2/3
Aber es gab diverse Issues...
#RaspAP z.B. ist trotz eigentlich guter Funktionalität für mich nicht zu gebrauchen. Leaken der echten IP in einigen #VPN Situationen - vor allem aber gibts mit RaspAP derzeit bekannte Stabilitätsprobleme mit dem aktuellen #RaspberryOS auf dem #RaspberryPiPico.
Und jetzt scripte ich mir seit 2 Tagen nen Wolf alle RaspAP Funktionalität mittels #NetworkManager (#nmcli), #dnsmasq und #iptables zu ersetzen.
konec #IPTables je v dohlednu, částecně už i na dosah
za poslední rok jsem investoval čas a z předchozích #UFW a mrtvého #Shorewall přeskočil #FirewallD rovnou do nahatých #NFTables
- UFW využívá na pozadí iptables automaticky překládané do nftables, což je paskvil, který může vyhovovat závislákům na prehistorických iptables souborech "na které se nešahá", ale progresivnějšímu uživateli dost svazuje ruce
- navíc je nutné mít namemorovanou jejich speciální syntaxi a hlavně skladbu argumentů, takže většinou zadám validní příkaz na asi 4. pokus
- FirewallD si samozřejmě taky vymyslel vlastní příkazovou syntaxi, ale zároveň zapleveluje nftables nepoužívanými chainy, přijít k cizímu stroji a udělat nějakou drobnou úpravu v pravidlech je skoro na nobelovku
- NFtables jsou za mě nejpřehlednější a nejspolehlivější (největší kontrola), navíc umožňujou mít totální kontrolu nad firewallem a poslat k šípku snahy Dockeru o nadvládu
- navíc jsou velmi jednoduché a snadno pochopitelné
Dropped a new Blogpost https://tinfoil-hat.net/posts/proxmox-server-vps-single-ip/
Please tell me what you think about it :-)
Hola querida comunidad!
Hoy les comentamos algunos avances del nuevo curso que estamos preparando:
Firewalls con #nftables en #Linux! 
Y algunos cambios que se vienen en el curso de Firewalls con #iptables 
Todos los avances en nuestras redes, no olviden seguirnos! 
Short en Youtube 
https://youtube.com/shorts/_1nZ0Mn7Ijk?feature=share
I updated my Framework 13 to Fedora 42 about two weeks ago, just before the final release. It has been pretty solid!
This evening, I went to start up my VPN (I use NordVPN, FWIW). No luck. Just no connection.
The VPN connection has failed. Please check your internet connection and try connecting to the VPN again. If the issue persists, contact our customer support.Well, thanks.
In case it was a package issue, I uninstalled and reinstalled the third party nordvpn RPM. No luck, same error.
Digging into the system log, I found this:
19:40:46 [Error] failed to connect to uk2646.nordvpn.com : resseting forward firewall: reseting allowlist rules: removing allowlisted subnets: listing iptables rules: exec: "iptables": executable file not found in $PATHA “smoking gun”!
OK, so let’s dig a bit more.
$ journalctl -g iptables -b --no-pagerApr 28 19:47:20 neshatan tailscaled[1649]: linuxfw: clear iptables: exec: "iptables": executable file not found in $PATHApr 28 19:47:20 neshatan tailscaled[1649]: router: iptables not found: firewall mode "iptables" not supported: iptables command run fail: multiple errors:Apr 28 19:47:20 neshatan tailscaled[1649]: exec: "iptables": executable file not found in $PATHApr 28 19:48:56 neshatan nordvpnd[1518]: 2025/04/28 19:48:56 [Error] failed to connect to uk2582.nordvpn.com : resseting forward firewall: reseting allowlist rules: removing allowlisted subnets: listing iptables rules: exec: "iptables": executable file not found in $PATHApr 28 19:49:22 neshatan nordvpnd[1518]: 2025/04/28 19:49:22 [Error] failed to connect to uk1910.nordvpn.com : unsetting allowlist: disabling allowlist routing: clearing allowlisting: iptables listing rules: exec: "iptables": executable file not found in $PATH:Apr 28 19:50:28 neshatan nordvpnd[1518]: 2025/04/28 19:50:28 [Error] failed to connect to uk2281.nordvpn.com : unsetting allowlist: disabling allowlist routing: clearing allowlisting: iptables listing rules: exec: "iptables": executable file not found in $PATH:Apr 28 19:53:36 neshatan nordvpnd[16192]: 2025/04/28 19:53:36 [Error] failed to connect to uk2570.nordvpn.com : resseting forward firewall: reseting allowlist rules: removing allowlisted subnets: listing iptables rules: exec: "iptables": executable file not found in $PATHApr 28 19:57:28 neshatan nordvpnd[16192]: 2025/04/28 19:57:28 [Error] failed to connect to uk2123.nordvpn.com : unsetting allowlist: disabling allowlist routing: clearing allowlisting: iptables listing rules: exec: "iptables": executable file not found in $PATH:OK, so we definitely don’t have an iptables executable.
It turns out that there is an iptables-nft package installed (for netfilter), and this is supposed to install /usr/bin/iptables – but that file doesn’t exist.
A quick symlink of iptables-nft as iptables was a basic patch for this, and I was able to bring the VPN connection up again.
Two related reports from the interwebs, one from as recent as today (which may explain why I only just encountered it) – I found these just as I started to write this post.
