iptables Demystified - Port Redirection and Forwarding HTTP Traffic to another machine (part 1)
Vložit
- čas přidán 6. 07. 2024
- The Linux kernel’s network packet processing subsystem is called Netfilter, and iptables is the command used to configure it. In this video I’ll demonstrate iptables and show you practical examples on how to do port forwarding, IP forwarding, and even load balancing hopefully in upcoming videos. This is part 1.
Slides
payhip.com/b/a7lP1
(Members get all slides for free. Become a Member to support the channel)
/ @hnasr
0:00 iptables components
4:24 Port Redirect in the same machine
10:54 Example
13:37 IP Forwarding to another machine (DNAT, SNAT)
22:00 Example
32:00 IP Forward Enable
commands used in this video
github.com/hnasr/javascript_p...
🎙️Listen to the Backend Engineering Podcast
husseinnasser.com/podcast
🏭 Backend Engineering Videos
backend.husseinnasser.com
💾 Database Engineering Videos
• Database Engineering
🏰 Load Balancing and Proxies Videos
• Proxies
🏛️ Software Archtiecture Videos
• Software Architecture
📩 Messaging Systems
• Message Queues & PubSu...
Become a Member
/ @hnasr
Support me on PayPal
bit.ly/33ENps4
Join our Thriving Backend Community on Discord
/ discord
Stay Awesome,
Hussein - Věda a technologie
Iptables have always been a mystery and rather complicated. Thanks for demystifying it. Thank you for all your great content delivered with such enthusiasm!
Glad it helped ❤️
Hussein! I've been trying to understand iptables for more than three months and you explained everything in less than 35 minutes in a super happy way!!! We want more hahaha, thanks for the video!
I've search all over the net for exactly this. Hours of searching and you're the only one covering iptables in this manner. Thank you.
Thanks for the video!! Clears a lot of things up for me. The bottleneck of using socat disappeared after I switched to iptables.
Thanks Hussein! This is a great tutorial! I work with docker/kubernetes and I never understood their complex iptable chains. I'll definitely keep watching this series to understand how container networks work
you're a good presenter, down to earth and seem genuinely enthusiastic. cheers :)
It's always a pleasure seeing people learning and/or hacking about with the same topics as you
Wow man, I thought ip tables was complicated, but u nailed it. Great examples. Thanks for your hard work
This is the best format I could imagine to explain iptables. Many thanks
Dude, AMAZING explination. Thank you so much. I've spent hours looking for the information like this. And you made it so easy to comprehend! THANK YOU SO MUCH. Keep the awesome work!!
beauuuutiful root permissions. beautiful. BEAUTIFUL.
So good !
sudo iptables -A OUTPUT -m statistic --mode random -p udp --probability 0.77 -j DROP
Useful in an online class when professor asks you a question and you don't know the answer 😜
Evil 🦹♀️
Will explain this in next episode! This is the filter table and Pratik here is dropping 77% of outgoing udp packets. So it forces video call to lag.
@@hnasr Can wait to watch next episode!!
This is pure value ! Thank you so much for this !
Love the storytelling. Great video!
Wow after hours searching iptables information, I am here, you're amazing teacher, thanks a lot! I'm working with mitmproxy in transparent mode for testing iot devices, tomorrow I will try to make my iptables. Greetings from Italy!
Perfect tone of voice. Funny and accurate. Kudos to you!
My Friend ... Amazing explanation .. Loved it! gonna recommend it to my friends
Oh man, you are the life saver.. very few dare to cover such boring topics with such excitement.. love you man ❤ you just saved me hours of work...❤
boring? its interesting af
Very nice. Thank you. Keep these videos coming!
Iptables is great 👍🏾. Good explanation. Thanks 🙏🏾
Very interesting to watch!
Genuinely informative video. Great job!
Thanks for the explanation. Awesome Job.👍
Thank you so much, i'm going through a Kali tutorial for pen testing studies to eventually pass my OSCP, i love your delivery and an enthusiasm, much of this was glossed over because its a vast aspect of linux's opensource firewall and you have a clear and concise way of boiling it all down so i can wrap my head around its many functions and uses, currently working on port forwarding 80 HTTP traffic to sslstripper on port 8080 and i was curious what that process actually looks like behind the curtains ... Appreciate the feedback and i just subscribed.
It is really demystified like he said, thank you very much Hussein
Fantastic tutorial. I loved that you mentioned you wasted hours because of ip forwarding as exactly the same happened to me being a newb to ip tables ha!
I liked how you stressed the important things, thks you saved me a lot of time!
Aweesome! Love this IP table course. I want to see more!
Very informative thank you for sharing, I will be waiting for more.
Such a insightful video, congrats Hussain
Thanks 🙏
hey mate, i appreciate your videos very much which you put on the internet.
