Networking

When deploying jump hosts, transparent proxies, or network bridges across multi-homed Linux systems, standard routing tables are often insufficient. Using the Linux Netfilter framework via iptables, you can manipulate packets at both ingress (PREROUTING) and egress (POSTROUTING). Scenario 1: Basic Traffic Forwarding via DNAT and MASQUERADE In this setup, our Linux server acts as an intermediary bridge forwarding traffic from a client to a remote backend service: Client Source IP: 198.51.100.12 Intermediary Gateway (Our Server): 203.0.113.30 Final Backend Destination: 192.0.2.84 Client [198.51.100.12] ──► Gateway [203.0.113.30] ──► Backend [192.0.2.84] Step 1: Destination NAT in PREROUTING Intercept incoming packets destined for our gateway and rewrite the destination IP before routing lookup occurs: ...

SSH is far more than an encrypted remote terminal—it is an extensible transport protocol capable of encapsulating arbitrary TCP traffic across segmented network boundaries, NAT gateways, and restrictive firewalls. Here is how to leverage Dynamic, Local, and Remote Reverse SSH tunnels. 1. Dynamic Port Forwarding (-D): SOCKS Proxy Dynamic port forwarding turns your SSH client into a local SOCKS5 proxy server. Any application configured to use this proxy routes its network requests through the remote SSH host. ...

Nmap (“Network Mapper”) is the industry standard for network discovery, port scanning, and vulnerability surface mapping. This cheat sheet compiles the most critical scanning flags categorized by operational objective. 1. Host Discovery (Ping Sweeps) Determine which hosts are alive on a target network without performing full port scans: # ICMP Echo Request nmap -sn -PE <target_range> # ICMP Timestamp & Address Mask Requests nmap -sn -PP <target_range> nmap -sn -PM <target_range> # ARP Ping (fastest for local subnet discovery) nmap -sn -PR <local_subnet> # TCP SYN / ACK Ping (probes ports without full scan) nmap -sn -PS22,80,443 <target_range> nmap -sn -PA80,443 <target_range> 2. Core Port Scanning Techniques Flag Scan Type Description -sS TCP SYN (Stealth) Default scan. Sends SYN, receives SYN/ACK, then sends RST without completing handshake. Stealthy and fast. -sT TCP Connect Completes the full 3-way handshake (connect() syscall). Used when unprivileged or behind strict proxies. -sU UDP Scan Probes UDP endpoints (DNS, SNMP, NTP, DHCP). Slower because closed ports return ICMP port unreachable. -sV Version Detection Interrogates open ports to determine service name and version numbers. -sA TCP ACK Scan Maps firewall rules and state tables (determines filtered vs. unfiltered ports). -sW TCP Window Scan Exploits anomalies in TCP Window sizes of certain OS implementations. # Typical comprehensive scan: nmap -sS -sV -sC -O -p- -T4 <target> 3. Advanced & Inverse TCP Scans (Bypassing Stateless Firewalls) Inverse scans manipulate TCP header flags (RFC 793). Open ports drop the packet without reply, whereas closed ports respond with a RST: ...

In honeypot deployments, captive portals, or specialized traffic inspection environments, administrators often need to forward all incoming traffic—regardless of destination port—to a single listening service (such as an HTTP inspection proxy or logging daemon). This can be accomplished at line rate within the Linux kernel using Netfilter Destination NAT (DNAT) via iptables. Redirecting Inbound Port Ranges via DNAT To redirect all incoming TCP traffic across ports 1 through 65535 arriving on interface eth0 to an internal service listening on port 80 at 192.168.1.10: ...