Hey ppl, In Rusty Russell's packet filtering HOWTO there is an introduction, (to make short), "This HOWTO flips between a gentle introduction (which will leave you feeling warm and fuzzy now, but unprotected in the real world) and raw full-disclosure (which would leave all but the hardiest souls confused, paranoid and seeking heavy weaponry)." I feel like the latter, seeking heavy weaponry, I must be missing (obviously, since I'm writing to the list) something in my configuration of either the script or the box itself. This is what my script looks like: #!/bin/bash # # This is my first attempt at a personalized iptables script # # ## Variables ## LOOPBACK="lo" ## Loopback Interface EXTERNAL_NET="eth0" ## External Interface DMZ_NET="eth1" ## DMZ Interface INTERNAL_NET="eth2" ## Internal Interface # # INTERNAL="192.168.1.0/24" ## Network address for internal network DMZ="172.16.1.0/24" ## Network address for the DMZ EXTERNAL="192.168.2.0/24" ## Network address for external network # # ##INT_IP="192.168.1.11" ## IP address of Internal Interface INT_IP=`ifconfig $INTERNAL_NET | grep "inet addr" | cut -d ":" -f 2 | cut -d " " -f 1` # ##DMZ_IP="172.16.1.1" ## IP address of DMZ Interface DMZ_IP=`ifconfig $DMZ_NET | grep "inet addr" | cut -d ":" -f 2 | cut -d " " -f 1` # ##EXT_IP="192.168.2.1" ## IP address of External Interface EXT_IP=`ifconfig $EXTERNAL_NET | grep "inet addr" | cut -d ":" -f 2 | cut -d " " -f 1` # LOG_LEVEL="notice" ## Default log level: kern.notice: # ## Routing packets (traffic) between interfaces echo 1 > /proc/sys/net/ipv4/ip_forward # # echo "[---Flushing the chains---]" iptables -F iptables -F INPUT iptables -F OUTPUT iptables -F FORWARD # # # echo "[--Setting Policies--]" iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD ACCEPT # # ## Allow inside traffic to get to the DMZ and back iptables -A FORWARD -i $INTERNAL_NET -o $DMZ_NET -j ACCEPT iptables -A FORWARD -i $DMZ_NET -o $INTERNAL_NET -j ACCEPT iptables -A INPUT -i $INTERNAL_NET -s 192.168.1.0/24 -d 172.16.1.0/24 -p icmp -j ACCEPT iptables -A OUTPUT -o $DMZ_NET -s 172.16.1.0/24 -d 192.168.1.0/24 -p icmp -j ACCEPT iptables -A INPUT -i $DMZ_NET -s 192.168.1.0/24 -d 172.16.1.0/24 -p icmp -j ACCEPT iptables -A OUTPUT -o $INTERNAL_NET -s 192.168.1.0/24 -d 172.16.1.0/24 -p icmp -j ACCEPT # # After I loaded the script and verified with the command iptables -L I go to one of my internal machines and attempt to ping one of the two machines on the DMZ to no avail. I checked that the machine I'm pinging from has a default gateway...this would be the address of eth2. The command to allow ip_forwarding is on the script and I get no errors when I load the script or do I need to set the default gateways for each of the NICs on the firewall machine? I have tried this both ways ..... there is also a setting in the network configuration utility that will allow me to enable ip forwarding....I have also tried it with this. Hence, "seeking heavy weaponry", I generally understand the concept, however putting it into action is another story, which I'm sure some of you might have witnessed yourselves. This is the output of the command iptables -L -n -v after I performed the ping from an internal machine to one of the DMZ machines. Chain INPUT (policy DROP 2 packets, 310 bytes) pkts bytes target prot opt in out source destination 0 0 ACCEPT icmp -- eth2 * 192.168.1.0/24 172.16.1.0/24 0 0 ACCEPT icmp -- eth1 * 192.168.1.0/24 172.16.1.0/24 Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 ACCEPT all -- eth2 eth1 0.0.0.0/0 0.0.0.0/0 0 0 ACCEPT all -- eth1 eth2 0.0.0.0/0 0.0.0.0/0 Chain OUTPUT (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 ACCEPT icmp -- * eth1 172.16.1.0/24 192.168.1.0/24 0 0 ACCEPT icmp -- * eth2 192.168.1.0/24 172.16.1.0/24 As you can see the packets are making it to the INPUT chain but it is either being dropped at the INPUT chain because of incorrect rule structure or it is not being forwarded out through the FORWARD chain.....routing ??? Any insights will be gratefully appreciated. I dislike violence, so any input into a resolution and/or pointer to documentation will keep me from seeking any need for heavy weaponry. Tim Rodriguez-- Mia/Fla. Network Security Student -- 90% of networking problems are routing problems. 9 of the remaining 10% are routing problems, but in the other direction. The final 1% might not be routing, but check it anyway. --