ipfilter on satellite receive only PC

ipfilter on satellite receive only PC

[yunus]

Dear netfilter gurus,

I am new to iptables. The computer on which I want to use iptables is a
Redhat linux 7.3 with satellite pentanet card. I want to filter the
traffice forwarded to our LAN. When I use iptables -P Forward DROP and
iptables -A INPUT -m state --state RELATED, ESTABLISHED -j ACCEPT
iptables -A Forward -m state --state RELATED, ESTABLISHED -j ACCEPT

It still does not allow me to browse from the LAN. Outgoing is through
router serial port.

Much oblige for all your help.

Regards.

Re: ipfilter on satellite receive only PC

[Antony Stone]

On Saturday 26 June 2004 8:41 am, yunus wrote:

> Dear netfilter gurus,
>
> I am new to iptables. The computer on which I want to use iptables is a
> Redhat linux 7.3 with satellite pentanet card. I want to filter the
> traffice forwarded to our LAN. When I use:
>
> iptables -P Forward DROP
> iptables -A INPUT -m state --state RELATED, ESTABLISHED -j ACCEPT
> iptables -A Forward -m state --state RELATED, ESTABLISHED -j ACCEPT
>
> It still does not allow me to browse from the LAN. Outgoing is through
> router serial port.

Well, if that's your complete ruleset, the main problem is that you are 
allowing established connections, but you have no way to establish them (ie: 
you are not allowing any NEW packets through).

If that's not your complete ruleset, then please post it so we can see what 
your firewall is being told to do.

Regards,

Antony.

-- 
All matter in the Universe can be placed into one of two categories:

1. Things which need to be fixed.
2. Things which need to be fixed once you've had a few minutes to play with 
them.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: ipfilter on satellite receive only PC

[Askar Ali Khan]

this is out im running on my slackware, adjust it to your needs :)

#!/bin/bash
#
# Basic script to keep the nasties out of slack-lap

# First we make the default policy to drop everything

iptables -P INPUT DROP

iptables -P FORWARD DROP

# Allow established connections and programs that use
loopback

iptables -A INPUT -m state --state ESTABLISHED,RELATED
-j ACCEPT

iptables -A INPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -i lo
-j ACCEPT

# Lets allow ssh to connect

iptables -A INPUT -p tcp --dport 22 -i ppp0 -j ACCEPT

#end script


On Sat, 26 Jun 2004 09:15:01 +0100, Antony Stone
<antony@soft-solutions.co.uk> wrote:
> 
> On Saturday 26 June 2004 8:41 am, yunus wrote:
> 
> > Dear netfilter gurus,
> >
> > I am new to iptables. The computer on which I want to use iptables is a
> > Redhat linux 7.3 with satellite pentanet card. I want to filter the
> > traffice forwarded to our LAN. When I use:
> >
> > iptables -P Forward DROP
> > iptables -A INPUT -m state --state RELATED, ESTABLISHED -j ACCEPT
> > iptables -A Forward -m state --state RELATED, ESTABLISHED -j ACCEPT
> >
> > It still does not allow me to browse from the LAN. Outgoing is through
> > router serial port.
> 
> Well, if that's your complete ruleset, the main problem is that you are
> allowing established connections, but you have no way to establish them (ie:
> you are not allowing any NEW packets through).
> 
> If that's not your complete ruleset, then please post it so we can see what
> your firewall is being told to do.
> 
> Regards,
> 
> Antony.
> 
> --
> All matter in the Universe can be placed into one of two categories:
> 
> 1. Things which need to be fixed.
> 2. Things which need to be fixed once you've had a few minutes to play with
> them.
> 
>                                                     Please reply to the list;
>                                                           please don't CC me.
> 
>

Re: ipfilter on satellite receive only PC

[Antony Stone]

On Saturday 26 June 2004 9:28 am, Askar Ali Khan wrote:

> this is out im running on my slackware, adjust it to your needs :)

That's okay - I run Slackware too :)

> #!/bin/bash
> #
> # Basic script to keep the nasties out of slack-lap
>
> # First we make the default policy to drop everything
> iptables -P INPUT DROP
> iptables -P FORWARD DROP
>
> # Allow established connections and programs that use
> loopback
>
> iptables -A INPUT -m state --state ESTABLISHED,RELATED
> -j ACCEPT
> iptables -A INPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -i lo
> -j ACCEPT

# Also allow established connections *through* the router, as well as *to* it:

iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# Now allow first packets of the connections we want to become established

iptables -A FORWARD -i eth0 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -i eth0 -p udp --dport 53 -j ACCEPT
iptables -A FORWARD -i eth0 -p tcp --dport 53 -j ACCEPT

> # Lets allow ssh to connect
>
> iptables -A INPUT -p tcp --dport 22 -i ppp0 -j ACCEPT
>
> #end script

The above rules should allow machines on your internal network (assumed to be 
connected to eth0, adjust if otherwise) to do DNS lookups and HTTP requests 
to the outside world.

