From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Tim" Subject: seeking heavy weaponry !! Date: Sun, 7 Jul 2002 16:32:44 -0700 Sender: netfilter-admin@lists.samba.org Message-ID: <002201c2260e$b9fd7b70$28d33cd0@nebuchadnezza> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_001F_01C225D3.EC12FDF0" Return-path: Errors-To: netfilter-admin@lists.samba.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: iptables This is a multi-part message in MIME format. ------=_NextPart_000_001F_01C225D3.EC12FDF0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hey ppl, In Rusty Russell's packet filtering HOWTO there is an introduction, (to = make short), "This HOWTO flips between a gentle introduction (which will = leave you feeling warm and fuzzy now, but unprotected in the real world) = and raw full-disclosure (which would leave all but the hardiest souls = confused, paranoid and seeking heavy weaponry)." I feel like the latter, seeking heavy weaponry, I must be missing = (obviously, since I'm writing to the list) something in my configuration = of either the script or the box itself. This is what my script looks = like: #!/bin/bash # # This is my first attempt at a personalized iptables script # # ## Variables ## LOOPBACK=3D"lo" ## Loopback = Interface EXTERNAL_NET=3D"eth0" ## External Interface DMZ_NET=3D"eth1" ## DMZ Interface INTERNAL_NET=3D"eth2" ## Internal Interface # # INTERNAL=3D"192.168.1.0/24" ## Network address for = internal network DMZ=3D"172.16.1.0/24" ## Network address = for the DMZ EXTERNAL=3D"192.168.2.0/24" ## Network address for = external network # # ##INT_IP=3D"192.168.1.11" ## IP address of = Internal Interface INT_IP=3D`ifconfig $INTERNAL_NET | grep "inet addr" | cut -d ":" -f 2 = | cut -d " " -f 1` # ##DMZ_IP=3D"172.16.1.1" ## IP address of DMZ = Interface DMZ_IP=3D`ifconfig $DMZ_NET | grep "inet addr" | cut -d ":" -f 2 | cut = -d " " -f 1` # ##EXT_IP=3D"192.168.2.1" ## IP address of External = Interface EXT_IP=3D`ifconfig $EXTERNAL_NET | grep "inet addr" | cut -d ":" -f 2 = | cut -d " " -f 1` # LOG_LEVEL=3D"notice" ## Default log level: kern.notice: # ## Routing packets (traffic) between interfaces=20 echo 1 > /proc/sys/net/ipv4/ip_forward # # echo "[---Flushing the chains---]" iptables -F iptables -F INPUT iptables -F OUTPUT iptables -F FORWARD # # # echo "[--Setting Policies--]" iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD ACCEPT # # ## Allow inside traffic to get to the DMZ and back iptables -A FORWARD -i $INTERNAL_NET -o $DMZ_NET -j ACCEPT iptables -A FORWARD -i $DMZ_NET -o $INTERNAL_NET -j ACCEPT iptables -A INPUT -i $INTERNAL_NET -s 192.168.1.0/24 -d 172.16.1.0/24 -p = icmp -j ACCEPT iptables -A OUTPUT -o $DMZ_NET -s 172.16.1.0/24 -d 192.168.1.0/24 -p = icmp -j ACCEPT iptables -A INPUT -i $DMZ_NET -s 192.168.1.0/24 -d 172.16.1.0/24 -p icmp = -j ACCEPT iptables -A OUTPUT -o $INTERNAL_NET -s 192.168.1.0/24 -d 172.16.1.0/24 = -p icmp -j ACCEPT # # After I loaded the script and verified with the command iptables -L I go = to one of my internal machines and attempt to ping one of the two = machines on the DMZ to no avail. I checked that the machine I'm pinging = from has a default gateway...this would be the address of eth2. The = command to allow ip_forwarding is on the script and I get no errors when = I load the script or do I need to set the default gateways for each of = the NICs on the firewall machine? I have tried this both ways ..... = there is also a setting in the network configuration utility that will = allow me to enable ip forwarding....I have also tried it with this. = Hence, "seeking heavy weaponry", I generally understand the concept, = however putting it into action is another story, which I'm sure some of = you might have witnessed yourselves. This is the output of the command iptables -L -n -v after I performed = the ping from an internal machine to one of the DMZ machines. Chain INPUT (policy DROP 2 packets, 310 bytes) pkts bytes target prot opt in out source = destination =20 0 0 ACCEPT icmp -- eth2 * 192.168.1.0/24 = 172.16.1.0/24 =20 0 0 ACCEPT icmp -- eth1 * 192.168.1.0/24 = 172.16.1.0/24 =20 Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source = destination =20 0 0 ACCEPT all -- eth2 eth1 0.0.0.0/0 = 0.0.0.0/0 =20 0 0 ACCEPT all -- eth1 eth2 0.0.0.0/0 = 0.0.0.0/0 =20 Chain OUTPUT (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source = destination =20 0 0 ACCEPT icmp -- * eth1 172.16.1.0/24 = 192.168.1.0/24 =20 0 0 ACCEPT icmp -- * eth2 192.168.1.0/24 = 172.16.1.0/24 =20 As you can see the packets are making it to the INPUT chain but it is = either being dropped at the INPUT chain because of incorrect rule = structure or it is not being forwarded out through the FORWARD = chain.....routing ??? Any insights will be gratefully appreciated. I = dislike violence, so any input into a resolution and/or pointer to = documentation will keep me from seeking any need for heavy weaponry. Tim Rodriguez-- Mia/Fla. Network Security Student -- 90% of networking problems are routing problems. 9 of the remaining 10% are routing problems, but in the other direction. The final 1% might not be routing, but check it anyway. -- ------=_NextPart_000_001F_01C225D3.EC12FDF0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Hey ppl,
 
