Re: forwarding (continued)

Re: forwarding (continued)

[Antony Stone]

On Monday 08 July 2002 5:54 am, Tim wrote:

> Antony,
>
> INTERNAL IP = 192.168.1.0/24  -- range 1 thru 11
> DMZ IP = 172.16.1.0/24 -- range 1 thru 5
>
> The reason I believe I know it is not forwarding....is that when I ping
> from the DMZ I get a "request time out"

In fact I am fairly sure this is a routing problem.

The routing table on your firewall looks a little odd - what are the actual 
IP addresses on its interfaces ?

Also, what are the routing tables on the machine you're pinging from, and the 
machine you're pinging to ?

My guess at the moment is the machine being pinged doesn't have a route to 
reply by.

 

Antony.

RE: forwarding (continued)

[George Vieira]

[-- Attachment #1: Type: text/plain, Size: 1813 bytes --]

sure your haven natted icmp too?? or just tcp??

thanks,
George Vieira
Systems Manager
Citadel Computer Systems P/L
http://www.citadelcomputer.com.au <http://www.citadelcomputer.com.au/> 

-----Original Message-----
From: Tim [mailto:twr@bellsouth.net]
Sent: Monday, 08 July 2002 2:54 PM
To: iptables-list
Subject: Re: forwarding (continued)


Antony,
 
INTERNAL IP = 192.168.1.0/24  -- range 1 thru 11
DMZ IP = 172.16.1.0/24 -- range 1 thru 5
 
The reason I believe I know it is not forwarding....is that when I ping from
the DMZ I get a "request time out", although come to think of it, it is
actually giving me a response, its just not necessarily the response I want.
 
Well in any case I issue the command iptables -L -n -v and it reports that
packets did get to the forwarding rule it just looks like I got a "request
time out" response. So, (having some enlightenment), do I need to specify a
rule for icmp types here?
 
On the files attached I use ping from a box on the DMZ to ping an INTERNAL
box I ran the command "iptables -L -n -v -x and iptables -L -n -v -x -t nat"
and the results are in the files Lvnx and Lvnxtnat text files.
 
I then used ping from a box from an INTERNAL box to ping a DMZ box and ran
the same commands as mentioned and the results are in the Lvnx2 and
Lvnxtnat2 text file. The other files are obvious.
 
It really goes back to the sig, routing, routing and routing......I just
can't seem to put my finger on it. Thanks for the assist, I appreciate the
time and patience.
 
Tim Rodriguez
Network Security Student
--
To me, being a student means that misconceptions and errors
are a way of learning. Frustration means that I'm learning.
Perseverance is of the utmost if one wants to learn. Having
someone to turn to ask for clarification is invaluable.
 
Thank you.
--
 
 
 
 
 

[-- Attachment #2: Type: text/html, Size: 3456 bytes --]

RE: forwarding (continued)

[George Vieira]

[-- Attachment #1: Type: text/plain, Size: 206 bytes --]

sorry.. just noticed the attachments.. damn that Outlook...
;)
 

thanks,
George Vieira
Systems Manager
Citadel Computer Systems P/L
http://www.citadelcomputer.com.au <http://www.citadelcomputer.com.au/> 


[-- Attachment #2: Type: text/html, Size: 788 bytes --]

Re: forwarding (continued)

[Tim]

[-- Attachment #1.1: Type: text/plain, Size: 1487 bytes --]

Antony,

INTERNAL IP = 192.168.1.0/24  -- range 1 thru 11
DMZ IP = 172.16.1.0/24 -- range 1 thru 5

The reason I believe I know it is not forwarding....is that when I ping from the DMZ I get a "request time out", although come to think of it, it is actually giving me a response, its just not necessarily the response I want.

Well in any case I issue the command iptables -L -n -v and it reports that packets did get to the forwarding rule it just looks like I got a "request time out" response. So, (having some enlightenment), do I need to specify a rule for icmp types here?

On the files attached I use ping from a box on the DMZ to ping an INTERNAL box I ran the command "iptables -L -n -v -x and iptables -L -n -v -x -t nat" and the results are in the files Lvnx and Lvnxtnat text files.

I then used ping from a box from an INTERNAL box to ping a DMZ box and ran the same commands as mentioned and the results are in the Lvnx2 and Lvnxtnat2 text file. The other files are obvious.

