All of lore.kernel.org
 help / color / mirror / Atom feed
* RE: Help debugging iptables firewall....
@ 2005-01-25 20:00 Gary W. Smith
  2005-01-25 22:06 ` Greg Cope
  0 siblings, 1 reply; 13+ messages in thread
From: Gary W. Smith @ 2005-01-25 20:00 UTC (permalink / raw)
  To: Greg Cope, netfilter

Try something a little more generic and see if it helps.

Enable bi-direction for all hosts in DMZ and the LAN for all hosts...
$IPTABLES -A FORWARD -p tcp --dport 1521 -i $DMZ_IFACE -o $LAN_IFACE -j
ACCEPT

### Notice --sport
$IPTABLES -A FORWARD -p tcp --sport 1521 -o $DMZ_IFACE -i $LAN_IFACE -j
ACCEPT

When the connection is started in the DMZ to the LAN the --dport will be
1521 but when the server is responding it should be doing so from 1521
which no becomes --sport.  Or, at least, that's how I have interpreted
it.

Once you get this working then modifiy the first rule to be point to
point.  Test and if successful work on the return.

That's the only think that I can think of 

Gary Wayne Smith

-----Original Message-----
From: netfilter-bounces@lists.netfilter.org
[mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Greg Cope
Sent: Tuesday, January 25, 2005 11:08 AM
To: netfilter@lists.netfilter.org
Subject: Re: Help debugging iptables firewall....

Its already configured like that :-(

When I drop all the ip rules I can connect.

Greg


On Tue, 25 Jan 2005 10:31:24 -0800, Gary W. Smith <gary@primeexalia.com>
wrote:
> My Oracle guy said that you need to open up either the high ports
> (1024+) for communication or set Oracle to use a shared port.  He
> mentioned that it works kind of like FTP in that the client
established
> a connection and then the server will open another reserve port back
to
> the client for the continued connection.  He said setting the
share_port
> setting (which he didn't know of the top of his head -- damn him)
should
> solve the problem.
> 
> Hope that helps.
> 
> Gary
> 
> 
> -----Original Message-----
> From: netfilter-bounces@lists.netfilter.org
> [mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Greg Cope
> 
> Sent: Tuesday, January 25, 2005 10:18 AM
> To: netfilter@lists.netfilter.org
> Subject: Re: Help debugging iptables firewall....
> 
> Removing my original rule I get logged:
> 
> Jan 25 18:13:19 gateway kernel: Oracle 1521 [tcp] before: IN=eth1
> OUT=eth2 SRC=192.168.254.3 DST=192.168.0.5 LEN=60 TOS=0x00 PREC=0x00
> TTL=63 ID=29681 DF PROTO=TCP SPT=32941 DPT=1521 WINDOW=5840 RES=0x00
> SYN URGP=0
> 
> Jan 25 18:13:19 gateway kernel: Oracle 1521 [tcp] after: IN=eth1
> OUT=eth2 SRC=192.168.254.3 DST=192.168.0.5 LEN=60 TOS=0x00 PREC=0x00
> TTL=63 ID=29681 DF PROTO=TCP SPT=32941 DPT=1521 WINDOW=5840 RES=0x00
> SYN URGP=0
> Jan 25 18:13:19 gateway kernel: FORWARD DENY: IN=eth1 OUT=eth2
> SRC=192.168.254.3 DST=192.168.0.5 LEN=60 TOS=0x00 PREC=0x00 TTL=63
> ID=29681 DF PROTO=TCP SPT=32941 DPT=1521 WINDOW=5840 RES=0x00 SYN
> URGP=0
> 
> Greg
> 
> On Tue, 25 Jan 2005 10:09:43 -0800, Gary W. Smith
<gary@primeexalia.com>
> wrote:
> > Crap, I had a typo.  It should have been -i, not -o for the lan
> > interface
> >
> > $IPTABLES -A FORWARD -o $DMZ_IFACE -i $LAN_IFACE -j ACCEPT
> >
> > Try that and let us know.
> >
> > Gary Wayne Smith
> >
> >
> > -----Original Message-----
> > From: netfilter-bounces@lists.netfilter.org
> > [mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Greg
Cope
> > Sent: Tuesday, January 25, 2005 9:59 AM
> > To: netfilter@lists.netfilter.org
> > Subject: Re: Help debugging iptables firewall....
> >
> > I think we are getting there:
> >
> > The one you suggested gives an error:
> >
> > Starting firewall: ^[[Aiptables v1.2.9: multiple -o flags not
allowed
> >
> > Looking at tcpdump on a few machines it looks like the packets are
> > getting through - but nothing gets sent:
> >
> > 17:57:18.168655 ex.e-dba.net.32931 > trotter.e-dba.net.1521: S
> > 965495617:965495617(0) win 5840 <mss 1460,sackOK,timestamp 2026024
> > 0,nop,wscale 0> (DF) [tos 0x10]
> >
> > And then nothing else - sadly I am not a tcpdump expert.....
> >
> > Any clues?  I am at a loss as to why this was working and now it
does
> > not.....
> >
> > Greg
> >
> >
> 
>



