Help debugging iptables firewall....

Help debugging iptables firewall....

[Greg Cope]

Hi All,

I have a 3 interface firewall (internet, dmz, lan).

For some reason a dmz host can longer ssh or connect to a DB server on
the lan(it could before).

Nothing seems to get logged with a $IPTABLES -A FORWARD -j LOG
--log-prefix "FORWARD DENY: " rule.  And when I disable the FW and
enable the plain routing it seems to be able to connect ok.

At a loss as to why this would not work without logging something.

Firewall and Webserver are FC1, DB server is Redhat AS3.

Could someone suggest some ideas on debuging this?

Any  ideas gratefully received.

Greg

RE: Help debugging iptables firewall....

[Gary W. Smith]

I would recommend that you put a log entry for the protocol(s) or IP to
IP connections that you want to debug across the DMZ.  I did this while
trying to debug some IPSEC traffic.

-A FORWARD -p tcp -m tcp --dport 1433 -j LOG --log-prefix "MySQL [tcp]:
" --log-level 1
-A FORWARD -p udp -m udp --dport 1433 -j LOG --log-prefix "MySQL [udp]:
" --log-level 1

Put this at the beginning of the chain (tweak it for whatever DB you
need) and then just watch the calls to make sure that you are see the
flow that you want.  When you are done move them down to the end of the
chain, if they are still hitting then you are loosing packets.

BTW, are you running pinholes (point to point IP for each port you want
open)?  What DB?

Gary Wayne Smith


-----Original Message-----
From: netfilter-bounces@lists.netfilter.org
[mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Greg Cope
Sent: Tuesday, January 25, 2005 8:54 AM
To: netfilter@lists.netfilter.org
Subject: Help debugging iptables firewall....

Hi All,

I have a 3 interface firewall (internet, dmz, lan).

For some reason a dmz host can longer ssh or connect to a DB server on
the lan(it could before).

Nothing seems to get logged with a $IPTABLES -A FORWARD -j LOG
--log-prefix "FORWARD DENY: " rule.  And when I disable the FW and
enable the plain routing it seems to be able to connect ok.

At a loss as to why this would not work without logging something.

Firewall and Webserver are FC1, DB server is Redhat AS3.

Could someone suggest some ideas on debuging this?

Any  ideas gratefully received.

Greg

Re: Help debugging iptables firewall....

[Greg Cope]

Hi Gary,

Pinholes?  If you mean specific IP to specific IP:PORT on specfic
interfaces then yes.

DB is an oracle listener (port 1521)

I have these:

# for ssh to db server from webserver
$IPTABLES -A FORWARD -p tcp --dport 22 -i $DMZ_IFACE -s $DMZ_EDGE_IP
-o $LAN_IFACE -d $TROT_IP -j ACCEPT

$IPTABLES -A FORWARD -p tcp --dport 1521 -i $DMZ_IFACE -s $DMZ_EDGE_IP
-o $LAN_IFACE -d $TROT_IP -j ACCEPT

I added 2 of your examples one before one after, and only see:

Jan 25 17:21:43 gateway kernel: Oracle 1521 [tcp] before: IN=eth1
OUT=eth2 SRC=192.168.254.3 DST=192.168.0.5 LEN=60 TOS=0x00 PREC=0x00
TTL=63 ID=30447 DF PROTO=TCP SPT=32907 DPT=1521 WINDOW=5840 RES=0x00
SYN URGP=0

Which would imply that the rule is ok and the packets goes through -
but why I am not getting a connection?