It really goes back to the sig, routing, routing and routing......I just can't seem to put my finger on it. Thanks for the assist, I appreciate the time and patience.

Tim Rodriguez
Network Security Student
--
To me, being a student means that misconceptions and errors
are a way of learning. Frustration means that I'm learning.
Perseverance is of the utmost if one wants to learn. Having
someone to turn to ask for clarification is invaluable.

Thank you.
--


 



[-- Attachment #1.2: Type: text/html, Size: 2817 bytes --]

[-- Attachment #2: script.txt --]
[-- Type: text/plain, Size: 986 bytes --]

#!/bin/bash
#
# LEARNING IPTABLES SCRIPT
#
## Variables ##
EXTERNAL_NET="eth0"
DMZ_NET="eth1"
INTERNAL_NET="eth2"
#
INTERNAL="192.168.1.0/24"
DMZ="172.16.1.0/24"
EXTERNAL="192.168.2.0/24"
#
## Acquiring the ip address for the devices ##
INT_IP=`ifconfig $INTERNAL_NET | grep "inet addr" | cut -d ":" -f 2 | cut -d " " -f 1`
DMZ_IP=`ifconfig $DMZ_NET | grep "inet addr" | cut -d ":" -f 2 | cut -d " " -f 1`
EXT_IP=`ifconfig $EXTERNAL_NET | grep "inet addr" | cut -d ":" -f 2 | cut -d " " -f 1`

## Flush the chains ##
iptables -F
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
#
## Setting policies
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
#
## Enable routing ##
echo "1" > /proc/sys/net/ipv4/ip_forward
#
## Logging ##
LOG_LEVEL="notice"
#
## FORWARD traffic between INTERNAL and DMZ
iptables -A FORWARD -i $INTERNAL_NET -o $DMZ_NET -j ACCEPT
iptables -A FORWARD -i $DMZ_NET -o $INTERNAL_NET -j ACCEPT
#


[-- Attachment #3: Lnvx2.txt --]
[-- Type: text/plain, Size: 605 bytes --]

Chain INPUT (policy DROP 23 packets, 2629 bytes)
    pkts      bytes target     prot opt in     out     source        destination         

Chain FORWARD (policy DROP 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source        destination         
       0        0 ACCEPT     	all  --  eth2   eth1    0.0.0.0/0       0.0.0.0/0          
       0        0 ACCEPT    	all  --  eth1   eth2    0.0.0.0/0       0.0.0.0/0          

Chain OUTPUT (policy DROP 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source        destination         


[-- Attachment #4: Lnvxtnat.txt --]
[-- Type: text/plain, Size: 435 bytes --]

Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source        destination         

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source        destination         

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source        destination         


[-- Attachment #5: Lnvxtnat2.txt --]
[-- Type: text/plain, Size: 436 bytes --]

Chain PREROUTING (policy ACCEPT 32 packets, 4647 bytes)
    pkts      bytes target     prot opt in     out     source       destination         

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source       destination         

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source       destination         


[-- Attachment #6: route.txt --]
[-- Type: text/plain, Size: 650 bytes --]

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.2.0     192.168.2.2     255.255.255.0   UG    0      0        0 eth0
192.168.2.0     *               255.255.255.0   U     0      0        0 eth0
172.16.0.0      *               255.255.255.0   U     0      0        0 eth1
192.168.1.0     *               255.255.255.0   U     0      0        0 eth2
172.16.1.0      172.16.1.1      255.255.255.0   UG    0      0        0 eth1
172.16.1.0      *               255.255.255.0   U     0      0        0 eth1
127.0.0.0       *               255.0.0.0       U     0      0        0 lo


[-- Attachment #7: Lnvx.txt --]
[-- Type: text/plain, Size: 615 bytes --]

Chain INPUT (policy DROP 21 packets, 2705 bytes)
    pkts      bytes target     prot opt in     out     source       	destination         

Chain FORWARD (policy DROP 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source       	destination         
       0        0 ACCEPT      all  --  eth2   eth1    0.0.0.0/0         0.0.0.0/0          
       4      240 ACCEPT      all  --  eth1   eth2    0.0.0.0/0         0.0.0.0/0          

Chain OUTPUT (policy DROP 16 packets, 1186 bytes)
    pkts      bytes target     prot opt in     out     source       	 destination         

