iptables Demystified - Port Redirection and Forwarding HTTP Traffic to another machine (part 1)
HTML-код
- Опубликовано: 3 авг 2024
- The Linux kernel’s network packet processing subsystem is called Netfilter, and iptables is the command used to configure it. In this video I’ll demonstrate iptables and show you practical examples on how to do port forwarding, IP forwarding, and even load balancing hopefully in upcoming videos. This is part 1.
Slides
payhip.com/b/a7lP1
(Members get all slides for free. Become a Member to support the channel)
/ @hnasr
0:00 iptables components
4:24 Port Redirect in the same machine
10:54 Example
13:37 IP Forwarding to another machine (DNAT, SNAT)
22:00 Example
32:00 IP Forward Enable
commands used in this video
github.com/hnasr/javascript_p...
🎙️Listen to the Backend Engineering Podcast
husseinnasser.com/podcast
🏭 Backend Engineering Videos
backend.husseinnasser.com
💾 Database Engineering Videos
• Database Engineering
🏰 Load Balancing and Proxies Videos
• Proxies
🏛️ Software Archtiecture Videos
• Software Architecture
📩 Messaging Systems
• Message Queues & PubSu...
Become a Member
/ @hnasr
Support me on PayPal
bit.ly/33ENps4
Join our Thriving Backend Community on Discord
/ discord
Stay Awesome,
Hussein 
Наука
Iptables have always been a mystery and rather complicated. Thanks for demystifying it. Thank you for all your great content delivered with such enthusiasm!
Glad it helped ❤️
I've search all over the net for exactly this. Hours of searching and you're the only one covering iptables in this manner. Thank you.
Thanks Hussein! This is a great tutorial! I work with docker/kubernetes and I never understood their complex iptable chains. I'll definitely keep watching this series to understand how container networks work
you're a good presenter, down to earth and seem genuinely enthusiastic. cheers :)
It's always a pleasure seeing people learning and/or hacking about with the same topics as you
Wow man, I thought ip tables was complicated, but u nailed it. Great examples. Thanks for your hard work
Dude, AMAZING explination. Thank you so much. I've spent hours looking for the information like this. And you made it so easy to comprehend! THANK YOU SO MUCH. Keep the awesome work!!
Hussein! I've been trying to understand iptables for more than three months and you explained everything in less than 35 minutes in a super happy way!!! We want more hahaha, thanks for the video!
This is pure value ! Thank you so much for this !
Love the storytelling. Great video!
Perfect tone of voice. Funny and accurate. Kudos to you!
Wow after hours searching iptables information, I am here, you're amazing teacher, thanks a lot! I'm working with mitmproxy in transparent mode for testing iot devices, tomorrow I will try to make my iptables. Greetings from Italy!
This is the best format I could imagine to explain iptables. Many thanks
Very nice. Thank you. Keep these videos coming!
Thanks for the video!! Clears a lot of things up for me. The bottleneck of using socat disappeared after I switched to iptables.
Oh man, you are the life saver.. very few dare to cover such boring topics with such excitement.. love you man ❤ you just saved me hours of work...❤
boring? its interesting af
Genuinely informative video. Great job!
My Friend ... Amazing explanation .. Loved it! gonna recommend it to my friends
Aweesome! Love this IP table course. I want to see more!
Iptables is great 👍🏾. Good explanation. Thanks 🙏🏾
Very informative thank you for sharing, I will be waiting for more.
This video is absolutely outstanding. Thank you
Thanks man!!! Topic makes sense now! Loved the way you presented, you got soul man 😎😎😎
Thank you so much, i'm going through a Kali tutorial for pen testing studies to eventually pass my OSCP, i love your delivery and an enthusiasm, much of this was glossed over because its a vast aspect of linux's opensource firewall and you have a clear and concise way of boiling it all down so i can wrap my head around its many functions and uses, currently working on port forwarding 80 HTTP traffic to sslstripper on port 8080 and i was curious what that process actually looks like behind the curtains ... Appreciate the feedback and i just subscribed.
It is really demystified like he said, thank you very much Hussein
Very interesting to watch!
hey mate, i appreciate your videos very much which you put on the internet.
Thanks for the explanation, it's very helpful.
I liked how you stressed the important things, thks you saved me a lot of time!
sudo iptables -A OUTPUT -m statistic --mode random -p udp --probability 0.77 -j DROP
Useful in an online class when professor asks you a question and you don't know the answer 😜
Evil 🦹♀️
Will explain this in next episode! This is the filter table and Pratik here is dropping 77% of outgoing udp packets. So it forces video call to lag.
@@hnasr Can wait to watch next episode!!
Thanks for the explanation. Awesome Job.👍
Such a insightful video, congrats Hussain
Thanks 🙏
Fantastic tutorial. I loved that you mentioned you wasted hours because of ip forwarding as exactly the same happened to me being a newb to ip tables ha!
beauuuutiful root permissions. beautiful. BEAUTIFUL.
