Iptables have always been a mystery and rather complicated. Thanks for demystifying it. Thank you for all your great content delivered with such enthusiasm!
Thanks Hussein! This is a great tutorial! I work with docker/kubernetes and I never understood their complex iptable chains. I'll definitely keep watching this series to understand how container networks work
Hussein! I've been trying to understand iptables for more than three months and you explained everything in less than 35 minutes in a super happy way!!! We want more hahaha, thanks for the video!
you're a good presenter, down to earth and seem genuinely enthusiastic. cheers :) It's always a pleasure seeing people learning and/or hacking about with the same topics as you
Wow after hours searching iptables information, I am here, you're amazing teacher, thanks a lot! I'm working with mitmproxy in transparent mode for testing iot devices, tomorrow I will try to make my iptables. Greetings from Italy!
Thank you so much, i'm going through a Kali tutorial for pen testing studies to eventually pass my OSCP, i love your delivery and an enthusiasm, much of this was glossed over because its a vast aspect of linux's opensource firewall and you have a clear and concise way of boiling it all down so i can wrap my head around its many functions and uses, currently working on port forwarding 80 HTTP traffic to sslstripper on port 8080 and i was curious what that process actually looks like behind the curtains ... Appreciate the feedback and i just subscribed.
Fantastic tutorial. I loved that you mentioned you wasted hours because of ip forwarding as exactly the same happened to me being a newb to ip tables ha!
sudo iptables -A OUTPUT -m statistic --mode random -p udp --probability 0.77 -j DROP Useful in an online class when professor asks you a question and you don't know the answer 😜
Evil 🦹♀️ Will explain this in next episode! This is the filter table and Pratik here is dropping 77% of outgoing udp packets. So it forces video call to lag.
Dude, AMAZING explination. Thank you so much. I've spent hours looking for the information like this. And you made it so easy to comprehend! THANK YOU SO MUCH. Keep the awesome work!!
Informative video. But there is also another approach to start an app and let is use the restricted ports without the root permission. The tool is called authbind.
The best visualization of the NAT flow I saw so far, the only thing left a bit unclear is the way back, when server responds - how does it do backwards translation?
@@hnasr I don't know why, but this is very common for lots of commands on Linux, Unix (thus Mac) and also Winows. -n is not the default for any of them. ping, traceroute, netstat, tcpdump, etc.
that was really smooth, thx a ton. Hussein are you aware of any implementations that do the processing thing on the NIC itself (talking about TOE NICs)?
In the example for DNAT & SNAT, in the response from the computer at 192.168.1.3 back to the server, how does the server determine that this response is meant for the computer at 192.168.1.2? I'm assuming the response packet will be something like (192.168.1.3:80 | 10.0.0.2:1234) (sIP | dIP)?
It must be using the created ip tables. when the response (192.168.1.3.:80 | 10.0.0.2:1234) is received the server should remember (lookup) that it mapped dIP from 10.0.0.2 => 192.168.1.3 and changed the mapping from sIP 192.168.1.2 to come back to 10.0.0.2. so it should know that if I get a response from 192.168.1.3 , by checking the dIP that must have been a request intended for me that I redirected to 192.168.1.3. and if I check the sIP I can see that the stuff that was supposed to come back to 10.0.0.2 was initially intended to go back to 192.168.1.2
The computer at 192.168.1.3 only knows that the packet needs to go to 10.0.0.2 , its the responsibility of 10.0.0.2 to send it back to 192.168.1.2 thats the job of DNAT .. watch NAT video for more details ruclips.net/video/RG97rvw1eUo/видео.html
@@hnasr Yup, I actually was asking about how 10.0.0.2 knows to forward this packet back to 192.168.1.2, which I believe @MrBrN197 answered above. Thank you so much for making these videos btw, learnt a ton of new stuff :)
@@brod515 okay, I kind of figured it was some kind of reverse lookup, thank you! Do you know if there's a name or something I can google to know more about this process?
@Husseein - ♦it looks like after the redirect - the packet is going straight to the process - but i know that is is passing the INPUT table before ... and u have omitted this hole important part ! ♦REDIRECT example config - PREROUTING is used for incoming traffic from the out side of the machine ( which u used ) , and "-t nat -I OUTPUT" is used to handle traffic that is originated from the local machine - why did u decided to use the "PREROUTING " ?
