iptables Demystified - Port Redirection and Forwarding HTTP Traffic to another machine (part 1)

[@zedzpan]

Iptables have always been a mystery and rather complicated. Thanks for demystifying it. Thank you for all your great content delivered with such enthusiasm!

[@hnasr]

Glad it helped ❤️

[@DerrickHayden]

I've search all over the net for exactly this. Hours of searching and you're the only one covering iptables in this manner. Thank you.

[@rolandgerges9246]

this is the most simple yet interesting video that helped me get over iptables after a year.

[@russohc]

Hussein! I've been trying to understand iptables for more than three months and you explained everything in less than 35 minutes in a super happy way!!! We want more hahaha, thanks for the video!

[@stolenidentity1152]

Perfect tone of voice. Funny and accurate. Kudos to you!

[@Demodude123]

Thanks Hussein! This is a great tutorial! I work with docker/kubernetes and I never understood their complex iptable chains. I'll definitely keep watching this series to understand how container networks work

[@m.m.4589]

Wow man, I thought ip tables was complicated, but u nailed it. Great examples. Thanks for your hard work

[@dacoup5955]

Thank you so much, i'm going through a Kali tutorial for pen testing studies to eventually pass my OSCP, i love your delivery and an enthusiasm, much of this was glossed over because its a vast aspect of linux's opensource firewall and you have a clear and concise way of boiling it all down so i can wrap my head around its many functions and uses, currently working on port forwarding 80 HTTP traffic to sslstripper on port 8080 and i was curious what that process actually looks like behind the curtains ... Appreciate the feedback and i just subscribed.

[@Z3rgatul]

This is the best format I could imagine to explain iptables. Many thanks

[@90hijacked]

you're a good presenter, down to earth and seem genuinely enthusiastic. cheers :) It's always a pleasure seeing people learning and/or hacking about with the same topics as you

[@matches0423]

Thanks for the video!! Clears a lot of things up for me. The bottleneck of using socat disappeared after I switched to iptables.

[@mishasawangwan6652]

beauuuutiful root permissions. beautiful. BEAUTIFUL.

[@hnasr]

So good !

[@LuisReyes-mw3jo]

Dude, AMAZING explination. Thank you so much. I've spent hours looking for the information like this. And you made it so easy to comprehend! THANK YOU SO MUCH. Keep the awesome work!!

[@totti343]

Love the storytelling. Great video!

[@fujinafiul6044]

Oh man, you are the life saver.. very few dare to cover such boring topics with such excitement.. love you man ❤ you just saved me hours of work...❤

[@jojojojola]

boring? its interesting af

[@yetanother7754]

My Friend ... Amazing explanation .. Loved it! gonna recommend it to my friends

[@TaniaTebaldi]

Wow after hours searching iptables information, I am here, you're amazing teacher, thanks a lot! I'm working with mitmproxy in transparent mode for testing iot devices, tomorrow I will try to make my iptables. Greetings from Italy!

[@leo-phiponacci]

It is really demystified like he said, thank you very much Hussein

[@Kifter1983]

Fantastic tutorial. I loved that you mentioned you wasted hours because of ip forwarding as exactly the same happened to me being a newb to ip tables ha!

[@AntonSokolov-i5k]

Thanks man!!! Topic makes sense now! Loved the way you presented, you got soul man 😎😎😎

[@prophetjamz94]

Studying for my LFCS exam right now and I just kept getting stuck on the commands. Thanks so much for explaining this

[@pging8328]

hey mate, i appreciate your videos very much which you put on the internet.

[@ChristianAltamiranoAyala]

Such a insightful video, congrats Hussain

[@hnasr]

Thanks 🙏

[@yashas8238]

I liked how you stressed the important things, thks you saved me a lot of time!

[@steamrangercomputing]

Genuinely informative video. Great job!

[@EddyCaffrey]

Iptables is great 👍🏾. Good explanation. Thanks 🙏🏾

[@pratikdaigavane1111]

sudo iptables -A OUTPUT -m statistic --mode random -p udp --probability 0.77 -j DROP Useful in an online class when professor asks you a question and you don't know the answer 😜

[@hnasr]

Evil 🦹‍♀️ Will explain this in next episode! This is the filter table and Pratik here is dropping 77% of outgoing udp packets. So it forces video call to lag.

