Networking & Firewall (Ss/Netstat/Iptables/Nftables/Curl)

Stop guessing why your packets aren’t leaving the host

🧩 The Challenge

Sometimes you have a service that should be talking to the world, but it’s just shouting into the void. You check the app logs, check the listening ports, and everything looks fine, but the remote end never sees a thing.

💡 The Fix

Use the NFQUEUE target or just rely on standard logging rules to see if your firewall is silently nuking your outbound traffic. It beats staring at tcpdump for three hours hoping you catch the right handshake.

iptables -I OUTPUT -p tcp --dport 80 -j LOG --log-prefix "OUTBOUND_BLOCKED: " --log-level 4

⚙️ Why It Works

By inserting a logging rule at the very top of your OUTPUT chain, you force the kernel to toss a breadcrumb into dmesg every time a packet hits that chain. It’s the quickest way to confirm if a chain is actually matching the traffic you think it is.

🚀 Pro-Tip: Run dmesg -w in another window so you don’t have to keep refreshing your log files manually.

Linux Tips & Tricks | © ngelinux.com | 9/15/2026