* Filter by IP address problems @ 2002-12-11 21:40 Damon Brinkley 2002-12-11 21:04 ` Marcello Scacchetti 2002-12-11 23:26 ` Stewart Thompson 0 siblings, 2 replies; 6+ messages in thread From: Damon Brinkley @ 2002-12-11 21:40 UTC (permalink / raw) To: netfilter Hey everyone! I'm getting extremely frustrated at iptables right now because it doesn't seem to follow the rules as ipchains did. Basically I'm just trying to replace my ipchains server with a new computer that uses 2.4 and iptables. This is a NAT/gateway machine and we filter our users by IP addresses. The different ip blocks have certain access to certain services. I've copied over my old script that's running right now and changed everything to work with iptables but it doesn't seem to deny anyone. Here's the basic rules I have right now for testing. ################################### # disable ip forwarding while rules are applied echo 0 > /proc/sys/net/ipv4/ip_forward /sbin/modprobe iptable_nat /sbin/modprobe ip_conntrack /sbin/iptables -F /sbin/iptables -t nat -F /sbin/iptables -X /sbin/iptables -t nat -X /sbin/iptables -P INPUT DROP /sbin/iptables -P OUTPUT DROP /sbin/iptables -P FORWARD DROP # no access /sbin/iptables -A INPUT -s 172.17.0.0/20 -j DROP # NAT /sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE /sbin/iptables -A FORWARD -j ACCEPT # turn on ip forwarding echo 1 > /proc/sys/net/ipv4/ip_forward #################### If I change my laptop IP to 172.17.0.244 then I'm able to ping www.yahoo.com when the no access rule should deny then from doing anything. This is all working on a machine that uses ipchains...what am I doing wrong? Thanks Damon Brinkley ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Filter by IP address problems 2002-12-11 21:40 Filter by IP address problems Damon Brinkley @ 2002-12-11 21:04 ` Marcello Scacchetti 2002-12-11 23:26 ` Stewart Thompson 1 sibling, 0 replies; 6+ messages in thread From: Marcello Scacchetti @ 2002-12-11 21:04 UTC (permalink / raw) To: netfilter Hi Damon, can you post on this list the output of: iptables -nL and of: iptables -t nat -nL and if possible the output of: ifconfig hiding public ip addresses? If you prefer you can use output of iptables-save for me is the same. Thanks, Marcello Il mer, 2002-12-11 alle 22:40, Damon Brinkley ha scritto: > Hey everyone! I'm getting extremely frustrated at iptables right now > because it doesn't seem to follow the rules as ipchains did. Basically > I'm just trying to replace my ipchains server with a new computer that > uses 2.4 and iptables. This is a NAT/gateway machine and we filter our > users by IP addresses. The different ip blocks have certain access to > certain services. I've copied over my old script that's running right > now and changed everything to work with iptables but it doesn't seem to > deny anyone. > > Here's the basic rules I have right now for testing. > > ################################### > > # disable ip forwarding while rules are applied > echo 0 > /proc/sys/net/ipv4/ip_forward > > /sbin/modprobe iptable_nat > /sbin/modprobe ip_conntrack > > /sbin/iptables -F > /sbin/iptables -t nat -F > /sbin/iptables -X > /sbin/iptables -t nat -X > > /sbin/iptables -P INPUT DROP > /sbin/iptables -P OUTPUT DROP > /sbin/iptables -P FORWARD DROP > > # no access > /sbin/iptables -A INPUT -s 172.17.0.0/20 -j DROP > > # NAT > /sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE > /sbin/iptables -A FORWARD -j ACCEPT > > # turn on ip forwarding > echo 1 > /proc/sys/net/ipv4/ip_forward > > #################### > > If I change my laptop IP to 172.17.0.244 then I'm able to ping > www.yahoo.com when the no access rule should deny then from doing > anything. This is all working on a machine that uses ipchains...what am > I doing wrong? > > Thanks > Damon Brinkley -- Marcello Scacchetti <marcello.scacchetti@nextrem.it> ^ permalink raw reply [flat|nested] 6+ messages in thread
