* Re: pls help a beginner linux admin - problem with packetfilter setup
2002-12-07 14:38 pls help a beginner linux admin - problem with packetfilter setup eugenio
@ 2002-12-16 21:13 ` Joel Newkirk
0 siblings, 0 replies; 2+ messages in thread
From: Joel Newkirk @ 2002-12-16 21:13 UTC (permalink / raw)
To: eugenio, netfilter
On Saturday 07 December 2002 09:38 am, eugenio wrote:
> I need to set packetfiltering on a debian linux firewall to enable a
> network game.
> Necessary firewall settings are descibed here:
> http://support.microsoft.com/default.aspx?scid=KB;en-us;q240429
>
> The system has client computers with 192.168.1.1x fix local IP
> addresses (no DHCP), and a gateway with both internal (192.168.1.1)
> and external (both fixed) IP adresses, w/ two network card of course
> (eth0 - external, eth1 - internal).
>
> Can anyone give me a hint what settings are necessary?
I assume that the network is functional as it stands, and that the client
machines are SNATted to allow internet access already.
If your client computers are only functioning as clients in the game,
this should work:
iptables -A FORWARD -i eth1 -p tcp \
-m multiport --dport 6073,47624 -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED \
-j ACCEPT
If you are allowing it only for specific machines, since you have static
local IPs, you can tighten this up as follows:
iptables -A FORWARD -s a.b.c.d -p tcp \
-m multiport --dport 6073,47624 -j ACCEPT
iptables -A FORWARD -s a.b.c.d -m state \
--state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -d a.b.c.d -m state \
--state ESTABLISHED,RELATED -j ACCEPT
This will allow the clients to communicate to the gameserver/host
initially, then allow established and related connections each way.
Just use this trio of rules for each IP that you want to allow. Note
that this will allow est/rel for ALL allowed connections, (but only from
the specified machines in the second version) so if this is undesireable
then you will need to specify each port range explicitly, like:
iptables -A FORWARD -i eth1 -p tcp -m multiport
--dport 6073,47624 -j ACCEPT
iptables -A FORWARD -p tcp --dport 2300:2400 -j ACCEPT
iptables -A FORWARD -p udp --dport 2300:2400 -j ACCEPT
You can tighten up any of these rules by specifying IP's of allowed local
machines, and in some cases you can specify IP's of remote machines,
since some of these games only ever connect to one or a small number of
IP's that handle all gaming communications. However, the state rules
will need to be duplicated for input AND output traffic in this case,
since both are required for the port 2300-2400 (or EST/REL) connections.
Note also that while EST/REL may seem insecure, it is in fact quite a bit
more secure than simply opening up 204 ports permanently. If at all
possible, the second approach, or the initial connections as specified
there with the single EST/REL from the first, is the best answer. If
you get things running this way first, you can log some game traffic and
see if there is a consistent remote IP used, and rewrite rules with that
if desired, which will be about as tight as you can get it, without
manually enabling/disabling all of this on demand when gaming is
desired.
Also, depending upon how the particular game communicates, you may find
it necessary to explicitly open the ports as in the third example, since
some games allow or even rely on communication directly between client
machines, and this would represent a new connection, not related
(state-wise) to the gameserver connection.
Finally if a local machine will function as a host (if even possible,
depends on the game) then you need to allow the reverse of the initial
connection as well, but will also need DNAT to allow internet clients to
connect, and only one server will probably be possible.
j
^ permalink raw reply [flat|nested] 2+ messages in thread