So good !
Great explanation. Thanks very much!!
nice . very clear way to explain !
Great content, great person. proud of you man.
❤️
Thank you very much, this video has helped me learn a lot.
Amazing explanation.
Just sent a donation on paypal for your efforts. Thanks a lot for the video.
You saved me a lot of trouble :)
could not have been easier. thanks a lot
Great work, great value, thank you so much.
Appreciate it!
Thank You very much! And it was a great idea to lowercase everything ( 07:00 ) o it became more meaningful.
Bro, you are awesome.
Absolutely amazing
great video, helped me a lot and it was also entertaining
peace
one of the best video thanks a ton
Thank you for your video :)
creative explanation!
Great video
Finally someone who understands this and explains it in a way that's understandable! Jesus bless you
If you press Ctrl+F5 you can force the browser to serve you a new non cached version
way too cool video !!
Yaaay finally Linux admin stuff 😍😍😍😍
that was really smooth, thx a ton. Hussein are you aware of any implementations that do the processing thing on the NIC itself (talking about TOE NICs)?
Thank you @Hussein , i appreciate your video
❤️
Awesome, I love linux!
informative and funny, good stuff
THANK YOUUUUU SOOO MUCHH!!!!
Thanks. This works.
Informative video. But there is also another approach to start an app and let is use the restricted ports without the root permission. The tool is called authbind.
Thanks, that was rather useful. The lack of use cases in reference materials is aggravating.
damn son, I love your content.
Thanks bro
hey man you saved me on the tip to to enable ip forwarding. I was literally about to smash my head against the computer
thanks, usefull.
Hi. In the last example, I wonder, would it also work if you defined both rules in the PREROUTING chain (or both in the POSTROUTING chain)? Why (not?)?
So if you have a rule for both tcp and udp (e.g. for a dns server as target), can you do that command in 1 line or do you have to create a separate rule for it?
Just saved my life, thanks! Do I need to do something else to make this configuration persistent?
for ip forwarding
#this injects the value to the kernel regardless of the destro
echo 1 > /proc/sys/net/ipv4/ip_forward
The best visualization of the NAT flow I saw so far, the only thing left a bit unclear is the way back, when server responds - how does it do backwards translation?
Holy fuck I enjoyed watching this😂😂❤️
this is a great help however I'm still quite confused. I'm trying to get my RPi to RPi WireGuard tunnel to allow Access Point traffic on the Client RPi to pass to the internet on the RPi server. Is this possible? I'm assuming I only need to modify the RPi Client ipTables? The Rpi AP Clients are on 10.10.10.X and the WireGuard tunnel is 10.6.0.2 (Client) to10.6.0.1 (server).
Super
Thanks, "babes"!
Please also explain ip masquerade as well.
Assalamualaikum
Great channel for programming. Thanks a lot of.
I want to you how you setup your raspberry pi. Plzzz tell me???
When their is a reply from 192.168.1.3: 8080 to 10.0.0.2:1234, do we need to have another DNAT rule to send this packet to 192.168.1.2?
Thanks for helping your viewers avoid hours of reading in just one video
In the example for DNAT & SNAT, in the response from the computer at 192.168.1.3 back to the server, how does the server determine that this response is meant for the computer at 192.168.1.2? I'm assuming the response packet will be something like (192.168.1.3:80 | 10.0.0.2:1234) (sIP | dIP)?
It must be using the created ip tables. when the response (192.168.1.3.:80 | 10.0.0.2:1234) is received the server should remember (lookup) that it mapped dIP from 10.0.0.2 => 192.168.1.3 and changed the mapping from sIP 192.168.1.2 to come back to 10.0.0.2. so it should know that if I get a response from 192.168.1.3 , by checking the dIP that must have been a request intended for me that I redirected to 192.168.1.3. and if I check the sIP I can see that the stuff that was supposed to come back to 10.0.0.2 was initially intended to go back to 192.168.1.2
The computer at 192.168.1.3 only knows that the packet needs to go to 10.0.0.2 , its the responsibility of 10.0.0.2 to send it back to 192.168.1.2 thats the job of DNAT .. watch NAT video for more details
ruclips.net/video/RG97rvw1eUo/видео.html
@@hnasr Yup, I actually was asking about how 10.0.0.2 knows to forward this packet back to 192.168.1.2, which I believe @MrBrN197 answered above.
Thank you so much for making these videos btw, learnt a ton of new stuff :)
@@brod515 okay, I kind of figured it was some kind of reverse lookup, thank you! Do you know if there's a name or something I can google to know more about this process?
you're funny, thanks for the explanation
1. is 8080 an ephemeral port from server's side/PoV?
