* Redirect on first encounter
@ 2004-02-14 8:57 Peter Poulsen
0 siblings, 0 replies; 2+ messages in thread
From: Peter Poulsen @ 2004-02-14 8:57 UTC (permalink / raw)
To: netfilter
I'm very new to netfilter and firewalls.
I have to set up a firewall that allows people to go on the Internet
(dooh). The first time they go through it on port 80 I would like to
redirect to the firewall itself (it also runs a webserver) which shows
who is proveding the Internet access.
I have almost got it working. The first time I tries to request a page I
get redirect, and all other pages gets delivered as expected. The only
problem is that if my first request is "www.google.com" all other
requests to "www.google.com" also gets redirect to the firewall. I only
planed for the first one to get redirected.
Can anybody tell how to fix this.
This is my script so far:
EXTIF="eth0"
INTIF="eth1"
INTNET="192.168.100.0/24"
EXTIP="192.168.1.48"
INTIP="192.168.100.1"
echo "1" > /proc/sys/net/ipv4/ip_forward
/sbin/iptables -P INPUT DROP
/sbin/iptables -F INPUT
/sbin/iptables -P OUTPUT DROP
/sbin/iptables -F OUTPUT
/sbin/iptables -P FORWARD DROP
/sbin/iptables -F FORWARD
/sbin/iptables -F -t nat
/sbin/iptables -F log-and-accept
/sbin/iptables -t nat -F log-and-accept
/sbin/iptables -F log-and-drop
/sbin/iptables -X
/sbin/iptables -t nat -X
/sbin/iptables -Z
# Everything should be clear now
/sbin/iptables -N log-and-accept
/sbin/iptables -A log-and-accept -j LOG --log-level info
/sbin/iptables -A log-and-accept -j ACCEPT
/sbin/iptables -t nat -N log-and-accept
/sbin/iptables -t nat -A log-and-accept -j LOG --log-level info
/sbin/iptables -t nat -A log-and-accept -j ACCEPT
/sbin/iptables -N log-and-drop
/sbin/iptables -A log-and-drop -j LOG --log-level info
/sbin/iptables -A log-and-drop -j DROP
# SSH
/sbin/iptables -A INPUT -i $EXTIF -p tcp -s 0.0.0.0/0 -d 0.0.0.0/0
--dport 22 -j log-and-accept
# Ping
#/sbin/iptables -A INPUT -i $EXTIF -p ICMP -s 0.0.0.0/0 -d $EXTIP -j
log-and-accept
# Allow this machine to get on the internet
/sbin/iptables -A INPUT -i $EXTIF -s 0.0.0.0/0 -d $EXTIP -m state
--state ESTABISHED,RELATED -j log-and-accept
# Input
/sbin/iptables -A INPUT -i lo -s 0.0.0.0/0 -d 0.0.0.0/0 -j log-and-accept
/sbin/iptables -A INPUT -i $INTIF -s $INTNET -d 0.0.0.0/0 -j log-and-accept
/sbin/iptables -A INPUT -i $EXTIF -s $INTNET -d 0.0.0.0/0 -j log-and-drop
/sbin/iptables -A INPUT -s 0.0.0.0/0 -d 0.0.0.0/0 -j log-and-drop
# Output
/sbin/iptables -A OUTPUT -o lo -s 0.0.0.0/0 -d 0.0.0.0/0 -j log-and-accept
/sbin/iptables -A OUTPUT -o $INTIF -s $EXTIP -d $INTNET -j log-and-accept
/sbin/iptables -A OUTPUT -o $INTIF -s $INTIP -d $INTNET -j log-and-accept
/sbin/iptables -A OUTPUT -o $EXTIF -s 0.0.0.0/0 -d $INTNET -j log-and-drop
/sbin/iptables -A OUTPUT -o $EXTIF -s $EXTIP -d 0.0.0/0/0 -j log-and-accept
/sbin/iptables -A OUTPUT -s 0.0.0.0/0 -d 0.0.0.0/0 -j log-and-drop
# Forwarding ans Masqurading
/sbin/iptables -t nat -A PREROUTING -i $INTIF -p tcp --dport 80 -m state
--state NEW --tcp-flags SYN,RST,ACK SYN -m limit --limit 1/hour
--limit-burst 1 -j REDIRECT
/sbin/iptables -A FORWARD -i $EXTIF -o $INTIF -m state --state
ESTABLISHED,RELATED -j log-and-accept
/sbin/iptables -A FORWARD -i $INTIF -o $EXTIF -j log-and-accept
/sbin/iptables -A FORWARD -j log-and-drop
/sbin/iptables -t nat -A POSTROUTING -o $EXTIF -j SNAT --to $EXTIP
^ permalink raw reply [flat|nested] 2+ messages in thread
* Redirect on first encounter
@ 2004-02-14 16:33 Peter Poulsen
0 siblings, 0 replies; 2+ messages in thread
From: Peter Poulsen @ 2004-02-14 16:33 UTC (permalink / raw)
To: netfilter
I'm very new to netfilter and firewalls.
