From: David Collodel <dave@crawlspaceradio.com>
To: netfilter@lists.netfilter.org
Subject: RE: DMZ trouble!
Date: 09 Jan 2003 00:34:56 -0500 [thread overview]
Message-ID: <1042090495.2320.216.camel@jimmy> (raw)
Perhaps it would help if I included my entire script? Or at least the
relevant parts of it.
Thanks for any help you can offer.
#
# 1.1 Internet Configuration.
#
#
# 1.1.1 Device and network configs.
#
EXT_IFACE="eth0" # External Interface
LAN_IFACE="eth1" # Internal Interface
DMZ_IFACE="eth2" # DMZ Interface
LO_IFACE="lo" # Loopback Interface
GATEWAY="66.91.171.1" # Our External gateway.
EXT_IP="66.92.171.151" # Primary IP address of $EXT_IFACE
NET_BCAST="66.92.171.255" # Broadcast addy of external (ISP's) net.
#
# 1.1.2 Define our "real" ip's to be NAT'ed
# More can be added, but additional rules will need to be created
# below to specify their access.
#
HTTP_IP="66.92.171.152" # WWW server IP
DNS_IP="66.92.171.150" # Mail, DNS IP
SQL_IP="66.92.171.149" # Data service IP
#
# 1.1.3 Local Area Network configuration.
#
# LAN IP range and localhost IP. /24 means to only use the first 24
# bits of the 32 bit IP address. the same as netmask 255.255.255.0
#
LAN_IP="172.16.11.1" # IP bound to $LAN_IFACE
LAN_NET="172.16.11.0/24" # Internal Net range
LAN_BCAST="172.16.11.255" # LAN Broadcast Address
#
# 1.1.4 DMZ Configuration.
#
DMZ_HTTP_IP="172.16.12.2" # IP where $HTTP_IP will be NAT'ed
DMZ_DNS_IP="172.16.12.3" # IP where $DNS_IP will be NAT'ed
DMZ_SQL_IP="172.16.12.4" # IP where $SQL_IP will be NAT'ed
DMZ_IP="172.16.12.1" # IP bound to $DMZ_IFACE
DMZ_NET="172.16.12.0/24" # DMZ Network range
DMZ_BCAST="172.16.12.255" # DMZ Broadcast Address
#
# 1.1.5 Localhost Configuration.
#
LO_IP="127.0.0.1"
#
# 1.2 IPTables Configuration.
#
#
# 1.2.1 Define IPtables binary
IPTABLES="/sbin/iptables"
#
# 2. rules set up.
#
# 2.1 Filter table
#
#
# 2.1.1 Set policies first, then flush chains
#
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP
$IPTABLES -F
$IPTABLES -F INPUT
$IPTABLES -F OUTPUT
$IPTABLES -F FORWARD
$IPTABLES -F -t mangle
$IPTABLES -t mangle -X
$IPTABLES -X
#
# 2.2 Create userspecified chains
#
#
# 2.2.1 Create chain for bad tcp packets
#
$IPTABLES -N bad_tcp_packets
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG
\
--log-prefix "New not syn:"
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP
## DROP packets associated with an "INVALID" connection.
$IPTABLES -A bad_tcp_packets -m state --state INVALID $LOG "INVALID
STATE: "
$IPTABLES -A bad_tcp_packets -m state --state INVALID -j DROP
#
# 2.2.2 Create chain to handle various stateful connections
#
$IPTABLES -N KEEP_STATE
$IPTABLES -F KEEP_STATE
## ACCEPT certain packets which are starting a new connection or are
## related to an established connection.
$IPTABLES -A KEEP_STATE -p TCP --syn -j ACCEPT
$IPTABLES -A KEEP_STATE -m state --state RELATED,ESTABLISHED -j ACCEPT
## ACCEPT packets whose input interface is anything but the external
interface.
$IPTABLES -A KEEP_STATE -i ! $EXT_IP -m state --state NEW -j ACCEPT
## DROP packets associated with an "INVALID" connection.
$IPTABLES -A KEEP_STATE -m state --state INVALID $LOG "INVALID STATE: "
$IPTABLES -A KEEP_STATE -m state --state INVALID -j DROP
## Drop the rest
$IPTABLES -A KEEP_STATE -p TCP -j DROP
#
# 2.2.3 Create chain for ICMP control
#
$IPTABLES -N icmp_packets
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 3 -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 4 -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT
#
# 2.3 INPUT chain
#
#
# 2.3.1 Take out the nasties first.
#
$IPTABLES -A INPUT -p tcp -j bad_tcp_packets
#
# 2.3.2 Filter ICMP Packets from the Internet to this box
#
$IPTABLES -A INPUT -p ICMP -i $EXT_IFACE -j icmp_packets
#
# 2.3.3 Packets from LAN, DMZ or LOCALHOST
#
# From External Interface, for SSH management
$IPTABLES -A INPUT -p TCP -i $EXT_IFACE -d $EXT_IP --dport 22 -j ACCEPT
# From DMZ Interface to DMZ firewall IP
$IPTABLES -A INPUT -p ALL -i $DMZ_IFACE -d $DMZ_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $DMZ_IFACE -s $DMZ_IP -d $DMZ_NET -j
KEEP_STATE
# From LAN Interface to LAN firewall IP
$IPTABLES -A INPUT -p ALL -i $LAN_IFACE -d $LAN_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LAN_IFACE -d $LAN_BCAST -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LAN_IFACE -d $LAN_NET -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LAN_IFACE -s $LAN_NET -d $LAN_IP -j ACCEPT
# From Localhost interface to Localhost IP's
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LO_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LAN_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $EXT_IP -j ACCEPT
# Special rule for DHCP requests from LAN, which are not caught properly
# otherwise.
$IPTABLES -A INPUT -p UDP -i $LAN_IFACE --dport 67 --sport 68 -j ACCEPT
# All established and related packets incoming from the internet to the
# firewall
$IPTABLES -A INPUT -p ALL -d $EXT_IP -m state --state
ESTABLISHED,RELATED \
-j ACCEPT
# Prevent MS multicast from nailing the logs.
$IPTABLES -A INPUT -i $EXT_IFACE -d 224.0.0.0/8 -j DROP
# Log weird packets that don't match the above.
$IPTABLES -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG \
--log-level DEBUG --log-prefix "IPT INPUT packet died: "
#
# 2.4 Forward chain
#
#
# 2.4.1 Take out the nasties first.
#
$IPTABLES -A FORWARD -p tcp -j bad_tcp_packets
#
# 2.4.2 DMZ section
#
# General rules
$IPTABLES -A FORWARD -i $DMZ_IFACE -o $EXT_IFACE -j ACCEPT
$IPTABLES -A FORWARD -i $EXT_IFACE -o $DMZ_IFACE -m state \
--state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $LAN_IFACE -o $DMZ_IFACE -j KEEP_STATE
$IPTABLES -A FORWARD -i $DMZ_IFACE -o $LAN_IFACE -m state \
--state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -p icmp -i $DMZ_IFACE -j icmp_packets