Re: forwarding (continued)

[Tim]

I'm pinging from INTERNAL = 192.168.1.4 and DMZ = 172.16.1.3 each one of
these machines has their own respective default gateway which are INTERNAL =
192.168.1.11 and DMZ = 172.16.1.1

----- Original Message -----
From: "Antony Stone" <Antony@Soft-Solutions.co.uk>
To: "iptables-list" <netfilter@lists.samba.org>
Sent: Sunday, July 07, 2002 7:05 PM
Subject: Re: forwarding (continued)


> On Monday 08 July 2002 5:54 am, Tim wrote:
>
> > Antony,
> >
> > INTERNAL IP = 192.168.1.0/24  -- range 1 thru 11
> > DMZ IP = 172.16.1.0/24 -- range 1 thru 5
> >
> > The reason I believe I know it is not forwarding....is that when I ping
> > from the DMZ I get a "request time out"
>
> In fact I am fairly sure this is a routing problem.
>
> The routing table on your firewall looks a little odd - what are the
actual
> IP addresses on its interfaces ?

Yes, I agree the routing table looks a little odd in the sense (from my
perspective) that there are only two interfaces that have a default gateway.
I had configured from the network configuration front-end for all to have
default gateways. The actual ipaddresses on the firewall box are .... eth0 =
192.168.2.1/eth1 = 172.16.1.1/eth2 = 192.168.1.11.

>
> Also, what are the routing tables on the machine you're pinging from, and
the
> machine you're pinging to ?

Does this mean that the default gateways (the NICs on the firewall box) are
not enough to route the packet through?
I just added a route to box 192.168.1.4 (an NT box INTERNAL) "route add -p
172.168.1.0 mask 255.255.255.0 192.168.1.11", and a route to box 172.16.1.5
(another NT box in the DMZ)  "route add -p 192.168.1.0 mask 255.255.255.0
172.16.1.1", to no avail....this can't be the answer.


> My guess at the moment is the machine being pinged doesn't have a route to
> reply by.

Each one of the machine has a default gateway (the NICs on the firewall box)
specified in the ip configuration.
I believe this to be true, but I believe the answer is in the firewall box
and the configuration of the rules.

>
>
>
> Antony.
>

Re: forwarding (continued)

[Antony Stone]

On Monday 08 July 2002 7:40 am, Tim wrote:

> I'm pinging from INTERNAL = 192.168.1.4 and DMZ = 172.16.1.3 each one of
> these machines has their own respective default gateway which are INTERNAL
> = 192.168.1.11 and DMZ = 172.16.1.1
>
> I agree the routing table looks a little odd in the sense (from my
> perspective) that there are only two interfaces that have a default
> gateway.

Slightly inappropriate terminology here.   A 'default gateway' does not apply 
to an interface, it applies to a whole machine; there should only be one 
default gateway on a machine (under most normal circumstances); and your 
machine does not have a default gateway.

Here is what you said your routing table on the firewall is:

Destination     Gateway         Genmask         Iface
192.168.2.0     192.168.2.2     255.255.255.0   eth0
192.168.2.0     *               255.255.255.0   eth0
172.16.0.0      *               255.255.255.0   eth1
192.168.1.0     *               255.255.255.0   eth2
172.16.1.0      172.16.1.1      255.255.255.0   eth1
172.16.1.0      *               255.255.255.0   eth1
127.0.0.0       *               255.0.0.0       lo

A default gateway is the address of a router to be used for any packets which 
don't match some other more specific route, and it is recognisable because 
the destination IP is 0.0.0.0 and the netmask is 0.0.0.0 (ie 'match 
everything').

> The actual ip addresses on the firewall box are
> .eth0 = 192.168.2.1 / eth1 = 172.16.1.1 / eth2 = 192.168.1.11.

> > Also, what are the routing tables on the machine you're pinging from, and
> > the machine you're pinging to ?
>
> Does this mean that the default gateways (the NICs on the firewall box) are
> not enough to route the packet through?

No, it just means I wanted to check they were correct :-)

> I just added a route to box 192.168.1.4 (an NT box INTERNAL) "route add -p
> 172.168.1.0 mask 255.255.255.0 192.168.1.11", and a route to box 172.16.1.5
> (another NT box in the DMZ)  "route add -p 192.168.1.0 mask 255.255.255.0
> 172.16.1.1", to no avail....this can't be the answer.

