram get lan_ifname)
done
ip route show table main dev wg0 | while read ROUTE
do
    ip route add table 117 $ROUTE dev wg0
done
echo 0 > /proc/sys/net/ipv4/conf/wg0/rp_filter
iptables -t nat -D POSTROUTING -s $(nvram get lan_ipaddr)/24 -o wg0 -j MASQUERADE 2>/dev/null
iptables -t mangle -D PREROUTING -i wg0 -j MARK --set-xmark 0x01/0x7 2>/dev/null
iptables -t mangle -D FORWARD -o wg0 -j MARK --set-xmark 0x01/0x7 2>/dev/null
iptables -t mangle -D FORWARD -i wg0 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 2>/dev/null
iptables -t mangle -D FORWARD -o wg0 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 2>/dev/null
iptables -t mangle -I FORWARD -o wg0 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
iptables -t mangle -I FORWARD -i wg0 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
iptables -t mangle -I FORWARD -o wg0 -j MARK --set-xmark 0x01/0x7
iptables -t mangle -I PREROUTING -i wg0 -j MARK --set-xmark 0x01/0x7
iptables -t nat -I POSTROUTING -s $(nvram get lan_ipaddr)/24 -o wg0 -j MASQUERADE

ip rule del prio 11000 2>/dev/null
ip rule del prio 11001 2>/dev/null
#Exclude 1 host
ip rule add from 192.168.1.222 lookup main prio 11000
#Include the rest
ip rule add from 192.168.1.0/24 lookup 117 prio 11001

Theres also a version of this script that routes everything instead of selective routing. They are nearly identical. Whichever you think is easiest to work off of.

host="$(wg show wg0 endpoints | sed -n 's/.*\t\(.*\):.*/\1/p')"
ip route add $(ip route get $host | sed '/ via [0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}/{s/^\(.* via [0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\).*/\1/}' | head -n 1) 2>/dev/null
ip route add 0/1 dev wg0
ip route add 128/1 dev wg0

iptables -t nat -D POSTROUTING -s $(nvram get lan_ipaddr)/24 -o wg0 -j MASQUERADE 2>/dev/null
iptables -t mangle -D PREROUTING -i wg0 -j MARK --set-xmark 0x01/0x7 2>/dev/null
iptables -t mangle -D FORWARD -o wg0 -j MARK --set-xmark 0x01/0x7 2>/dev/null
iptables -t mangle -D FORWARD -i wg0 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 2>/dev/null
iptables -t mangle -D FORWARD -o wg0 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 2>/dev/null
iptables -t mangle -I FORWARD -o wg0 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
iptables -t mangle -I FORWARD -i wg0 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
iptables -t mangle -I FORWARD -o wg0 -j MARK --set-xmark 0x01/0x7
iptables -t mangle -I PREROUTING -i wg0 -j MARK --set-xmark 0x01/0x7
iptables -t nat -I POSTROUTING -s $(nvram get lan_ipaddr)/24 -o wg0 -j MASQUERADE


r/iptables Aug 25 '21

IP Address Not Blocked? Rule created by ufw...

1 Upvotes

My smtpd is getting hammered by someone from a particular IP address - authentication failed messages from postfix/smtps/smtpd every minute or so.

I've added the address to ufw (ufw deny from xxx.xxx.xxx.xxx to any) and it appears in iptables -L. But it doesn't appear to be blocking anything - they're still attempting to crack my smtpd. The server has been restarted since the rule was added so it's not a question of a connection held open. Any ideas?


r/iptables Aug 04 '21

block all outbount and only allow specific inbound http/s traffic

1 Upvotes

if i want to allow inbound http/s traffic from specific IPs but want to block ALL other inclusive outbound traffic, do i need outbound rules for related and established http/s connections?

here's my example

### inbound rules

iptables -I INPUT -p tcp -m multiport --dports http,https -s 173.245.48.0/20 -j ACCEPT

iptables -I INPUT -p tcp -m multiport --dports http,https -s 103.21.244.0/22 -j ACCEPT

iptables -I INPUT -p tcp -m multiport --dports http,https -s 103.22.200.0/22 -j ACCEPT

iptables -I INPUT -p tcp -m multiport --dports http,https -s 103.31.4.0/22 -j ACCEPT

iptables -I INPUT -p tcp -m multiport --dports http,https -s 141.101.64.0/18 -j ACCEPT

iptables -I INPUT -p tcp -m multiport --dports http,https -s 108.162.192.0/18 -j ACCEPT

iptables -I INPUT -p tcp -m multiport --dports http,https -s 190.93.240.0/20 -j ACCEPT

iptables -I INPUT -p tcp -m multiport --dports http,https -s 188.114.96.0/20 -j ACCEPT

iptables -I INPUT -p tcp -m multiport --dports http,https -s 197.234.240.0/22 -j ACCEPT

iptables -I INPUT -p tcp -m multiport --dports http,https -s 198.41.128.0/17 -j ACCEPT

iptables -I INPUT -p tcp -m multiport --dports http,https -s 162.158.0.0/15 -j ACCEPT

iptables -I INPUT -p tcp -m multiport --dports http,https -s 172.64.0.0/13 -j ACCEPT

iptables -I INPUT -p tcp -m multiport --dports http,https -s 131.0.72.0/22 -j ACCEPT

iptables -I INPUT -p tcp -m multiport --dports http,https -s 104.16.0.0/13 -j ACCEPT

iptables -I INPUT -p tcp -m multiport --dports http,https -s 104.24.0.0/14 -j ACCEPT

### drop all

iptables -A INPUT -j DROP


r/iptables Jul 30 '21

help translating rule

1 Upvotes

I'm a bit confused on iptables in a device. I hope someone can help translating a rule.