Thanks,

Greg

On Tue, 25 Jan 2005 09:13:04 -0800, Gary W. Smith <gary@primeexalia.com> wrote:
> I would recommend that you put a log entry for the protocol(s) or IP to
> IP connections that you want to debug across the DMZ.  I did this while
> trying to debug some IPSEC traffic.
> 
> -A FORWARD -p tcp -m tcp --dport 1433 -j LOG --log-prefix "MySQL [tcp]:
> " --log-level 1
> -A FORWARD -p udp -m udp --dport 1433 -j LOG --log-prefix "MySQL [udp]:
> " --log-level 1
> 
> Put this at the beginning of the chain (tweak it for whatever DB you
> need) and then just watch the calls to make sure that you are see the
> flow that you want.  When you are done move them down to the end of the
> chain, if they are still hitting then you are loosing packets.
> 
> BTW, are you running pinholes (point to point IP for each port you want
> open)?  What DB?
> 
> Gary Wayne Smith
> 
> 
> -----Original Message-----
> From: netfilter-bounces@lists.netfilter.org
> [mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Greg Cope
> Sent: Tuesday, January 25, 2005 8:54 AM
> To: netfilter@lists.netfilter.org
> Subject: Help debugging iptables firewall....
> 
> Hi All,
> 
> I have a 3 interface firewall (internet, dmz, lan).
> 
> For some reason a dmz host can longer ssh or connect to a DB server on
> the lan(it could before).
> 
> Nothing seems to get logged with a $IPTABLES -A FORWARD -j LOG
> --log-prefix "FORWARD DENY: " rule.  And when I disable the FW and
> enable the plain routing it seems to be able to connect ok.
> 
> At a loss as to why this would not work without logging something.
> 
> Firewall and Webserver are FC1, DB server is Redhat AS3.
> 
> Could someone suggest some ideas on debuging this?
> 
> Any  ideas gratefully received.
> 
> Greg
> 
>

RE: Help debugging iptables firewall....

[Gary W. Smith]

Are you getting the connection coming back?  Try

$IPTABLES -A FORWARD -o $DMZ_IFACE -o $LAN_IFACE -j ACCEPT

And see if it makes any difference.  Forward works in both directions.
We typically allow established,related to return the path that it came
from.  You might need to do the same.


-----Original Message-----
From: netfilter-bounces@lists.netfilter.org
[mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Greg Cope
Sent: Tuesday, January 25, 2005 9:25 AM
To: netfilter@lists.netfilter.org
Subject: Re: Help debugging iptables firewall....

Hi Gary,

Pinholes?  If you mean specific IP to specific IP:PORT on specfic
interfaces then yes.

DB is an oracle listener (port 1521)

I have these:

# for ssh to db server from webserver
$IPTABLES -A FORWARD -p tcp --dport 22 -i $DMZ_IFACE -s $DMZ_EDGE_IP
-o $LAN_IFACE -d $TROT_IP -j ACCEPT

$IPTABLES -A FORWARD -p tcp --dport 1521 -i $DMZ_IFACE -s $DMZ_EDGE_IP
-o $LAN_IFACE -d $TROT_IP -j ACCEPT

I added 2 of your examples one before one after, and only see:

Jan 25 17:21:43 gateway kernel: Oracle 1521 [tcp] before: IN=eth1
OUT=eth2 SRC=192.168.254.3 DST=192.168.0.5 LEN=60 TOS=0x00 PREC=0x00
TTL=63 ID=30447 DF PROTO=TCP SPT=32907 DPT=1521 WINDOW=5840 RES=0x00
SYN URGP=0

Which would imply that the rule is ok and the packets goes through -
but why I am not getting a connection?

Thanks,

Greg

Re: Help debugging iptables firewall....

[Greg Cope]

I think we are getting there:

The one you suggested gives an error:

Starting firewall: ^[[Aiptables v1.2.9: multiple -o flags not allowed

Looking at tcpdump on a few machines it looks like the packets are
getting through - but nothing gets sent:

17:57:18.168655 ex.e-dba.net.32931 > trotter.e-dba.net.1521: S
965495617:965495617(0) win 5840 <mss 1460,sackOK,timestamp 2026024
0,nop,wscale 0> (DF) [tos 0x10]

And then nothing else - sadly I am not a tcpdump expert.....

Any clues?  I am at a loss as to why this was working and now it does not..... 

Greg


On Tue, 25 Jan 2005 09:46:20 -0800, Gary W. Smith <gary@primeexalia.com> wrote:
> Are you getting the connection coming back?  Try
> 
> $IPTABLES -A FORWARD -o $DMZ_IFACE -o $LAN_IFACE -j ACCEPT
> 
> And see if it makes any difference.  Forward works in both directions.
> We typically allow established,related to return the path that it came
> from.  You might need to do the same.
> 
> 
> -----Original Message-----
> From: netfilter-bounces@lists.netfilter.org
> [mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Greg Cope
> Sent: Tuesday, January 25, 2005 9:25 AM
> To: netfilter@lists.netfilter.org
> 
> Subject: Re: Help debugging iptables firewall....
> 
> Hi Gary,
> 
> Pinholes?  If you mean specific IP to specific IP:PORT on specfic
> interfaces then yes.
> 
> DB is an oracle listener (port 1521)
> 
> I have these:
> 
> # for ssh to db server from webserver
> $IPTABLES -A FORWARD -p tcp --dport 22 -i $DMZ_IFACE -s $DMZ_EDGE_IP
> -o $LAN_IFACE -d $TROT_IP -j ACCEPT
> 
> $IPTABLES -A FORWARD -p tcp --dport 1521 -i $DMZ_IFACE -s $DMZ_EDGE_IP
> -o $LAN_IFACE -d $TROT_IP -j ACCEPT
> 
> I added 2 of your examples one before one after, and only see:
> 
> Jan 25 17:21:43 gateway kernel: Oracle 1521 [tcp] before: IN=eth1
> OUT=eth2 SRC=192.168.254.3 DST=192.168.0.5 LEN=60 TOS=0x00 PREC=0x00
> TTL=63 ID=30447 DF PROTO=TCP SPT=32907 DPT=1521 WINDOW=5840 RES=0x00
> SYN URGP=0
> 
> Which would imply that the rule is ok and the packets goes through -
> but why I am not getting a connection?
> 
> Thanks,
> 
> Greg
> 
>

RE: Help debugging iptables firewall....

[Gary W. Smith]

Crap, I had a typo.  It should have been -i, not -o for the lan
interface

$IPTABLES -A FORWARD -o $DMZ_IFACE -i $LAN_IFACE -j ACCEPT

Try that and let us know.

Gary Wayne Smith


-----Original Message-----
From: netfilter-bounces@lists.netfilter.org
[mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Greg Cope
Sent: Tuesday, January 25, 2005 9:59 AM
To: netfilter@lists.netfilter.org
Subject: Re: Help debugging iptables firewall....

I think we are getting there:

The one you suggested gives an error:

Starting firewall: ^[[Aiptables v1.2.9: multiple -o flags not allowed

Looking at tcpdump on a few machines it looks like the packets are
getting through - but nothing gets sent:

17:57:18.168655 ex.e-dba.net.32931 > trotter.e-dba.net.1521: S
965495617:965495617(0) win 5840 <mss 1460,sackOK,timestamp 2026024
0,nop,wscale 0> (DF) [tos 0x10]

And then nothing else - sadly I am not a tcpdump expert.....

Any clues?  I am at a loss as to why this was working and now it does
not..... 

Greg

Re: Help debugging iptables firewall....

[Greg Cope]

Removing my original rule I get logged:


Jan 25 18:13:19 gateway kernel: Oracle 1521 [tcp] before: IN=eth1
OUT=eth2 SRC=192.168.254.3 DST=192.168.0.5 LEN=60 TOS=0x00 PREC=0x00
TTL=63 ID=29681 DF PROTO=TCP SPT=32941 DPT=1521 WINDOW=5840 RES=0x00
SYN URGP=0
Jan 25 18:13:19 gateway kernel: Oracle 1521 [tcp] after: IN=eth1
OUT=eth2 SRC=192.168.254.3 DST=192.168.0.5 LEN=60 TOS=0x00 PREC=0x00
TTL=63 ID=29681 DF PROTO=TCP SPT=32941 DPT=1521 WINDOW=5840 RES=0x00
SYN URGP=0
Jan 25 18:13:19 gateway kernel: FORWARD DENY: IN=eth1 OUT=eth2
SRC=192.168.254.3 DST=192.168.0.5 LEN=60 TOS=0x00 PREC=0x00 TTL=63
ID=29681 DF PROTO=TCP SPT=32941 DPT=1521 WINDOW=5840 RES=0x00 SYN
URGP=0

Greg




On Tue, 25 Jan 2005 10:09:43 -0800, Gary W. Smith <gary@primeexalia.com> wrote:
> Crap, I had a typo.  It should have been -i, not -o for the lan
> interface
> 
> $IPTABLES -A FORWARD -o $DMZ_IFACE -i $LAN_IFACE -j ACCEPT
> 
> Try that and let us know.
> 
> Gary Wayne Smith
> 
> 
> -----Original Message-----
> From: netfilter-bounces@lists.netfilter.org
> [mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Greg Cope
> Sent: Tuesday, January 25, 2005 9:59 AM
> To: netfilter@lists.netfilter.org
> Subject: Re: Help debugging iptables firewall....
> 
> I think we are getting there:
> 
> The one you suggested gives an error:
> 
> Starting firewall: ^[[Aiptables v1.2.9: multiple -o flags not allowed
> 
> Looking at tcpdump on a few machines it looks like the packets are
> getting through - but nothing gets sent:
> 
> 17:57:18.168655 ex.e-dba.net.32931 > trotter.e-dba.net.1521: S
> 965495617:965495617(0) win 5840 <mss 1460,sackOK,timestamp 2026024
> 0,nop,wscale 0> (DF) [tos 0x10]
> 
> And then nothing else - sadly I am not a tcpdump expert.....
> 
> Any clues?  I am at a loss as to why this was working and now it does
> not.....
> 
> Greg
> 
>

RE: Help debugging iptables firewall....

[Gary W. Smith]

My Oracle guy said that you need to open up either the high ports
(1024+) for communication or set Oracle to use a shared port.  He
mentioned that it works kind of like FTP in that the client established
a connection and then the server will open another reserve port back to
the client for the continued connection.  He said setting the share_port
setting (which he didn't know of the top of his head -- damn him) should
solve the problem.

Hope that helps.

Gary


-----Original Message-----
From: netfilter-bounces@lists.netfilter.org
[mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Greg Cope
Sent: Tuesday, January 25, 2005 10:18 AM
To: netfilter@lists.netfilter.org
Subject: Re: Help debugging iptables firewall....

Removing my original rule I get logged:


Jan 25 18:13:19 gateway kernel: Oracle 1521 [tcp] before: IN=eth1
OUT=eth2 SRC=192.168.254.3 DST=192.168.0.5 LEN=60 TOS=0x00 PREC=0x00
TTL=63 ID=29681 DF PROTO=TCP SPT=32941 DPT=1521 WINDOW=5840 RES=0x00
SYN URGP=0

Jan 25 18:13:19 gateway kernel: Oracle 1521 [tcp] after: IN=eth1
OUT=eth2 SRC=192.168.254.3 DST=192.168.0.5 LEN=60 TOS=0x00 PREC=0x00
TTL=63 ID=29681 DF PROTO=TCP SPT=32941 DPT=1521 WINDOW=5840 RES=0x00
SYN URGP=0
Jan 25 18:13:19 gateway kernel: FORWARD DENY: IN=eth1 OUT=eth2
SRC=192.168.254.3 DST=192.168.0.5 LEN=60 TOS=0x00 PREC=0x00 TTL=63
ID=29681 DF PROTO=TCP SPT=32941 DPT=1521 WINDOW=5840 RES=0x00 SYN
URGP=0

Greg




On Tue, 25 Jan 2005 10:09:43 -0800, Gary W. Smith <gary@primeexalia.com>
wrote:
> Crap, I had a typo.  It should have been -i, not -o for the lan
> interface
> 
> $IPTABLES -A FORWARD -o $DMZ_IFACE -i $LAN_IFACE -j ACCEPT
> 
> Try that and let us know.
> 
> Gary Wayne Smith
> 
> 
> -----Original Message-----
> From: netfilter-bounces@lists.netfilter.org
> [mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Greg Cope
> Sent: Tuesday, January 25, 2005 9:59 AM
> To: netfilter@lists.netfilter.org
> Subject: Re: Help debugging iptables firewall....
> 
> I think we are getting there:
> 
> The one you suggested gives an error:
> 
> Starting firewall: ^[[Aiptables v1.2.9: multiple -o flags not allowed
> 
> Looking at tcpdump on a few machines it looks like the packets are
> getting through - but nothing gets sent:
> 
> 17:57:18.168655 ex.e-dba.net.32931 > trotter.e-dba.net.1521: S
> 965495617:965495617(0) win 5840 <mss 1460,sackOK,timestamp 2026024
> 0,nop,wscale 0> (DF) [tos 0x10]
> 
> And then nothing else - sadly I am not a tcpdump expert.....
> 
> Any clues?  I am at a loss as to why this was working and now it does
> not.....
> 
> Greg
> 
>

Re: Help debugging iptables firewall....

[Greg Cope]

Its already configured like that :-(

When I drop all the ip rules I can connect.

Greg


On Tue, 25 Jan 2005 10:31:24 -0800, Gary W. Smith <gary@primeexalia.com> wrote:
> My Oracle guy said that you need to open up either the high ports
> (1024+) for communication or set Oracle to use a shared port.  He
> mentioned that it works kind of like FTP in that the client established
> a connection and then the server will open another reserve port back to
> the client for the continued connection.  He said setting the share_port
> setting (which he didn't know of the top of his head -- damn him) should
> solve the problem.
> 
> Hope that helps.
> 
> Gary
> 
> 
> -----Original Message-----
> From: netfilter-bounces@lists.netfilter.org
> [mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Greg Cope
> 
> Sent: Tuesday, January 25, 2005 10:18 AM
> To: netfilter@lists.netfilter.org
> Subject: Re: Help debugging iptables firewall....
> 
> Removing my original rule I get logged:
> 
> Jan 25 18:13:19 gateway kernel: Oracle 1521 [tcp] before: IN=eth1
> OUT=eth2 SRC=192.168.254.3 DST=192.168.0.5 LEN=60 TOS=0x00 PREC=0x00
> TTL=63 ID=29681 DF PROTO=TCP SPT=32941 DPT=1521 WINDOW=5840 RES=0x00
> SYN URGP=0
> 
> Jan 25 18:13:19 gateway kernel: Oracle 1521 [tcp] after: IN=eth1
> OUT=eth2 SRC=192.168.254.3 DST=192.168.0.5 LEN=60 TOS=0x00 PREC=0x00
> TTL=63 ID=29681 DF PROTO=TCP SPT=32941 DPT=1521 WINDOW=5840 RES=0x00
> SYN URGP=0
> Jan 25 18:13:19 gateway kernel: FORWARD DENY: IN=eth1 OUT=eth2
> SRC=192.168.254.3 DST=192.168.0.5 LEN=60 TOS=0x00 PREC=0x00 TTL=63
> ID=29681 DF PROTO=TCP SPT=32941 DPT=1521 WINDOW=5840 RES=0x00 SYN
> URGP=0
> 
> Greg
> 
> On Tue, 25 Jan 2005 10:09:43 -0800, Gary W. Smith <gary@primeexalia.com>
> wrote:
> > Crap, I had a typo.  It should have been -i, not -o for the lan
> > interface
> >
> > $IPTABLES -A FORWARD -o $DMZ_IFACE -i $LAN_IFACE -j ACCEPT
> >
> > Try that and let us know.
> >
> > Gary Wayne Smith
> >
> >
> > -----Original Message-----
> > From: netfilter-bounces@lists.netfilter.org
> > [mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Greg Cope
> > Sent: Tuesday, January 25, 2005 9:59 AM
> > To: netfilter@lists.netfilter.org
> > Subject: Re: Help debugging iptables firewall....
> >
> > I think we are getting there:
> >
> > The one you suggested gives an error:
> >
> > Starting firewall: ^[[Aiptables v1.2.9: multiple -o flags not allowed
> >
> > Looking at tcpdump on a few machines it looks like the packets are
> > getting through - but nothing gets sent:
> >
> > 17:57:18.168655 ex.e-dba.net.32931 > trotter.e-dba.net.1521: S
> > 965495617:965495617(0) win 5840 <mss 1460,sackOK,timestamp 2026024
> > 0,nop,wscale 0> (DF) [tos 0x10]
> >
> > And then nothing else - sadly I am not a tcpdump expert.....
> >
> > Any clues?  I am at a loss as to why this was working and now it does
> > not.....
> >
> > Greg
> >
> >
> 
>

RE: Help debugging iptables firewall....

[Gary W. Smith]

Try something a little more generic and see if it helps.

Enable bi-direction for all hosts in DMZ and the LAN for all hosts...
$IPTABLES -A FORWARD -p tcp --dport 1521 -i $DMZ_IFACE -o $LAN_IFACE -j
ACCEPT

### Notice --sport
$IPTABLES -A FORWARD -p tcp --sport 1521 -o $DMZ_IFACE -i $LAN_IFACE -j
ACCEPT

When the connection is started in the DMZ to the LAN the --dport will be
1521 but when the server is responding it should be doing so from 1521
which no becomes --sport.  Or, at least, that's how I have interpreted
it.

Once you get this working then modifiy the first rule to be point to
point.  Test and if successful work on the return.

That's the only think that I can think of 

Gary Wayne Smith

-----Original Message-----
From: netfilter-bounces@lists.netfilter.org
[mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Greg Cope
Sent: Tuesday, January 25, 2005 11:08 AM
To: netfilter@lists.netfilter.org
Subject: Re: Help debugging iptables firewall....

Its already configured like that :-(

When I drop all the ip rules I can connect.

Greg


On Tue, 25 Jan 2005 10:31:24 -0800, Gary W. Smith <gary@primeexalia.com>
wrote:
> My Oracle guy said that you need to open up either the high ports
> (1024+) for communication or set Oracle to use a shared port.  He
> mentioned that it works kind of like FTP in that the client
established
> a connection and then the server will open another reserve port back
to
> the client for the continued connection.  He said setting the
share_port
> setting (which he didn't know of the top of his head -- damn him)
should
> solve the problem.
> 
> Hope that helps.
> 
> Gary
> 
> 
> -----Original Message-----
> From: netfilter-bounces@lists.netfilter.org
> [mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Greg Cope
> 
> Sent: Tuesday, January 25, 2005 10:18 AM
> To: netfilter@lists.netfilter.org
> Subject: Re: Help debugging iptables firewall....
> 
> Removing my original rule I get logged:
> 
> Jan 25 18:13:19 gateway kernel: Oracle 1521 [tcp] before: IN=eth1
> OUT=eth2 SRC=192.168.254.3 DST=192.168.0.5 LEN=60 TOS=0x00 PREC=0x00
> TTL=63 ID=29681 DF PROTO=TCP SPT=32941 DPT=1521 WINDOW=5840 RES=0x00
> SYN URGP=0
> 
> Jan 25 18:13:19 gateway kernel: Oracle 1521 [tcp] after: IN=eth1
> OUT=eth2 SRC=192.168.254.3 DST=192.168.0.5 LEN=60 TOS=0x00 PREC=0x00
> TTL=63 ID=29681 DF PROTO=TCP SPT=32941 DPT=1521 WINDOW=5840 RES=0x00
> SYN URGP=0
> Jan 25 18:13:19 gateway kernel: FORWARD DENY: IN=eth1 OUT=eth2
> SRC=192.168.254.3 DST=192.168.0.5 LEN=60 TOS=0x00 PREC=0x00 TTL=63
> ID=29681 DF PROTO=TCP SPT=32941 DPT=1521 WINDOW=5840 RES=0x00 SYN
> URGP=0
> 
> Greg
> 
> On Tue, 25 Jan 2005 10:09:43 -0800, Gary W. Smith
<gary@primeexalia.com>
> wrote:
> > Crap, I had a typo.  It should have been -i, not -o for the lan
> > interface
> >
> > $IPTABLES -A FORWARD -o $DMZ_IFACE -i $LAN_IFACE -j ACCEPT
> >
> > Try that and let us know.
> >
> > Gary Wayne Smith
> >
> >
> > -----Original Message-----
> > From: netfilter-bounces@lists.netfilter.org
> > [mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Greg
Cope
> > Sent: Tuesday, January 25, 2005 9:59 AM
> > To: netfilter@lists.netfilter.org
> > Subject: Re: Help debugging iptables firewall....
> >
> > I think we are getting there:
> >
> > The one you suggested gives an error:
> >
> > Starting firewall: ^[[Aiptables v1.2.9: multiple -o flags not
allowed
> >
> > Looking at tcpdump on a few machines it looks like the packets are
> > getting through - but nothing gets sent:
> >
> > 17:57:18.168655 ex.e-dba.net.32931 > trotter.e-dba.net.1521: S
> > 965495617:965495617(0) win 5840 <mss 1460,sackOK,timestamp 2026024
> > 0,nop,wscale 0> (DF) [tos 0x10]
> >
> > And then nothing else - sadly I am not a tcpdump expert.....
> >
> > Any clues?  I am at a loss as to why this was working and now it
does
> > not.....
> >
> > Greg
> >
> >
> 
>

Re: Help debugging iptables firewall....

[Greg Cope]

Bingo.

Seemed to have solved it.  I noticed that without the firewall running
the following rule was in the stop section:

iptables -t nat -A POSTROUTING -s 192.168.0.0/24  -j MASQUERADE

Looking at the tcp dumps when it "worked" without the firewall the db
server thought it was talking to the firewall.

When the firewall was on the db server was failing to talk to the
webserver, and the conection packet got through, but there never
seemed to be an ack packet backout.

I am a bit confused, but it seems to work now - which is good until
tomorrow morning.

Thanks for your help.

Not sure what the right way to do it is.  I suppose the LAN should be
masqueraded to the DMZ hosts, as the DMZ hosts should not have
detailed knowledge of the LAN side.

Greg
On Tue, 25 Jan 2005 12:00:43 -0800, Gary W. Smith <gary@primeexalia.com> wrote:
> Try something a little more generic and see if it helps.
> 
> Enable bi-direction for all hosts in DMZ and the LAN for all hosts...
> $IPTABLES -A FORWARD -p tcp --dport 1521 -i $DMZ_IFACE -o $LAN_IFACE -j
> ACCEPT
> 
> ### Notice --sport
> $IPTABLES -A FORWARD -p tcp --sport 1521 -o $DMZ_IFACE -i $LAN_IFACE -j
> ACCEPT
> 
> When the connection is started in the DMZ to the LAN the --dport will be
> 1521 but when the server is responding it should be doing so from 1521
> which no becomes --sport.  Or, at least, that's how I have interpreted
> it.
> 
> Once you get this working then modifiy the first rule to be point to
> point.  Test and if successful work on the return.
> 
> That's the only think that I can think of
> 
> Gary Wayne Smith
> 
> -----Original Message-----
> From: netfilter-bounces@lists.netfilter.org
> [mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Greg Cope
> 
> Sent: Tuesday, January 25, 2005 11:08 AM
> To: netfilter@lists.netfilter.org
> Subject: Re: Help debugging iptables firewall....
> 
> Its already configured like that :-(
> 
> When I drop all the ip rules I can connect.
> 
> Greg
> 
> On Tue, 25 Jan 2005 10:31:24 -0800, Gary W. Smith <gary@primeexalia.com>
> wrote:
> > My Oracle guy said that you need to open up either the high ports
> > (1024+) for communication or set Oracle to use a shared port.  He
> > mentioned that it works kind of like FTP in that the client
> established
> > a connection and then the server will open another reserve port back
> to
> > the client for the continued connection.  He said setting the
> share_port
> > setting (which he didn't know of the top of his head -- damn him)
> should
> > solve the problem.
> >
> > Hope that helps.
> >
> > Gary
> >
> >
> > -----Original Message-----
> > From: netfilter-bounces@lists.netfilter.org
> > [mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Greg Cope
> >
> > Sent: Tuesday, January 25, 2005 10:18 AM
> > To: netfilter@lists.netfilter.org
> > Subject: Re: Help debugging iptables firewall....
> >
> > Removing my original rule I get logged:
> >
> > Jan 25 18:13:19 gateway kernel: Oracle 1521 [tcp] before: IN=eth1
> > OUT=eth2 SRC=192.168.254.3 DST=192.168.0.5 LEN=60 TOS=0x00 PREC=0x00
> > TTL=63 ID=29681 DF PROTO=TCP SPT=32941 DPT=1521 WINDOW=5840 RES=0x00
> > SYN URGP=0
> >
> > Jan 25 18:13:19 gateway kernel: Oracle 1521 [tcp] after: IN=eth1
> > OUT=eth2 SRC=192.168.254.3 DST=192.168.0.5 LEN=60 TOS=0x00 PREC=0x00
> > TTL=63 ID=29681 DF PROTO=TCP SPT=32941 DPT=1521 WINDOW=5840 RES=0x00
> > SYN URGP=0
> > Jan 25 18:13:19 gateway kernel: FORWARD DENY: IN=eth1 OUT=eth2
> > SRC=192.168.254.3 DST=192.168.0.5 LEN=60 TOS=0x00 PREC=0x00 TTL=63
> > ID=29681 DF PROTO=TCP SPT=32941 DPT=1521 WINDOW=5840 RES=0x00 SYN
> > URGP=0
> >
> > Greg
> >
> > On Tue, 25 Jan 2005 10:09:43 -0800, Gary W. Smith
> <gary@primeexalia.com>
> > wrote:
> > > Crap, I had a typo.  It should have been -i, not -o for the lan
> > > interface
> > >
> > > $IPTABLES -A FORWARD -o $DMZ_IFACE -i $LAN_IFACE -j ACCEPT
> > >
> > > Try that and let us know.
> > >
> > > Gary Wayne Smith
> > >
> > >
> > > -----Original Message-----
> > > From: netfilter-bounces@lists.netfilter.org
> > > [mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Greg
> Cope
> > > Sent: Tuesday, January 25, 2005 9:59 AM
> > > To: netfilter@lists.netfilter.org
> > > Subject: Re: Help debugging iptables firewall....
> > >
> > > I think we are getting there:
> > >
> > > The one you suggested gives an error:
> > >
> > > Starting firewall: ^[[Aiptables v1.2.9: multiple -o flags not
> allowed
> > >
> > > Looking at tcpdump on a few machines it looks like the packets are
> > > getting through - but nothing gets sent:
> > >
> > > 17:57:18.168655 ex.e-dba.net.32931 > trotter.e-dba.net.1521: S
> > > 965495617:965495617(0) win 5840 <mss 1460,sackOK,timestamp 2026024
> > > 0,nop,wscale 0> (DF) [tos 0x10]
> > >
> > > And then nothing else - sadly I am not a tcpdump expert.....
> > >
> > > Any clues?  I am at a loss as to why this was working and now it
> does
> > > not.....
> > >
> > > Greg
> > >
> > >
> >
> >
> 
>

