Strange misunderstandings

Strange misunderstandings

[John Jones]

Two issues, first issue is a simple question:

[root] iptables -h
...
  --check   -C chain            Test this packet on chain
...

[root] iptables --check
iptables v1.2.6a: Unknown arg `--check'

What's up with that?  The help screen shows me it is a command, but it
doesn't exist?  Is this an optional kernel compilation thing that is
missing, or has it been removed from the distro?


Second issue:

I hate to post something like this to the list, but I need help.  I am
replacing an IPCHAINS firewall with an IPTABLES firewall, and am running
into failures that I cannot track down.

Below is my ruleset, simplified to remove extraneous information:

Iptables 1.2.6a on Debian 3.0:

Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source
destination         
  859 61128 ACCEPT     tcp  --  *      *       0.0.0.0/0
66.38.133.120      tcp dpt:22 
   15  1260 ACCEPT     all  --  *      *       0.0.0.0/0
10.0.0.3           
    0     0 LOG        all  --  *      *       0.0.0.0/0
0.0.0.0/0          LOG flags 0 level 4 prefix `INPUT:' 

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source
destination         
  208 13839 ACCEPT     udp  --  *      *       0.0.0.0/0
10.0.0.10          udp dpt:53 
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0
10.0.0.10          udp dpt:53 
    0     0 LOG        all  --  *      *       0.0.0.0/0
0.0.0.0/0          LOG flags 0 level 4 prefix `FORWARD:' 

Chain OUTPUT (policy ACCEPT 15 packets, 1260 bytes)
 pkts bytes target     prot opt in     out     source
destination         
  767  202K ACCEPT     all  --  *      *       0.0.0.0/0
209.139.199.253    
    0     0 ACCEPT     all  --  *      *       10.0.0.10
0.0.0.0/0          
   15  1260 LOG        all  --  *      *       0.0.0.0/0
0.0.0.0/0          LOG flags 0 level 4 prefix `OUTPUT:' 

----------------------- NAT TABLES ---------------------------

Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source
destination         
   52  3475 DNAT       udp  --  *      *       0.0.0.0/0
66.38.133.120      udp dpt:53 to:10.0.0.10:53 
    0     0 DNAT       udp  --  *      *       0.0.0.0/0
66.38.133.120      udp dpt:53 to:10.0.0.10:53 
    0     0 LOG        all  --  *      *       0.0.0.0/0
0.0.0.0/0          LOG flags 0 level 4 prefix `NAT-PREROUTING:' 

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source
destination         
    0     0 MASQUERADE  all  --  *      eth1    10.0.0.0/24
0.0.0.0            
    0     0 SNAT       all  --  *      eth1    10.0.0.0/24
0.0.0.0/0          to:66.38.133.120 
   69  4835 ACCEPT     all  --  *      *       0.0.0.0/0
10.0.0.10          
    0     0 LOG        all  --  *      *       0.0.0.0/0
0.0.0.0/0          LOG flags 0 level 4 prefix `NAT-POSTROUTING:' 

Chain OUTPUT (policy ACCEPT 15 packets, 1260 bytes)
 pkts bytes target     prot opt in     out     source
destination         
   15  1260 LOG        all  --  *      *       0.0.0.0/0
0.0.0.0/0          LOG flags 0 level 4 prefix `NAT-OUTPUT:' 

---------------------- FINISH -------------------------------

What is happening/wrong, is that I cannot seem to get an answer when I
point my nameserver settings to 66.38.133.120.  From everything that I
can tell, it is getting the traffic, processing it through the chains
correctly, but the workstation is not getting a response.  Further, I
have set up a logging entry on the nameserver (10.0.0.10) to log
anything from the internal interface of the firewall (10.0.0.3), but it
is not seeing anything at all.  That is why I think that I have somehow
screwed up the above rules.  I can ping between the two machines fine,
and when that is done, entries in the /var/log/messages file -do- come
up.

The relevant section of my setup script is below.

DMZ_TARGET="10.0.0.10"
EXT_IP_NS1="66.38.133.120"

iptables -t nat -I PREROUTING 1 -p udp -d $EXT_IP_NS1 --dport 53 -j DNAT
--to $DMZ_TARGET:53
iptables -I FORWARD 1 -p udp -d $DMZ_TARGET --dport 53 -j ACCEPT
iptables -t nat -I PREROUTING 1 -p udp -d $EXT_IP_NS2 --dport 53 -j DNAT
--to $DMZ_TARGET:53
iptables -I FORWARD 1 -p udp -d $DMZ_TARGET --dport 53 -j ACCEPT

Can anyone spot what I am missing here?  I am banging my head off my
desk trying to spot the Stupid Mistake that I am overlooking.  Any help
appreciated.

Re: Strange misunderstandings

[Sascha Reissner]

From: "John Jones" <jjones@merlintechnologies.com>

> Two issues, first issue is a simple question:
>
> [root] iptables -h
> ...
>   --check   -C chain            Test this packet on chain
> ...
>
> [root] iptables --check
> iptables v1.2.6a: Unknown arg `--check'
>
> What's up with that?  The help screen shows me it is a command, but it
> doesn't exist?  Is this an optional kernel compilation thing that is
> missing, or has it been removed from the distro?

if you try it with iptables -C it will work.. and result in.. tataaaa

"iptables: Will be implemented real soon.  I promise ;)" so it aint in there
yet.

RE: Strange misunderstandings

[John Jones]

[gemini:~] iptables -C
iptables v1.2.6a: Unknown arg `-C'
Try `iptables -h' or 'iptables --help' for more information.



