Re: seeking heavy weaponry !!

Re: seeking heavy weaponry !!

[Antony Stone]

On Monday 08 July 2002 12:32 am, Tim wrote:

> Hey ppl,
>
> echo "[--Setting Policies--]"
> iptables -P INPUT DROP
> iptables -P OUTPUT DROP
> iptables -P FORWARD ACCEPT

Please set this one to DROP as well :-)

> #
> #
> ## Allow inside traffic to get to the DMZ and back
> iptables -A FORWARD -i $INTERNAL_NET -o $DMZ_NET -j ACCEPT
> iptables -A FORWARD -i $DMZ_NET -o $INTERNAL_NET -j ACCEPT
> iptables -A INPUT -i $INTERNAL_NET -s 192.168.1.0/24 -d 172.16.1.0/24
> -p icmp -j ACCEPT
> iptables -A OUTPUT -o $DMZ_NET -s 172.16.1.0/24 -d 192.168.1.0/24 -p icmp
> -j ACCEPT
> iptables -A INPUT -i $DMZ_NET -s 192.168.1.0/24 -d 172.16.1.0/24 -p icmp
> -j ACCEPT
> iptables -A OUTPUT -o $INTERNAL_NET -s 192.168.1.0/24 -d 172.16.1.0/24
> -p icmp -j ACCEPT #

You seem to have a big misunderstanding of how packets go through the chains 
in iptables (hint: it's very different from ipchains...)

The INPUT chain is *only* for packets addressed to the firewall itself.

The FORWARD chain is *only* for packets going through the firewall from a 
machine on one side to another machine on the other.

The OUTPUT chain is *only* for packets originated on the firewall itself.

No packet will ever go through both INPUT and FORWARD, or through both 
FORWARD and OUTPUT.

 

Antony.

seeking heavy weaponry !!

[Tim]

[-- Attachment #1: Type: text/plain, Size: 5206 bytes --]

Hey ppl,

In Rusty Russell's packet filtering HOWTO there is an introduction, (to make short), "This HOWTO flips between a gentle introduction (which will leave you feeling warm and fuzzy now, but unprotected in the real world) and raw full-disclosure (which would leave all but the hardiest souls confused, paranoid and seeking heavy weaponry)."

I feel like the latter, seeking heavy weaponry, I must be missing (obviously, since I'm writing to the list) something in my configuration of either the script or the box itself. This is what my script looks like:

#!/bin/bash
#
# This is my first attempt at a personalized iptables script #
#
## Variables ##
LOOPBACK="lo"                                         ## Loopback Interface
EXTERNAL_NET="eth0"                              ## External Interface
DMZ_NET="eth1"                                       ## DMZ Interface
INTERNAL_NET="eth2"                              ## Internal Interface
#
#
INTERNAL="192.168.1.0/24"                     ## Network address for internal network
DMZ="172.16.1.0/24"                               ## Network address for the DMZ
EXTERNAL="192.168.2.0/24"                   ## Network address for external network
#
#
##INT_IP="192.168.1.11"                        ## IP address of Internal Interface
  INT_IP=`ifconfig $INTERNAL_NET | grep "inet addr" | cut -d ":" -f 2 | cut -d " " -f 1`
#
##DMZ_IP="172.16.1.1"                        ## IP address of DMZ Interface
  DMZ_IP=`ifconfig $DMZ_NET | grep "inet addr" | cut -d ":" -f 2 | cut -d " " -f 1`
#
##EXT_IP="192.168.2.1"                      ## IP address of External Interface
  EXT_IP=`ifconfig $EXTERNAL_NET | grep "inet addr" | cut -d ":" -f 2 | cut -d " " -f 1`
#
LOG_LEVEL="notice"   ## Default log level: kern.notice:
#
## Routing packets (traffic) between interfaces 
echo 1 > /proc/sys/net/ipv4/ip_forward
#
#
echo "[---Flushing the chains---]"
iptables -F
iptables -F INPUT
iptables -F OUTPUT
iptables -F FORWARD
#
#
#
echo "[--Setting Policies--]"
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD ACCEPT
#
#
## Allow inside traffic to get to the DMZ and back
iptables -A FORWARD -i $INTERNAL_NET -o $DMZ_NET -j ACCEPT
iptables -A FORWARD -i $DMZ_NET -o $INTERNAL_NET -j ACCEPT
iptables -A INPUT -i $INTERNAL_NET -s 192.168.1.0/24 -d 172.16.1.0/24 -p icmp -j ACCEPT
iptables -A OUTPUT -o $DMZ_NET -s 172.16.1.0/24 -d 192.168.1.0/24 -p icmp -j ACCEPT
iptables -A INPUT -i $DMZ_NET -s 192.168.1.0/24 -d 172.16.1.0/24 -p icmp -j ACCEPT
iptables -A OUTPUT -o $INTERNAL_NET -s 192.168.1.0/24 -d 172.16.1.0/24 -p icmp -j ACCEPT
#
#
After I loaded the script and verified with the command iptables -L I go to one of my internal machines and attempt to ping one of the two machines on the DMZ to no avail. I checked that the machine I'm pinging from has a default gateway...this would be the address of eth2. The command to allow ip_forwarding is on the script and I get no errors when I load the script or do I need to set the default gateways for each of the NICs on the firewall machine? I have tried this both ways ..... there is also a setting in the network configuration utility that will allow me to enable ip forwarding....I have also tried it with this. Hence, "seeking heavy weaponry", I generally understand the concept, however putting it into action is another story, which I'm sure some of you might have witnessed yourselves.

This is the output of the command iptables -L -n -v after I performed the ping from an internal machine to one of the DMZ machines.

Chain INPUT (policy DROP 2 packets, 310 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     icmp --  eth2   *       192.168.1.0/24       172.16.1.0/24      
    0     0 ACCEPT     icmp --  eth1   *       192.168.1.0/24       172.16.1.0/24      

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  eth2   eth1    0.0.0.0/0            0.0.0.0/0          
    0     0 ACCEPT     all  --  eth1   eth2    0.0.0.0/0            0.0.0.0/0          

Chain OUTPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     icmp --  *      eth1    172.16.1.0/24        192.168.1.0/24     
    0     0 ACCEPT     icmp --  *      eth2    192.168.1.0/24       172.16.1.0/24    

As you can see the packets are making it to the INPUT chain but it is either being dropped at the INPUT chain because of incorrect rule structure or it is not being forwarded out through the FORWARD chain.....routing ??? Any insights will be gratefully appreciated. I dislike violence, so any input into a resolution and/or pointer to documentation will keep me from seeking any need for heavy weaponry.

Tim Rodriguez-- Mia/Fla.
Network Security Student
--
90% of networking problems are routing problems.
9 of the remaining 10% are routing problems, but in the other direction.
The final 1% might not be routing, but check it anyway.
--


[-- Attachment #2: Type: text/html, Size: 9372 bytes --]