1. is 8080 an ephemeral port from server's side/PoV? 2. Also, does it make the diff between an app server running on 8080 while the web server exposed on 80? 3. is this port redirect the same as port forwarding?
Hi. In the last example, I wonder, would it also work if you defined both rules in the PREROUTING chain (or both in the POSTROUTING chain)? Why (not?)?
this is a great help however I'm still quite confused. I'm trying to get my RPi to RPi WireGuard tunnel to allow Access Point traffic on the Client RPi to pass to the internet on the RPi server. Is this possible? I'm assuming I only need to modify the RPi Client ipTables? The Rpi AP Clients are on 10.10.10.X and the WireGuard tunnel is 10.6.0.2 (Client) to10.6.0.1 (server).
More great stuff as always, Hussein, and thanks. But I had a couple of observations/questions for you and that may help other viewers considering all this. First, you mention the need to enable ip forwarding, as it's off by default in Linux (at 21:25) . I'm a little surprised you didn't elaborate at least a bit (or offer a brief caution) on the possible implications of doing that. I'm new to the topic of iptables myself, so again thanks for the great intro, but I've been burned by making such a change too innocently. :-) A quick poke around the web found a few cautions. I fear that some viewers may not be likely to consider that without your suggesting it. Given how your goal always is to educate and share words of advice, it just seemed a missed opportunity. Or do you think any concern is perhaps overstated? Second, while you understandably picked an http example to keep things simple, it seems that such a use case could be solved at a higher level by a reverse proxy (nginx, haproxy, varnish, etc.). But I don't think you mentioned that. Given the concern above, it seems worth at least a brief mention. Of course you've covered that topic well in the past, but you produce so much great content that most people can't track it all. :-) This would have seemed another one worth offering a pop up link to such a past video. All that said, as one who also likes to share knowledge myself, I realize it's a balancing act. Just trying to help. And I appreciate that this was just a part 1, introducing the wonders and power of iptables with your inimitable style. :-) Again I share these observations here for your viewers, and perhaps also for your consideration in future videos, assuming you'd not already planned to cover them. :-)
So if you have a rule for both tcp and udp (e.g. for a dns server as target), can you do that command in 1 line or do you have to create a separate rule for it?
im trying to work on that and so far not reached the solution. i have this 2 networks 10.0.0.6 (public IP) 192.168.30.254 (private) I want to enable there iptables to port map the apache server that is located at 192.168.30.2 , everything I tried not working, connection refused : here is my chain: sudo iptables -t nat -A PREROUTING -d 10.0.0.6 -p tcp --dport 80 -j DNAT --to-destination 192.168.30.2:80 sudo iptables -t nat -A POSTROUTING -j MASQUERADE sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT sudo iptables -A FORWARD -p tcp --dport 80 -j ACCEPT
@@DamjanDimitrioski their are some possible ways to do but it gets complicated and error prone to to let iptables look inside the packet and hopefully find the URL and it only works with HTTP not HTTPS. But the Linux kernel has some crazy capabilities if you know how to use it because you can also upload code into the Linux kernel with "eBPF"
![[#2024MAMA] BIGBANG (빅뱅) - 뱅뱅뱅 (BANG BANG BANG) + FANTASTIC BABY | Mnet 241123 방송](http://i.ytimg.com/vi/EQsYfiPR9uM/mqdefault.jpg)
Iptables have always been a mystery and rather complicated. Thanks for demystifying it. Thank you for all your great content delivered with such enthusiasm!
Glad it helped ❤️
I've search all over the net for exactly this. Hours of searching and you're the only one covering iptables in this manner. Thank you.
Studying for my LFCS exam right now and I just kept getting stuck on the commands. Thanks so much for explaining this
Thanks Hussein! This is a great tutorial! I work with docker/kubernetes and I never understood their complex iptable chains. I'll definitely keep watching this series to understand how container networks work
Hussein! I've been trying to understand iptables for more than three months and you explained everything in less than 35 minutes in a super happy way!!! We want more hahaha, thanks for the video!
