Re: Output Chain Problem...

[Antony Stone <Antony@Soft-Solutions.co.uk>]

On Friday 18 June 2004 2:28 pm, Eric Poulin wrote:

> > > iptables -A OUTPUT -p ALL -s 127.0.0.1 -j ACCEPT
> > > iptables -A OUTPUT -p ALL -s 192.168.0.0/24 -j ACCEPT
> > > iptables -A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
> >
> > That second rule suggests to me that you are slightly mistaken about what
> > packets go through the OUTPUT chain - you have allowed all packets
> > sourced from an entire Class C, so I suspect you think that all packets
> > from your local network, which pass through the Firewall, are traversing
> > the OUTPUT chain?
>
> Not really, I got several virtual IP on my NIC facing the internal Network,
> so some packet will sent from my firewall(like those coming from it while
> i'm doing ssh in it), and I have decided to set the entire subnet. Remember
> this is a test, I'm doing large rule to make it works first...

Okay, I understand.

> The problem can be simplify as the following. Everything is fine now,
> because my Default Policy is set to ACCEPT. Following "Best Practices", I
> would prefer to set it to "DROP" and only allow what I need. The problem is
> that I have rules that ACCEPT my ssh response packet form the firewall
> perfectly. PLease check the counters:

I think the counter you need to focus on is the one right at the top: "policy 
ACCEPT 19 packets, 2060 bytes" - that means 19 packets went out by means of 
the default policy, instead of any of the specified rules...

> Chain OUTPUT (policy ACCEPT 19 packets, 2060 bytes)
>     pkts      bytes target     prot opt in     out     source
> destination
>        0        0 ACCEPT     all  --  *      *       127.0.0.1
> 0.0.0.0/0
>     3543   625244 ACCEPT     all  --  *      *       192.168.0.0/24
> 0.0.0.0/0
>       36     3240 ACCEPT     all  --  *      *       66.11.160.119
> 0.0.0.0/0
>        6     1948 ACCEPT     all  --  *      *       0.0.0.0/0
> 0.0.0.0/0          state NEW,RELATED,ESTABLISHED
>        0        0 ACCEPT     all  --  *      *       0.0.0.0/0
> 0.0.0.0/0
>        0        0 LOG        all  --  *      *       0.0.0.0/0
> 0.0.0.0/0          LOG flags 0 level 4 prefix `Output:'
>
>
> If I put back the default output policy to ACCEPT, everything is fine... I
> don't know if you understand my point, or if I'm wrong...

Yes, I understand your point, and no, you're not wrong (at least, not wrong to 
be puzzled by what's going on, anyway).   I similarly cannot understand why 
you have 19 packets hitting the default policy, which do not get logged by a 
LOG rule put at the end of the chain.

Can anyone else here see something we're both obviously missing?

Antony.

-- 
The lottery is a tax for people who can't do maths.

                                                     Please reply to the list;
                                                           please don't CC me.