^ permalink raw reply	[flat|nested] 13+ messages in thread
* RE: Help debugging iptables firewall....
@ 2005-01-25 22:11 Gary W. Smith
  2005-01-26  7:19 ` Greg Cope
  0 siblings, 1 reply; 13+ messages in thread
From: Gary W. Smith @ 2005-01-25 22:11 UTC (permalink / raw)
  To: Greg Cope, netfilter

Greg, 

This might be real dump but do you have IP forwarding enabled?  If you
do then NAT's isn't necessary between the LANs.  

Gary 


> -----Original Message-----
> From: netfilter-bounces@lists.netfilter.org [mailto:netfilter-
> bounces@lists.netfilter.org] On Behalf Of Greg Cope
> Sent: Tuesday, January 25, 2005 2:07 PM
> To: netfilter@lists.netfilter.org
> Subject: Re: Help debugging iptables firewall....
> 
> Bingo.
> 
> Seemed to have solved it.  I noticed that without the firewall running
> the following rule was in the stop section:
> 
> iptables -t nat -A POSTROUTING -s 192.168.0.0/24  -j MASQUERADE
> 
> Looking at the tcp dumps when it "worked" without the firewall the db
> server thought it was talking to the firewall.
> 
> When the firewall was on the db server was failing to talk to the
> webserver, and the conection packet got through, but there never
> seemed to be an ack packet backout.
> 
> I am a bit confused, but it seems to work now - which is good until
> tomorrow morning.
> 
> Thanks for your help.
> 
> Not sure what the right way to do it is.  I suppose the LAN should be
> masqueraded to the DMZ hosts, as the DMZ hosts should not have
> detailed knowledge of the LAN side.
> 
> Greg


^ permalink raw reply	[flat|nested] 13+ messages in thread
* RE: Help debugging iptables firewall....
@ 2005-01-25 18:31 Gary W. Smith
  2005-01-25 19:08 ` Greg Cope
  0 siblings, 1 reply; 13+ messages in thread
From: Gary W. Smith @ 2005-01-25 18:31 UTC (permalink / raw)
  To: Greg Cope, netfilter

My Oracle guy said that you need to open up either the high ports
(1024+) for communication or set Oracle to use a shared port.  He
mentioned that it works kind of like FTP in that the client established
a connection and then the server will open another reserve port back to
the client for the continued connection.  He said setting the share_port
setting (which he didn't know of the top of his head -- damn him) should
solve the problem.

Hope that helps.

Gary


-----Original Message-----
From: netfilter-bounces@lists.netfilter.org
[mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Greg Cope
Sent: Tuesday, January 25, 2005 10:18 AM
To: netfilter@lists.netfilter.org
Subject: Re: Help debugging iptables firewall....

Removing my original rule I get logged:


Jan 25 18:13:19 gateway kernel: Oracle 1521 [tcp] before: IN=eth1
OUT=eth2 SRC=192.168.254.3 DST=192.168.0.5 LEN=60 TOS=0x00 PREC=0x00
TTL=63 ID=29681 DF PROTO=TCP SPT=32941 DPT=1521 WINDOW=5840 RES=0x00
SYN URGP=0

Jan 25 18:13:19 gateway kernel: Oracle 1521 [tcp] after: IN=eth1
OUT=eth2 SRC=192.168.254.3 DST=192.168.0.5 LEN=60 TOS=0x00 PREC=0x00
TTL=63 ID=29681 DF PROTO=TCP SPT=32941 DPT=1521 WINDOW=5840 RES=0x00
SYN URGP=0
Jan 25 18:13:19 gateway kernel: FORWARD DENY: IN=eth1 OUT=eth2
SRC=192.168.254.3 DST=192.168.0.5 LEN=60 TOS=0x00 PREC=0x00 TTL=63
ID=29681 DF PROTO=TCP SPT=32941 DPT=1521 WINDOW=5840 RES=0x00 SYN
URGP=0