Yaaay finally Linux admin stuff 😍😍😍😍
This video is absolutely outstanding. Thank you
Great content, great person. proud of you man.
❤️
Thanks for the explanation, it's very helpful.
If you press Ctrl+F5 you can force the browser to serve you a new non cached version
Finally someone who understands this and explains it in a way that's understandable! Jesus bless you
Great explanation. Thanks very much!!
nice . very clear way to explain !
Thank you very much, this video has helped me learn a lot.
Amazing explanation.
Bro, you are awesome.
Absolutely amazing
Thanks, that was rather useful. The lack of use cases in reference materials is aggravating.
hey man you saved me on the tip to to enable ip forwarding. I was literally about to smash my head against the computer
could not have been easier. thanks a lot
that was really smooth, thx a ton. Hussein are you aware of any implementations that do the processing thing on the NIC itself (talking about TOE NICs)?
Just sent a donation on paypal for your efforts. Thanks a lot for the video.
You saved me a lot of trouble :)
Great work, great value, thank you so much.
Appreciate it!
Great video
way too cool video !!
Thank You very much! And it was a great idea to lowercase everything ( 07:00 ) o it became more meaningful.
one of the best video thanks a ton
great video, helped me a lot and it was also entertaining
peace
creative explanation!
Thank you for your video :)
Awesome, I love linux!
informative and funny, good stuff
Thanks. This works.
Thank you @Hussein , i appreciate your video
❤️
Hi. In the last example, I wonder, would it also work if you defined both rules in the PREROUTING chain (or both in the POSTROUTING chain)? Why (not?)?
THANK YOUUUUU SOOO MUCHH!!!!
Informative video. But there is also another approach to start an app and let is use the restricted ports without the root permission. The tool is called authbind.
Thanks for helping your viewers avoid hours of reading in just one video
damn son, I love your content.
Thanks bro
So if you have a rule for both tcp and udp (e.g. for a dns server as target), can you do that command in 1 line or do you have to create a separate rule for it?
for ip forwarding
#this injects the value to the kernel regardless of the destro
echo 1 > /proc/sys/net/ipv4/ip_forward
thanks, usefull.
The best visualization of the NAT flow I saw so far, the only thing left a bit unclear is the way back, when server responds - how does it do backwards translation?
Holy fuck I enjoyed watching this😂😂❤️
Please also explain ip masquerade as well.
Just saved my life, thanks! Do I need to do something else to make this configuration persistent?
Super
this is a great help however I'm still quite confused. I'm trying to get my RPi to RPi WireGuard tunnel to allow Access Point traffic on the Client RPi to pass to the internet on the RPi server. Is this possible? I'm assuming I only need to modify the RPi Client ipTables? The Rpi AP Clients are on 10.10.10.X and the WireGuard tunnel is 10.6.0.2 (Client) to10.6.0.1 (server).
1. is 8080 an ephemeral port from server's side/PoV?
2. Also, does it make the diff between an app server running on 8080 while the web server exposed on 80?
3. is this port redirect the same as port forwarding?
why do we need this exactly? what are its actual use cases in real-world as compared to delegating a request explicitly by some server to another?
30:53 if you hate it, use the --numeric ( -n ) when listing my dear friend :-)
PS You forgot to mention what to do after changing the config file.
😍 nice tip that should be the default though :p
@@hnasr I don't know why, but this is very common for lots of commands on Linux, Unix (thus Mac) and also Winows. -n is not the default for any of them. ping, traceroute, netstat, tcpdump, etc.
What is tcpdump? ;) :p
@@hnasr I feel some day you might do videos on tcpdump as well
Assalamualaikum
Great channel for programming. Thanks a lot of.
I want to you how you setup your raspberry pi. Plzzz tell me???
In the example for DNAT & SNAT, in the response from the computer at 192.168.1.3 back to the server, how does the server determine that this response is meant for the computer at 192.168.1.2? I'm assuming the response packet will be something like (192.168.1.3:80 | 10.0.0.2:1234) (sIP | dIP)?
It must be using the created ip tables. when the response (192.168.1.3.:80 | 10.0.0.2:1234) is received the server should remember (lookup) that it mapped dIP from 10.0.0.2 => 192.168.1.3 and changed the mapping from sIP 192.168.1.2 to come back to 10.0.0.2. so it should know that if I get a response from 192.168.1.3 , by checking the dIP that must have been a request intended for me that I redirected to 192.168.1.3. and if I check the sIP I can see that the stuff that was supposed to come back to 10.0.0.2 was initially intended to go back to 192.168.1.2
The computer at 192.168.1.3 only knows that the packet needs to go to 10.0.0.2 , its the responsibility of 10.0.0.2 to send it back to 192.168.1.2 thats the job of DNAT .. watch NAT video for more details
czcams.com/video/RG97rvw1eUo/video.html
@@hnasr Yup, I actually was asking about how 10.0.0.2 knows to forward this packet back to 192.168.1.2, which I believe @MrBrN197 answered above.