Thanks for the video!! Clears a lot of things up for me. The bottleneck of using socat disappeared after I switched to iptables.
This is the best format I could imagine to explain iptables. Many thanks
Wow man, I thought ip tables was complicated, but u nailed it. Great examples. Thanks for your hard work
Perfect tone of voice. Funny and accurate. Kudos to you!
you're a good presenter, down to earth and seem genuinely enthusiastic. cheers :)
It's always a pleasure seeing people learning and/or hacking about with the same topics as you
Oh man, you are the life saver.. very few dare to cover such boring topics with such excitement.. love you man ❤ you just saved me hours of work...❤
boring? its interesting af
Thanks, that was rather useful. The lack of use cases in reference materials is aggravating.
Wow after hours searching iptables information, I am here, you're amazing teacher, thanks a lot! I'm working with mitmproxy in transparent mode for testing iot devices, tomorrow I will try to make my iptables. Greetings from Italy!
Thank you so much, i'm going through a Kali tutorial for pen testing studies to eventually pass my OSCP, i love your delivery and an enthusiasm, much of this was glossed over because its a vast aspect of linux's opensource firewall and you have a clear and concise way of boiling it all down so i can wrap my head around its many functions and uses, currently working on port forwarding 80 HTTP traffic to sslstripper on port 8080 and i was curious what that process actually looks like behind the curtains ... Appreciate the feedback and i just subscribed.
Fantastic tutorial. I loved that you mentioned you wasted hours because of ip forwarding as exactly the same happened to me being a newb to ip tables ha!
Finally someone who understands this and explains it in a way that's understandable! Jesus bless you
beauuuutiful root permissions. beautiful. BEAUTIFUL.
So good !
sudo iptables -A OUTPUT -m statistic --mode random -p udp --probability 0.77 -j DROP
Useful in an online class when professor asks you a question and you don't know the answer 😜
Evil 🦹♀️
Will explain this in next episode! This is the filter table and Pratik here is dropping 77% of outgoing udp packets. So it forces video call to lag.
@@hnasr Can wait to watch next episode!!
It is really demystified like he said, thank you very much Hussein
Dude, AMAZING explination. Thank you so much. I've spent hours looking for the information like this. And you made it so easy to comprehend! THANK YOU SO MUCH. Keep the awesome work!!
Love the storytelling. Great video!
Thanks man!!! Topic makes sense now! Loved the way you presented, you got soul man 😎😎😎
If you press Ctrl+F5 you can force the browser to serve you a new non cached version
My Friend ... Amazing explanation .. Loved it! gonna recommend it to my friends
Iptables is great 👍🏾. Good explanation. Thanks 🙏🏾
I liked how you stressed the important things, thks you saved me a lot of time!
This is pure value ! Thank you so much for this !
hey mate, i appreciate your videos very much which you put on the internet.
Informative video. But there is also another approach to start an app and let is use the restricted ports without the root permission. The tool is called authbind.
Thanks for helping your viewers avoid hours of reading in just one video
Genuinely informative video. Great job!
Such a insightful video, congrats Hussain
Thanks 🙏
Very nice. Thank you. Keep these videos coming!
Very interesting to watch!
hey man you saved me on the tip to to enable ip forwarding. I was literally about to smash my head against the computer
Yaaay finally Linux admin stuff 😍😍😍😍
Thank You very much! And it was a great idea to lowercase everything ( 07:00 ) o it became more meaningful.
Absolutely amazing
Thanks for the explanation. Awesome Job.👍
Very informative thank you for sharing, I will be waiting for more.
Great content, great person. proud of you man.
❤️
could not have been easier. thanks a lot
Just sent a donation on paypal for your efforts. Thanks a lot for the video.
You saved me a lot of trouble :)
nice . very clear way to explain !
Thank you very much, this video has helped me learn a lot.
Bro, you are awesome.
Please also explain ip masquerade as well.
for ip forwarding
#this injects the value to the kernel regardless of the destro
echo 1 > /proc/sys/net/ipv4/ip_forward
Thank you @Hussein , i appreciate your video
❤️
Great explanation. Thanks very much!!
