linux-admin.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* IP_TABLES Q
@ 2003-02-17 13:07 Andrew B. Cramer
       [not found] ` <000001c2d693$d57d2400$230110ac@berlin.kade.de>
  0 siblings, 1 reply; 6+ messages in thread
From: Andrew B. Cramer @ 2003-02-17 13:07 UTC (permalink / raw)
  To: linux-admin


Hi All,
	Please look at this and explain where I make the mistake that none 
of the workstations Masq'd are able to establish a FTP session. 
Telnet, email, and web browsing work just fine. 

TIA - Andrew Cramer

<ip_tables commands>

#!/bin/sh
#
# rc.firewall-2.4
FWVER=0.70
#
# Thanks to David Ranch's IPMasq HowTo
#               Initial SIMPLE IP Masquerade test for 2.4.x kernels
#               using IPTABLES.
#

echo -e "\n\nLoading simple rc.firewall version $FWVER..\n"

IPTABLES=/usr/sbin/iptables
DEPMOD=/sbin/depmod
INSMOD=/sbin/insmod

EXTIP="xxx.yyy.zzz.1" # your external IP here.
EXTIF="ppp0"
INTIF="eth0"

echo "   External Interface:  $EXTIF"
echo "   Internal Interface:  $INTIF"
echo -en "   loading modules: "
echo "  - Verifying that all kernel modules are ok"
$DEPMOD -a

echo "----------------------------------------------------------------
------"
echo -en "ip_tables, "

$INSMOD ip_tables

echo -en "ip_conntrack, "
$INSMOD ip_conntrack

echo -en "iptable_nat, "
$INSMOD iptable_nat

echo "----------------------------------------------------------------
------"

echo ".  Done loading modules."

echo "   enabling forwarding.."
echo "1" > /proc/sys/net/ipv4/ip_forward

echo "   clearing any existing rules and setting default policy.."
$IPTABLES -P INPUT ACCEPT
$IPTABLES -F INPUT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -F OUTPUT
$IPTABLES -P FORWARD ACCEPT
$IPTABLES -F FORWARD
$IPTABLES -t nat -F

$IPTABLES -A INPUT -p TCP -s 0/0 --destination-port 25  -j ACCEPT
$IPTABLES -A INPUT -p TCP -s 0/0 --destination-port 110 -j ACCEPT

# Reject telnet sessions from outside (Shouldn't it be 23 ?!?)
$IPTABLES -A INPUT -p TCP -i $EXTIF --destination-port 21   -j REJECT

# Forward HTTPS requests  (change the port number to suit yourself)
$IPTABLES -A FORWARD -i $EXTIF -o $INTIF -p tcp --dport 443 -m state 
\
   --state NEW,ESTABLISHED,RELATED -j ACCEPT

$IPTABLES -A PREROUTING -t nat -p tcp -d $EXTIP --dport 443 \
   -j DNAT --to 192.168.1.1:443

$IPTABLES -t nat -A PREROUTING -d $EXTIP -p tcp --dport 443 \
    -m state --state NEW,ESTABLISHED,RELATED -j DNAT --to 192.168.1.1

echo "   FWD: Allow all connections OUT and only existing and related 
ones IN"
$IPTABLES -A FORWARD -i $EXTIF -o $INTIF -m state --state 
ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
$IPTABLES -A FORWARD -j LOG

echo "   Enabling SNAT (MASQUERADE) functionality on $EXTIF"
$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE

echo -e "\nrc.firewall-2.4 v$FWVER done.\n"

<ip_tables Listing>
root@home:/etc/rc.d# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere           tcp 
dpt:smtp
ACCEPT     tcp  --  anywhere             anywhere           tcp 
dpt:pop3
REJECT     tcp  --  anywhere             anywhere           tcp 
dpt:ftp reject-with icmp-port-unreachable

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             anywhere           tcp 
dpt:https state NEW,RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere           state 
RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere
LOG        all  --  anywhere             anywhere           LOG level 
warning

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination





^ permalink raw reply	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2003-02-18  1:30 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2003-02-17 13:07 IP_TABLES Q Andrew B. Cramer
     [not found] ` <000001c2d693$d57d2400$230110ac@berlin.kade.de>
2003-02-17 17:33   ` AW: " Andrew B. Cramer
     [not found]     ` <1045526303.18928.3.camel@linux>
2003-02-18  0:31       ` Andrew B. Cramer
2003-02-18  1:04         ` Glynn Clements
2003-02-18  1:30           ` AW: IP_TABLES Q - Solved Andrew B. Cramer
     [not found]         ` <1045530465.18928.9.camel@linux>
2003-02-18  1:18           ` AW: IP_TABLES Q Andrew B. Cramer

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).