In Rusty Russell's packet filtering = HOWTO there is=20 an introduction, (to make short), "This HOWTO flips between a gentle=20 introduction (which will leave you feeling warm and fuzzy now, but = unprotected=20 in the real world) and raw full-disclosure (which would leave all but = the=20 hardiest souls confused, paranoid and seeking heavy = weaponry)."
 
I feel like the latter, seeking heavy = weaponry, I=20 must be missing (obviously, since I'm writing to the list) something in = my=20 configuration of either the script or the box itself. This is what my = script=20 looks like:
 
#!/bin/bash
#
# This is my first = attempt at a=20 personalized iptables script #
#
## Variables=20 ##
LOOPBACK=3D"lo"        &nbs= p;            = ;  =20             =    =20  ## Loopback=20 Interface
EXTERNAL_NET=3D"eth0"      &nb= sp; =20            =20        ## External=20 Interface
DMZ_NET=3D"eth1"      =20         =       =20             =     ##=20 DMZ Interface
INTERNAL_NET=3D"eth2"     =20             =    =20         ## Internal=20 Interface
#
#
INTERNAL=3D"192.168.1.0/24"    = ;            =     =20 ## Network address for internal=20 network
DMZ=3D"172.16.1.0/24"       = ;            =            =20 ## Network address for the=20 DMZ
EXTERNAL=3D"192.168.2.0/24"     =20             ## Network = address for=20 external=20 network
#
#
##INT_IP=3D"192.168.1.11"    &nb= sp; =20             =     ##=20 IP address of Internal Interface
  INT_IP=3D`ifconfig = $INTERNAL_NET | grep=20 "inet addr" | cut -d ":" -f 2 | cut -d " " -f=20 1`
#
##DMZ_IP=3D"172.16.1.1"     =20            =20       ## IP address of DMZ Interface
 =20 DMZ_IP=3D`ifconfig $DMZ_NET | grep "inet addr" | cut -d ":" -f 2 | cut = -d " " -f=20 1`
#
##EXT_IP=3D"192.168.2.1"      &n= bsp;           &nb= sp;   ##=20 IP address of External Interface
  EXT_IP=3D`ifconfig = $EXTERNAL_NET | grep=20 "inet addr" | cut -d ":" -f 2 | cut -d " " -f=20 1`
#
LOG_LEVEL=3D"notice"   ## Default log level:=20 kern.notice:
#
## Routing packets (traffic) between interfaces =
echo 1=20 > /proc/sys/net/ipv4/ip_forward
#
#
echo "[---Flushing the=20 chains---]"
iptables -F
iptables -F INPUT
iptables -F=20 OUTPUT
iptables -F FORWARD
#
#
#
echo "[--Setting=20 Policies--]"
iptables -P INPUT DROP
iptables -P OUTPUT = DROP
iptables -P=20 FORWARD ACCEPT
#
#
## Allow inside traffic to get to the DMZ = and=20 back
iptables -A FORWARD -i $INTERNAL_NET -o $DMZ_NET -j = ACCEPT
iptables=20 -A FORWARD -i $DMZ_NET -o $INTERNAL_NET -j ACCEPT
iptables -A INPUT = -i=20 $INTERNAL_NET -s 192.168.1.0/24 -d 172.16.1.0/24 -p icmp -j = ACCEPT