Aweesome! Love this IP table course. I want to see more!
Thanks for the explanation, it's very helpful.
one of the best video thanks a ton
Amazing explanation.
This video is absolutely outstanding. Thank you
way too cool video !!
Great work, great value, thank you so much.
Appreciate it!
The best visualization of the NAT flow I saw so far, the only thing left a bit unclear is the way back, when server responds - how does it do backwards translation?
great video, helped me a lot and it was also entertaining
peace
informative and funny, good stuff
30:53 if you hate it, use the --numeric ( -n ) when listing my dear friend :-)
PS You forgot to mention what to do after changing the config file.
😍 nice tip that should be the default though :p
@@hnasr I don't know why, but this is very common for lots of commands on Linux, Unix (thus Mac) and also Winows. -n is not the default for any of them. ping, traceroute, netstat, tcpdump, etc.
What is tcpdump? ;) :p
@@hnasr I feel some day you might do videos on tcpdump as well
Great video
creative explanation!
Thank you for your video :)
Just saved my life, thanks! Do I need to do something else to make this configuration persistent?
Awesome, I love linux!
Thanks. This works.
damn son, I love your content.
THANK YOUUUUU SOOO MUCHH!!!!
that was really smooth, thx a ton. Hussein are you aware of any implementations that do the processing thing on the NIC itself (talking about TOE NICs)?
Thanks bro
thanks, usefull.
Holy fuck I enjoyed watching this😂😂❤️
In the example for DNAT & SNAT, in the response from the computer at 192.168.1.3 back to the server, how does the server determine that this response is meant for the computer at 192.168.1.2? I'm assuming the response packet will be something like (192.168.1.3:80 | 10.0.0.2:1234) (sIP | dIP)?
It must be using the created ip tables. when the response (192.168.1.3.:80 | 10.0.0.2:1234) is received the server should remember (lookup) that it mapped dIP from 10.0.0.2 => 192.168.1.3 and changed the mapping from sIP 192.168.1.2 to come back to 10.0.0.2. so it should know that if I get a response from 192.168.1.3 , by checking the dIP that must have been a request intended for me that I redirected to 192.168.1.3. and if I check the sIP I can see that the stuff that was supposed to come back to 10.0.0.2 was initially intended to go back to 192.168.1.2
The computer at 192.168.1.3 only knows that the packet needs to go to 10.0.0.2 , its the responsibility of 10.0.0.2 to send it back to 192.168.1.2 thats the job of DNAT .. watch NAT video for more details
ruclips.net/video/RG97rvw1eUo/видео.html
@@hnasr Yup, I actually was asking about how 10.0.0.2 knows to forward this packet back to 192.168.1.2, which I believe @MrBrN197 answered above.
Thank you so much for making these videos btw, learnt a ton of new stuff :)
@@brod515 okay, I kind of figured it was some kind of reverse lookup, thank you! Do you know if there's a name or something I can google to know more about this process?
@Husseein -
♦it looks like after the redirect - the packet is going straight to the process - but i know that is is passing the INPUT table before ... and u have omitted this hole important part !
♦REDIRECT example config - PREROUTING is used for incoming traffic from the out side of the machine ( which u used ) , and "-t nat -I OUTPUT" is used to handle traffic that is originated
from the local machine - why did u decided to use the "PREROUTING " ?
Super
Assalamualaikum
Great channel for programming. Thanks a lot of.
I want to you how you setup your raspberry pi. Plzzz tell me???
❤
Thanks, "babes"!
1. is 8080 an ephemeral port from server's side/PoV?
2. Also, does it make the diff between an app server running on 8080 while the web server exposed on 80?
3. is this port redirect the same as port forwarding?
Hi. In the last example, I wonder, would it also work if you defined both rules in the PREROUTING chain (or both in the POSTROUTING chain)? Why (not?)?
why do we need this exactly? what are its actual use cases in real-world as compared to delegating a request explicitly by some server to another?
this is a great help however I'm still quite confused. I'm trying to get my RPi to RPi WireGuard tunnel to allow Access Point traffic on the Client RPi to pass to the internet on the RPi server. Is this possible? I'm assuming I only need to modify the RPi Client ipTables? The Rpi AP Clients are on 10.10.10.X and the WireGuard tunnel is 10.6.0.2 (Client) to10.6.0.1 (server).
you're funny, thanks for the explanation
More great stuff as always, Hussein, and thanks. But I had a couple of observations/questions for you and that may help other viewers considering all this.
