Search the Community

Ubuntu 22.04 Cloud VM. Using iptables persistent. Saved rules file located in: /etc/iptables/rules.v4 Using this command to load changes to iptables. All changes are made by editing the rules.v4 file and restoring: sudo /sbin/iptables-restore < /etc/iptables/rules.v4 Spoiler: Network Information (VNICs, Subnets, etc) Summary: I have 3 VNICs, along with 2 OpenVPN Servers, 2 Wireguard Servers, 1 Tailscale Client and 2 ZeroTier One subnets. Here are iptables rules that I think might be important to the problem - The specific problem I have, only happens with all wireguard servers, with a "limited" user. I have a limited user, named "limited", which should: Have full access / should be fully accessible from any of the VPN subnets Should have no internet access, for security. All users besides the limited user can access everything normally. To the best of my knowledge, iptables works with "first matching rule wins". I created my rules based on that logic so far. Also to the best of my knowledge, the matching logic below does not work when used with INPUT. -m owner --uid-owner username_or_uid To limit the "limited" user, here are the rules I created with logic - First, allow the limited user on all VPN subnets: -A OUTPUT -o wg0 -m owner --uid-owner limited -j ACCEPT -A OUTPUT -o wg2 -m owner --uid-owner limited -j ACCEPT -A OUTPUT -o zt0 -m owner --uid-owner limited -j ACCEPT -A OUTPUT -o zt1 -m owner --uid-owner limited -j ACCEPT -A OUTPUT -o tailscale0 -m owner --uid-owner limited -j ACCEPT -A OUTPUT -o tun0 -m owner --uid-owner limited -j ACCEPT -A OUTPUT -o tun2 -m owner --uid-owner limited -j ACCEPT Then, drop all output to either of the VNICs: -A OUTPUT -o enp0s3 -m owner --uid-owner limited -j DROP -A OUTPUT -o enp1s0 -m owner --uid-owner limited -j DROP -A OUTPUT -o enp2s0 -m owner --uid-owner limited -j DROP User "limited" is able to ping any device connected through Tailscale, ZeroTier One and OpenVPN. I can use this command below, to "watch" how many packets matched the rules, by using this command: sudo watch -n1 -d "(iptables -tfilter -vnxL;iptables -tnat -vnxL;iptables -tmangle -vnxL;iptables -traw -vnxL;iptables -tsecurity -vnxL) | grep -vE 'pkts|Chain' | sort -nk1,1hr | column -t" User "limited" is NOT able to ping any device connected through either of the Wireguard servers. Two rules get triggered when I try to ping any device on wireguard subnet at the same time. Here are other rules I tried to use which would do the same thing, that DID NOT WORK. The final attempt I made to try and make this work has a very interesting result, which confirms that two rules are matching at the same time. If I add a rule that accepts all packets from the internal ipv4 address of enp0s3 (default vnic) - -A OUTPUT -m owner --uid-owner limited -s 10.0.0.175 -j ACCEPT Everything works and nothing is blocked for the "limited" user. (the ipv4 address 10.0.0.195 is the internal ipv4 of the VM for interface enp0s3) Indicating that iptables knows that packets coming to "limited" user from either wg0 or wg2 interface, are actually from an external source that is not in 192.168.x.x range and matches enp0s3 or enp2s0 output interfaces. 1. How are two rules getting matched at the same time, and why is DROP rule winning? 2. How does iptables know that packets coming to wireguard are from an external source? 3. Why does this happen only with wireguard and not with any other VPNs I have set up? 4. Is there any other way I could block all internet access from "limited" user and still be able to connect to devices on VPN subnets? I could not find answers to this problem anywhere and I have no idea why this is happening. Any help, suggestions and explanations would be nice. Thanks in advance!

Having some real issues with setting rules for OpenVPN with iptables on Ubuntu 18.04. Main issue being that the rules I write just don't work. all I want is for all traffic over the OpenVPN to be blocked apart from port 3389 (remote desktop port) I have done this : Where am I going wrong i'm really confused.

Hi I've got the current iptables below on my gateway pi Chain INPUT (policy ACCEPT) target prot opt source destination DROP all -- 172.16.0.0/24 anywhere REJECT tcp -- anywhere anywhere tcp dpt:http reject-with icmp-port-unreachable REJECT tcp -- anywhere anywhere tcp dpt:https reject-with icmp-port-unreachable ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh ACCEPT icmp -- anywhere anywhere icmp echo-request Chain FORWARD (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED ACCEPT all -- anywhere anywhere Chain OUTPUT (policy ACCEPT) target prot opt source destination but for some reason its not taking any affect on my traffic Thank you

Hey all Back again with yet another networking question This time there is the setup I have a linux router, doing portforwarding using IPtables. External client logs into internal server using ssh on routers external IP What im looking for is a graceful way to close the connection Not block it, just close it. Currently I am adding a forward drop to the top of the tables list, and that breaks the connection, but it doesn't drop it properly, and as soon as I remove the rule, the connection just pops back up What im wanting is for when I drop the connection, the client drops properly and has to re connect to the server, rather than just auto connecting (If that makes any sense?) And yes I know there is a timeout, (putty will timeout if no connection is made within a certain time), but I want it to work for everything, even if the timeout isn't set on the client side Thanks again for any help, and fingers crossed there is a good way of doing this

The problem is pretty much as the title says, have to grant internet access to a node (already gave it an ip with my server dhcp) with the use of ip_tables which as far as I know it could be tricky to use, and I do not want to fuck this up, help please :C

So I've been trying to set up an email server on my home network. Unfortunately, I am stuck with Comcast and they block incoming/outgoing port 25. I've managed to get outgoing email working by using the relay they provide, however, that still leaves me with having to figure out incoming emails. My idea was to use iptables on a remote VPS I have, and redirect incoming emails to that server on port 25, use iptables to redirect incoming port 25 to my home network port 35, and have my home router redirect incoming 35 to port 25 on the email server. I set my mx records to point towards the VPS and I have this iptables rule already set up iptables -t nat -A PREROUTING -p tcp --dport 25 -j DNAT --to-destination <my public ip>:35 If I telnet directly to my IP on port 35 from outside my network, it goes through to the mailserver. However, if I try to telnet to the VPS on port 25, it hangs. My guess is because I have no return iptable information provided. And the main problem: emails still aren't going through locally. If anyone has any ideas on what I'm missing, or if what I'm trying to do is possible/makes sense, please let me know!

I'm trying to extract the NAT rules from Windows 10's Mobile Hotspot feature to replicate them in the iptables of an ASUS Router running DD-WRT but I can't figure out how to correctly use "netsh" to extract this information. Does anyone here have experience with "netsh"? The reason I want to do this is because with the standard NAT rules of the router the connection from the WAN isn't shared to the LAN, I can SSH into the router and access the internet but I cannot from anything connected to the router. However, if I use the Mobile Hotspot feature, any device connected can connect to the internet. So I know those NAT rules work, and I'd like to emulate the same rules on the router. Thank you, MrTimcakes