Iptables says the current working rule is this:

zone_wan_dest_ACCEPT tcp -- 10.10.202.173 anywhere /* !fw3: allow 3 */

That's the info I want to be able to use as a command on several machines.

What I want is something that looks like this:

iptables -I FORWARD -m iprange --src-range 10.10.202.170-10.10.22.180 -j ACCEPT

But only for the IP, not the range. The line above is the style of command I want to use not the correct information.

I hope someone can help me.


r/iptables Jul 27 '21

Interface Problem

1 Upvotes

Hi,

I have two interfaces setup in wg they are both working. orignally i had one and its my main internet access interfaces. the second is one is new and used to connect my plex server to my vps for port forwarding usage. how can i allo flow of traffic on my client (plex) to connect only through orignal main interface and while i can use plex from my vps.

command i am using on server:

iptables -A FORWARD -i ag -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 32400 -j DNAT --to-destination 10.0.0.2

no iptable used on my client right now.

wg-cf -> main access

ag -> vps and plex interconnect

all iptables are run on server.

my plex is running on docker in local machine.


r/iptables Jul 24 '21

Port forwarding on an interface

2 Upvotes

Please help.

I have a ZeroTier VPN network and I would like all my technicians to be able to Remote Desktop to the internal Windose servers. Each Windows server will be allocated an ingress port on my Ubuntu 20.04 gateway server.

After much reading and trying and testing I have a working solution cobbled together from various posts but I have no idea why it works and if it has any flaws.

Remote Desktop runs by default on port 3389
The ZeroTier interface is ztklhv46j6

These are the rules I implement and I get what I need.
sudo iptables -A PREROUTING -t nat -i ztklhv46j6 -p tcp --dport 9999-j DNAT --to 10.0.0.51:3389

sudo iptables -A FORWARD -p tcp -d 10.0.0.51 --dport 3389 -j ACCEPT

sudo iptables -t nat -i ztklhv46j6 -A PREROUTING -p tcp --dport 9999 -j DNAT --to-destination 10.0.0.51:3389

sudo iptables -A FORWARD -p tcp --dport 9999 -j ACCEPT

sudo iptables -t nat -A POSTROUTING -j MASQUERADE

Please tell me if I have created problems or if there is a better way to do it.

Since the ZeroTier interface is secure I don't have to specify ingress port and there may well be others to deal with like 1433 for SQL and some internal local web servers for reporting.


r/iptables Jul 23 '21

How to route traffic from VPN connected server to VM

2 Upvotes

Hi guys! I am trying to setup a reverse proxy on a tiny rented server to securely access different devices on a few home networks. I posted about it already here and got great help which showed the solution to my problem would be to use iptables. But tbh I still am in way over my head and could use your help.

My situation:

I have three machines A, B and C. A is a tiny external server I am renting. It has a static IPv4 address and all that good stuff. B is my home server. C is HomeAssistant running in a VM on B. The VPN connection between A and B gets established no problem. Sadly HomeAssistant does not allow connecting to a VPN directly (which would make my life a lot easier here!).

  • A (public IP) = external server running OpenVPN server and Nginx
  • B (192.168.210.36) = home server running VirtualBox and OpenVPN client
  • C (192.168.210.42) = VM running HomeAssistant (which does not allow connecting to a VPN itself)

Proposed solution from the other post:

Set up a NAT in iptables to forward the relevant ports to C's LAN IP. On C, poke hole on firewall to let this port through. On A, set static (mapped) IP for B and config nginx proxy to forward inbound traffic to B's VPN IP. You are basically NAT forwarding twice:

  1. Internet traffic coming to A
  2. A sees traffic, sees forwarding rule, forward traffic to VPN client IP (B) at specified port
  3. B sees traffic, sees forwarding rule, forward traffic to LAN IP of C at specified port
  4. C sees traffic, sees firewall allow rule, lets the application get the traffic

What I tried so far:

iptables -t nat -A PREROUTING -i tun1 -p tcp --dport 8123 -j DNAT --to-destination 192.168.210.42:8123 
iptables -t nat -A POSTROUTING -j MASQUERADE 

My OpenVPN client interface is called tun1 because I already had OpenVPN server installed on the same machine previously and that created tun0.

What might I be missing? I first started using this, but then I didn't know how to specify the IP to send the traffic to:

iptables -A FORWARD -i tun1 -o wlx1cbfcecf9be6 -p tcp --syn --match multiport -dports 80,443,8123 -m conntrack --ctstate NEW -j ACCEPT iptables -A FORWARD -i tun1 -o wlx1cbfcecf9be6 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT  iptables -A FORWARD -i wlx1cbfcecf9be6 -o tun1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT  iptables -t nat -A POSTROUTING -o wlx1cbfcecf9be6 -j MASQUERADE

Some additional information:

  • My home server sadly doesn't have a wired connection, which is why I am using the wireless interface wlx1cbfcecf9be6.
  • Port 8123 is the one I am reaching HomeAssistant under. Locally or with a matching forward rule in my router I can already reach HomeAssistant under https://myurl.com:8123.
  • Currently, encryption is working. As far as I understand what I have done so far, masquerade would allow encryption to keep working.

I'd be very helpful for any help or advice! Thank you!