again, firewall help....

again, firewall help....

[egilmore]

Can anyone give me a clue?  The basics are:
1 machine: SuSE 8.2
3 nics
2 internal networks (examples):
$INTLAN1:> 192.0.0.2   $INTLAN2:> 192.0.5.2
 
3 good ip's (examples):
eth0> 128.0.0.1   eth0:1> 128.0.0.2   eth0:2> 128.0.0.3
 
2 spoofed ip's:
$INTIF1> 192.0.5.2  $INTIF2> 192.0.48.3
 
works:
-connecting from the internet/external LAN to all machines via (ssh, FTP, 
HTTP)
 
not:
-connecting between $INTLAN1 & $INTLAN2 
-samba connections from anywhere
-afp (apple) connections from anywhere
 
-Thanks in advance....

#!/bin/sh
PATH="$PATH:/usr/bin/:/usr/sbin"
DEPMOD=/sbin/depmod
INSMOD=/sbin/insmod
EXTIF=eth0
INTIF1=eth1
INTIF2=eth2

case "$1" in
'start')
        echo "Clearing any existing rules and setting default policy.."
	iptables -P INPUT ACCEPT
	iptables -P OUTPUT ACCEPT
	iptables -P FORWARD ACCEPT
	iptables -F
	iptables -F INPUT
	iptables -F OUTPUT
	iptables -F FORWARD
	iptables -X
	iptables -t nat -F
# loopback rules
	iptables -A INPUT -i lo -j ACCEPT
	iptables -A OUTPUT -o lo -j ACCEPT
	iptables -A INPUT -i $EXTIF -m state --state ESTABLISHED,RELATED -j ACCEPT
	iptables -A OUTPUT -o $EXTIF -m state --state NEW,ESTABLISHED,RELATED  -j 
ACCEPT
	iptables -A INPUT -i $EXTIF -j ACCEPT
echo "Adding Masquerade support for 192.0.0.0 subnet..."
	iptables -A FORWARD -i $EXTIF -o $INTIF1 -m state --state ESTABLISHED,RELATED 
-j ACCEPT
	iptables -A FORWARD -i $INTIF1 -o $EXTIF -j ACCEPT
       echo "Adding Masquerade support for 192.0.5.0 subnet..."
	iptables -A FORWARD -i $EXTIF -o $INTIF2 -m state --state ESTABLISHED,RELATED 
-j ACCEPT
	iptables -A FORWARD -i $INTIF2 -o $EXTIF -j ACCEPT
echo "Allowing traffic between internal networks..."
	iptables -A FORWARD -i $INTIF1 -o $INTIF2 -m state --state 
ESTABLISHED,RELATED -j ACCEPT
	iptables -A FORWARD -i $INTIF2 -o $INTIF1 -j ACCEPT
	iptables -A FORWARD -i $INTIF2 -o $INTIF1 -m state --state 
ESTABLISHED,RELATED -j ACCEPT
	iptables -A FORWARD -i $INTIF1 -o $INTIF2 -j ACCEPT
	iptables -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE
echo "Associating internal address 192.0.0.2 with external address 128.0.0.2"
	iptables -t nat -A PREROUTING -p tcp --dst 128.0.0.2 -j DNAT --to-destination 
192.0.0.2
	iptables -t nat -A PREROUTING -p udp --dst 128.0.0.2 -j DNAT --to-destination 
192.0.0.2
	iptables -t nat -A PREROUTING -p icmp --dst 128.0.0.2 -j DNAT 
--to-destination 192.0.0.2
	iptables -t nat -A POSTROUTING -p tcp --dst 128.0.0.2 -j SNAT --to-source 
192.0.0.2
	iptables -t nat -A POSTROUTING -p udp --dst 128.0.0.2 -j SNAT --to-source 
192.0.0.2
	iptables -t nat -A POSTROUTING -p icmp --dst 128.0.0.2 -j SNAT --to-source 
192.0.0.2
echo "Associating internal address 192.0.5.2 with external address 128.0.0.3"
	iptables -t nat -A PREROUTING -p tcp --dst 128.0.0.3 -j DNAT --to-destination 
192.0.5.2
	iptables -t nat -A PREROUTING -p udp --dst 128.0.0.3 -j DNAT --to-destination 
192.0.5.2
	iptables -t nat -A PREROUTING -p icmp --dst 128.0.0.3 -j DNAT 
--to-destination 192.0.5.2
	iptables -t nat -A POSTROUTING -p tcp --dst 128.0.0.3 -j SNAT --to-source 
192.0.5.2
	iptables -t nat -A POSTROUTING -p udp --dst 128.0.0.3 -j SNAT --to-source 
192.0.5.2
	iptables -t nat -A POSTROUTING -p icmp --dst 128.0.0.3 -j SNAT --to-source 
192.0.5.2
# add logging
	iptables -A INPUT -j LOG
	#iptables -A FORWARD -j LOG
	#iptables -t nat -A PREROUTING -j LOG
	#iptables -t nat -A POSTROUTING -j LOG
	#iptables -A OUTPUT -j LOG
	#iptables -A block -j LOG
;;
'stop')
	echo "Flushing iptables firewall..."
	iptables -P INPUT ACCEPT
	iptables -F INPUT
	iptables -P OUTPUT ACCEPT
	iptables -F OUTPUT
	iptables -P FORWARD DROP
	iptables -F FORWARD
	#iptables -F block
	iptables -t nat -F
;;
'restart')
        $0 stop
	$0 start
;;
*)
	echo "$0 {start|stop}"
	exit 1
;;
esac
exit 0