* Strange firewall problem, help needed
@ 2003-02-01 12:16 Daniel Desages
0 siblings, 0 replies; only message in thread
From: Daniel Desages @ 2003-02-01 12:16 UTC (permalink / raw)
To: netfilter
Hello,
First sorry for this long message, I'm trying to give as much info as I can.
I have a strange problem, I've really read all FAQs I could find, but
couldn't find an answer to it :
- I have a Debian Gnu/Linux firewall with kernel 2.4.20, iptables v1.2.7a.
It's a pentium 133 MHz,
connected to a cable modem (dynamic ip) on one side and static ip
192.168.0.1 on the other.
- Behind it, two computers :
One is a dual-boot windows 2000/linux, static ip 192.168.0.2
The other one is dual-boot WindowsXP/linux. static ip 192.168.0.3
- The firewall is also used as a dns server, mail gateway (smtp + pop) for
the lan.
- The first client box can go on the internet with no problem.
- The second client can go on the internet with no problem under linux, the
normal connection spped is about 40 KB/s
Under windows XP, the connection is established, then the speed slows down
rapidly and constantly until it's 2.6 KB/s.
then it stays at that speed :( I checked the log, there is nothing related
to packets dropped. Ftp connection, if I use "passive", is slow while
connecting and gives timeout while retrieving the dir list
If I use squid proxy on the firewall and set it up in the XP box, it's fast
as it should be. I should also say that I checked the speed in the lan,
It's normal between the three computers.
I tried to play with MTU, but didn't get different results. Could you please
tell me if there is something wrong with my iptables script ?
You'll notice it's kindda paranoid setup, maybe too much ?
Thanks in advance for your help. No the details :
The iptables modules that are loaded are (lsmod):
ipt_state 568 1 (autoclean)
cls_u32 4220 0 (autoclean)
ip_conntrack_ftp 3824 1 (autoclean)
ip_nat_ftp 2928 0 (unused)
ipt_MASQUERADE 1240 1 (autoclean)
ipt_REDIRECT 856 0 (autoclean)
ipt_LOG 3224 11 (autoclean)
iptable_mangle 2192 0 (autoclean) (unused)
iptable_filter 1668 1 (autoclean)
iptable_nat 14488 2 [ip_nat_ftp ipt_MASQUERADE ipt_REDIRECT]
ip_tables 10616 9 [ipt_state ipt_MASQUERADE ipt_REDIRECT
ipt_LOG iptable_mangle iptable_filter iptable_nat]
ip_conntrack 16768 3 [ipt_state ip_conntrack_ftp ip_nat_ftp
ipt_MASQUERADE ipt_REDIRECT iptable_nat]
af_packet 12008 0 (autoclean)
Here is what route -n give :
Destination Passerelle Genmask Indic Metric Ref Use
Iface
212.198.135.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1
192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
0.0.0.0 212.198.135.1 0.0.0.0 UG 0 0 0 eth1
And below is the firewall script I use (genereated with ipmasq to
dynamically set eth1 ip address:
#: Interfaces found:
#: eth1 212.198.135.235/255.255.255.0
#: eth1 212.198.135.235/255.255.255.0
#: eth0 192.168.0.1/255.255.255.0
#: Turn off forwarding for 2.1 kernels
#: Disable automatic IP defragmentation
#: Disable ip_dynaddr
echo "0" > /proc/sys/net/ipv4/ip_forward
echo "0" > /proc/sys/net/ipv4/ip_dynaddr
#: Flush all and set default policy of deny.