# HTTP server
$IPTABLES -A FORWARD -p TCP -i $EXT_IFACE -o $DMZ_IFACE -d $DMZ_HTTP_IP
--dport 80 -j KEEP_STATE
$IPTABLES -A FORWARD -p TCP -i $EXT_IFACE -o $DMZ_IFACE -d $DMZ_HTTP_IP
--dport 443 -j KEEP_STATE
$IPTABLES -A FORWARD -p TCP -i $EXT_IFACE -o $DMZ_IFACE -d $DMZ_HTTP_IP
--dport 8000 -j KEEP_STATE
$IPTABLES -A FORWARD -p TCP -i $EXT_IFACE -o $DMZ_IFACE -d $DMZ_HTTP_IP
--dport 8001 -j KEEP_STATE
$IPTABLES -A FORWARD -p TCP -i $EXT_IFACE -o $DMZ_IFACE -d $DMZ_HTTP_IP
--dport 22 -j KEEP_STATE
$IPTABLES -A FORWARD -p ICMP -i $EXT_IFACE -o $DMZ_IFACE -d $DMZ_HTTP_IP
-j icmp_packets
# DNS server
$IPTABLES -A FORWARD -p TCP -i $EXT_IFACE -o $DMZ_IFACE -d $DMZ_DNS_IP
--dport 53 -j KEEP_STATE
$IPTABLES -A FORWARD -p UDP -i $EXT_IFACE -o $DMZ_IFACE -d $DMZ_DNS_IP
--dport 53 -j ACCEPT
$IPTABLES -A FORWARD -p TCP -i $EXT_IFACE -o $DMZ_IFACE -d $DMZ_DNS_IP
--dport 443 -j KEEP_STATE
$IPTABLES -A FORWARD -p TCP -i $EXT_IFACE -o $DMZ_IFACE -d $DMZ_DNS_IP
--dport 25 -j KEEP_STATE
$IPTABLES -A FORWARD -p TCP -i $EXT_IFACE -o $DMZ_IFACE -d $DMZ_DNS_IP
--dport 22 -j KEEP_STATE
$IPTABLES -A FORWARD -p TCP -i $EXT_IFACE -o $DMZ_IFACE -d $DMZ_DNS_IP
--dport 995 -j KEEP_STATE
$IPTABLES -A FORWARD -p ICMP -i $EXT_IFACE -o $DMZ_IFACE -d $DMZ_DNS_IP
-j icmp_packets
#
# 2.4.3 LAN section
#
$IPTABLES -A FORWARD -i $LAN_IFACE -j ACCEPT
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
# Log weird packets that don't match the above.
$IPTABLES -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG \
--log-level DEBUG --log-prefix "IPT FORWARD packet died: "
#
# 2.5 OUTPUT chain
#
#
# 2.5.1 Take out the nasties first
#
$IPTABLES -A OUTPUT -p tcp -j bad_tcp_packets
#
# Special OUTPUT rules to decide which IP's to allow.
#
$IPTABLES -A OUTPUT -p ALL -s $LO_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $LAN_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $LAN_NET -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $EXT_IP -j ACCEPT
# Log weird packets that don't match the above.
$IPTABLES -A OUTPUT -m limit --limit 3/minute --limit-burst 3 -j LOG \
--log-level DEBUG --log-prefix "IPT OUTPUT packet died: "
#
# 3 NAT table
#
#
# 3.1 Flush the NAT table
#
$IPTABLES -F -t nat
#
# 3.2 PREROUTING chain
#
#
# 3.2.3 DMZ DNAT
#
$IPTABLES -t nat -A PREROUTING -p TCP -i $EXT_IFACE -d $HTTP_IP --dport
80 -j DNAT --to-destination $DMZ_HTTP_IP
$IPTABLES -t nat -A PREROUTING -p TCP -i $EXT_IFACE -d $HTTP_IP --dport
22 -j DNAT --to-destination $DMZ_HTTP_IP
$IPTABLES -t nat -A PREROUTING -p TCP -i $EXT_IFACE -d $HTTP_IP --dport
443 -j DNAT --to-destination $DMZ_HTTP_IP
$IPTABLES -t nat -A PREROUTING -p TCP -i $EXT_IFACE -d $HTTP_IP --dport
8000 -j DNAT --to-destination $DMZ_HTTP_IP
$IPTABLES -t nat -A PREROUTING -p TCP -i $EXT_IFACE -d $HTTP_IP --dport
8001 -j DNAT --to-destination $DMZ_HTTP_IP
$IPTABLES -t nat -A PREROUTING -p TCP -i $EXT_IFACE -d $DNS_IP --dport
53 -j DNAT --to-destination $DMZ_DNS_IP
$IPTABLES -t nat -A PREROUTING -p UDP -i $EXT_IFACE -d $DNS_IP --dport
53 -j DNAT --to-destination $DMZ_DNS_IP
$IPTABLES -t nat -A PREROUTING -p TCP -i $EXT_IFACE -d $DNS_IP --dport
443 -j DNAT --to-destination $DMZ_DNS_IP
$IPTABLES -t nat -A PREROUTING -p TCP -i $EXT_IFACE -d $DNS_IP --dport
22 -j DNAT --to-destination $DMZ_DNS_IP
$IPTABLES -t nat -A PREROUTING -p TCP -i $EXT_IFACE -d $DNS_IP --dport
25 -j DNAT --to-destination $DMZ_DNS_IP
$IPTABLES -t nat -A PREROUTING -p TCP -i $EXT_IFACE -d $DNS_IP --dport
995 -j DNAT --to-destination $DMZ_DNS_IP
#
# 3.3 POSTROUTING chain
#
#
# 3.3.1 Enable simple IP Forwarding and Network Address Translation
#
$IPTABLES -t nat -A POSTROUTING -o $EXT_IFACE -j SNAT --to-source
$EXT_IP
--
David Collodel <dave@crawlspaceradio.com>
next reply other threads:[~2003-01-09 5:34 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2003-01-09 5:34 David Collodel [this message]
2003-01-09 7:58 ` DMZ trouble! Joel Newkirk
2003-01-10 0:11 ` Configuration Questions Brad Morgan
-- strict thread matches above, loose matches on Subject: below --
2003-01-09 4:22 DMZ trouble! John A. Novak
2003-01-09 4:59 ` David Collodel
2003-01-09 3:42 David Collodel
2003-01-09 5:07 ` Dharmendra.T
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1042090495.2320.216.camel@jimmy \
--to=dave@crawlspaceradio.com \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.