[@pratikdaigavane1111]

@@hnasr Can wait to watch next episode!!

[@OfferoC]

Very nice. Thank you. Keep these videos coming!

[@rightangleoverseas2391]

This is pure value ! Thank you so much for this !

[@mathisart]

Finally someone who understands this and explains it in a way that's understandable! Jesus bless you

[@root1101]

Thanks, that was rather useful. The lack of use cases in reference materials is aggravating.

[@yassirhassan2063]

Great content, great person. proud of you man.

[@hnasr]

❤️

[@ArtusMagnificus3_2_1]

Awesome vid, thanks for explaining

[@bun4bun]

Just sent a donation on paypal for your efforts. Thanks a lot for the video. You saved me a lot of trouble :)

[@martinfurstenberg2281]

Thanks for the explanation. Awesome Job.👍

[@islem1263]

If you press Ctrl+F5 you can force the browser to serve you a new non cached version

[@phoenixray3512]

Very informative thank you for sharing, I will be waiting for more.

[@shashidharnagraj896]

Thank you very much, this video has helped me learn a lot.

[@romans4471]

Thank You very much! And it was a great idea to lowercase everything ( 07:00 ) o it became more meaningful.

[@totopops98]

nice . very clear way to explain !

[@saad.83]

Very interesting to watch!

[@lajoskicsi6910]

Aweesome! Love this IP table course. I want to see more!

[@mohamedhabas7391]

Yaaay finally Linux admin stuff 😍😍😍😍

[@adamstrejcovsky8257]

could not have been easier. thanks a lot

[@ivanramadhan5185]

Thanks for the explanation, it's very helpful.

[@jlxip]

This video is absolutely outstanding. Thank you

[@pging8328]

hey man you saved me on the tip to to enable ip forwarding. I was literally about to smash my head against the computer

[@mdshehab8947]

Absolutely amazing

[@conscium]

great video, helped me a lot and it was also entertaining peace

[@AshutoshKumardevx]

Bro, you are awesome.

[@mohammedaris2338]

Thank you @Hussein , i appreciate your video

[@hnasr]

❤️

[@anisht1838]

Great work, great value, thank you so much.

[@hnasr]

Appreciate it!

[@robertphillips124714]

Great explanation. Thanks very much!!

[@bharadwaz7]

one of the best video thanks a ton

[@kaustubhmane8287]

way too cool video !!

[@okekeebube1426]

Thanks for helping your viewers avoid hours of reading in just one video

[@misterg4548]

Informative video. But there is also another approach to start an app and let is use the restricted ports without the root permission. The tool is called authbind.

[@bobsmithy3103]

informative and funny, good stuff

[@uwontlikeit]

The best visualization of the NAT flow I saw so far, the only thing left a bit unclear is the way back, when server responds - how does it do backwards translation?

[@rahulcsaple]

Amazing explanation.

[@alkklajslkdajlk]

Thank you for your video :)

[@kaczuszka-dt]

damn son, I love your content.

[@mohamedhabas7391]

for ip forwarding #this injects the value to the kernel regardless of the destro echo 1 > /proc/sys/net/ipv4/ip_forward

[@usamatahseenulhaque9125]

Great video

[@autohmae]

30:53 if you hate it, use the --numeric ( -n ) when listing my dear friend :-) PS You forgot to mention what to do after changing the config file.

[@hnasr]

😍 nice tip that should be the default though :p

[@autohmae]

@@hnasr I don't know why, but this is very common for lots of commands on Linux, Unix (thus Mac) and also Winows. -n is not the default for any of them. ping, traceroute, netstat, tcpdump, etc.

[@hnasr]

What is tcpdump? ;) :p

[@autohmae]

@@hnasr I feel some day you might do videos on tcpdump as well

[@syedtahaaziz2668]

Please also explain ip masquerade as well.

[@synchronizingsynchronize3066]

creative explanation!

