Problem w/ iptables on FC3

Problem w/ iptables on FC3

[John Sasso]

I am desperately trying to get the version of iptables that comes
default on Fedora Core 3 to work, even with a simple configuration.  The
version of iptables is 1.2.11.

The simple script is shown below, followed by the 'iptables -L' output
and interface configuration.  My system is single-homed, and starting
off simple I am trying to allow outgoing pings.  After running the
script, when I try to ping anything I get:

ping: sendmsg: Operation not permitted

What is going on here?  I've followed closely the guidelines given in
several books on iptables and a variety of online docs, but to no avail.
Is this a bug?

--john

--------------------------------------------
# Initialize all the chains by removing all the rules tied to them
iptables --flush
iptables -t nat --flush
iptables -t mangle --flush

# Now that the chains have been initialized, remove the user-defined
# chains.  We will recreate them afterwards
iptables --delete-chain
iptables -t nat --delete-chain
iptables -t mangle --delete-chain

# If a packet does not match any of the built-in chains, then the policy
# should be to drop it.
# If the firewall has only one interface, the FORWARD policy is not
necessary.
# However, defining a FORWARD policy is a precaution for future use.
iptables --policy INPUT    DROP
iptables --policy OUTPUT   DROP
iptables --policy FORWARD  DROP

iptables -A INPUT  -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

iptables -A OUTPUT -o eth0 -s 192.168.50.100 -p icmp --icmp-type echo-
request -j ACCEPT
iptables -A INPUT -i eth0 -d 192.168.50.100 -p icmp --icmp-type echo-
reply -j ACCEPT
--------------------------------------------


--------------------------------------------
# iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     icmp --  anywhere             192.168.50.100      icmp echo-
reply

Chain FORWARD (policy DROP)
target     prot opt source               destination

Chain OUTPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     icmp --  192.168.50.100       anywhere            icmp echo-
request
--------------------------------------------


# ifconfig -a
eth0      Link encap:Ethernet  HWaddr 00:20:78:07:BE:45
          inet addr:192.168.50.100  Bcast:192.168.50.255
Mask:255.255.255.0
          inet6 addr: fe80::220:78ff:fe07:be45/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:160 errors:0 dropped:0 overruns:0 frame:0
          TX packets:144 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:25140 (24.5 KiB)  TX bytes:14039 (13.7 KiB)
          Interrupt:11 Base address:0x2000

Re: Problem w/ iptables on FC3

[/dev/rob0]

On Monday 04 July 2005 09:25, John Sasso wrote:
> avail. Is this a bug?

Not likely.

> iptables --policy OUTPUT   DROP

Don't do this. How do you think it will help? Do you have untrusted 
local shell users? If so, you are doomed anyway. They will find an 
opening, get root, and get out as they wish. If it's just you on the 
machine, OUTPUT filtering is silly. Use self-control, not netfilter.

iptables -P OUTPUT ACCEPT

For the return packets, go stateful. An example is posted in the thread 
earlier today, Subject: help me. It's also given and explained in the 
Packet Filtering HOWTO.
-- 
    mail to this address is discarded unless "/dev/rob0"
    or "not-spam" is in Subject: header

RE: Problem w/ iptables on FC3

[John Sasso Jr]

Thank-you for the helpful response!

I'm curious - for the sample configuration I gave in my original posting,
why would:

iptables -A OUTPUT -o eth0 -s 192.168.50.100 -p icmp --icmp-type
echo-request -j ACCEPT

fail to permit a packet originating from my system out?  I understand what
"iptables -P OUTPUT ACCEPT" does, and I am not arguing the logic behind
using that instead for my situation, but I'm wondering if packet filtering
operates differently for traffic originated by a firewall as opposed to
traversing a firewall.

I looked through the Packet Filtering HOWTO, as well as Ziegler's "Linux
Firewalls" book but could not find an answer.  Thanks!

--john


> -----Original Message-----
> From: netfilter-bounces@lists.netfilter.org
> [mailto:netfilter-bounces@lists.netfilter.org]On Behalf Of /dev/rob0
> Sent: Monday, July 04, 2005 10:50 AM
> To: netfilter@lists.netfilter.org
> Subject: Re: Problem w/ iptables on FC3
>
>
> On Monday 04 July 2005 09:25, John Sasso wrote:
> > avail. Is this a bug?
>
> Not likely.
>
> > iptables --policy OUTPUT   DROP
>
> Don't do this. How do you think it will help? Do you have untrusted
> local shell users? If so, you are doomed anyway. They will find an
> opening, get root, and get out as they wish. If it's just you on the
> machine, OUTPUT filtering is silly. Use self-control, not netfilter.
>
> iptables -P OUTPUT ACCEPT
>
> For the return packets, go stateful. An example is posted in
> the thread
> earlier today, Subject: help me. It's also given and explained in the
> Packet Filtering HOWTO.
> --
>     mail to this address is discarded unless "/dev/rob0"
>     or "not-spam" is in Subject: header
>
>

Re: Problem w/ iptables on FC3

[/dev/rob0]

On Monday 04 July 2005 13:36, John Sasso Jr wrote:
> I'm curious - for the sample configuration I gave in my original
> posting, why would:
>
> iptables -A OUTPUT -o eth0 -s 192.168.50.100 -p icmp --icmp-type
> echo-request -j ACCEPT
>
> fail to permit a packet originating from my system out?  I understand

Try inserting a LOG rule ahead of that ...
iptables -I OUTPUT -o eth0 -j LOG
and watch your kernel logs while trying to ping. Check the counters, 
with "iptables -vnL". Are they incremented for each ping sent? If so, 
they matched the rule, if not, they didn't.

Maybe the replies aren't matching. Repeat the above steps for INPUT. 
Soon enough you will find out why it didn't work.

Or not. Actually I bet you will find that no pings were sent. What do 
you have for "ls -l `which ping`"? Is it SUID?

$ v `which ping`
-rws--x--x  1 root bin 29232 2004-11-03 22:55 /bin/ping
   ^
That little "s" there is necessary for non-root users.

> what "iptables -P OUTPUT ACCEPT" does, and I am not arguing the logic
> behind using that instead for my situation, but I'm wondering if
> packet filtering operates differently for traffic originated by a
> firewall as opposed to traversing a firewall.

OUTPUT is the chain that sees the packets which originated on the 
firewall machine. Packet matching follows the same principle in all 
tables and chains.
-- 
    mail to this address is discarded unless "/dev/rob0"
    or "not-spam" is in Subject: header