These entries are completely redundant.   You said in your last answer that 
each of these machines already had a default route of the address of the 
firewall on their respective networks.   Adding a more specific route to the 
other network, still using the firewall's IP as the gateway address, adds 
nothing to this (however it subtracts nothing either, so no harm done).

The routes on the machine you're pinging from (172.16.1.3) looks okay, and 
the routes on the machine you're pinging to (192.168.1.4) looks okay, however 
I still don't like the routes on your firewall now that you've told me what 
your IP addresses are.

Referring back to your firewall routing table listed above, I don't like the 
two lines with gateways listed.   They should not be there; the lines 
immediately following each of them handle routing to those two local networks.

Also, I don't quite understand why you have the line
172.16.0.0      *               255.255.255.0   eth1
in the table ?

Here's a quick routing table tutorial:

1. Packets being sent to a directly connected network (eg in your case 
192.168.1.0/24, 192.168.2.0/24 and 172.16.1.0/24) should only specify the 
interface name through which to send the packets - there should be no gateway 
listed, because the destination machine on the locally connected network is 
directly accessible without going through a gateway.

2. Packets going to networks not directly connected to the machine, but 
accessible on the other side of some router which is directly connected 
should be specified with the gateway address = IP of the router on the local 
network, and the interfacce = where the router is plugged into.

3. A default gateway (addr = 0.0.0.0, mask = 0.0.0.0) specifies where to send 
any packets which do not match any of the previously listed rules, and the 
gateway addr = IP of the router on the local network which knows how to send 
packets out to the Big Wide World.

Try removing the two entries in your firewall routing table which show 
gateway addresses:

192.168.2.0     192.168.2.2     255.255.255.0   eth0
172.16.1.0      172.16.1.1      255.255.255.0   eth1

Then re-run the pings and see what happens.

By the way, can you ping from the firewall to either/both of the machines ?

I assume your physical network cables are plugged in correctly and work :-) ?
Do you have link lights at both ends of all connections ?

 

Antony.

Re: forwarding (continued)

[Antony Stone]

On Monday 08 July 2002 5:23 pm, Tim wrote:

> > I don't quite understand why you have the line
> > 172.16.0.0      *               255.255.255.0   eth1
> > in the table ?
>
>  I have no idea how this got here to begin with, I certainly did no
> such configuration. (??)

Ah.   In that case you can blame the entire failure of this firewall to do 
what it's supposed to on the dreaded Firewall Reconfiguration Fairy, who 
comes along when you're not looking and messes with your routing table :-)

> Here is what Im going to do, Im going to remove all routes (except local)
> and re-establish a table that makes  more sense.

Sounds good to me.

> > By the way, can you ping from the firewall to either/both of the
> > machines ?

> Only if I have INPUT and OUTPUT rules in place.

Sounds like that would be a good thing to do (temporarily) just to make sure 
that A can talk to B, and B can reply to A, that B can talk to C, and C can 
reply to B, before taking the daring step of seeing whether A can talk to C 
through B and getting the reply back again as well :-)

 

Antony.

Re: forwarding (continued)

[Tim]

----- Original Message -----
From: "Antony Stone" <Antony@Soft-Solutions.co.uk>
To: "iptables-list" <netfilter@lists.samba.org>
Sent: Monday, July 08, 2002 12:54 AM
Subject: Re: forwarding (continued)


> On Monday 08 July 2002 7:40 am, Tim wrote:
>
> > I'm pinging from INTERNAL = 192.168.1.4 and DMZ = 172.16.1.3 each one of
> > these machines has their own respective default gateway which are
INTERNAL
> > = 192.168.1.11 and DMZ = 172.16.1.1
> >
> > I agree the routing table looks a little odd in the sense (from my
> > perspective) that there are only two interfaces that have a default
> > gateway.
>
> Slightly inappropriate terminology here.   A 'default gateway' does not
apply
> to an interface, it applies to a whole machine; there should only be one
> default gateway on a machine (under most normal circumstances); and your
> machine does not have a default gateway.

You are right, I guess that having the three NICs (something new for me)
in one machine threw me off. After writing last night I began looking at the
routing table a little closer and became aware that there is really no
routing taking place between the three NICs.