Greg




On Tue, 25 Jan 2005 10:09:43 -0800, Gary W. Smith <gary@primeexalia.com>
wrote:
> Crap, I had a typo.  It should have been -i, not -o for the lan
> interface
> 
> $IPTABLES -A FORWARD -o $DMZ_IFACE -i $LAN_IFACE -j ACCEPT
> 
> Try that and let us know.
> 
> Gary Wayne Smith
> 
> 
> -----Original Message-----
> From: netfilter-bounces@lists.netfilter.org
> [mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Greg Cope
> Sent: Tuesday, January 25, 2005 9:59 AM
> To: netfilter@lists.netfilter.org
> Subject: Re: Help debugging iptables firewall....
> 
> I think we are getting there:
> 
> The one you suggested gives an error:
> 
> Starting firewall: ^[[Aiptables v1.2.9: multiple -o flags not allowed
> 
> Looking at tcpdump on a few machines it looks like the packets are
> getting through - but nothing gets sent:
> 
> 17:57:18.168655 ex.e-dba.net.32931 > trotter.e-dba.net.1521: S
> 965495617:965495617(0) win 5840 <mss 1460,sackOK,timestamp 2026024
> 0,nop,wscale 0> (DF) [tos 0x10]
> 
> And then nothing else - sadly I am not a tcpdump expert.....
> 
> Any clues?  I am at a loss as to why this was working and now it does
> not.....
> 
> Greg
> 
>



^ permalink raw reply	[flat|nested] 13+ messages in thread
* RE: Help debugging iptables firewall....
@ 2005-01-25 18:09 Gary W. Smith
  2005-01-25 18:18 ` Greg Cope
  0 siblings, 1 reply; 13+ messages in thread
From: Gary W. Smith @ 2005-01-25 18:09 UTC (permalink / raw)
  To: Greg Cope, netfilter

Crap, I had a typo.  It should have been -i, not -o for the lan
interface

$IPTABLES -A FORWARD -o $DMZ_IFACE -i $LAN_IFACE -j ACCEPT

Try that and let us know.

Gary Wayne Smith


-----Original Message-----
From: netfilter-bounces@lists.netfilter.org
[mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Greg Cope
Sent: Tuesday, January 25, 2005 9:59 AM
To: netfilter@lists.netfilter.org
Subject: Re: Help debugging iptables firewall....

I think we are getting there:

The one you suggested gives an error:

Starting firewall: ^[[Aiptables v1.2.9: multiple -o flags not allowed

Looking at tcpdump on a few machines it looks like the packets are
getting through - but nothing gets sent:

17:57:18.168655 ex.e-dba.net.32931 > trotter.e-dba.net.1521: S
965495617:965495617(0) win 5840 <mss 1460,sackOK,timestamp 2026024
0,nop,wscale 0> (DF) [tos 0x10]

And then nothing else - sadly I am not a tcpdump expert.....

Any clues?  I am at a loss as to why this was working and now it does
not..... 

Greg




^ permalink raw reply	[flat|nested] 13+ messages in thread
* RE: Help debugging iptables firewall....
@ 2005-01-25 17:46 Gary W. Smith
  2005-01-25 17:59 ` Greg Cope
  0 siblings, 1 reply; 13+ messages in thread
From: Gary W. Smith @ 2005-01-25 17:46 UTC (permalink / raw)
  To: Greg Cope, netfilter

Are you getting the connection coming back?  Try

$IPTABLES -A FORWARD -o $DMZ_IFACE -o $LAN_IFACE -j ACCEPT

And see if it makes any difference.  Forward works in both directions.
We typically allow established,related to return the path that it came
from.  You might need to do the same.


-----Original Message-----
From: netfilter-bounces@lists.netfilter.org
[mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Greg Cope
Sent: Tuesday, January 25, 2005 9:25 AM
To: netfilter@lists.netfilter.org
Subject: Re: Help debugging iptables firewall....

Hi Gary,

Pinholes?  If you mean specific IP to specific IP:PORT on specfic
interfaces then yes.

