From: "BERTRAND Joël" <joel.bertrand@systella.fr>
To: sparclinux@vger.kernel.org
Subject: [2.6.21.1] Nat trouble
Date: Mon, 07 May 2007 11:57:11 +0000 [thread overview]
Message-ID: <463F1417.80409@systella.fr> (raw)
Hello,
I have built a 2.6.21.1 kernel to replace a working 2.6.20 on an
U60/SMP. NAT (iptables) worked fine with 2.6.20 but not with 2.6.21.1.
That being said, all other iptables rules seem to works fine with 2.6.21.1.
My /var/lib/iptables/active script :
# Generated by iptables-save v1.2.11 on Sat Jan 22 20:25:31 2005
*filter
#
#
#=======================================# Par défaut, tout est rejeté sauf sur l'interface loopback
#=======================================#
:INPUT DROP [28:3300]
:FORWARD DROP [0:0]
:OUTPUT DROP [27:3120]
[0:0] -A INPUT -i lo -j ACCEPT
#
#
#=======================================# Tout ce qui provient du LAN est accepté.
#=======================================#
[0:0] -A INPUT -i eth0 -j ACCEPT
#
#
#=======================================# Protocoles provenant de l'interface WAN rayleigh.
# ftp, ssh, smtp, http, ntp, https, imaps, pop3s, cvs, jabber
#=======================================#
[0:0] -A INPUT -i eth1 -p tcp -m tcp --dport 21 -j ACCEPT
[0:0] -A INPUT -i eth1 -p tcp -m tcp --dport 22 -j ACCEPT
[0:0] -A INPUT -i eth1 -p tcp -m tcp --dport 25 -j ACCEPT
[0:0] -A INPUT -i eth1 -p tcp -m tcp --dport 80 -j ACCEPT
[0:0] -A INPUT -i eth1 -p tcp -m tcp --dport 123 -j ACCEPT
[0:0] -A INPUT -i eth1 -p udp -m udp --dport 123 -j ACCEPT
[0:0] -A INPUT -i eth1 -p tcp -m tcp --dport 443 -j ACCEPT
[0:0] -A INPUT -i eth1 -p tcp -m tcp --dport 993 -j ACCEPT
[0:0] -A INPUT -i eth1 -p tcp -m tcp --dport 995 -j ACCEPT
[0:0] -A INPUT -i eth1 -p tcp -m tcp --dport 2401 -j ACCEPT
[0:0] -A INPUT -i eth1 -p udp -m udp --dport 2401 -j ACCEPT
[0:0] -A INPUT -i eth1 -p tcp -m tcp --dport 5222 -j ACCEPT
[0:0] -A INPUT -i eth1 -p icmp -j ACCEPT
#
#
#=======================================# Protocoles provenant de l'interface WAN newton.
# ssh, ntp, smtp
#=======================================#
[0:0] -A INPUT -i eth2 -p tcp -m tcp --dport 22 -j ACCEPT
[0:0] -A INPUT -i eth2 -p tcp -m tcp --dport 25 -j ACCEPT
[0:0] -A INPUT -i eth2 -p tcp -m tcp --dport 123 -j ACCEPT
[0:0] -A INPUT -i eth2 -p udp -m udp --dport 123 -j ACCEPT
[0:0] -A INPUT -i eth2 -p icmp -j ACCEPT
#
#
#=======================================# Réceptions inconditionnelles
#=======================================#
[0:0] -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A INPUT -m state --state INVALID -j DROP
#
#
#=======================================# Transmission du LAN vers l'interface WAN rayleigh (route par défaut).