> -----Original Message-----
> From: Sascha Reissner [mailto:sascha.reissner@toxicnet.de] 
> Sent: Friday, May 31, 2002 2:11 PM
> To: jjones@merlintechnologies.com; 'Iptables'
> Subject: Re: Strange misunderstandings
> 
> 
> From: "John Jones" <jjones@merlintechnologies.com>
> 
> > Two issues, first issue is a simple question:
> >
> > [root] iptables -h
> > ...
> >   --check   -C chain            Test this packet on chain
> > ...
> >
> > [root] iptables --check
> > iptables v1.2.6a: Unknown arg `--check'
> >
> > What's up with that?  The help screen shows me it is a 
> command, but it 
> > doesn't exist?  Is this an optional kernel compilation 
> thing that is 
> > missing, or has it been removed from the distro?
> 
> if you try it with iptables -C it will work.. and result in.. tataaaa
> 
> "iptables: Will be implemented real soon.  I promise ;)" so 
> it aint in there yet.
> 
> 
> 

Re: Strange misunderstandings

[Hervé Eychenne]

On Fri, May 31, 2002 at 11:11:15PM +0200, Sascha Reissner wrote:

> > Two issues, first issue is a simple question:
> >
> > [root] iptables -h
> > ...
> >   --check   -C chain            Test this packet on chain
> > ...
> >
> > [root] iptables --check
> > iptables v1.2.6a: Unknown arg `--check'
> >
> > What's up with that?  The help screen shows me it is a command, but it
> > doesn't exist?  Is this an optional kernel compilation thing that is
> > missing, or has it been removed from the distro?

> if you try it with iptables -C it will work.. and result in.. tataaaa
> 
> "iptables: Will be implemented real soon.  I promise ;)" so it aint in
> there yet.

No, it never will. Man page and tool have recently be updated about
this in the CVS tree.
And I can promise you that. ;-)

 RV

-- 
 _
(°=  Hervé Eychenne
//)
v_/_ WallFire project:  http://www.wallfire.org/

Re: Strange misunderstandings

[Sascha Reissner]

From: "John Jones" <jjones@merlintechnologies.com>

as iptables -h states :

--check   -C chain

so its: iptables -C <chain name>

and then it works pretty fine.. results into:

iptables v1.2.6a: You need to supply the `-s' option for this command

once you add a -s with value you get:

iptables v1.2.6a: You need to supply the `-d' option for this command

if you add that you get

iptables v1.2.6a: You need to supply the `-p' option for this command

if you add that you get 

iptables v1.2.6a: Need -i with INPUT

and finally you get 

iptables: Will be implemented real soon.  I promise ;)

Re: Strange misunderstandings

[Adam D. Barratt]

John Jones asked:

> [root] iptables -h
> ...
>   --check   -C chain            Test this packet on chain
> ...
>
> [root] iptables --check
> iptables v1.2.6a: Unknown arg `--check'
>
> What's up with that?  The help screen shows me it is a command, but
it
> doesn't exist?  Is this an optional kernel compilation thing that is
> missing, or has it been removed from the distro?

It's been removed. It has never been implemented, and never will be.
v1.27 (i.e. current CVS version) no longer contains references to this
option.

hth

Adam

RE: Strange misunderstandings

[Tony Earnshaw]

[-- Attachment #1: Type: text/plain, Size: 1580 bytes --]

fre, 2002-05-31 kl. 23:16 skrev John Jones:

> [gemini:~] iptables -C
> iptables v1.2.6a: Unknown arg `-C'
> Try `iptables -h' or 'iptables --help' for more information.

I don't know whether you noticed, but you finally got your answer from
Sascha. The funny thing is, is that all the answers were time-shuffeled,
like a pack of cards. Sascha is using a dial-in WinXP mail client to a
webmail Sendmail server, and is based in Germany. John's (your) mail
server is Sendmail and is based in North America. Adam's is a Postfix
server in the U.K.

The shuffeling has no doubt to do with a preference for European Union
vis a vis British origins by Samba.org, and quite right too. Maybe the
position of the sun at the time had something to do with it, as well. Or
Gemini in ascendence.

Had you done "man iptables", you'd never have had to ask the question,
but Sascha's analysis was witty and droll, so worth waiting for,
perhaps.

No-one gave you the answer to your second question. The latter is, that
you've established a path to the internal name server with PREROUTING
and DNAT, but none back again. So no packets get returned. Do that with
POSTROUTING and SNAT. Also, you haven't specified any interfaces, but
try that later if things don't work.

Tony


-- 

Tony Earnshaw

e-post:		tonni@billy.demon.nl
www:		http://www.billy.demon.nl
gpg public key:	http://www.billy.demon.nl/tonni.armor

Telefoon:	(+31) (0)172 530428
Mobiel:		(+31) (0)6 51153356

GPG Fingerprint = 3924 6BF8 A755 DE1A 4AD6 FA2B F7D7 6051 3BE7 B981
3BE7B981



[-- Attachment #2: Dette er en digitalt signert meldingsdel --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: Strange misunderstandings

[Nick Drage]

On Fri, May 31, 2002 at 10:34:23PM +0100, Adam D. Barratt wrote:
> John Jones asked:
> 
> > [root] iptables -h
> > ...
> >   --check   -C chain            Test this packet on chain

<snip>

> It's been removed. It has never been implemented, and never will be. v1.27
> (i.e. current CVS version) no longer contains references to this option.

Shame it won't be implemented, this strikes me as an incredibly useful option. 
I would guess there's the demand for it, is it hard to code in?

-- 
FunkyJesus System Administration Team