[@azul2011ish]

Awesome, I love linux!

[@francisobwogo6366]

Thanks. This works.

[@hsjsjssnnsjsjs1666]

Holy fuck I enjoyed watching this😂😂❤️

[@PauloGervilla]

Just saved my life, thanks! Do I need to do something else to make this configuration persistent?

[@johnmark2014]

THANK YOUUUUU SOOO MUCHH!!!!

[@osamaa.h.altameemi5592]

that was really smooth, thx a ton. Hussein are you aware of any implementations that do the processing thing on the NIC itself (talking about TOE NICs)?

[@ehsanshadi810]

Thanks bro

[@akashagarwal6390]

why do we need this exactly? what are its actual use cases in real-world as compared to delegating a request explicitly by some server to another?

[@ShueFig]

In the example for DNAT & SNAT, in the response from the computer at 192.168.1.3 back to the server, how does the server determine that this response is meant for the computer at 192.168.1.2? I'm assuming the response packet will be something like (192.168.1.3:80 | 10.0.0.2:1234) (sIP | dIP)?

[@brod515]

It must be using the created ip tables. when the response (192.168.1.3.:80 | 10.0.0.2:1234) is received the server should remember (lookup) that it mapped dIP from 10.0.0.2 => 192.168.1.3 and changed the mapping from sIP 192.168.1.2 to come back to 10.0.0.2. so it should know that if I get a response from 192.168.1.3 , by checking the dIP that must have been a request intended for me that I redirected to 192.168.1.3. and if I check the sIP I can see that the stuff that was supposed to come back to 10.0.0.2 was initially intended to go back to 192.168.1.2

[@hnasr]

The computer at 192.168.1.3 only knows that the packet needs to go to 10.0.0.2 , its the responsibility of 10.0.0.2 to send it back to 192.168.1.2 thats the job of DNAT .. watch NAT video for more details kzbin.info/www/bejne/iHicaKWsrJaYi9E

[@ShueFig]

@@hnasr Yup, I actually was asking about how 10.0.0.2 knows to forward this packet back to 192.168.1.2, which I believe @MrBrN197 answered above. Thank you so much for making these videos btw, learnt a ton of new stuff :)

[@ShueFig]

@@brod515 okay, I kind of figured it was some kind of reverse lookup, thank you! Do you know if there's a name or something I can google to know more about this process?

[@thierryalbareda3860]

thanks, usefull.

[@akashagarwal6390]

1. is 8080 an ephemeral port from server's side/PoV? 2. Also, does it make the diff between an app server running on 8080 while the web server exposed on 80? 3. is this port redirect the same as port forwarding?

[@edgarlip2]

@Husseein - ♦it looks like after the redirect - the packet is going straight to the process - but i know that is is passing the INPUT table before ... and u have omitted this hole important part ! ♦REDIRECT example config - PREROUTING is used for incoming traffic from the out side of the machine ( which u used ) , and "-t nat -I OUTPUT" is used to handle traffic that is originated from the local machine - why did u decided to use the "PREROUTING " ?

[@kallingal1662]

Super

[@ebu7]

Assalamualaikum Great channel for programming. Thanks a lot of. I want to you how you setup your raspberry pi. Plzzz tell me???

[@pajeetsingh]

iptables vs ip route? Do they serve same purpose? Why does changes made using ip route does not show up in iptables rules?

[@fabwrld5773]

When their is a reply from 192.168.1.3: 8080 to 10.0.0.2:1234, do we need to have another DNAT rule to send this packet to 192.168.1.2?

[@ekaf3544]

❤

[@michelef406]

So is nginx basically a wrap around iptables?

[@alexbennion9087]

Thanks, "babes"!

[@bayliner4387]

this is a great help however I'm still quite confused. I'm trying to get my RPi to RPi WireGuard tunnel to allow Access Point traffic on the Client RPi to pass to the internet on the RPi server. Is this possible? I'm assuming I only need to modify the RPi Client ipTables? The Rpi AP Clients are on 10.10.10.X and the WireGuard tunnel is 10.6.0.2 (Client) to10.6.0.1 (server).

