https://luth.io/tags/iptables/ Recent content in Iptables on Luther Monson Hugo en Wed, 26 Aug 2026 20:30:00 -0700 https://luth.io/blog/2026/08/iptables-rule-zero-packets/ Wed, 26 Aug 2026 20:30:00 -0700 https://luth.io/blog/2026/08/iptables-rule-zero-packets/ <p>After a week of Windows firewall rules that <a href="https://luth.io/blog/2026/08/windows-container-egress-firewall/">listed fine and enforced nothing</a>, I went back to the Linux side of <a href="https://github.com/ephpm/ephemerd">ephemerd</a> feeling pretty good about it. iptables is the boring, well-understood one. Then I looked at the packet counters on a live node. I found a rule that had never matched a packet in its life. That node had pushed 9.8 GB through the same chain.</p> <h3 id="the-rules-i-thought-i-had">The rules I thought I had</h3> <p>Job containers sit on a CNI bridge, <code>10.88.0.0/16</code>, with the host on <code>10.88.0.1</code>. ephemerd puts its egress policy in its own chain, <code>EPHEMERD-FORWARD</code>. <code>FORWARD</code> jumps to it for anything to or from the container subnet. From a live node:</p>