2. Also, does it make the diff between an app server running on 8080 while the web server exposed on 80?
3. is this port redirect the same as port forwarding?
30:53 if you hate it, use the --numeric ( -n ) when listing my dear friend :-)
PS You forgot to mention what to do after changing the config file.
😍 nice tip that should be the default though :p
@@hnasr I don't know why, but this is very common for lots of commands on Linux, Unix (thus Mac) and also Winows. -n is not the default for any of them. ping, traceroute, netstat, tcpdump, etc.
What is tcpdump? ;) :p
@@hnasr I feel some day you might do videos on tcpdump as well
More great stuff as always, Hussein, and thanks. But I had a couple of observations/questions for you and that may help other viewers considering all this.
First, you mention the need to enable ip forwarding, as it's off by default in Linux (at 21:25) . I'm a little surprised you didn't elaborate at least a bit (or offer a brief caution) on the possible implications of doing that. I'm new to the topic of iptables myself, so again thanks for the great intro, but I've been burned by making such a change too innocently. :-)
A quick poke around the web found a few cautions. I fear that some viewers may not be likely to consider that without your suggesting it. Given how your goal always is to educate and share words of advice, it just seemed a missed opportunity. Or do you think any concern is perhaps overstated?
Second, while you understandably picked an http example to keep things simple, it seems that such a use case could be solved at a higher level by a reverse proxy (nginx, haproxy, varnish, etc.). But I don't think you mentioned that.
Given the concern above, it seems worth at least a brief mention. Of course you've covered that topic well in the past, but you produce so much great content that most people can't track it all. :-) This would have seemed another one worth offering a pop up link to such a past video.
All that said, as one who also likes to share knowledge myself, I realize it's a balancing act. Just trying to help.
And I appreciate that this was just a part 1, introducing the wonders and power of iptables with your inimitable style. :-) Again I share these observations here for your viewers, and perhaps also for your consideration in future videos, assuming you'd not already planned to cover them. :-)
is it possible to have 'any' protocol ?
iptables vs ip route? Do they serve same purpose? Why does changes made using ip route does not show up in iptables rules?
What is the equivalent tool of iptables in Windows?
why do we need this exactly? what are its actual use cases in real-world as compared to delegating a request explicitly by some server to another?
I am not getting ack packets when I redirect the port. Can anyone help?
@Husseein -
♦it looks like after the redirect - the packet is going straight to the process - but i know that is is passing the INPUT table before ... and u have omitted this hole important part !
♦REDIRECT example config - PREROUTING is used for incoming traffic from the out side of the machine ( which u used ) , and "-t nat -I OUTPUT" is used to handle traffic that is originated
from the local machine - why did u decided to use the "PREROUTING " ?
Can you show us how to redirect port 443 to another port, Thanks.
why nginx if we can use something like this to achieve network control?
So my question is iptables able to replace port forwarding, reverse proxy, and as a firewall rules if we do it right?
Same question, can we match HTTP path like /api1/ on inbound port 80/443 and redirect to some docker container on port N.
@@DamjanDimitrioski nope, guys, it's completely different levels of OSI. Iptables works with 2nd to 4th and http is 7th.
Sorry, I mix up the word reverse proxy. It shouldn't be there
@@DamjanDimitrioski their are some possible ways to do but it gets complicated and error prone to to let iptables look inside the packet and hopefully find the URL and it only works with HTTP not HTTPS. But the Linux kernel has some crazy capabilities if you know how to use it because you can also upload code into the Linux kernel with "eBPF"
As some said there are ways but very complicated and not a replacement for layer 7 proxying. But layer 4 proxying? perhaps
im trying to work on that and so far not reached the solution. i have this 2 networks 10.0.0.6 (public IP) 192.168.30.254 (private) I want to enable there iptables to port map the apache server that is located at 192.168.30.2 , everything I tried not working, connection refused :
here is my chain:
sudo iptables -t nat -A PREROUTING -d 10.0.0.6 -p tcp --dport 80 -j DNAT --to-destination 192.168.30.2:80
sudo iptables -t nat -A POSTROUTING -j MASQUERADE
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo iptables -A FORWARD -p tcp --dport 80 -j ACCEPT
how to route from to IPv6 to ipv4
Can you share your presentation file on this video? thanks u so much
Sorry just saw the message! Here it is IPTables (Members slides)
Slides payhip.com/b/VTsPG
Brother can you recommend any books regarding Database Or Application Scale Out. I would be really grateful.😘
1. Designing Data Intensive Applications by Martin Klepmann
2. Database Internals
@@aymanpatel5862 Thank you🙏
actually I think for the POSTROUTING it should have been --out-interface
2021 ? I am learning in 2022😁
26:00
Buuuttt it doesn't work on my linux vps :( I just only thought that this can solve my almost half a year problem