Thank you so much for making these videos btw, learnt a ton of new stuff :)
@@brod515 okay, I kind of figured it was some kind of reverse lookup, thank you! Do you know if there's a name or something I can google to know more about this process?
When their is a reply from 192.168.1.3: 8080 to 10.0.0.2:1234, do we need to have another DNAT rule to send this packet to 192.168.1.2?
iptables vs ip route? Do they serve same purpose? Why does changes made using ip route does not show up in iptables rules?
is it possible to have 'any' protocol ?
Can you show us how to redirect port 443 to another port, Thanks.
@Husseein -
♦it looks like after the redirect - the packet is going straight to the process - but i know that is is passing the INPUT table before ... and u have omitted this hole important part !
♦REDIRECT example config - PREROUTING is used for incoming traffic from the out side of the machine ( which u used ) , and "-t nat -I OUTPUT" is used to handle traffic that is originated
from the local machine - why did u decided to use the "PREROUTING " ?
Thanks, "babes"!
So my question is iptables able to replace port forwarding, reverse proxy, and as a firewall rules if we do it right?
Same question, can we match HTTP path like /api1/ on inbound port 80/443 and redirect to some docker container on port N.
@@DamjanDimitrioski nope, guys, it's completely different levels of OSI. Iptables works with 2nd to 4th and http is 7th.
Sorry, I mix up the word reverse proxy. It shouldn't be there
@@DamjanDimitrioski their are some possible ways to do but it gets complicated and error prone to to let iptables look inside the packet and hopefully find the URL and it only works with HTTP not HTTPS. But the Linux kernel has some crazy capabilities if you know how to use it because you can also upload code into the Linux kernel with "eBPF"
As some said there are ways but very complicated and not a replacement for layer 7 proxying. But layer 4 proxying? perhaps
What is the equivalent tool of iptables in Windows?
why nginx if we can use something like this to achieve network control?
I am not getting ack packets when I redirect the port. Can anyone help?
you're funny, thanks for the explanation
More great stuff as always, Hussein, and thanks. But I had a couple of observations/questions for you and that may help other viewers considering all this.
First, you mention the need to enable ip forwarding, as it's off by default in Linux (at 21:25) . I'm a little surprised you didn't elaborate at least a bit (or offer a brief caution) on the possible implications of doing that. I'm new to the topic of iptables myself, so again thanks for the great intro, but I've been burned by making such a change too innocently. :-)
A quick poke around the web found a few cautions. I fear that some viewers may not be likely to consider that without your suggesting it. Given how your goal always is to educate and share words of advice, it just seemed a missed opportunity. Or do you think any concern is perhaps overstated?
Second, while you understandably picked an http example to keep things simple, it seems that such a use case could be solved at a higher level by a reverse proxy (nginx, haproxy, varnish, etc.). But I don't think you mentioned that.
Given the concern above, it seems worth at least a brief mention. Of course you've covered that topic well in the past, but you produce so much great content that most people can't track it all. :-) This would have seemed another one worth offering a pop up link to such a past video.
All that said, as one who also likes to share knowledge myself, I realize it's a balancing act. Just trying to help.
And I appreciate that this was just a part 1, introducing the wonders and power of iptables with your inimitable style. :-) Again I share these observations here for your viewers, and perhaps also for your consideration in future videos, assuming you'd not already planned to cover them. :-)
im trying to work on that and so far not reached the solution. i have this 2 networks 10.0.0.6 (public IP) 192.168.30.254 (private) I want to enable there iptables to port map the apache server that is located at 192.168.30.2 , everything I tried not working, connection refused :
here is my chain:
sudo iptables -t nat -A PREROUTING -d 10.0.0.6 -p tcp --dport 80 -j DNAT --to-destination 192.168.30.2:80
sudo iptables -t nat -A POSTROUTING -j MASQUERADE
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo iptables -A FORWARD -p tcp --dport 80 -j ACCEPT
how to route from to IPv6 to ipv4
Brother can you recommend any books regarding Database Or Application Scale Out. I would be really grateful.😘
1. Designing Data Intensive Applications by Martin Klepmann
2. Database Internals
@@aymanpatel5862 Thank you🙏
Can you share your presentation file on this video? thanks u so much
Sorry just saw the message! Here it is IPTables (Members slides)
Slides payhip.com/b/VTsPG
2021 ? I am learning in 2022😁
actually I think for the POSTROUTING it should have been --out-interface
26:00
Buuuttt it doesn't work on my linux vps :( I just only thought that this can solve my almost half a year problem
12:10 Wouldn't that be dangerous - if you do not specific matching port and protocol - everything goes to port 8080 including TCP on Port 22 - essentially locking you from accessing your RPi