* RE: Filter by IP address problems 2002-12-11 21:40 Filter by IP address problems Damon Brinkley 2002-12-11 21:04 ` Marcello Scacchetti @ 2002-12-11 23:26 ` Stewart Thompson 2002-12-12 14:13 ` Damon Brinkley 1 sibling, 1 reply; 6+ messages in thread From: Stewart Thompson @ 2002-12-11 23:26 UTC (permalink / raw) To: Damon Brinkley, netfilter Hi Damon: Iptables is different than Ipchains. The forwarded Packets do not go through the Input or Output chains. If you want to deny certain packets from being forwarded, you have to put your deny rule in the forward chains. Have a look at the documentation at www.netfilter.org. They show a diagram there of the packet traversal. Hope that helps. Stu....... -----Original Message----- From: netfilter-admin@lists.netfilter.org [mailto:netfilter-admin@lists.netfilter.org]On Behalf Of Damon Brinkley Sent: December 11, 2002 1:41 PM To: netfilter@lists.netfilter.org Subject: Filter by IP address problems Hey everyone! I'm getting extremely frustrated at iptables right now because it doesn't seem to follow the rules as ipchains did. Basically I'm just trying to replace my ipchains server with a new computer that uses 2.4 and iptables. This is a NAT/gateway machine and we filter our users by IP addresses. The different ip blocks have certain access to certain services. I've copied over my old script that's running right now and changed everything to work with iptables but it doesn't seem to deny anyone. Here's the basic rules I have right now for testing. ################################### # disable ip forwarding while rules are applied echo 0 > /proc/sys/net/ipv4/ip_forward /sbin/modprobe iptable_nat /sbin/modprobe ip_conntrack /sbin/iptables -F /sbin/iptables -t nat -F /sbin/iptables -X /sbin/iptables -t nat -X /sbin/iptables -P INPUT DROP /sbin/iptables -P OUTPUT DROP /sbin/iptables -P FORWARD DROP # no access /sbin/iptables -A INPUT -s 172.17.0.0/20 -j DROP # NAT /sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE /sbin/iptables -A FORWARD -j ACCEPT # turn on ip forwarding echo 1 > /proc/sys/net/ipv4/ip_forward #################### If I change my laptop IP to 172.17.0.244 then I'm able to ping www.yahoo.com when the no access rule should deny then from doing anything. This is all working on a machine that uses ipchains...what am I doing wrong? Thanks Damon Brinkley ^ permalink raw reply [flat|nested] 6+ messages in thread
* RE: Filter by IP address problems 2002-12-11 23:26 ` Stewart Thompson @ 2002-12-12 14:13 ` Damon Brinkley 2002-12-12 14:39 ` Joel Newkirk 0 siblings, 1 reply; 6+ messages in thread From: Damon Brinkley @ 2002-12-12 14:13 UTC (permalink / raw) To: stewart.thompson; +Cc: netfilter Thanks Stu but I'm still doing something wrong. Here's the rules I have now. ############################### echo 0 > /proc/sys/net/ipv4/ip_forward /sbin/modprobe iptable_nat /sbin/modprobe ip_conntrack /sbin/modprobe ip_conntrack_ftp /sbin/iptables -F /sbin/iptables -t nat -F /sbin/iptables -X /sbin/iptables -t nat -X /sbin/iptables -P INPUT DROP /sbin/iptables -P OUTPUT DROP /sbin/iptables -P FORWARD DROP # INPUT CHAIN # NONUSERS = 172.17.0.0/20 /sbin/iptables -A INPUT -s $NONUSERS -j ACCEPT # FORWARD CHAIN /sbin/iptables -A FORWARD -s $NONUSERS -j ACCEPT # POSTROUTING /sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE echo 1 > /proc/sys/net/ipv4/ip_forward ###################################### This should give my laptop, IP 172.17.0.244, complete access but I get Request timed out when pinging www.yahoo.com Here's what I get when running iptables -nL Chain INPUT (policy DROP) target prot opt source destination ACCEPT all -- 172.17.0.0/20 0.0.0.0/0 Chain FORWARD (policy DROP) target prot opt source destination ACCEPT all -- 172.17.0.0/20 0.0.0.0/0 Chain OUTPUT (policy DROP) target prot opt source destination ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 Has there been a book written on iptables yet? Thanks for your help. Damon On Wed, 2002-12-11 at 18:26, Stewart Thompson wrote: > Hi Damon: > > Iptables is different than Ipchains. The forwarded > Packets do not go through the Input or Output chains. If > you want to deny certain packets from being forwarded, > you have to put your deny rule in the forward chains. > Have a look at the documentation at www.netfilter.org. > They show a diagram there of the packet traversal. > Hope that helps. > > Stu....... > > > -----Original Message----- > From: netfilter-admin@lists.netfilter.org > [mailto:netfilter-admin@lists.netfilter.org]On