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT DROP
/sbin/iptables -P FORWARD DROP
/sbin/iptables -F INPUT
/sbin/iptables -F OUTPUT
/sbin/iptables -F FORWARD
/sbin/iptables -t mangle -P PREROUTING ACCEPT
/sbin/iptables -t mangle -P OUTPUT ACCEPT
/sbin/iptables -t mangle -F PREROUTING
/sbin/iptables -t mangle -F OUTPUT
/sbin/iptables -t nat -P PREROUTING ACCEPT
/sbin/iptables -t nat -P POSTROUTING ACCEPT
/sbin/iptables -t nat -P OUTPUT ACCEPT
/sbin/iptables -t nat -F PREROUTING
/sbin/iptables -t nat -F POSTROUTING
/sbin/iptables -t nat -F OUTPUT
#: Forward packets among internal networks
#: Accept all packets coming in from the loopback interface
/sbin/iptables -A INPUT -j ACCEPT -i lo
#: Deny and log all packets trying to come in from a 127.0.0.0/8 address
#: over a non-'lo' interface
/sbin/iptables -A INPUT -j LOG -i ! lo -s 127.0.0.1/255.0.0.0
/sbin/iptables -A INPUT -j DROP -i ! lo -s 127.0.0.1/255.0.0.0
#: règles de DNAT
#: Accept dumb broadcast packets on internal interfaces
/sbin/iptables -A INPUT -j ACCEPT -i eth0 -d 255.255.255.255/32
#: Accept packets from internal networks on internal interfaces
/sbin/iptables -A INPUT -j ACCEPT -i eth0 -s 192.168.0.1/255.255.255.0
#: Accept multicast packets (adresses 224.0.0.0) from internal interfaces
/sbin/iptables -A INPUT -j ACCEPT -i eth0 -d 224.0.0.0/4 -p ! tcp
#: Disallow and log packets trying to come in over external interfaces
#: from hosts claiming to be internal
/sbin/iptables -A INPUT -j LOG -i eth1 -s 192.168.0.1/255.255.255.0
/sbin/iptables -A INPUT -j DROP -i eth1 -s 192.168.0.1/255.255.255.0
#: Firewall for incoming packets
/sbin/iptables -A INPUT -j ACCEPT -i eth1 -d 212.198.135.235/255.255.255.0
-p tcp --destination-port ssh
/sbin/iptables -A INPUT -j ACCEPT -i eth1 -d 212.198.135.235/255.255.255.0
-p tcp --destination-port auth
/sbin/iptables -A INPUT -j ACCEPT -i eth1 -d 212.198.135.235/255.255.255.0
-p tcp --destination-port bootpc
/sbin/iptables -A INPUT -j ACCEPT -i eth1 -d 212.198.135.235/255.255.255.0
-p tcp --destination-port www
/sbin/iptables -A INPUT -j ACCEPT -i eth1 -d 212.198.135.235/255.255.255.0
-p udp --destination-port bootpc
/sbin/iptables -A INPUT -j DROP -i eth1 -d 212.198.135.235/255.255.255.0 -p
tcp --destination-port nameserver
/sbin/iptables -A INPUT -j DROP -i eth1 -d 212.198.135.235/255.255.255.0 -p
tcp --destination-port smtp
/sbin/iptables -A INPUT -j DROP -i eth1 -d 212.198.135.235/255.255.255.0 -p
tcp --destination-port pop3
/sbin/iptables -A INPUT -j DROP -i eth1 -d 212.198.135.235/255.255.255.0 -p
tcp --destination-port netbios-ns
/sbin/iptables -A INPUT -j DROP -i eth1 -d 212.198.135.235/255.255.255.0 -p
tcp --destination-port netbios-ssn
/sbin/iptables -A INPUT -j DROP -i eth1 -d 212.198.135.235/255.255.255.0 -p
tcp --destination-port 3000
/sbin/iptables -A INPUT -j DROP -i eth1 -d 212.198.135.235/255.255.255.0 -p