I have to set up a firewall that allows people to go on the Internet
(dooh). The first time they go through it on port 80 I would like to
redirect to the firewall itself (it also runs a webserver) which shows
who is proveding the Internet access.
I have almost got it working. The first time I tries to request a page I
get redirect, and all other pages gets delivered as expected. The only
problem is that if my first request is "www.google.com" all other
requests to "www.google.com" also gets redirect to the firewall. I only
planed for the first one to get redirected.
Can anybody tell how to fix this.
This is my script so far:
EXTIF="eth0"
INTIF="eth1"
INTNET="192.168.100.0/24"
EXTIP="192.168.1.48"
INTIP="192.168.100.1"
echo "1" > /proc/sys/net/ipv4/ip_forward
/sbin/iptables -P INPUT DROP
/sbin/iptables -F INPUT
/sbin/iptables -P OUTPUT DROP
/sbin/iptables -F OUTPUT
/sbin/iptables -P FORWARD DROP
/sbin/iptables -F FORWARD
/sbin/iptables -F -t nat
/sbin/iptables -F log-and-accept
/sbin/iptables -t nat -F log-and-accept
/sbin/iptables -F log-and-drop
/sbin/iptables -X
/sbin/iptables -t nat -X
/sbin/iptables -Z
# Everything should be clear now
/sbin/iptables -N log-and-accept
/sbin/iptables -A log-and-accept -j LOG --log-level info
/sbin/iptables -A log-and-accept -j ACCEPT
/sbin/iptables -t nat -N log-and-accept
/sbin/iptables -t nat -A log-and-accept -j LOG --log-level info
/sbin/iptables -t nat -A log-and-accept -j ACCEPT
/sbin/iptables -N log-and-drop
/sbin/iptables -A log-and-drop -j LOG --log-level info
/sbin/iptables -A log-and-drop -j DROP
# SSH
/sbin/iptables -A INPUT -i $EXTIF -p tcp -s 0.0.0.0/0 -d 0.0.0.0/0
--dport 22 -j log-and-accept
# Ping
#/sbin/iptables -A INPUT -i $EXTIF -p ICMP -s 0.0.0.0/0 -d $EXTIP -j
log-and-accept
# Allow this machine to get on the internet
/sbin/iptables -A INPUT -i $EXTIF -s 0.0.0.0/0 -d $EXTIP -m state
--state ESTABISHED,RELATED -j log-and-accept
# Input
/sbin/iptables -A INPUT -i lo -s 0.0.0.0/0 -d 0.0.0.0/0 -j log-and-accept
/sbin/iptables -A INPUT -i $INTIF -s $INTNET -d 0.0.0.0/0 -j log-and-accept
/sbin/iptables -A INPUT -i $EXTIF -s $INTNET -d 0.0.0.0/0 -j log-and-drop
/sbin/iptables -A INPUT -s 0.0.0.0/0 -d 0.0.0.0/0 -j log-and-drop
# Output
/sbin/iptables -A OUTPUT -o lo -s 0.0.0.0/0 -d 0.0.0.0/0 -j log-and-accept
/sbin/iptables -A OUTPUT -o $INTIF -s $EXTIP -d $INTNET -j log-and-accept
/sbin/iptables -A OUTPUT -o $INTIF -s $INTIP -d $INTNET -j log-and-accept
/sbin/iptables -A OUTPUT -o $EXTIF -s 0.0.0.0/0 -d $INTNET -j log-and-drop
/sbin/iptables -A OUTPUT -o $EXTIF -s $EXTIP -d 0.0.0/0/0 -j log-and-accept
/sbin/iptables -A OUTPUT -s 0.0.0.0/0 -d 0.0.0.0/0 -j log-and-drop
# Forwarding ans Masqurading
/sbin/iptables -t nat -A PREROUTING -i $INTIF -p tcp --dport 80 -m state
--state NEW --tcp-flags SYN,RST,ACK SYN -m limit --limit 1/hour
--limit-burst 1 -j REDIRECT
/sbin/iptables -A FORWARD -i $EXTIF -o $INTIF -m state --state
ESTABLISHED,RELATED -j log-and-accept
/sbin/iptables -A FORWARD -i $INTIF -o $EXTIF -j log-and-accept
/sbin/iptables -A FORWARD -j log-and-drop
/sbin/iptables -t nat -A POSTROUTING -o $EXTIF -j SNAT --to $EXTIP
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2004-02-14 16:33 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2004-02-14 8:57 Redirect on first encounter Peter Poulsen
-- strict thread matches above, loose matches on Subject: below --
2004-02-14 16:33 Peter Poulsen
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.