From mboxrd@z Thu Jan 1 00:00:00 1970 From: =?iso-8859-1?Q?Leonardo_Rodrigues_Magalh=E3es?= Subject: Re: Help on IPTABLES Date: Sat, 11 Oct 2003 11:32:37 -0300 Sender: netfilter-admin@lists.netfilter.org Message-ID: <001901c39004$861778e0$8b00000a@casa> References: <3F855272.2080201@novelgmt.intnet.mu> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0016_01C38FEB.5F77D040" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: info , netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------=_NextPart_000_0016_01C38FEB.5F77D040 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable You'll probably browse with no problems if you use IP addresses. If = you try to browse using names (www.something.com), you'll need to do a = DNS request for the IP of that hostname. The request will go out with no = problems, as OUTPUT is ACCEPT. But DNS reply will be blocked, as INPUT = only allows port 80 traffic. For allowing web browsing ONLY, you'll have to allow AT LEAST = packets with source port 53 (TCP and UDP - almost all will be UDP but = TCP can be also used). Dont forget HTTPS too, which is port 443. You should also analyse the RH-Lokkit-0-50-INPUT chain. As packets = are getting to this chain BEFORE reaching your rules, if something gets = blocked there, it will NEVER reach YOUR rules. For static rules, you can create them on /etc/rc.d/rc.local. This = file will be executed after ALL daemons got UP on the reboot process. Sincerily, Leonardo Rodrigues ----- Original Message -----=20 From: info=20 To: netfilter@lists.netfilter.org=20 Sent: Thursday, October 09, 2003 9:20 AM Subject: Help on IPTABLES hi all, Can somebody explain to me why is when i changed my Chain INPUT Rules = from ACCEPT to DROP, i cannot browse the internet despite opening port = 80 in the INPUT rule. However, when Chain INPUT is changed to ACCEPT, browsing the internet = works fine. (Note: CHAIN Output is accept for ALL) The configurations on my IPTABLES are as follows Chain INPUT (policy DROP) target prot opt source destination RH-Lokkit-0-50-INPUT all -- anywhere anywhere ACCEPT tcp -- anywhere anywhere tcp = spt:http ACCEPT udp -- anywhere anywhere udp = spt:http Note that my OUTPUT Rules are as follows: Chain OUTPUT (policy ACCEPT) target prot opt source destination I have two network cards installed on my pc - running Red Hat 9.0 Routing for static routes are follows: xx.yy.zz.aa 0.0.0.0 255.255.255.0 U 0 0 = 0 eth0 xx.0.0.0 0.0.0.0 255.0.0.0 U 0 0 = 0 eth1 127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 = 0 lo 0.0.0.0 zz.zz.zz.zz 0.0.0.0 UG 0 0 = 0 eth0 0.0.0.0 zz.zz.zz.zz 0.0.0.0 UG 0 0 = 0 eth1 where zz.zz.zz.zz is my gateway to the internet. eth0 - Interface with local address eth1 - Interface with Internet address. By the way, is there a way to save static routes because when i reboot = my pc, all routes are lost. Thanks for any help. guy ------=_NextPart_000_0016_01C38FEB.5F77D040 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
 
    You'll probably = browse with no=20 problems if you use IP addresses. If you try to browse using names (www.something.com), you'll need to = do a DNS=20 request for the IP of that hostname. The request will go out with no = problems,=20 as OUTPUT is ACCEPT. But DNS reply will be blocked, as INPUT only allows = port 80=20 traffic.
 
    For allowing web = browsing ONLY,=20 you'll have to allow AT LEAST packets with source port 53 (TCP and UDP - = almost=20 all will be UDP but TCP can be also used). Dont forget HTTPS too, which = is port=20 443.
 
    You should also = analyse the=20 RH-Lokkit-0-50-INPUT chain. As packets are getting to this = chain BEFORE=20 reaching your rules, if something gets blocked there, it will NEVER = reach YOUR=20 rules.
 
    For static rules, = you can create=20 them on /etc/rc.d/rc.local. This file will be executed after ALL daemons = got UP=20 on the reboot process.
 
    = Sincerily,
    Leonardo = Rodrigues
 
----- Original Message -----
From:=20 info
To: netfilter@lists.netfilter.o= rg=20
Sent: Thursday, October 09, = 2003 9:20=20 AM
Subject: Help on IPTABLES

hi all,

 Can somebody explain to me why is = when i=20 changed my Chain INPUT Rules from ACCEPT to DROP, i cannot browse the = internet=20 despite opening port 80 in the INPUT rule.
However, when Chain = INPUT is=20 changed to ACCEPT, browsing the internet works fine. (Note: CHAIN = Output is=20 accept for ALL)


The configurations on my IPTABLES are as=20 follows

Chain INPUT (policy=20 DROP)
target     prot opt=20 = source           &= nbsp;  =20 destination
RH-Lokkit-0-50-INPUT  all  -- =20 = anywhere           = ; =20 anywhere
ACCEPT     tcp  -- =20 = anywhere           = ; =20 anywhere           = tcp=20 spt:http
ACCEPT     udp  -- =20 = anywhere           = ; =20 anywhere           = udp=20 spt:http

Note that my OUTPUT Rules are as follows:

Chain OUTPUT (policy=20 ACCEPT)
target     prot opt=20 = source           &= nbsp;  =20 destination

I have two network cards installed on my pc - = running Red=20 Hat 9.0

Routing for static routes are follows:

xx.yy.zz.aa=20       =20 0.0.0.0        =20 255.255.255.0       U     = 0      = 0        0=20 eth0
xx.0.0.0        =   =20 0.0.0.0        =20 255.0.0.0          =20 U     0     =20 0        0=20 eth1
127.0.0.0         =20 0.0.0.0        =20 255.0.0.0          =20 U     0     =20 0        0=20 lo
0.0.0.0         =   =20 zz.zz.zz.zz      =20 0.0.0.0          =20 UG    0     =20 0        0=20 eth0
0.0.0.0         =   =20 zz.zz.zz.zz      =20 0.0.0.0          =20 UG    0     =20 0        0 eth1

where = zz.zz.zz.zz is my gateway to the internet.
eth0 - Interface with = local=20 address
eth1 - Interface with Internet address.

By the way, = is there=20 a way to save static routes because when i reboot my pc, all routes = are=20 lost.

Thanks for any=20 help.

guy


------=_NextPart_000_0016_01C38FEB.5F77D040--