# ftp, ssh, http, pop3, nntp, https, imaps, pop3s, openvpn, cvs,
# 3000:3001 (jcollab)
#=======================================#
[0:0] -A FORWARD -i eth0 -o eth1 -p tcp -m tcp --dport 21 -j ACCEPT
[0:0] -A FORWARD -i eth0 -o eth1 -p tcp -m tcp --dport 22 -j ACCEPT
[0:0] -A FORWARD -i eth0 -o eth1 -p tcp -m tcp --dport 43 -j ACCEPT
[0:0] -A FORWARD -i eth0 -o eth1 -p tcp -m tcp --dport 80 -j ACCEPT
[0:0] -A FORWARD -i eth0 -o eth1 -p tcp -m tcp --dport 110 -j ACCEPT
[0:0] -A FORWARD -i eth0 -o eth1 -p tcp -m tcp --dport 119 -j ACCEPT
[0:0] -A FORWARD -i eth0 -o eth1 -p tcp -m tcp --dport 443 -j ACCEPT
[0:0] -A FORWARD -i eth0 -o eth1 -p tcp -m tcp --dport 993 -j ACCEPT
[0:0] -A FORWARD -i eth0 -o eth1 -p tcp -m tcp --dport 995 -j ACCEPT
[0:0] -A FORWARD -i eth0 -o eth1 -p tcp -m tcp --dport 1194 -j ACCEPT
[0:0] -A FORWARD -i eth0 -o eth1 -p udp -m udp --dport 1194 -j ACCEPT
[0:0] -A FORWARD -i eth0 -o eth1 -p tcp -m tcp --dport 2401 -j ACCEPT
[0:0] -A FORWARD -i eth0 -o eth1 -p udp -m udp --dport 2401 -j ACCEPT
[0:0] -A FORWARD -i eth0 -o eth1 -p tcp -m tcp --dport 3000:3001 -j ACCEPT
[0:0] -A FORWARD -i eth0 -o eth1 -p tcp -m tcp --dport 5900 -j ACCEPT
#
#
#=======================================# De l'interface WAN rayleigh Vers les machines du /29.
# ssh
#=======================================#
[0:0] -A FORWARD -i eth1 -o eth0 -p tcp -m tcp --dport 22 -j ACCEPT
#
#
#=======================================# De l'interface WAN rayleigh vers lebegue.
# 3000:3001 (jcollab), mysql
#=======================================#
[0:0] -A FORWARD -i eth1 -o eth0 -p tcp -m tcp -d 192.168.0.81 --dport
80 -j ACCEPT
[0:0] -A FORWARD -i eth1 -o eth0 -p tcp -m tcp -d 192.168.0.81 --dport
3000:3001 -j ACCEPT
[0:0] -A FORWARD -i eth1 -o eth0 -p tcp -m tcp -d 192.168.0.81 --dport
3306 -j ACCEPT
#
#
#=======================================# De l'interface WAN rayleigh vers fermat.
# smtp, http
#=======================================#
[0:0] -A FORWARD -i eth1 -o eth0 -p tcp -m tcp -d 192.168.0.83 --dport
25 -j ACCEPT
[0:0] -A FORWARD -i eth1 -o eth0 -p tcp -m tcp -d 192.168.0.83 --dport
80 -j ACCEPT
#
#
#=======================================# De fermat vers l'interface WAN newton.
# smtp
#=======================================#
[0:0] -A FORWARD -i eth0 -o eth2 -p tcp -m tcp -s 192.168.0.83 --dport
25 -j ACCEPT
#
#
#=======================================# De fermat vers l'interface WAN rayleigh.