tcp --destination-port 3128
/sbin/iptables -A INPUT -j DROP -i eth1 -d 212.198.135.235/255.255.255.0 -p
udp --destination-port nameserver
/sbin/iptables -A INPUT -j DROP -i eth1 -d 212.198.135.235/255.255.255.0 -p
udp --destination-port netbios-ns
/sbin/iptables -A INPUT -j DROP -i eth1 -d 212.198.135.235/255.255.255.0 -p
udp --destination-port netbios-ssn
/sbin/iptables -A INPUT -j DROP -i eth1 -d 212.198.135.235/255.255.255.0 -p
udp --destination-port 3128
/sbin/iptables -A INPUT -j LOG -i eth1 -d 212.198.135.235/255.255.255.0 -p
tcp --destination-port 1:1023
/sbin/iptables -A INPUT -j DROP -i eth1 -d 212.198.135.235/255.255.255.0 -p
tcp --destination-port 1:1023
/sbin/iptables -A INPUT -j LOG -i eth1 -d 212.198.135.235/255.255.255.0 -p
udp --destination-port 1:1023
/sbin/iptables -A INPUT -j DROP -i eth1 -d 212.198.135.235/255.255.255.0 -p
udp --destination-port 1:1023
#: Accept dumb broadcast packets on external interfaces
/sbin/iptables -A INPUT -j ACCEPT -i eth1 -d 255.255.255.255/32
/sbin/iptables -A INPUT -j ACCEPT -i eth1 -d 224.0.0.1
#: Accept incoming packets from external networks on external interfaces
/sbin/iptables -A INPUT -j ACCEPT -i eth1 -d 212.198.135.235/32
/sbin/iptables -A INPUT -j ACCEPT -i eth1 -d 212.198.135.255/32
#: Masquerade packets from internal networks
/sbin/iptables -t nat -A POSTROUTING -s 192.168.0.1/255.255.255.0 -j
MASQUERADE
/sbin/iptables -A FORWARD -i eth0 -o eth1 -s 192.168.0.1/255.255.255.0 -j
ACCEPT
/sbin/iptables -A FORWARD -o eth0 -i eth1 -d 192.168.0.1/255.255.255.0 -j
ACCEPT
#: Allow packets to go out over the loopback interface
/sbin/iptables -A OUTPUT -j ACCEPT -o lo
#: Allow dumb broadcast packets to leave on internal interfaces
/sbin/iptables -A OUTPUT -j ACCEPT -o eth0 -d 255.255.255.255/32
#: Allow packets for internal hosts to be delivered using internal
interfaces
/sbin/iptables -A OUTPUT -j ACCEPT -o eth0 -d 192.168.0.1/255.255.255.0
#: Allow multicast packets (adresses 224.0.0.0) to be delivered using
#: internal interfaces
/sbin/iptables -A OUTPUT -j ACCEPT -o eth0 -d 224.0.0.0/4 -p ! tcp
#: Deny and log packets attempting to leave over external interfaces
claiming
#: to be for internal networks
/sbin/iptables -A FORWARD -j LOG -o eth1 -d 192.168.0.1/255.255.255.0
/sbin/iptables -A FORWARD -j DROP -o eth1 -d 192.168.0.1/255.255.255.0
/sbin/iptables -A OUTPUT -j LOG -o eth1 -d 192.168.0.1/255.255.255.0
/sbin/iptables -A OUTPUT -j DROP -o eth1 -d 192.168.0.1/255.255.255.0
#: Firewall for outgoing packets
/sbin/iptables -A OUTPUT -j ACCEPT -o eth1 -s 212.198.135.235/255.255.255.0
-p tcp --source-port ssh
/sbin/iptables -A OUTPUT -j ACCEPT -o eth1 -s 212.198.135.235/255.255.255.0
-p tcp --source-port auth
/sbin/iptables -A OUTPUT -j ACCEPT -o eth1 -s 212.198.135.235/255.255.255.0
-p tcp --source-port bootpc
/sbin/iptables -A OUTPUT -j ACCEPT -o eth1 -s 212.198.135.235/255.255.255.0
