iptables/netfilter hooks&rules

                                    | Incoming             ++---------------------++
                                    ↓                      || raw                 ||
                           +-------------------+           || connection tracking ||
                           | NF_IP_PRE_ROUTING |= = = = = =|| mangle              ||
                           +-------------------+           || nat (DNAT)          ||
                                    |                      ++---------------------++
                                    |
                                    ↓                                                ++------------++
                           +------------------+                                      || mangle     ||
                           |                  |         +----------------+           || filter     ||
                           | routing decision |-------->| NF_IP_LOCAL_IN |= = = = = =|| security   ||
                           |                  |         +----------------+           || nat (SNAT) ||
                           +------------------+                 |                    ++------------++
                                    |                           |
                                    |                           ↓
                                    |                  +-----------------+
                                    |                  | local processes |
                                    |                  +-----------------+
                                    |                           |
                                    |                           |                    ++---------------------++
 ++------------++                   ↓                           ↓                    || raw                 ||
 || mangle     ||           +---------------+          +-----------------+           || connection tracking ||
 || filter     ||= = = = = =| NF_IP_FORWARD |          | NF_IP_LOCAL_OUT |= = = = = =|| mangle              ||
 || security   ||           +---------------+          +-----------------+           || nat (DNAT)          ||
 ++------------++                   |                           |                    || filter              ||
                                    |                           |                    || security            ||
                                    ↓                           |                    ++---------------------++
                           +------------------+                 |
                           |                  |                 |
                           | routing decision |<----------------+
                           |                  |
                           +------------------+
                                    |
                                    |
                                    ↓
                           +--------------------+           ++------------++
                           | NF_IP_POST_ROUTING |= = = = = =|| mangle     ||
                           +--------------------+           || nat (SNAT) ||
                                    |                       ++------------++
                                    | Outgoing
                                    ↓

Deep dive into iptables on k3s node

Was struggling as I could not get "ss" or "netstat" to show me which port is listening on internet:

A Screenshot explains everything ( regarding 32233 port): 

ufw cheatsheet

Why does Linux have such a wide array of different firewalls? Have to make cheatsheet for every single one of them...here it is the ufw one:

Conf files:
/etc/ufw/user.rules
/etc/ufw/user6.rules

ufw enable
ufw disable
ufw show added
ufw status verbose
ufw status numbered
ufw allow 22/tcp
ufw deny 22/up
ufw delete deny 22/udp
ufw delete 2
ufw allow from 192.168.2.0/24 to 192.168.2.25 port 22 proto tcp
ufw allow from 192.168.2.0/24 to 192.168.2.26 port 22 proto tcp
ufw allow from 192.168.1.155 to any port 22 proto tcp
ufw allow 80/tcp comment 'accept Web'
ufw allow 443/tcp comment 'accept HTTPS'

Linux as workstation

I'm planning to phase out Windows and transition to a Linux and Mac-only environment. Here are a few glitches we encountered along with their fixes:

Issue #1: When pressing an arrow key in the VM, alphabet characters are generated.
Fix: Add "set nocompatible" to the /.vimrc file.

Issue #2: Dual booting requires re-pairing of Bluetooth devices.
Fix: Duplicate the Windows Bluetooth keys to Linux.

=====windows key location sample:==============

Key Name:          HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BTHPORT\Parameters\Keys\#BluetoothMac

Class Name:        <NO CLASS>

Last Write Time:   6/24/2023 - 08:04

Value 1

  Name:            #SpeakerMac

  Type:            REG_BINARY

  Data:            

00000000   9c ***Key here  .*****.

======Linux key location sample=============

File location: /var/lib/bluetooth/#BluetoothMac/#SpeakerMac/info

[General]

******

[LinkKey]

Key=9C***Key here

Type=4

PINLength=0

Issue #3: Attempting to run any X11 app with sudo results in the error message "Failed to execute child process 'dbus-launch'."
Fix: Install dbus-launch by running "sudo apt install dbus-x11".

Issue #4: Time zone issue with dual boot, resolved by setting the hardware time to RTC for linux (which uses UTC by default): timedatectl set-local-rtc 1

Something else:

sudo apt install putty-tools

puttygen PrivateKy.ppk -O private-openssh -o id_rsa

ssh host fingerprint

  ssh-keygen -E md5 -lf ssh_host_rsa_key

P.s.

• id_rsa.pub: RSA algorithm.
• id_ed25519.pub: Ed25519 algorithm.
• id_ecdsa.pub: Elliptic Curve Digital Signature Algorithm.

Host volume mount with nginx container deployment

root@K8S:~# cat test_nginx_dep.yaml 

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:latest
        ports:
        - containerPort: 80
        volumeMounts:
        - name: host-volume
          mountPath: /var/www/html
      volumes:
      - name: host-volume
        hostPath:
          path: /var/www/html

Flush iptables for troubleshooting

iptables -P INPUT ACCEPT

iptables -P OUTPUT ACCEPT

iptables -P FORWARD ACCEPT

iptables -F