Re: problems with nat

[Joel Newkirk <netfilter@newkirk.us>]

On Wednesday 13 November 2002 01:13 pm, Rahul Jadhav wrote:
> please check the attachment...
>
> Thanks
> Rahul

Regarding your DNAT/SNAT issues, I suggest reading through Oscar's tutorial at 
http://iptables-tutorial.frozentux.net/chunkyhtml/targets.html#DNATTARGET 
where he explores your situation pretty precisely, forwarding HTTP from EXTRA 
and INTRA, and making sure responses are directed properly.  You also seem to 
have some problems in FORWARD, which I comment on below.


grep = and grep FORWARD give us:

RTRIP=router's ip
EXTIP=external eth ip
INTIP=internal eth ip
HTTPSERVER="http server ip"
MAILSERVER="mail server ip"
SSHSERVER="ssh server ip"
UNPRIVPORTS="1024:65535"
INTRA_DEV="internal eth"
EXTRA_DEV="external eth"
INTRA_IP="internal ip"
EXTRA_IP="external ip"
INTRA_LAN="internal lan"
PUBLIC_IP="public ip of the router"

## FORWARD-Chain  ## (everything that passes the firewall)
$IPTABLES -A FORWARD -m state --state INVALID -j LOG_INVALID
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -p tcp -j CHECK_BAD_FLAG
$IPTABLES -A FORWARD -o $EXTRA_DEV -j SMB
$IPTABLES -A FORWARD -o $EXTRA_DEV -p tcp -i $INTRA_DEV -d $UNIVERSE -j ACCEPT
$IPTABLES -A FORWARD -o $EXTRA_DEV -p udp -i $INTRA_DEV -d $UNIVERSE -j ACCEPT
$IPTABLES -A FORWARD -o $EXTRA_DEV -s $HTTPSERVER -p tcp --sport 80 -j ACCEPT
$IPTABLES -A FORWARD -o $EXTRA_DEV -s $HTTPSERVER -p udp --sport 80 -j ACCEPT
$IPTABLES -A FORWARD -o $EXTRA_DEV -s $HTTPSERVER -p tcp --sport $UNPRIVPORTS 
-j ACCEPT
$IPTABLES -A FORWARD -o $EXTRA_DEV -s $HTTPSERVER -p udp --sport $UNPRIVPORTS 
-j ACCEPT
$IPTABLES -A FORWARD -o $EXTRA_DEV -s $MAILSERVER -p tcp --sport 25 -j ACCEPT
$IPTABLES -A FORWARD -o $EXTRA_DEV -s $MAILSERVER -p tcp --sport 110 -j ACCEPT
$IPTABLES -A FORWARD -o $EXTRA_DEV -s $MAILSERVER -p tcp --sport 109 -j ACCEPT
$IPTABLES -A FORWARD -o $EXTRA_DEV -s $MAILSERVER -p tcp --sport 143 -j ACCEPT
$IPTABLES -A FORWARD -o $EXTRA_DEV -s $MAILSERVER -p tcp --sport 81 -j ACCEPT
$IPTABLES -A FORWARD -o $EXTRA_DEV -s $MAILSERVER -p udp --sport 81 -j ACCEPT
$IPTABLES -A FORWARD -o $EXTRA_DEV -s $MAILSERVER -p tcp --sport $UNPRIVPORTS 
-j ACCEPT
$IPTABLES -A FORWARD -o $EXTRA_DEV -s $MAILSERVER -p udp --sport $UNPRIVPORTS 
-j ACCEPT
$IPTABLES -A FORWARD -o $EXTRA_DEV -s $MAILSERVER -p tcp --sport 389 -j ACCEPT
$IPTABLES -A FORWARD -o $EXTRA_DEV -s $SSHSERVER -p tcp --sport 82 -j ACCEPT
$IPTABLES -A FORWARD -o $EXTRA_DEV -s $SSHSERVER -p tcp --sport 83 -j ACCEPT
$IPTABLES -A FORWARD -o $EXTRA_DEV -s $SSHSERVER -p tcp --sport 22 -j ACCEPT
$IPTABLES -A FORWARD -i $INTRA_DEV -o $EXTRA_DEV -s $INTRA_LAN -p tcp --sport 
$UNPRIVPORTS -j ACCEPT
$IPTABLES -A FORWARD -i $INTRA_DEV -o $EXTRA_DEV -s $INTRA_LAN -p udp --sport 
$UNPRIVPORTS -j ACCEPT
$IPTABLES -A FORWARD -i $INTRA_DEV -o $EXTRA_DEV -s $INTRA_LAN -p icmp -j 
ACCEPT