# smtp
#=======================================#
[0:0] -A FORWARD -i eth0 -o eth1 -p tcp -m tcp -s 192.168.0.83 --dport
3307 -j ACCEPT
#
#
#=======================================# Transmissions inconditionnelles
#=======================================#
[0:0] -A FORWARD -p icmp -j ACCEPT
[0:0] -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A FORWARD -m state --state INVALID -j DROP
#
#
#=======================================# Émissions autorisées sur les interfaces LAN et loopback
#=======================================#
[0:0] -A OUTPUT -o lo -j ACCEPT
[0:0] -A OUTPUT -o eth0 -j ACCEPT
#
#
#=======================================# Émissions autorisées sur l'interface WAN rayleigh
# ftp, ssh, telnet, smtp, whois, domain, http, pop3, nntp, ntp, https, cvs
# 3000:3001 (jcollab), mysql, 8080 (servlet jcollab)
#=======================================#
[0:0] -A OUTPUT -o eth1 -p tcp -m tcp --dport 21 -j ACCEPT
[0:0] -A OUTPUT -o eth1 -p tcp -m tcp --dport 22 -j ACCEPT
[0:0] -A OUTPUT -o eth1 -p tcp -m tcp --dport 23 -j ACCEPT
[0:0] -A OUTPUT -o eth1 -p tcp -m tcp --dport 25 -j ACCEPT
[0:0] -A OUTPUT -o eth1 -p tcp -m tcp --dport 43 -j ACCEPT
[0:0] -A OUTPUT -o eth1 -p tcp -m tcp --dport 53 -j ACCEPT
[0:0] -A OUTPUT -o eth1 -p udp -m udp --dport 53 -j ACCEPT
[0:0] -A OUTPUT -o eth1 -p tcp -m tcp --dport 80 -j ACCEPT
[0:0] -A OUTPUT -o eth1 -p tcp -m tcp --dport 110 -j ACCEPT
[0:0] -A OUTPUT -o eth1 -p tcp -m tcp --dport 119 -j ACCEPT
[0:0] -A OUTPUT -o eth1 -p tcp -m tcp --dport 123 -j ACCEPT
[0:0] -A OUTPUT -o eth1 -p udp -m udp --dport 123 -j ACCEPT
[0:0] -A OUTPUT -o eth1 -p tcp -m tcp --dport 443 -j ACCEPT
[0:0] -A OUTPUT -o eth1 -p tcp -m tcp --dport 554 -j ACCEPT
[0:0] -A OUTPUT -o eth1 -p tcp -m tcp --dport 2401 -j ACCEPT
[0:0] -A OUTPUT -o eth1 -p udp -m udp --dport 2401 -j ACCEPT
[0:0] -A OUTPUT -o eth1 -p tcp -m tcp --dport 3000 -j ACCEPT
[0:0] -A OUTPUT -o eth1 -p tcp -m tcp --dport 3001 -j ACCEPT
[0:0] -A OUTPUT -o eth1 -p tcp -m tcp --dport 3306 -j ACCEPT
[0:0] -A OUTPUT -o eth1 -p tcp -m tcp --dport 8080 -j ACCEPT
[0:0] -A OUTPUT -o eth1 -p icmp -j ACCEPT
#
#
#=======================================# Émissions autorisées sur l'interface WAN newton
# telnet, ntp
#=======================================#
[0:0] -A OUTPUT -o eth2 -p tcp -m tcp --dport 23 -j ACCEPT
[0:0] -A OUTPUT -o eth2 -p tcp -m tcp --dport 80 -j ACCEPT
[0:0] -A OUTPUT -o eth2 -p tcp -m tcp --dport 123 -j ACCEPT
[0:0] -A OUTPUT -o eth2 -p udp -m udp --dport 123 -j ACCEPT
[0:0] -A OUTPUT -o eth2 -p icmp -j ACCEPT
[0:0] -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
[0:0] -A OUTPUT -m state --state INVALID -j DROP
COMMIT
# Completed on Sat Jan 22 20:25:31 2005
# Generated by iptables-save v1.2.11 on Sat Jan 22 20:25:31 2005
*nat
:PREROUTING ACCEPT [2:156]
:POSTROUTING ACCEPT [4:377]
:OUTPUT ACCEPT [0:0]
#
#
#=======================================# NAT de tout ce qui provient de l'interface LAN
#=======================================#
[0:0] -A POSTROUTING -s 192.168.0.0/255.255.255.0 -j MASQUERADE
COMMIT
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
#
#
#=======================================# Force le routage des paquets à destination du port 25 provenant de fermat
# vers l'interface WAN newton
#=======================================#
[0:0] -A PREROUTING -s 192.168.0.83 -p tcp -m tcp --dport 25 -jMARK
--set-mark 1
COMMIT
# Completed on Sat Jan 22 20:25:31 2005
eth1 and eth2 are WAN interfaces, eth0 is LAN. All options required for
iptables have been built as modules. Configurations of both 2.6.20 and
2.6.21.1 are the same.
Regards,
JKB
next reply other threads:[~2007-05-07 11:57 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-05-07 11:57 BERTRAND Joël [this message]
2007-05-07 20:17 ` [2.6.21.1] Nat trouble David Miller
2007-05-08 10:07 ` BERTRAND Joël
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=463F1417.80409@systella.fr \
--to=joel.bertrand@systella.fr \
--cc=sparclinux@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.