From: Greg Cope <gregcope@gmail.com>
To: netfilter@lists.netfilter.org
Subject: Re: Why is can't my clients use DNS?
Date: Thu, 9 Feb 2006 10:34:10 +0000 [thread overview]
Message-ID: <c0e9781f0602090234j24fa6e4fn@mail.gmail.com> (raw)
In-Reply-To: <c0e9781f0602090218y2d8cc31dy@mail.gmail.com>
I am an idiot sorry
I was missing this;
${IPTABLES} -t nat -A POSTROUTING -s ${DMZ_IP_RANGE} -j MASQUERADE
Greg
On 09/02/06, Greg Cope <gregcope@gmail.com> wrote:
> Hi All,
>
> I have a simple firewall/router.
>
> Behind are a few servers.
>
> I need to be able to;
>
> - Let clients use external dns (does not work)
> - ssh onto firewall (works)
> - NAT packets onto webservers behind firewall (works)
>
> This is a simple problem, but I can't seem to crack it - please can
> someone point out my stupidity;
>
> Some of the rules I have;
>
> ${IPTABLES} -A INPUT -p udp -s ${EXT_DNS_IP} --source-port 53 -d
> ${DMZ_IP_RANGE} -j ACCEPT
> ${IPTABLES} -A INPUT -p udp -s ${EXT_DNS_IP2} --source-port 53 -d
> ${DMZ_IP_RANGE} -j ACCEPT
> ${IPTABLES} -A FORWARD -p udp -s ${EXT_DNS_IP} -d ${DMZ_IP_RANGE}
> --sport 53 -j ACCEPT
>
>
> What am I missing?
>
> snipped output of iptables -nvL -t filter
>
> Chain INPUT (policy DROP 0 packets, 0 bytes)
> pkts bytes target prot opt in out source
> destination
> 119 8981 ACCEPT all -- eth1 * 0.0.0.0/0
> 0.0.0.0/0 state RELATED,ESTABLISHED
> 6 680 ACCEPT all -- eth0 * 0.0.0.0/0
> 0.0.0.0/0
> 0 0 ACCEPT all -- lo * 0.0.0.0/0
> 0.0.0.0/0
> 0 0 icmp_packets icmp -- eth1 * 0.0.0.0/0
> 0.0.0.0/0
> 0 0 DROP all -- eth1 * 192.168.0.0/16
> 0.0.0.0/0
> 0 0 DROP all -- eth1 * 127.0.0.0/8
> 0.0.0.0/0
> 0 0 ACCEPT tcp -- * * 0.0.0.0/0
> 0.0.0.0/0 tcp dpt:80 flags:0x16/0x02
> 0 0 ACCEPT tcp -- * * 0.0.0.0/0
> 0.0.0.0/0 tcp dpt:22 flags:0x16/0x02
> 0 0 ACCEPT udp -- * * 195.40.1.36
> 192.168.0.0/16 udp spt:53
> 0 0 ACCEPT udp -- * * 195.184.228.6
> 192.168.0.0/16 udp spt:53
> 0 0 DROP udp -- * * 0.0.0.0/0
> 0.0.0.0/0
> 1 40 DROP tcp -- * * 0.0.0.0/0
> 0.0.0.0/0 tcp flags:0x16/0x02
> 0 0 LOG all -- * * 0.0.0.0/0
> 0.0.0.0/0 LOG flags 0 level 7 prefix `INPUT DENY: '
>
> Chain FORWARD (policy DROP 0 packets, 0 bytes)
> pkts bytes target prot opt in out source
> destination
> 8 536 ACCEPT all -- eth0 eth1 0.0.0.0/0
> 0.0.0.0/0
> 0 0 ACCEPT all -- eth1 eth0 0.0.0.0/0
> 0.0.0.0/0 state RELATED,ESTABLISHED
> 0 0 ACCEPT tcp -- * * 0.0.0.0/0
> 192.168.0.0/16 tcp dpt:22 flags:0x16/0x02
> 0 0 ACCEPT tcp -- * * 0.0.0.0/0
> 192.168.0.0/16 tcp dpt:80 flags:0x16/0x02
> 0 0 ACCEPT udp -- * * 195.40.1.36
> 192.168.0.0/16 udp spt:53
> 0 0 LOG all -- * * 0.0.0.0/0
> 0.0.0.0/0 LOG flags 0 level 7 prefix `FORWARD DENY: '
>
next prev parent reply other threads:[~2006-02-09 10:34 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2006-02-09 10:18 Why is can't my clients use DNS? Greg Cope
2006-02-09 10:34 ` Greg Cope [this message]
2006-02-09 10:48 ` Rob Sterenborg
2006-02-10 3:50 ` ludi
2006-02-10 4:06 ` Cedric Blancher
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=c0e9781f0602090234j24fa6e4fn@mail.gmail.com \
--to=gregcope@gmail.com \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.