possibly annoing ...

possibly annoing ...

[PiSiC...]

[-- Attachment #1: Type: text/plain, Size: 708 bytes --]

Hello

I want to ask you something ... 

 - first what i have ...
   
   Internet ---> [eth0(fully qualified IP) linux (192.168.13.0/24)eth1] ---> LAN
 
 -second what i need ...
   
  only if you can send me,  a firewall script which i will use for :
  -a web server running on external interface
  -a web server running on internal interface ( a LAN portal )
  -and ... the most sensitive problem... a web server visibile from the Internet on another machine on internal LAN (192.168.13.199 let's say) 
  -smtp server
  -pop3 server
  -imap server

Basically ... i managed to setup everything just fine but i can't solve the "sensitive problem" ... it's just not working...
Any ideeas ?

[-- Attachment #2: Type: text/html, Size: 1869 bytes --]

Re: possibly annoing ...

[PiSiC...]

 First of all thanks for help ...
 but i'm kinda new with iptables and i want to show you the big picture :

 - i heard something about static NAT and dynamic NAT (not source or
destination NAT) and i'm not sure i fully understand what is the
aplicability on my situation.

the situation is this :

 i have a radio link with only one staticaly allocated  IP (aaa.bbb.ccc.ddd)
which is connected on my linux machine on eth1
eth0 on the same machine is connected on LAN.
I have up and running Webserver,SMTP,FTP and POP3.
I want to run now 2 webservers one on external and one on internal(that is
easy with binding on their interfaces).
But i want also to allow access from the world to a third webserver which
runs on 192.168.13.199:80 which will be accesibile on port 33333 on my
external ip.

... my machine runs Slackware 8.0 with kernel 2.4.5. and i have compiled the
kernel with all the features included(i don't need modprobe).


I wonder if you can give me an rc.firewall for this situation or at least
the tricky part(webserver on 192.168.13.199) with all their related stuff.

       Thank you very much in advance.

                                                      Danila Octavian

RE: possibly annoing ...

[Matt Hellman]

I'll give you an example. It assumes a default drop policy. Also, INTIF =
internal interface, HTTP1 = external ip address clients will connect to
(www.mydomain.com resolves to this address), and HTTPDMZ1 = internal web
server.

##### Setup prerouting rules to route Internet traffic internally
## Change the destination of external $HTTP requests to the DMZ HTTP server
$ipt -t nat -A PREROUTING -i $EXTIF -p tcp -d $HTTP1 --dport 33333 -j DNAT
--to $HTTPDMZ1:80

## Allow established,related forward traffic
$ipt -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

## Allow new http forward traffic from Internet to servers in the DMZ
$ipt -A FORWARD -m state --state NEW -i $EXTIF -p tcp -d $HTTPDMZ1 --dport
80 -j ACCEPT
$ipt -A FORWARD -m state --state NEW -i $EXTIF -p tcp -d $SMTPDMZ --dport 25
-j ACCEPT

>>-----Original Message-----
>>From: netfilter-admin@lists.netfilter.org 
>>[mailto:netfilter-admin@lists.netfilter.org] On Behalf Of PiSiC...
>>Sent: Thursday, February 27, 2003 12:15 PM
>>To: richardo@start-global.com
>>Cc: netfilter@lists.netfilter.org
>>Subject: Re: possibly annoing ...
>>
>>
>> First of all thanks for help ...
>> but i'm kinda new with iptables and i want to show you the 
>>big picture :
>>
>> - i heard something about static NAT and dynamic NAT (not source or
>>destination NAT) and i'm not sure i fully understand what is the
>>aplicability on my situation.
>>
>>the situation is this :
>>
>> i have a radio link with only one staticaly allocated  IP 
>>(aaa.bbb.ccc.ddd)
>>which is connected on my linux machine on eth1
>>eth0 on the same machine is connected on LAN.
>>I have up and running Webserver,SMTP,FTP and POP3.
>>I want to run now 2 webservers one on external and one on 
>>internal(that is
>>easy with binding on their interfaces).
>>But i want also to allow access from the world to a third 
>>webserver which
>>runs on 192.168.13.199:80 which will be accesibile on port 33333 on my
>>external ip.
>>
>>... my machine runs Slackware 8.0 with kernel 2.4.5. and i 
>>have compiled the
>>kernel with all the features included(i don't need modprobe).
>>
>>
>>I wonder if you can give me an rc.firewall for this situation 
>>or at least
>>the tricky part(webserver on 192.168.13.199) with all their 
>>related stuff.
>>
>>       Thank you very much in advance.
>>
>>                                                      Danila Octavian
>>
>>
>>
>>

Re: possibly annoing ...