> Here is what you said your routing table on the firewall is:
>
> Destination     Gateway         Genmask         Iface
> 192.168.2.0     192.168.2.2     255.255.255.0   eth0
> 192.168.2.0     *               255.255.255.0   eth0
> 172.16.0.0      *               255.255.255.0   eth1
> 192.168.1.0     *               255.255.255.0   eth2
> 172.16.1.0      172.16.1.1      255.255.255.0   eth1
> 172.16.1.0      *               255.255.255.0   eth1
> 127.0.0.0       *               255.0.0.0       lo
>
> A default gateway is the address of a router to be used for any packets
which
> don't match some other more specific route, and it is recognisable because
> the destination IP is 0.0.0.0 and the netmask is 0.0.0.0 (ie 'match
> everything').
>
> > The actual ip addresses on the firewall box are
> > .eth0 = 192.168.2.1 / eth1 = 172.16.1.1 / eth2 = 192.168.1.11.
>
> > > Also, what are the routing tables on the machine you're pinging from,
and
> > > the machine you're pinging to ?
> >
> > Does this mean that the default gateways (the NICs on the firewall box)
are
> > not enough to route the packet through?
>
> No, it just means I wanted to check they were correct :-)
>
> > I just added a route to box 192.168.1.4 (an NT box INTERNAL) "route
add -p
> > 172.168.1.0 mask 255.255.255.0 192.168.1.11", and a route to box
172.16.1.5
> > (another NT box in the DMZ)  "route add -p 192.168.1.0 mask
255.255.255.0
> > 172.16.1.1", to no avail....this can't be the answer.
>
> These entries are completely redundant.   You said in your last answer
that
> each of these machines already had a default route of the address of the
> firewall on their respective networks.   Adding a more specific route to
the
> other network, still using the firewall's IP as the gateway address, adds
> nothing to this (however it subtracts nothing either, so no harm done).
>
> The routes on the machine you're pinging from (172.16.1.3) looks okay, and
> the routes on the machine you're pinging to (192.168.1.4) looks okay,
however
> I still don't like the routes on your firewall now that you've told me
what
> your IP addresses are.
>
> Referring back to your firewall routing table listed above, I don't like
the
> two lines with gateways listed.   They should not be there; the lines
> immediately following each of them handle routing to those two local
networks.

I wholeheartdly aggree......

> Also, I don't quite understand why you have the line
> 172.16.0.0      *               255.255.255.0   eth1
> in the table ?

 I have no idea how this got here to begin with, I certainly did no
such configuration. (??)

> Here's a quick routing table tutorial:
>
> 1. Packets being sent to a directly connected network (eg in your case
> 192.168.1.0/24, 192.168.2.0/24 and 172.16.1.0/24) should only specify the
> interface name through which to send the packets - there should be no
gateway
> listed, because the destination machine on the locally connected network
is
> directly accessible without going through a gateway.
>
> 2. Packets going to networks not directly connected to the machine, but
> accessible on the other side of some router which is directly connected
> should be specified with the gateway address = IP of the router on the
local > network, and the interfacce = where the router is plugged into.
>
> 3. A default gateway (addr = 0.0.0.0, mask = 0.0.0.0) specifies where to
send
> any packets which do not match any of the previously listed rules, and the
> gateway addr = IP of the router on the local network which knows how to
send
> packets out to the Big Wide World.
>
> Try removing the two entries in your firewall routing table which show
> gateway addresses:
>
> 192.168.2.0     192.168.2.2     255.255.255.0   eth0
> 172.16.1.0      172.16.1.1      255.255.255.0   eth1
>
> Then re-run the pings and see what happens.

Here is what Im going to do, Im going to remove all routes (except local)
and
re-establish a table that makes  more sense.

> By the way, can you ping from the firewall to either/both of the machines
?

Only if I have INPUT and OUTPUT rules in place.

> I assume your physical network cables are plugged in correctly and work
:-) ?
> Do you have link lights at both ends of all connections ?

Yes, all cabling has been done and tested correctly, if all boxes are on the
same subnet, I can ping all over the subnet to which ever machine there is.
I do believe
that this whole thing has to do with the firewall box and the way the
routing table is
configured or better yet ill-configured.

> Antony.
>