Hopefully this gives you a template to which you can add more rules for 
whatever other protocols you want to allow.

Regards,

Antony.

-- 
The words "e pluribus unum" on the Great Seal of the United States are from a 
poem by Virgil entitled "Moretum", which is about cheese and garlic salad 
dressing.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: ipfilter on satellite receive only PC

[Askar Ali Khan]

hey 
if this is your router/getway through which all other clients LAN will
access Internet then you have to add a rule for NAT Masq :)

Edit the file /etc/sysctl.conf and on the line net.ipv4.ip_forward =
0, change 0 to 1.
           net.ipv4.ip_forward = 1

This is another script for this perpose :)

 iptables -F INPUT	
 iptables -F OUTPUT	
 iptables -F FORWARD
 iptables -t nat -F

The following commands will create new rules for your system.

   iptables -P INPUT ACCEPT	
   iptables -P OUTPUT ACCEPT	
   iptables -P FORWARD DROP	

   iptables -A FORWARD -i eth0 -o eth1 -m state --state
ESTABLISHED,RELATED -j ACCEPT

iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT	

$ iptables -A FORWARD -j LOG	

$ iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Regards

Askar


On Sat, 26 Jun 2004 09:45:38 +0100, Antony Stone
<antony@soft-solutions.co.uk> wrote:
> 
> On Saturday 26 June 2004 9:28 am, Askar Ali Khan wrote:
> 
> > this is out im running on my slackware, adjust it to your needs :)
> 
> That's okay - I run Slackware too :)
> 
> > #!/bin/bash
> > #
> > # Basic script to keep the nasties out of slack-lap
> >
> > # First we make the default policy to drop everything
> > iptables -P INPUT DROP
> > iptables -P FORWARD DROP
> >
> > # Allow established connections and programs that use
> > loopback
> >
> > iptables -A INPUT -m state --state ESTABLISHED,RELATED
> > -j ACCEPT
> > iptables -A INPUT -s 127.0.0.0/8 -d 127.0.0.0/8 -i lo
> > -j ACCEPT
> 
> # Also allow established connections *through* the router, as well as *to* it:
> 
> iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
> 
> # Now allow first packets of the connections we want to become established
> 
> iptables -A FORWARD -i eth0 -p tcp --dport 80 -j ACCEPT
> iptables -A FORWARD -i eth0 -p udp --dport 53 -j ACCEPT
> iptables -A FORWARD -i eth0 -p tcp --dport 53 -j ACCEPT
> 
> > # Lets allow ssh to connect
> >
> > iptables -A INPUT -p tcp --dport 22 -i ppp0 -j ACCEPT
> >
> > #end script
> 
> The above rules should allow machines on your internal network (assumed to be
> connected to eth0, adjust if otherwise) to do DNS lookups and HTTP requests
> to the outside world.
> 
> Hopefully this gives you a template to which you can add more rules for
> whatever other protocols you want to allow.
> 
> Regards,
> 
> Antony.
> 
> --
> The words "e pluribus unum" on the Great Seal of the United States are from a
> poem by Virgil entitled "Moretum", which is about cheese and garlic salad
> dressing.
> 
> 
> 
>                                                     Please reply to the list;
>                                                           please don't CC me.
> 
>

Re: ipfilter on satellite receive only PC

[Ruprecht Helms]

Askar Ali Khan wrote:

>
>The following commands will create new rules for your system.
>
>   iptables -P INPUT ACCEPT	
>   iptables -P OUTPUT ACCEPT	
>   iptables -P FORWARD DROP	
>
> 
>
normaly you begin your firewallscript by dropping all packages in the 
chains. In the
next line you open the connections as needed. The other way, first all 
is open and than
you close all that is needed , remember your mind  can forget  -  not 
good practise.

Regards,
Ruprecht

---------------------------------------------------------
Ruprecht Helms IT-Service & Softwareentwicklung

Tel/Fax +49[0]7621 16 99 16
Web:     htp://www.rheyn.de