# How to Configure the Scoped iptables Rule in OpenFlux

> Configure the scoped iptables rule in OpenFlux to drop TCP RST packets from a dedicated egress IP alias, preventing tunnel termination and host-wide side effects. Learn the syntax now.

- Repository: [p1neappleXpress/OpenFlux](https://github.com/p1neappleXpress/OpenFlux)
- Tags: how-to-guide
- Published: 2026-09-13

---

**OpenFlux requires a scoped iptables rule that drops TCP RST packets originating from a dedicated egress IP alias to prevent kernel resets from terminating the tunnel while avoiding host-wide side effects.**

OpenFlux is an open-source tunneling tool designed to bypass network restrictions by maintaining persistent TCP connections. To prevent the kernel from sending TCP reset packets that would tear down these tunnels, you must configure a **scoped iptables rule** that targets only the exit node's traffic. According to the `p1neappleXpress/OpenFlux` source code, this approach isolates the packet filtering to a specific alias IP, ensuring other services on the host remain unaffected.

## Syntax of the Scoped iptables Rule

The complete syntax for the scoped rule documented in the project is:

```bash
sudo iptables -A OUTPUT -p tcp --tcp-flags RST RST -s <egress-ip> -j DROP

```

Breaking down each component:

- `-A OUTPUT` — Appends the rule to the OUTPUT chain for outgoing packets
- `-p tcp` — Restricts matches to TCP protocol only  
- `--tcp-flags RST RST` — Matches packets where only the RST flag is set
- `-s <egress-ip>` — **Scopes the rule** to packets originating from the dedicated alias IP address
- `-j DROP` — Silently discards matching packets

## Implementation in the OpenFlux Codebase

The [`README.md`](https://github.com/p1neappleXpress/OpenFlux/blob/main/README.md) in the repository root documents this syntax and emphasizes that **scoping is preferred** over host-wide rules because it prevents side effects like ports appearing "filtered" to external scanners on unrelated services.

In [`tunnel/tunnel.go`](https://github.com/p1neappleXpress/OpenFlux/blob/main/tunnel/tunnel.go), the `localIPOverride` mechanism enables the exit node to bind to a specific local IP address. This is the same alias IP that your iptables rule must target. When the exit node initializes with a local IP override, it directs all tunnel traffic through that interface, ensuring the scoped rule catches only the tunnel's RST packets.

The [`docker/entrypoint.sh`](https://github.com/p1neappleXpress/OpenFlux/blob/main/docker/entrypoint.sh) script demonstrates runtime validation, checking that the iptables rule exists before starting the tunnel process. Meanwhile, [`main.go`](https://github.com/p1neappleXpress/OpenFlux/blob/main/main.go) logs the exact iptables command that administrators should execute manually when launching outside of Docker.

## Step-by-Step Configuration

Follow these steps to implement the scoped iptables rule on your exit node.

### 1. Assign the Alias IP

First, configure a dedicated egress IP alias on your network interface. This IP must be unique to the OpenFlux exit node:

```bash
sudo ip addr add 203.0.113.10/32 dev eth0

```

### 2. Apply the Scoped iptables Rule

Execute the iptables command using your newly assigned alias IP:

```bash
sudo iptables -A OUTPUT -p tcp --tcp-flags RST RST -s 203.0.113.10 -j DROP

```

This ensures that only RST packets originating from `203.0.113.10` are dropped, leaving other host traffic unaffected.

### 3. Launch the Exit Node

Start the OpenFlux exit node, specifying the same alias IP used in your iptables rule:

```bash
./universal-bypass-tool --exit-node --local-ip 203.0.113.10 \
    --url "YOUR_YANDEX_DOC_URL" --debug

```

## Host-Wide Fallback (Not Recommended)

If you cannot assign a dedicated alias IP, you can apply a host-wide rule as a fallback:

```bash
sudo iptables -A OUTPUT -p tcp --tcp-flags RST RST -j DROP

```

However, the OpenFlux documentation explicitly warns against this on multi-purpose machines. A host-wide rule interferes with all outbound TCP connections, causing ports to appear filtered to external scanners and potentially disrupting other services that rely on normal RST behavior.

## Summary

- The **scoped iptables rule** syntax requires the `-s <egress-ip>` parameter to limit RST drops to OpenFlux traffic only
- Configure the alias IP using standard Linux networking tools before applying the rule
- The `localIPOverride` functionality in [`tunnel/tunnel.go`](https://github.com/p1neappleXpress/OpenFlux/blob/main/tunnel/tunnel.go) ensures the exit node uses the same IP specified in your iptables rule
- Always prefer scoped rules over host-wide drops to prevent side effects on co-located services

## Frequently Asked Questions

### Why does OpenFlux need to drop TCP RST packets?

OpenFlux drops TCP RST packets to prevent the kernel from terminating connections prematurely. When the tunnel establishes connections that appear abnormal to the network stack, the kernel generates RST packets that would tear down the tunnel; dropping these keeps the tunnel alive without interrupting the flow.

### What happens if I use the host-wide iptables rule instead of the scoped version?

Using a host-wide rule drops all outgoing TCP RST packets from the machine, which causes ports to appear "filtered" to external scanners and can break other services that depend on normal connection reset behavior. The scoped rule avoids this by targeting only the alias IP used by the exit node.

### How do I verify the iptables rule is working correctly?

Check the [`docker/entrypoint.sh`](https://github.com/p1neappleXpress/OpenFlux/blob/main/docker/entrypoint.sh) implementation, which validates the rule exists before starting the tunnel. You can manually verify with `sudo iptables -L OUTPUT -v -n` and look for entries matching your egress IP with the DROP target on RST flags.

### Can I use any IP address as the egress alias?

You must use an IP address assigned to a local interface on your host, configured via `ip addr add` or similar. The IP must match the value passed to `--local-ip` when starting the exit node, ensuring [`tunnel/tunnel.go`](https://github.com/p1neappleXpress/OpenFlux/blob/main/tunnel/tunnel.go) can bind to it while iptables filters traffic from it.