From mboxrd@z Thu Jan 1 00:00:00 1970 From: =?ISO-8859-2?Q?G=E1sp=E1r_Lajos?= Subject: Re: Default deny rule Date: Fri, 11 May 2007 12:09:08 +0200 Message-ID: <464440C4.7000605@freemail.hu> References: Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="iso-8859-1"; format="flowed" To: Gopinath Cc: netfilter@lists.netfilter.org Gopinath =EDrta: > Good day everyone, > I am very new to this list. I am running FC3 and want to convert my > server to act as firewall, which does static NAT. I had setup > everything and works fine in simulation. But the only thing is i am > not able to make restriction in the FORWARD chain. The basic > functionality of firewall, the DEFAULT DENYING FUNCTIONALITY is > missing in my firewall. I tried to make it by applicy DROP policy to > the FORWARD chain & also appending a default DROP rule to the end of > the FORWARD chain. But when i do so, all the packets were getting > dropped at the firewall. I have pasted my firewall script below. I > have enabled ip_conntrack & iptable_nat modules during bootup. > > OS: Fedora Core 3 > IPtables Version: v1.2.11 It is kind of old... :D > > # Generated by iptables-save v1.2.11 on Fri Apr 27 08:16:21 2007 > *filter > :INPUT ACCEPT [364:57615] > :FORWARD ACCEPT [1:52] > :OUTPUT ACCEPT [211:18044] The DEFAULT DENYING FUNCTIONALITY is achieved by using these commands: iptables -t filter -P INPUT DROP iptables -t filter -P FORWARD DROP iptables -t filter -P OUTPUT DROP > -A INPUT -s 10.44.x.x -p icmp -j ACCEPT > -A INPUT -s 10.44.x.x -p icmp -j ACCEPT > -A INPUT -s 10.44.x.x -p tcp -m tcp --dport 22 -j ACCEPT > -A INPUT -s 10.44.x.x -p tcp -m tcp --dport 22 -j ACCEPT > -A INPUT -s 10.1.x.x -p tcp -m tcp --dport 22 -j ACCEPT > -A FORWARD -d 10.44.x.x -i eth0 -o eth1 -p tcp -m state --state NEW -j = > ACCEPT > -A FORWARD -d 10.44.x.x -i eth0 -o eth1 -p tcp -m state --state NEW -j = > ACCEPT > -A FORWARD -o eth0 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT > -A FORWARD -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT > COMMIT > # Completed on Fri Apr 27 08:16:21 2007 > # Generated by iptables-save v1.2.11 on Fri Apr 27 08:16:21 2007 > *nat > :PREROUTING ACCEPT [289:55706] > :POSTROUTING ACCEPT [77:6468] > :OUTPUT ACCEPT [77:6468] > -A PREROUTING -d 10.1.x.x -i eth0 -j DNAT --to-destination 10.44.x.x > -A PREROUTING -d 10.1.x.x. -i eth0 -j DNAT --to-destination 10.44.x.x > -A POSTROUTING -s 10.44.x.x -o eth0 -j SNAT --to-source 10.1.x.x > -A POSTROUTING -s 10.44.x.x -o eth0 -j SNAT --to-source 10.1.x.x > COMMIT > # Completed on Fri Apr 27 08:16:21 2007 > > Output of iptables -nv -L > > Chain INPUT (policy ACCEPT 73 packets, 13040 bytes) > > pkts bytes target prot opt in out source destination > 501 30228 ACCEPT icmp -- * * 10.44.x.x 0.0.0.0/0 > 8648 576K ACCEPT tcp -- * * 10.44.x.x 0.0.0.0/0 tcp dpt:22 > 52464 9344K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state=20 > NEW,RELATED,ESTABLISHED > > Chain FORWARD (policy ACCEPT 68 packets, 5648 bytes) > > pkts bytes target prot opt in out source destination > 0 0 ACCEPT tcp -- eth0 eth1 0.0.0.0/0 10.44.x.x state NEW > 0 0 ACCEPT tcp -- eth0 eth1 0.0.0.0/0 10.44.x.x state NEW > 0 0 ACCEPT all -- * eth0 0.0.0.0/0 0.0.0.0/0 state=20 > NEW,RELATED,ESTABLISHED > 0 0 ACCEPT all -- eth0 * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED There is no packet that matches your rules.... What are these destinations : 10.44.x.x ??? Do you mean 10.44.0.0/16 ??? fw1:~# whois 10.44.0.0 =2E.. NetRange: 10.0.0.0 - 10.255.255.255 CIDR: 10.0.0.0/8 NetName: RESERVED-10 NetHandle: NET-10-0-0-0-1 Parent: NetType: IANA Special Use NameServer: BLACKHOLE-1.IANA.ORG NameServer: BLACKHOLE-2.IANA.ORG Comment: This block is reserved for special purposes. Comment: Please see RFC 1918 for additional information. Comment: RegDate: Updated: 2002-09-12 > > Chain OUTPUT (policy ACCEPT 10236 packets, 1175K bytes) > pkts bytes target prot opt in out source destination > > Any help would be highly appreciated. > > Thanks & Regards, > Gopinath.U > >