RE: Help debugging iptables firewall....

[Gary W. Smith]

Greg, 

This might be real dump but do you have IP forwarding enabled?  If you
do then NAT's isn't necessary between the LANs.  

Gary 


> -----Original Message-----
> From: netfilter-bounces@lists.netfilter.org [mailto:netfilter-
> bounces@lists.netfilter.org] On Behalf Of Greg Cope
> Sent: Tuesday, January 25, 2005 2:07 PM
> To: netfilter@lists.netfilter.org
> Subject: Re: Help debugging iptables firewall....
> 
> Bingo.
> 
> Seemed to have solved it.  I noticed that without the firewall running
> the following rule was in the stop section:
> 
> iptables -t nat -A POSTROUTING -s 192.168.0.0/24  -j MASQUERADE
> 
> Looking at the tcp dumps when it "worked" without the firewall the db
> server thought it was talking to the firewall.
> 
> When the firewall was on the db server was failing to talk to the
> webserver, and the conection packet got through, but there never
> seemed to be an ack packet backout.
> 
> I am a bit confused, but it seems to work now - which is good until
> tomorrow morning.
> 
> Thanks for your help.
> 
> Not sure what the right way to do it is.  I suppose the LAN should be
> masqueraded to the DMZ hosts, as the DMZ hosts should not have
> detailed knowledge of the LAN side.
> 
> Greg

Re: Help debugging iptables firewall....

[Greg Cope]

Hiya,

[07:09:48 root@gateway root]$ cat /proc/sys/net/ipv4/ip_forward
1

It would seem that the one rule that is causing the issue is this one:

Works:

$IPTABLES -t nat -A POSTROUTING -s $LAN_IP_RANGE -j MASQUERADEb

Does not:

$IPTABLES -t nat -A POSTROUTING -s $LAN_IP_RANGE -d ! $LAN_IP_RANGE -j
MASQUERADE

The lan is on 192.168.0.0/24.
DMZ is on 192.168.254.0/24

Ie the -d ! $LAN_IP_RANGE

LAN_IP_RANGE="192.168.0.0/16"

So should the DMZ be natted to the LAN?  I would assume yes.

Are there any good guides to 3 inteface'ed firewalls - ie lan, dmz, red?

Greg

On Tue, 25 Jan 2005 14:11:30 -0800, Gary W. Smith <gary@primeexalia.com> wrote:
> Greg,
> 
> This might be real dump but do you have IP forwarding enabled?  If you
> do then NAT's isn't necessary between the LANs.
> 
> Gary
> 
> > -----Original Message-----
> > From: netfilter-bounces@lists.netfilter.org [mailto:netfilter-
> > bounces@lists.netfilter.org] On Behalf Of Greg Cope
> > Sent: Tuesday, January 25, 2005 2:07 PM
> > To: netfilter@lists.netfilter.org
> > Subject: Re: Help debugging iptables firewall....
> > 
> 
> > Bingo.
> >
> > Seemed to have solved it.  I noticed that without the firewall running
> > the following rule was in the stop section:
> >
> > iptables -t nat -A POSTROUTING -s 192.168.0.0/24  -j MASQUERADE
> >
> > Looking at the tcp dumps when it "worked" without the firewall the db
> > server thought it was talking to the firewall.
> >
> > When the firewall was on the db server was failing to talk to the
> > webserver, and the conection packet got through, but there never
> > seemed to be an ack packet backout.
> >
> > I am a bit confused, but it seems to work now - which is good until
> > tomorrow morning.
> >
> > Thanks for your help.
> >
> > Not sure what the right way to do it is.  I suppose the LAN should be
> > masqueraded to the DMZ hosts, as the DMZ hosts should not have
> > detailed knowledge of the LAN side.
> >
> > Greg
>