Behalf Of Damon Brinkley > Sent: December 11, 2002 1:41 PM > To: netfilter@lists.netfilter.org > Subject: Filter by IP address problems > > Hey everyone! I'm getting extremely frustrated at iptables right now > because it doesn't seem to follow the rules as ipchains did. Basically > I'm just trying to replace my ipchains server with a new computer that > uses 2.4 and iptables. This is a NAT/gateway machine and we filter our > users by IP addresses. The different ip blocks have certain access to > certain services. I've copied over my old script that's running right > now and changed everything to work with iptables but it doesn't seem to > deny anyone. > > Here's the basic rules I have right now for testing. > > ################################### > > # disable ip forwarding while rules are applied > echo 0 > /proc/sys/net/ipv4/ip_forward > > /sbin/modprobe iptable_nat > /sbin/modprobe ip_conntrack > > /sbin/iptables -F > /sbin/iptables -t nat -F > /sbin/iptables -X > /sbin/iptables -t nat -X > > /sbin/iptables -P INPUT DROP > /sbin/iptables -P OUTPUT DROP > /sbin/iptables -P FORWARD DROP > > # no access > /sbin/iptables -A INPUT -s 172.17.0.0/20 -j DROP > > # NAT > /sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE > /sbin/iptables -A FORWARD -j ACCEPT > > # turn on ip forwarding > echo 1 > /proc/sys/net/ipv4/ip_forward > > #################### > > If I change my laptop IP to 172.17.0.244 then I'm able to ping > www.yahoo.com when the no access rule should deny then from doing > anything. This is all working on a machine that uses ipchains...what am > I doing wrong? > > Thanks > Damon Brinkley > > > ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Filter by IP address problems 2002-12-12 14:13 ` Damon Brinkley @ 2002-12-12 14:39 ` Joel Newkirk 2002-12-12 15:16 ` Damon Brinkley 0 siblings, 1 reply; 6+ messages in thread From: Joel Newkirk @ 2002-12-12 14:39 UTC (permalink / raw) To: Damon Brinkley, stewart.thompson; +Cc: netfilter On Thursday 12 December 2002 09:13 am, Damon Brinkley wrote: > Thanks Stu but I'm still doing something wrong. > > Here's the rules I have now. > > ############################### > > echo 0 > /proc/sys/net/ipv4/ip_forward > > /sbin/modprobe iptable_nat > /sbin/modprobe ip_conntrack > /sbin/modprobe ip_conntrack_ftp > > /sbin/iptables -F > /sbin/iptables -t nat -F > /sbin/iptables -X > /sbin/iptables -t nat -X > > /sbin/iptables -P INPUT DROP > /sbin/iptables -P OUTPUT DROP > /sbin/iptables -P FORWARD DROP > > # INPUT CHAIN > # NONUSERS = 172.17.0.0/20 > /sbin/iptables -A INPUT -s $NONUSERS -j ACCEPT > > # FORWARD CHAIN > /sbin/iptables -A FORWARD -s $NONUSERS -j ACCEPT > > # POSTROUTING > /sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE > > echo 1 > /proc/sys/net/ipv4/ip_forward > > ###################################### > > This should give my laptop, IP 172.17.0.244, complete access but I get > Request timed out when pinging www.yahoo.com > > Here's what I get when running iptables -nL You can also run "iptables -t nat -nL" to show the nat table chains. As with most iptables calls, if you don't specify it assumes filter table. anyway, make sure you are also doing: echo 1 > /proc/sys/net/ipv4/ip_dynaddr so that it will actually have (and maintain) the current IP address for masquerading. Finally, you are not allowing any return connection back to the laptop through the FORWARD chain. Try adding: /sbin/iptables -A FORWARD -d $NONUSERS -m state \ --state ESTABLISHED -j ACCEPT and it should work for browsing. If you use "ESTABLISHED,RELATED" instead then it should be more reliable, since it will allow icmp traffic related to the browsing. Also, you are allowing the laptop to communicate to the firewall box local processes (INPUT) but not allowing anything back from it to the laptop (OUTPUT). If you need them to communicate with each other, apart from the firewall forwarding (separate issues) then you need to allow communications in OUTPUT that go to the laptop as well, either simply ACCEPTing appropriate traffic, or using a state rule as above in OUTPUT to allow local processes on the firewall box to reply, but not initiate connections to the laptop. I've never worked with ipchains, just iptables, but I gather that with ipchains it was necessary to allow traffic through INPUT in order to forward. (I've seen this a lot this past week :^) With iptables the packets hit prerouting then netfilter decides whether the packet is destined for the local box, or forwarding, and it goes to EITHER one or the other, but not both. INPUT and OUTPUT are for the local box itself, and don't have any affect at all on forwarding, SNAT/DNAT, etc. j ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Filter by IP address problems 2002-12-12 14:39 ` Joel Newkirk @ 2002-12-12 15:16 ` Damon Brinkley 0 siblings, 0 replies; 6+ messages in thread From: Damon Brinkley @ 2002-12-12 15:16 UTC (permalink / raw) To: netfilter; +Cc: stewart.thompson, netfilter On Thu, 2002-12-12 at 09:39, Joel Newkirk wrote: > On Thursday 12 December 2002 09:13 am, Damon Brinkley wrote: > > Thanks Stu but I'm still doing something wrong. > > > > Here's the rules I have now. > > > > ############################### > > > > echo 0 > /proc/sys/net/ipv4/ip_forward > > > > /sbin/modprobe iptable_nat > > /sbin/modprobe ip_conntrack > > /sbin/modprobe ip_conntrack_ftp > > > > /sbin/iptables -F > > /sbin/iptables -t nat -F > > /sbin/iptables -X > > /sbin/iptables -t nat -X > > > > /sbin/iptables -P INPUT DROP > > /sbin/iptables -P OUTPUT DROP > > /sbin/iptables -P FORWARD DROP > > > > # INPUT CHAIN > > # NONUSERS = 172.17.0.0/20 > > /sbin/iptables -A INPUT -s $NONUSERS -j ACCEPT > > > > # FORWARD CHAIN > > /sbin/iptables -A FORWARD -s $NONUSERS -j ACCEPT > > > > # POSTROUTING > > /sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE > > > > echo 1 > /proc/sys/net/ipv4/ip_forward > > > > ###################################### > > > > This should give my laptop, IP 172.17.0.244, complete access but I get > > Request timed out when pinging www.yahoo.com > > > > Here's what I get when running iptables -nL > > You can also run "iptables -t nat -nL" to show the nat table chains. As > with most iptables calls, if you don't specify it assumes filter table. > > anyway, make sure you are also doing: > echo 1 > /proc/sys/net/ipv4/ip_dynaddr > so that it will actually have (and maintain) the current IP address for > masquerading. > > Finally, you are not allowing any return connection back to the laptop > through the FORWARD chain. Try adding: > > /sbin/iptables -A FORWARD -d $NONUSERS -m state \ > --state ESTABLISHED -j ACCEPT > > and it should work for browsing. If you use "ESTABLISHED,RELATED" > instead then it should be more reliable, since it will allow icmp > traffic related to the browsing. > > Also, you are allowing the laptop to communicate to the firewall box > local processes (INPUT) but not allowing anything back from it to the > laptop (OUTPUT). If you need them to communicate with each other, apart > from the firewall forwarding (separate issues) then you need to allow > communications in OUTPUT that go to the laptop as well, either simply > ACCEPTing appropriate traffic, or using a state rule as above in OUTPUT > to allow local processes on the firewall box to reply, but not initiate > connections to the laptop. > > I've never worked with ipchains, just iptables, but I gather that with > ipchains it was necessary to allow traffic through INPUT in order to > forward. (I've seen this a lot this past week :^) With iptables the > packets hit prerouting then netfilter decides whether the packet is > destined for the local box, or forwarding, and it goes to EITHER one or > the other, but not both. INPUT and OUTPUT are for the local box itself, > and don't have any affect at all on forwarding, SNAT/DNAT, etc. > > j > > Thank you so much j. You cleared up a lot of things and I believe things are working now. Thanks Damon ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2002-12-12 15:16 UTC | newest] Thread overview: 6+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2002-12-11 21:40 Filter by IP address problems Damon Brinkley 2002-12-11 21:04 ` Marcello Scacchetti 2002-12-11 23:26 ` Stewart Thompson 2002-12-12 14:13 ` Damon Brinkley 2002-12-12 14:39 ` Joel Newkirk 2002-12-12 15:16 ` Damon Brinkley
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.