Fwd: Re: Help with ICMP Ruls

Fwd: Re: Help with ICMP Ruls

[Real Cucumber]

[-- Attachment #1: Type: text/plain, Size: 424 bytes --]

I do have a state rule already for allowing any
established,related connections.

So should I add another one such as:

iptables -A FORWARD -p icmp -m state --state RELATED
-j ACCEPT

The current ruleset is attached (I've only excluded
the variables and logging sections of it).



		
__________________________________
Do you Yahoo!?
Yahoo! Mail - 50x more storage than other providers!
http://promotions.yahoo.com/new_mail

[-- Attachment #2: Type: message/rfc822, Size: 3900 bytes --]

From: Antony Stone <Antony@Soft-Solutions.co.uk>
To: netfilter@lists.netfilter.org
Subject: Re: Help with ICMP Ruls
Date: Thu, 15 Jul 2004 20:32:54 +0100

On Thursday 15 July 2004 8:21 pm, Real Cucumber wrote:

> > I would allow the firewall to send ICMP messages through its OUTPUT chain,
> > and if it can generate any connections from itself, then you should allow
> > them in through the INPUT chain as well, however you say you do not allow
> > outgoing connections (not even DNS??), so this may not be needed.
>
> The fedora box doesn't do dns or anything. It's sole purpose is a packet
> forwarding router that doesnt' allow any input or output, just forwards.
>
> That is why I'm not sure if I need ICMP supported on it or not, and not sure
> where do add the ICMP support (input, output, forward).

I would allow the machine to forward ICMP messages which are RELATED to the 
existing SSH sessions, so that means the rule should go in the FORWARD chain.

If you want more specific advice, please post the current ruleset.

Regards,

Antony.

-- 
In Heaven, the police are British, the chefs are Italian, the beer is Belgian, 
the mechanics are German, the lovers are French, the entertainment is 
American, and everything is organised by the Swiss.

In Hell, the police are German, the chefs are British, the beer is American, 
the mechanics are French, the lovers are Swiss, the entertainment is Belgian, 
and everything is organised by the Italians.

                                                     Please reply to the list;
                                                           please don't CC me.



[-- Attachment #3: firewall.sh --]
[-- Type: text/plain, Size: 1592 bytes --]


# This will set all default policies to DROP
iptables -P FORWARD DROP
iptables -P INPUT DROP
iptables -P OUTPUT DROP

# Enable Loopback Interface
iptables -A INPUT -i $LOOPBACK_INTERFACE -j ACCEPT
iptables -A OUTPUT -o $LOOPBACK_INTERFACE -j ACCEPT

# Protect against Source-Address Spoofing (Ingress/Egress)
iptables -A FORWARD -i $WAN_INTERFACE -s $WAN_ADDRESSES -j DROP
iptables -A FORWARD -i $WAN_INTERFACE -s $LAN_ADDRESSES -j DROP
iptables -A FORWARD -o $WAN_INTERFACE -s $WAN_ADDRESSES -j DROP

# Allow previously initiated and accepted connections
# to bypass firewall tests (state matching)
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# Remove INVALID state packets to stablize state connections
iptables -A INPUT -m state --state INVALID -j DROP
iptables -A OUTPUT -m state --state INVALID -j DROP
iptables -A FORWARD -m state --state INVALID -j DROP

# This will allow SSH in/out from TIC ADMIN IP to LAN interface
iptables -A INPUT -p tcp --dport $WAN_SSH_PORT -i $LAN_INTERFACE -j ACCEPT
iptables -A OUTPUT -p tcp --sport $WAN_SSH_PORT -o $LAN_INTERFACE -j ACCEPT


# This will allow SSH forwarding from/to INT_SERVER Server
iptables -A FORWARD -s $INT_SERVER_IP -j ACCEPT
iptables -A FORWARD -d $INT_SERVER_IP -j ACCEPT