[@jakke1975]

So if you have a rule for both tcp and udp (e.g. for a dns server as target), can you do that command in 1 line or do you have to create a separate rule for it?

[@SuperMan-rw6iz]

why nginx if we can use something like this to achieve network control?

[@mnj1]

Hi. In the last example, I wonder, would it also work if you defined both rules in the PREROUTING chain (or both in the POSTROUTING chain)? Why (not?)?

[@CharlieArehart1]

More great stuff as always, Hussein, and thanks. But I had a couple of observations/questions for you and that may help other viewers considering all this. First, you mention the need to enable ip forwarding, as it's off by default in Linux (at 21:25) . I'm a little surprised you didn't elaborate at least a bit (or offer a brief caution) on the possible implications of doing that. I'm new to the topic of iptables myself, so again thanks for the great intro, but I've been burned by making such a change too innocently. :-) A quick poke around the web found a few cautions. I fear that some viewers may not be likely to consider that without your suggesting it. Given how your goal always is to educate and share words of advice, it just seemed a missed opportunity. Or do you think any concern is perhaps overstated? Second, while you understandably picked an http example to keep things simple, it seems that such a use case could be solved at a higher level by a reverse proxy (nginx, haproxy, varnish, etc.). But I don't think you mentioned that. Given the concern above, it seems worth at least a brief mention. Of course you've covered that topic well in the past, but you produce so much great content that most people can't track it all. :-) This would have seemed another one worth offering a pop up link to such a past video. All that said, as one who also likes to share knowledge myself, I realize it's a balancing act. Just trying to help. And I appreciate that this was just a part 1, introducing the wonders and power of iptables with your inimitable style. :-) Again I share these observations here for your viewers, and perhaps also for your consideration in future videos, assuming you'd not already planned to cover them. :-)

[@emmanuell89]

you're funny, thanks for the explanation

[@ConversationWay]

is it possible to have 'any' protocol ?

[@shubhamjain9433]

I am not getting ack packets when I redirect the port. Can anyone help?

[@thoongchinglee4905]

So my question is iptables able to replace port forwarding, reverse proxy, and as a firewall rules if we do it right?

[@DamjanDimitrioski]

Same question, can we match HTTP path like /api1/ on inbound port 80/443 and redirect to some docker container on port N.

[@ShamilSattarov]

@@DamjanDimitrioski nope, guys, it's completely different levels of OSI. Iptables works with 2nd to 4th and http is 7th.

[@thoongchinglee4905]

Sorry, I mix up the word reverse proxy. It shouldn't be there

[@autohmae]

@@DamjanDimitrioski their are some possible ways to do but it gets complicated and error prone to to let iptables look inside the packet and hopefully find the URL and it only works with HTTP not HTTPS. But the Linux kernel has some crazy capabilities if you know how to use it because you can also upload code into the Linux kernel with "eBPF"

[@hnasr]

As some said there are ways but very complicated and not a replacement for layer 7 proxying. But layer 4 proxying? perhaps

[@codewithmubin8866]

What is the equivalent tool of iptables in Windows?

[@ethangender]

im trying to work on that and so far not reached the solution. i have this 2 networks 10.0.0.6 (public IP) 192.168.30.254 (private) I want to enable there iptables to port map the apache server that is located at 192.168.30.2 , everything I tried not working, connection refused : here is my chain: sudo iptables -t nat -A PREROUTING -d 10.0.0.6 -p tcp --dport 80 -j DNAT --to-destination 192.168.30.2:80 sudo iptables -t nat -A POSTROUTING -j MASQUERADE sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT sudo iptables -A FORWARD -p tcp --dport 80 -j ACCEPT

[@ahangk]

Can you show us how to redirect port 443 to another port, Thanks.

[@gentleling9404]

how to route from to IPv6 to ipv4

[@alizia2186]

Brother can you recommend any books regarding Database Or Application Scale Out. I would be really grateful.😘

[@aymanpatel5862]

1. Designing Data Intensive Applications by Martin Klepmann 2. Database Internals

[@alizia2186]

@@aymanpatel5862 Thank you🙏