$IPTABLES -A FORWARD -i $EXTRA_DEV -p tcp -m state --state ESTABLISHED -j 
ACCEPT
$IPTABLES -A FORWARD -i $EXTRA_DEV -p udp -m state --state ESTABLISHED -j 
ACCEPT
$IPTABLES -A FORWARD -i $EXTRA_DEV -p tcp -m state --state RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $EXTRA_DEV -p udp -m state --state RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $EXTRA_DEV -p icmp -m state --state RELATED -j ACCEPT
$IPTABLES -A FORWARD -p tcp --dport 80 -d $HTTPSERVER -j ACCEPT
$IPTABLES -A FORWARD -p udp --dport 80 -d $HTTPSERVER -j ACCEPT
$IPTABLES -A FORWARD -p tcp --dport 80 -d $EXTRA_IP -j ACCEPT
$IPTABLES -A FORWARD -p udp --dport 80 -d $EXTRA_IP -j ACCEPT
$IPTABLES -A FORWARD -p tcp --dport 81 -d $MAILSERVER -j ACCEPT
$IPTABLES -A FORWARD -p udp --dport 81 -d $MAILSERVER -j ACCEPT
$IPTABLES -A FORWARD -p tcp --dport 81 -d $EXTRA_IP -j ACCEPT
$IPTABLES -A FORWARD -p udp --dport 81 -d $EXTRA_IP -j ACCEPT
$IPTABLES -A FORWARD -p tcp --dport 22 -d $SSHSERVER -j ACCEPT
$IPTABLES -A FORWARD -p tcp --dport 82 -d $SSHSERVER -j ACCEPT
$IPTABLES -A FORWARD -p udp --dport 82 -d $SSHSERVER -j ACCEPT
$IPTABLES -A FORWARD -p tcp --dport 83 -d $SSHSERVER -j ACCEPT
$IPTABLES -A FORWARD -p udp --dport 83 -d $SSHSERVER -j ACCEPT
$IPTABLES -A FORWARD -p tcp --dport 82 -d $EXTRA_IP -j ACCEPT
$IPTABLES -A FORWARD -p udp --dport 82 -d $EXTRA_IP -j ACCEPT
$IPTABLES -A FORWARD -p tcp --dport 83 -d $EXTRA_IP -j ACCEPT
$IPTABLES -A FORWARD -p udp --dport 83 -d $EXTRA_IP -j ACCEPT
$IPTABLES -A FORWARD -p tcp --dport 22 -d $EXTRA_IP -j ACCEPT
$IPTABLES -A FORWARD -j LOG_DROP
## Port-Forwarding (--> Also see chain FORWARD)

Where do you define $UNIVERSE?  You are referring here to user-defined chains 
that are not defined, like CHECK_BAD_FLAG and SMB.  I assume you DO define 
them, just didn't include them?  With ALL TCP going through CHECK_BAD_FLAG 
(except EST/REL, caught just before) the contents of that chain could be 
rather important in trying to find problems.  The same for SMB where 
everything outbound from your LAN to the internet is filtered...

Your second FORWARD rule allows all EST/REL traffic through, regardless of 
source or destination.  This is normally OK, but makes the five state rules 
further down rather pointless.  (they could also be condensed, unless you are 
using them as counters, but aren't ever matched as it stands)  But you don't 
follow up by allowing new HTTP or DNS traffic from the LAN to your servers.  
-o $EXTRA_DEV -i $INTRA_DEV should allow local machines to browse the 
internet, but doesn't address local machines trying to connect to your 
servers.  -p tcp --dport 80 -i $INTRA_DEV -d $HTTPSERVER, for example, should 
match them.

Also, I'd suggest that rather than test for "--sport $UNPRIVPORTS" you test 
for allowed destination ports only.  IE, for HTTP forwarding, use "--dport 
80", etc.  Otherwise you let ANY traffic through, as long as it's source port 
is over 1024.   

j