# This will forward inbound WAN SSH to LAN INT_SERVER with port remapping
iptables -t nat -A PREROUTING -p tcp --dport $WAN_SSH_PORT -i $WAN_INTERFACE -j DNAT --to $INT_SERVER_IP:$INT_SERVER_SSH_PORT

Re: Fwd: Re: Help with ICMP Ruls

[Aleksandar Milivojevic]

Real Cucumber wrote:
> I do have a state rule already for allowing any
> established,related connections.
> 
> So should I add another one such as:
> 
> iptables -A FORWARD -p icmp -m state --state RELATED
> -j ACCEPT
> 
> The current ruleset is attached (I've only excluded
> the variables and logging sections of it).
> 
> # Allow previously initiated and accepted connections
> # to bypass firewall tests (state matching)
> iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
> iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
> iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

If you have this three generic rules, you don't need separate rule just 
for ICMP.  The generic rule will match all IP protocols (tcp, udp, and 
icmp).

-- 
Aleksandar Milivojevic <amilivojevic@pbl.ca>    Pollard Banknote Limited
Systems Administrator                           1499 Buffalo Place
Tel: (204) 474-2323 ext 276                     Winnipeg, MB  R3T 1L7

Re: Fwd: Re: Help with ICMP Ruls

[Antony Stone]

On Thursday 15 July 2004 8:55 pm, Real Cucumber wrote:

> I do have a state rule already for allowing any
> established,related connections.

In that case you are already allowing ICMP :)

> So should I add another one such as:
>
> iptables -A FORWARD -p icmp -m state --state RELATED
> -j ACCEPT

No.   ICMP messages which are RELATED to the existing SSH connections will get 
matched by the final rule in this section of your rules:

# Allow previously initiated and accepted connections
# to bypass firewall tests (state matching)
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

Just out of interest, why do you have the first two of these rules, if you 
have no INPUT or OUTPUT traffic?

Regards,

Antony.

-- 
Microsoft may sell more software than any other company, but McDonald's sell 
more burgers than any other company, and I think the other similarities are 
obvious...

                                                     Please reply to the list;
                                                           please don't CC me.

Re: Fwd: Re: Help with ICMP Ruls

[Real Cucumber]

I allow myself restricted by IP to connect in for SSH
on the LAN interface on the fedora box.

However, no Input/Output is alowed on the WAN
interface though.

Sorry I guess I lied/misled by saying "NO"
input/output - as I was just referring to the WAN.




--- Antony Stone <Antony@Soft-Solutions.co.uk> wrote:
> On Thursday 15 July 2004 8:55 pm, Real Cucumber
> wrote:
> 
> > I do have a state rule already for allowing any
> > established,related connections.
> 
> In that case you are already allowing ICMP :)
> 
> > So should I add another one such as:
> >
> > iptables -A FORWARD -p icmp -m state --state
> RELATED
> > -j ACCEPT
> 
> No.   ICMP messages which are RELATED to the
> existing SSH connections will get 
> matched by the final rule in this section of your
> rules:
> 
> # Allow previously initiated and accepted
> connections
> # to bypass firewall tests (state matching)
> iptables -A INPUT -m state --state
> ESTABLISHED,RELATED -j ACCEPT
> iptables -A OUTPUT -m state --state
> ESTABLISHED,RELATED -j ACCEPT
> iptables -A FORWARD -m state --state
> ESTABLISHED,RELATED -j ACCEPT
> 
> Just out of interest, why do you have the first two
> of these rules, if you 
> have no INPUT or OUTPUT traffic?
> 
> Regards,
> 
> Antony.
> 
> -- 
> Microsoft may sell more software than any other
> company, but McDonald's sell 
> more burgers than any other company, and I think the
> other similarities are 
> obvious...
> 
>                                                     
> Please reply to the list;
>                                                     
>       please don't CC me.
> 
> 
> 



	
		
__________________________________
Do you Yahoo!?
New and Improved Yahoo! Mail - 100MB free storage!
http://promotions.yahoo.com/new_mail