First, you mention the need to enable ip forwarding, as it's off by default in Linux (at 21:25) . I'm a little surprised you didn't elaborate at least a bit (or offer a brief caution) on the possible implications of doing that. I'm new to the topic of iptables myself, so again thanks for the great intro, but I've been burned by making such a change too innocently. :-)
A quick poke around the web found a few cautions. I fear that some viewers may not be likely to consider that without your suggesting it. Given how your goal always is to educate and share words of advice, it just seemed a missed opportunity. Or do you think any concern is perhaps overstated?
Second, while you understandably picked an http example to keep things simple, it seems that such a use case could be solved at a higher level by a reverse proxy (nginx, haproxy, varnish, etc.). But I don't think you mentioned that.
Given the concern above, it seems worth at least a brief mention. Of course you've covered that topic well in the past, but you produce so much great content that most people can't track it all. :-) This would have seemed another one worth offering a pop up link to such a past video.
All that said, as one who also likes to share knowledge myself, I realize it's a balancing act. Just trying to help.
And I appreciate that this was just a part 1, introducing the wonders and power of iptables with your inimitable style. :-) Again I share these observations here for your viewers, and perhaps also for your consideration in future videos, assuming you'd not already planned to cover them. :-)
So if you have a rule for both tcp and udp (e.g. for a dns server as target), can you do that command in 1 line or do you have to create a separate rule for it?
is it possible to have 'any' protocol ?
iptables vs ip route? Do they serve same purpose? Why does changes made using ip route does not show up in iptables rules?
When their is a reply from 192.168.1.3: 8080 to 10.0.0.2:1234, do we need to have another DNAT rule to send this packet to 192.168.1.2?
What is the equivalent tool of iptables in Windows?
I am not getting ack packets when I redirect the port. Can anyone help?
why nginx if we can use something like this to achieve network control?
im trying to work on that and so far not reached the solution. i have this 2 networks 10.0.0.6 (public IP) 192.168.30.254 (private) I want to enable there iptables to port map the apache server that is located at 192.168.30.2 , everything I tried not working, connection refused :
here is my chain:
sudo iptables -t nat -A PREROUTING -d 10.0.0.6 -p tcp --dport 80 -j DNAT --to-destination 192.168.30.2:80
sudo iptables -t nat -A POSTROUTING -j MASQUERADE
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo iptables -A FORWARD -p tcp --dport 80 -j ACCEPT
Can you show us how to redirect port 443 to another port, Thanks.
how to route from to IPv6 to ipv4
actually I think for the POSTROUTING it should have been --out-interface
So my question is iptables able to replace port forwarding, reverse proxy, and as a firewall rules if we do it right?
Same question, can we match HTTP path like /api1/ on inbound port 80/443 and redirect to some docker container on port N.
@@DamjanDimitrioski nope, guys, it's completely different levels of OSI. Iptables works with 2nd to 4th and http is 7th.
Sorry, I mix up the word reverse proxy. It shouldn't be there
@@DamjanDimitrioski their are some possible ways to do but it gets complicated and error prone to to let iptables look inside the packet and hopefully find the URL and it only works with HTTP not HTTPS. But the Linux kernel has some crazy capabilities if you know how to use it because you can also upload code into the Linux kernel with "eBPF"
As some said there are ways but very complicated and not a replacement for layer 7 proxying. But layer 4 proxying? perhaps
2021 ? I am learning in 2022😁
Brother can you recommend any books regarding Database Or Application Scale Out. I would be really grateful.😘
1. Designing Data Intensive Applications by Martin Klepmann
2. Database Internals
@@aymanpatel5862 Thank you🙏
Can you share your presentation file on this video? thanks u so much
Sorry just saw the message! Here it is IPTables (Members slides)
Slides payhip.com/b/VTsPG