-p tcp --source-port www
/sbin/iptables -A OUTPUT -j ACCEPT -o eth1 -s 212.198.135.235/255.255.255.0
-p udp --source-port bootpc
/sbin/iptables -A OUTPUT -j DROP -o eth1 -s 0.0.0.0/0 -p tcp --source-port
nameserver
/sbin/iptables -A OUTPUT -j DROP -o eth1 -s 0.0.0.0/0 -p tcp --source-port
smtp
/sbin/iptables -A OUTPUT -j DROP -o eth1 -s 0.0.0.0/0 -p tcp --source-port
pop3
/sbin/iptables -A OUTPUT -j DROP -o eth1 -s 0.0.0.0/0 -p tcp --source-port
netbios-ns
/sbin/iptables -A OUTPUT -j DROP -o eth1 -s 0.0.0.0/0 -p tcp --source-port
netbios-ssn
/sbin/iptables -A OUTPUT -j DROP -o eth1 -s 0.0.0.0/0 -p tcp --source-port
3000
/sbin/iptables -A OUTPUT -j DROP -o eth1 -s 0.0.0.0/0 -p tcp --source-port
3128
/sbin/iptables -A OUTPUT -j DROP -o eth1 -s 0.0.0.0/0 -p udp --source-port
nameserver
/sbin/iptables -A OUTPUT -j DROP -o eth1 -s 0.0.0.0/0 -p udp --source-port
netbios-ns
/sbin/iptables -A OUTPUT -j DROP -o eth1 -s 0.0.0.0/0 -p udp --source-port
netbios-ssn
/sbin/iptables -A OUTPUT -j DROP -o eth1 -s 0.0.0.0/0 -p udp --source-port
3128
/sbin/iptables -A OUTPUT -j LOG -o eth1 -s 0.0.0.0/0 -p tcp --source-port
1:1023
/sbin/iptables -A OUTPUT -j DROP -o eth1 -s 0.0.0.0/0 -p tcp --source-port
1:1023
/sbin/iptables -A OUTPUT -j LOG -o eth1 -s 0.0.0.0/0 -p udp --source-port
1:1023
/sbin/iptables -A OUTPUT -j DROP -o eth1 -s 0.0.0.0/0 -p udp --source-port
1:1023
#: Allow dumb broadcast packets to leave on external interfaces
/sbin/iptables -A OUTPUT -j ACCEPT -o eth1 -d 255.255.255.255/32
#: Allow packets for external networks leave over external interfaces
/sbin/iptables -A OUTPUT -j ACCEPT -o eth1 -s 212.198.135.235/32
/sbin/iptables -A OUTPUT -j ACCEPT -o eth1 -s 212.198.135.255/32
#: Turn on forwarding for 2.1 kernels
#: Enable automatic IP defragmentation
#: Enable ip_dynaddr
echo "1" > /proc/sys/net/ipv4/ip_forward
echo "1" > /proc/sys/net/ipv4/ip_dynaddr
#: Set masqerading timeouts:
#: 2 hrs for TCP
#: 10 sec for TCP after FIN has been sent
#: 160 sec for UDP (important for ICQ users)
#: Run the deprecated /etc/ipmasq.rules, if present
#: Deny and log anything that may have snuck past any of our other rules
/sbin/iptables -A INPUT -j LOG -s 0.0.0.0/0 -d 0.0.0.0/0
/sbin/iptables -A INPUT -j DROP -s 0.0.0.0/0 -d 0.0.0.0/0
/sbin/iptables -A OUTPUT -j LOG -s 0.0.0.0/0 -d 0.0.0.0/0
/sbin/iptables -A OUTPUT -j DROP -s 0.0.0.0/0 -d 0.0.0.0/0
/sbin/iptables -A FORWARD -j LOG -s 0.0.0.0/0 -d 0.0.0.0/0
/sbin/iptables -A FORWARD -j DROP -s 0.0.0.0/0 -d 0.0.0.0/0
Please CC me any answer so I'm sure to get them, I'm not subscribed to the
list.
--
Daniel Desages
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2003-02-01 12:16 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2003-02-01 12:16 Strange firewall problem, help needed Daniel Desages
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox