From mboxrd@z Thu Jan 1 00:00:00 1970 From: "PiSiC..." Subject: possibly annoing ... Date: Thu, 27 Feb 2003 16:47:18 +0200 Sender: netfilter-admin@lists.netfilter.org Message-ID: <001101c2de6f$32634d60$c80da8c0@service.agress.ro> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_000E_01C2DE7F.E41CC9E0" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------=_NextPart_000_000E_01C2DE7F.E41CC9E0 Content-Type: text/plain; charset="iso-8859-2" Content-Transfer-Encoding: quoted-printable Hello I want to ask you something ...=20 - first what i have ... =20 Internet ---> [eth0(fully qualified IP) linux (192.168.13.0/24)eth1] = ---> LAN =20 -second what i need ... =20 only if you can send me, a firewall script which i will use for : -a web server running on external interface -a web server running on internal interface ( a LAN portal ) -and ... the most sensitive problem... a web server visibile from the = Internet on another machine on internal LAN (192.168.13.199 let's say)=20 -smtp server -pop3 server -imap server Basically ... i managed to setup everything just fine but i can't solve = the "sensitive problem" ... it's just not working... Any ideeas ? ------=_NextPart_000_000E_01C2DE7F.E41CC9E0 Content-Type: text/html; charset="iso-8859-2" Content-Transfer-Encoding: quoted-printable

Hello

I want to ask you something ... =

- first what i have = ...

Internet ---> = [eth0(fully qualified=20 IP) linux (192.168.13.0/24)eth1] ---> LAN

-second what i need = ...

only if you can send = me, a=20 firewall script which i will use for :

-a web server running on = external=20 interface

-a web server running on = internal interface=20 ( a LAN portal )

-and ... the most sensitive = problem... a web=20 server visibile from the Internet on another machine on internal = LAN=20 (192.168.13.199 let's say)

-smtp server

-pop3 server

-imap server

Basically ... i managed to setup = everything just=20 fine but i can't solve the "sensitive problem" ... it's just not=20 working...

Any ideeas ?