DB is an oracle listener (port 1521)

I have these:

# for ssh to db server from webserver
$IPTABLES -A FORWARD -p tcp --dport 22 -i $DMZ_IFACE -s $DMZ_EDGE_IP
-o $LAN_IFACE -d $TROT_IP -j ACCEPT

$IPTABLES -A FORWARD -p tcp --dport 1521 -i $DMZ_IFACE -s $DMZ_EDGE_IP
-o $LAN_IFACE -d $TROT_IP -j ACCEPT

I added 2 of your examples one before one after, and only see:

Jan 25 17:21:43 gateway kernel: Oracle 1521 [tcp] before: IN=eth1
OUT=eth2 SRC=192.168.254.3 DST=192.168.0.5 LEN=60 TOS=0x00 PREC=0x00
TTL=63 ID=30447 DF PROTO=TCP SPT=32907 DPT=1521 WINDOW=5840 RES=0x00
SYN URGP=0

Which would imply that the rule is ok and the packets goes through -
but why I am not getting a connection?

Thanks,

Greg



^ permalink raw reply	[flat|nested] 13+ messages in thread
* RE: Help debugging iptables firewall....
@ 2005-01-25 17:13 Gary W. Smith
  2005-01-25 17:24 ` Greg Cope
  0 siblings, 1 reply; 13+ messages in thread
From: Gary W. Smith @ 2005-01-25 17:13 UTC (permalink / raw)
  To: Greg Cope, netfilter

I would recommend that you put a log entry for the protocol(s) or IP to
IP connections that you want to debug across the DMZ.  I did this while
trying to debug some IPSEC traffic.

-A FORWARD -p tcp -m tcp --dport 1433 -j LOG --log-prefix "MySQL [tcp]:
" --log-level 1
-A FORWARD -p udp -m udp --dport 1433 -j LOG --log-prefix "MySQL [udp]:
" --log-level 1

Put this at the beginning of the chain (tweak it for whatever DB you
need) and then just watch the calls to make sure that you are see the
flow that you want.  When you are done move them down to the end of the
chain, if they are still hitting then you are loosing packets.

BTW, are you running pinholes (point to point IP for each port you want
open)?  What DB?

Gary Wayne Smith


-----Original Message-----
From: netfilter-bounces@lists.netfilter.org
[mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Greg Cope
Sent: Tuesday, January 25, 2005 8:54 AM
To: netfilter@lists.netfilter.org
Subject: Help debugging iptables firewall....

Hi All,

I have a 3 interface firewall (internet, dmz, lan).

For some reason a dmz host can longer ssh or connect to a DB server on
the lan(it could before).

Nothing seems to get logged with a $IPTABLES -A FORWARD -j LOG
--log-prefix "FORWARD DENY: " rule.  And when I disable the FW and
enable the plain routing it seems to be able to connect ok.

At a loss as to why this would not work without logging something.

Firewall and Webserver are FC1, DB server is Redhat AS3.

Could someone suggest some ideas on debuging this?

Any  ideas gratefully received.

Greg



^ permalink raw reply	[flat|nested] 13+ messages in thread
* Help debugging iptables firewall....
@ 2005-01-25 16:53 Greg Cope
  0 siblings, 0 replies; 13+ messages in thread
From: Greg Cope @ 2005-01-25 16:53 UTC (permalink / raw)
  To: netfilter

Hi All,

I have a 3 interface firewall (internet, dmz, lan).

For some reason a dmz host can longer ssh or connect to a DB server on
the lan(it could before).

Nothing seems to get logged with a $IPTABLES -A FORWARD -j LOG
--log-prefix "FORWARD DENY: " rule.  And when I disable the FW and
enable the plain routing it seems to be able to connect ok.

At a loss as to why this would not work without logging something.

Firewall and Webserver are FC1, DB server is Redhat AS3.

Could someone suggest some ideas on debuging this?

Any  ideas gratefully received.

Greg


^ permalink raw reply	[flat|nested] 13+ messages in thread
end of thread, other threads:[~2005-01-26  7:19 UTC | newest]

Thread overview: 13+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2005-01-25 20:00 Help debugging iptables firewall Gary W. Smith
2005-01-25 22:06 ` Greg Cope
  -- strict thread matches above, loose matches on Subject: below --
2005-01-25 22:11 Gary W. Smith
2005-01-26  7:19 ` Greg Cope
2005-01-25 18:31 Gary W. Smith
2005-01-25 19:08 ` Greg Cope
2005-01-25 18:09 Gary W. Smith
2005-01-25 18:18 ` Greg Cope
2005-01-25 17:46 Gary W. Smith
2005-01-25 17:59 ` Greg Cope
2005-01-25 17:13 Gary W. Smith
2005-01-25 17:24 ` Greg Cope
2005-01-25 16:53 Greg Cope

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.