[Joel Newkirk]

On Thursday 27 February 2003 01:14 pm, PiSiC... wrote:
>  First of all thanks for help ...
>  but i'm kinda new with iptables and i want to show you the big
> picture :
>
>  - i heard something about static NAT and dynamic NAT (not source or
> destination NAT) and i'm not sure i fully understand what is the
> aplicability on my situation.

Static is a static IP, Dynamic with a Dynamic IP.  Source NAT is where 
you change the source IP on an outbound packet so it appears to 
originate at the firewall, instead of a private IP 'behind' it.  
Destination NAT is where you change the destination of an (usually) 
incoming packet to send it elsewhere, usually used to send traffic 
coming to a public IP to a machine 'behind' the firewall with a private 
IP address. For SNAT (Source NAT) netfilter offers two flavors - SNAT 
uses a single static IP, and MASQUERADE checks the IP of the interface 
to make sure it uses the correct IP in a Dynamic IP setup.

> the situation is this :
>
>  i have a radio link with only one staticaly allocated  IP
> (aaa.bbb.ccc.ddd) which is connected on my linux machine on eth1
> eth0 on the same machine is connected on LAN.
> I have up and running Webserver,SMTP,FTP and POP3.
> I want to run now 2 webservers one on external and one on
> internal(that is easy with binding on their interfaces).
> But i want also to allow access from the world to a third webserver
> which runs on 192.168.13.199:80 which will be accesibile on port 33333
> on my external ip.

iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 33333 -d DNAT
--to 192.168.13.199:80

Along with FORWARD rules to allow port 80 traffic going to 192.168.13.199 
and to allow return traffic.  Likely return traffic will already get 
through if your iptables box is allowing internet access from machines 
on the LAN right now, but this would do it if not:

iptables -A FORWARD -i eth1 -m state --state ESTABLISHED,RELATED -j 
ACCEPT

The inbound would be allowed with:

iptables -A FORWARD -d 192.168.13.199 -p tcp --dport 80 -j ACCEPT

j

Re: possibly annoing ...

[PiSiC...]

 I tried this ... and doesn't seem to work... but i'm afraid my firewall
script is kinda messy
 I realized that i use MASQUERADE instead of SNAT.
 Can you give me a script or a link where to get one for my case ?

I will show the stuff that i have :

          eth0(aaa.bbb.ccc.ddd)
            |
           fw
            |
           eth1(192.168.13.1)
            |
           switch
            |
           LAN
 - eth0 has a staticaly assigned IP by my ISP.
 - eth1 has an private IP staticaly assigned by me.
 - on LAN i have a machine (192.168.13.199) which runs a webserver which i
want to be accesible from the world.

I think that i should use Static NAT for my machines inside LAN.
I have a firewall script that i just realized that was created for Dynamic
NAT.
I'm running Slackware 8.0 with kernel 2.4.5(all the modules for netfilter
are compiled into kernel(i don't need modprobe)).

I hope i was clear enough.

           Thank you four your efforts,


Danila Octavian
----- Original Message -----
From: Matt Hellman <mhellman@taxandfinance.com>
To: 'PiSiC...' <pisic@service.agress.ro>
Cc: <netfilter@lists.netfilter.org>
Sent: Friday, February 28, 2003 6:18 AM
Subject: RE: possibly annoing ...


> I'll give you an example. It assumes a default drop policy. Also, INTIF =
> internal interface, HTTP1 = external ip address clients will connect to
> (www.mydomain.com resolves to this address), and HTTPDMZ1 = internal web
> server.
>
> ##### Setup prerouting rules to route Internet traffic internally
> ## Change the destination of external $HTTP requests to the DMZ HTTP
server
> $ipt -t nat -A PREROUTING -i $EXTIF -p tcp -d $HTTP1 --dport 33333 -j DNAT
> --to $HTTPDMZ1:80
>
> ## Allow established,related forward traffic
> $ipt -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
>
> ## Allow new http forward traffic from Internet to servers in the DMZ
> $ipt -A FORWARD -m state --state NEW -i $EXTIF -p tcp -d $HTTPDMZ1 --dport
> 80 -j ACCEPT
> $ipt -A FORWARD -m state --state NEW -i $EXTIF -p tcp -d $SMTPDMZ --dport
25
> -j ACCEPT