------=_NextPart_000_000E_01C2DE7F.E41CC9E0-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: "PiSiC..." Subject: Re: possibly annoing ... Date: Thu, 27 Feb 2003 20:14:42 +0200 Sender: netfilter-admin@lists.netfilter.org Message-ID: <001301c2de8c$263cc620$c80da8c0@service.agress.ro> References: Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: richardo@start-global.com Cc: netfilter@lists.netfilter.org First of all thanks for help ... but i'm kinda new with iptables and i want to show you the big picture : - i heard something about static NAT and dynamic NAT (not source or destination NAT) and i'm not sure i fully understand what is the aplicability on my situation. the situation is this : i have a radio link with only one staticaly allocated IP (aaa.bbb.ccc.ddd) which is connected on my linux machine on eth1 eth0 on the same machine is connected on LAN. I have up and running Webserver,SMTP,FTP and POP3. I want to run now 2 webservers one on external and one on internal(that is easy with binding on their interfaces). But i want also to allow access from the world to a third webserver which runs on 192.168.13.199:80 which will be accesibile on port 33333 on my external ip. ... my machine runs Slackware 8.0 with kernel 2.4.5. and i have compiled the kernel with all the features included(i don't need modprobe). I wonder if you can give me an rc.firewall for this situation or at least the tricky part(webserver on 192.168.13.199) with all their related stuff. Thank you very much in advance. Danila Octavian From mboxrd@z Thu Jan 1 00:00:00 1970 From: Joel Newkirk Subject: Re: possibly annoing ... Date: Fri, 28 Feb 2003 02:48:43 -0500 Sender: netfilter-admin@lists.netfilter.org Message-ID: <200302280248.43412.netfilter@newkirk.us> References: <001301c2de8c$263cc620$c80da8c0@service.agress.ro> Reply-To: netfilter@newkirk.us Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <001301c2de8c$263cc620$c80da8c0@service.agress.ro> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: "PiSiC..." , richardo@start-global.com Cc: netfilter@lists.netfilter.org On Thursday 27 February 2003 01:14 pm, PiSiC... wrote: > First of all thanks for help ... > but i'm kinda new with iptables and i want to show you the big > picture : > > - i heard something about static NAT and dynamic NAT (not source or > destination NAT) and i'm not sure i fully understand what is the > aplicability on my situation. Static is a static IP, Dynamic with a Dynamic IP. Source NAT is where=20 you change the source IP on an outbound packet so it appears to=20 originate at the firewall, instead of a private IP 'behind' it. =20 Destination NAT is where you change the destination of an (usually)=20 incoming packet to send it elsewhere, usually used to send traffic=20 coming to a public IP to a machine 'behind' the firewall with a private=20 IP address. For SNAT (Source NAT) netfilter offers two flavors - SNAT=20 uses a single static IP, and MASQUERADE checks the IP of the interface=20 to make sure it uses the correct IP in a Dynamic IP setup. > the situation is this : > > i have a radio link with only one staticaly allocated IP > (aaa.bbb.ccc.ddd) which is connected on my linux machine on eth1 > eth0 on the same machine is connected on LAN. > I have up and running Webserver,SMTP,FTP and POP3. > I want to run now 2 webservers one on external and one on > internal(that is easy with binding on their interfaces). > But i want also to allow access from the world to a third webserver > which runs on 192.168.13.199:80 which will be accesibile on port 33333 > on my external ip. iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 33333 -d DNAT --to 192.168.13.199:80 Along with FORWARD rules to allow port 80 traffic going to 192.168.13.199= =20 and to allow return traffic. Likely return traffic will already get=20 through if your iptables box is allowing internet access from machines=20 on the LAN right now, but this would do it if not: iptables -A FORWARD -i eth1 -m state --state ESTABLISHED,RELATED -j=20 ACCEPT The inbound would be allowed with: iptables -A FORWARD -d 192.168.13.199 -p tcp --dport 80 -j ACCEPT j From mboxrd@z Thu Jan 1 00:00:00 1970 From: "PiSiC..." Subject: Re: possibly annoing ... Date: Fri, 28 Feb 2003 13:42:44 +0200 Sender: netfilter-admin@lists.netfilter.org Message-ID: <000f01c2df1e$84c04040$c80da8c0@service.agress.ro> References: <000101c2dee0$78f1fa80$fd0aa8c0@winxp> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: Matt Hellman Cc: netfilter@lists.netfilter.org I tried this ... and doesn't seem to work... but i'm afraid my firewall script is kinda messy I realized that i use MASQUERADE instead of SNAT. Can you give me a script or a link where to get one for my case ? I will show the stuff that i have : eth0(aaa.bbb.ccc.ddd) | fw | eth1(192.168.13.1) | switch | LAN - eth0 has a staticaly assigned IP by my ISP. - eth1 has an private IP staticaly assigned by me. - on LAN i have a machine (192.168.13.199) which runs a webserver which i want to be accesible from the world. I think that i should use Static NAT for my machines inside LAN. I have a firewall script that i just realized that was created for Dynamic NAT. I'm running Slackware 8.0 with kernel 2.4.5(all the modules for netfilter are compiled into kernel(i don't need modprobe)). I hope i was clear enough. Thank you four your efforts, Danila Octavian ----- Original Message ----- From: Matt Hellman To: 'PiSiC...' Cc: Sent: Friday, February 28, 2003 6:18 AM Subject: RE: possibly annoing ... > I'll give you an example. It assumes a default drop policy. Also, INTIF = > internal interface, HTTP1 = external ip address clients will connect to > (www.mydomain.com resolves to this address), and HTTPDMZ1 = internal web > server. > > ##### Setup prerouting rules to route Internet traffic internally > ## Change the destination of external $HTTP requests to the DMZ HTTP server > $ipt -t nat -A PREROUTING -i $EXTIF -p tcp -d $HTTP1 --dport 33333 -j DNAT > --to $HTTPDMZ1:80 > > ## Allow established,related forward traffic > $ipt -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT > > ## Allow new http forward traffic from Internet to servers in the DMZ > $ipt -A FORWARD -m state --state NEW -i $EXTIF -p tcp -d $HTTPDMZ1 --dport > 80 -j ACCEPT > $ipt -A FORWARD -m state --state NEW -i $EXTIF -p tcp -d $SMTPDMZ --dport 25 > -j ACCEPT From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Matt Hellman" Subject: RE: possibly annoing ... Date: Thu, 27 Feb 2003 22:18:39 -0600 Sender: netfilter-admin@lists.netfilter.org Message-ID: <000101c2dee0$78f1fa80$fd0aa8c0@winxp> References: <001301c2de8c$263cc620$c80da8c0@service.agress.ro> Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: <001301c2de8c$263cc620$c80da8c0@service.agress.ro> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: "'PiSiC...'" Cc: netfilter@lists.netfilter.org I'll give you an example. It assumes a default drop policy. Also, INTIF = =3D internal interface, HTTP1 =3D external ip address clients will connect = to (www.mydomain.com resolves to this address), and HTTPDMZ1 =3D internal = web server. ##### Setup prerouting rules to route Internet traffic internally ## Change the destination of external $HTTP requests to the DMZ HTTP = server $ipt -t nat -A PREROUTING -i $EXTIF -p tcp -d $HTTP1 --dport 33333 -j = DNAT --to $HTTPDMZ1:80 ## Allow established,related forward traffic $ipt -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT ## Allow new http forward traffic from Internet to servers in the DMZ $ipt -A FORWARD -m state --state NEW -i $EXTIF -p tcp -d $HTTPDMZ1 = --dport 80 -j ACCEPT $ipt -A FORWARD -m state --state NEW -i $EXTIF -p tcp -d $SMTPDMZ = --dport 25 -j ACCEPT >>-----Original Message----- >>From: netfilter-admin@lists.netfilter.org=20 >>[mailto:netfilter-admin@lists.netfilter.org] On Behalf Of PiSiC... >>Sent: Thursday, February 27, 2003 12:15 PM >>To: richardo@start-global.com >>Cc: netfilter@lists.netfilter.org >>Subject: Re: possibly annoing ... >> >> >> First of all thanks for help ... >> but i'm kinda new with iptables and i want to show you the=20 >>big picture : >> >> - i heard something about static NAT and dynamic NAT (not source or >>destination NAT) and i'm not sure i fully understand what is the >>aplicability on my situation. >> >>the situation is this : >> >> i have a radio link with only one staticaly allocated IP=20 >>(aaa.bbb.ccc.ddd) >>which is connected on my linux machine on eth1 >>eth0 on the same machine is connected on LAN. >>I have up and running Webserver,SMTP,FTP and POP3. >>I want to run now 2 webservers one on external and one on=20 >>internal(that is >>easy with binding on their interfaces). >>But i want also to allow access from the world to a third=20 >>webserver which >>runs on 192.168.13.199:80 which will be accesibile on port 33333 on my >>external ip. >> >>... my machine runs Slackware 8.0 with kernel 2.4.5. and i=20 >>have compiled the >>kernel with all the features included(i don't need modprobe). >> >> >>I wonder if you can give me an rc.firewall for this situation=20 >>or at least >>the tricky part(webserver on 192.168.13.199) with all their=20 >>related stuff. >> >> Thank you very much in advance. >> >> Danila Octavian >> >> >> >>