I’ll take the opportunity of this blog post to point out that nordvpnd has two typos in log messages. I’m not entirely certain where else to report this issue. Consider resetting these.
In the meantime, I also accidentally discovered that tailscaled had also been reporting issues with a missing iptables executable. I hadn’t noticed too many issues with it over the past couple of weeks, but hopefully this is an improvement for both daemons!
This server does not support sharing. Please visit .
https://andypiper.co.uk/2025/04/28/nordvpn-fedora-42-and-iptables-compatibility/
iptables decided that life is too short for this hobbyist to go down that path, so installed ufw and saw there was an XMPP app profile when doing ufw app list.ufw app info XMPP gave:Profile: XMPPWhich is um... not many ports. And naturally broke things like image uploading.
Title: XMPP Chat
Description: XMPP protocol (Jabber and Google Talk)
Ports:
5222/tcp
5269/tcp
[Prosody]Which after saving, doing
title=Prosody XMPP
description=Prosody XMPP Server ports per https://prosody.im/doc/ports
ports=5000,5222,5223,5269,5270,5281/tcp
ufw app update Prosody,ufw app info Prosody now gives:Profile: Prosody
Title: Prosody XMPP
Description: Prosody XMPP Server ports per https://prosody.im/doc/ports
Ports:
5000,5222,5223,5269,5270,5281/tcp
ufw allow Prosody to apply (allow) the rules and all is well again.
I must be doing something wrong.
On the older EL8/Docker 24 instances, I can access the published port for a container via the host’s private IP. So host:32768->container:8080. This works great, even within a container.
It does not work on EL9/Docker 25. I do not know why. #iptables is configured near identically. Anyone have any ideas? I’ve tried nearly everything at this point. Going to try Docker 24 on EL9 next
Wer Probleme mit dem Jetson und Docker hat das er nach einen "apt upgrade" und Docker Version 28.0.X nicht mehr läuft, gibt es hier die Lösung: https://forums.developer.nvidia.com/t/another-solution-with-iptables-raw-issue/328477
How To Check And Secure Open Ports In Linux #Linuxnetworking #Linuxsecurity #Linuxadmin #Linuxhowto #Linux #netstat #ss #firewalld #iptables #nmap #lsof
https://ostechnix.com/check-and-secure-open-ports-in-linux/
#Linux #SysAdmins #NetworkAdmins
Ubuntu 24.04 system with a publicly-routable external IP address.
For a given incoming UDP port (<1024, call it port x, I can’t change this), I want to forward that to localhost (or the ens3 interface) on another port (>1024, port y) so I can invoke QEMU as non-root and forward port y to the emulated system’s port x via slirp.
Is this doable?
I’ve tried heaps of nat prerouted examples, but haven’t yet gotten anything to stick.
Boosts appreciated!
Was fuer ein Quatsch ist das eigentlich denn, dass ufw nicht greift, wenn die offizielle Docker-Version installiert ist.
Meiner Ansicht nach eine riesiges Sicherheitsrisiko, dem sich viele Admins evtl. gar nicht bewusst sind.
Habe ich auch erst vor ein paar Monaten entdeckt.
Was meint Ihr? Und wie siehts da eigentlich bei debian 13 aus?
Por si les interesa, ando preparando un nuevo curso, relacionado con las redes y seguridad. Sale algo de firewalling con #nftables!
Y de paso, a aprovechar para regrabar mucho contenido del curso de #iptables, teoría de firewalling, DMZ, y casos prácticos.
Se vienen cositas interesantes con el networking en #Linux!
Since #Tumblr (owned by #MattMullenweg's #Automattic) renewed plans to join the #Fediverse, I suggest blocking them (as I have) for the same reason as #Threads: queerphobia and corporate tracking.
Just like the anti-Meta #FediPact (https://FediPact.online), there's now an anti-Automattic #FediPact2: https://FediPact2.online
Like I did with Meta, I wrote #iptables commands your #FediAdmin can use to drop all traffic to and from Automattic's IP addresses: https://pastebin.com/e5UKJCKU (source: AS2635)
Oh my jeeebus! Fucking #iptables and #docker. Took me half an hour to figure out that I needed to pass through the docker0 (and friends) network interfaces. I was trying all kinds of shit to pass through localhost, lo, 127.0.0.1/32, etc. like what the hell, but it's obvious. Of course containers have their own interfaces. Excuse the n00b.
I was finally forced to switch from #iptables to #nftables on a new #linux campus firewall setup.
I really should have made the switch years ago. Nftables is SO MUCH nicer! Having sets and variables has really simplified the configuration a ton.
I was happy with iptables for a really long time and so familiar with it, that I guess I was afraid of something new, but learning nftables has been fun and a lot easier than I expected for some reason.
Can anyone tell me what this #IPTables entry related to #DNS is?
#Asus has "helpfully" added this to my parents' router.
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
OUTPUT_DNS udp -- anywhere anywhere udp dpt:domain u32 "0x0>>0x16&0x3c@0x8>>0xf&0x1=0x0"
OUTPUT_DNS tcp -- anywhere anywhere tcp dpt:domain u32 "0x0>>0x16&0x3c@0xc>>0x1a&0x3c@0x8>>0xf&0x1=0x0"
@lanefu @pearl I mean, I'd rather try to use #ipFire but sadly I've yet to see some #Linux-based #Networking distro / setup that comes close to #pfSense / #OPNsense...
But that's me being "too lazy" to do #iptables...