iptables=20 -A OUTPUT -o $DMZ_NET -s 172.16.1.0/24 -d 192.168.1.0/24 -p icmp -j=20 ACCEPT
iptables -A INPUT -i $DMZ_NET -s 192.168.1.0/24 -d = 172.16.1.0/24 -p=20 icmp -j ACCEPT
iptables -A OUTPUT -o $INTERNAL_NET -s 192.168.1.0/24 = -d=20 172.16.1.0/24 -p icmp -j ACCEPT
#
#
After I loaded the script and verified = with the=20 command iptables -L I go to one of my internal machines and attempt to = ping one=20 of the two machines on the DMZ to no avail. I checked that the machine = I'm=20 pinging from has a default gateway...this would be the address of eth2. = The=20 command to allow ip_forwarding is on the script and I get no errors when = I load=20 the script or do I need to set the default gateways for each of the NICs = on the=20 firewall machine? I have tried this both ways ..... there is also a = setting in=20 the network configuration utility that will allow me to enable ip=20 forwarding....I have also tried it with this. Hence, "seeking heavy = weaponry", I=20 generally understand the concept, however putting it into action is = another=20 story, which I'm sure some of you might have witnessed = yourselves.
 
This is the output of the command = iptables -L -n -v=20 after I performed the ping from an internal machine to one of the DMZ=20 machines.
 
Chain INPUT (policy DROP 2 packets, 310 = bytes)
 pkts bytes target     prot opt=20 in     out    =20 source           &= nbsp;  =20 destination        =20
    0     0=20 ACCEPT     icmp --  eth2  =20 *      =20 192.168.1.0/24      =20 172.16.1.0/24     
   =20 0     0 ACCEPT     icmp --  = eth1   *      =20 192.168.1.0/24      =20 172.16.1.0/24     
 
Chain FORWARD (policy ACCEPT 0 packets, = 0=20 bytes)
 pkts bytes target     prot opt=20 in     out    =20 source           &= nbsp;  =20 destination        =20
    0     0=20 ACCEPT     all  --  eth2  =20 eth1   =20 0.0.0.0/0          &nbs= p;=20 0.0.0.0/0         =20
    0     0=20 ACCEPT     all  --  eth1  =20 eth2   =20 0.0.0.0/0          &nbs= p;=20 0.0.0.0/0          =
 
Chain OUTPUT (policy DROP 0 packets, 0=20 bytes)
 pkts bytes target     prot opt=20 in     out    =20 source           &= nbsp;  =20 destination        =20
    0     0=20 ACCEPT     icmp --  = *     =20 eth1    = 172.16.1.0/24       =20 192.168.1.0/24    
   =20 0     0 ACCEPT     icmp --  = *      eth2   =20 192.168.1.0/24      =20 172.16.1.0/24   
 
As you can see the packets are making = it to the=20 INPUT chain but it is either being dropped at the INPUT chain because of = incorrect rule structure or it is not being forwarded out through the = FORWARD=20 chain.....routing ??? Any insights will be gratefully appreciated. I = dislike=20 violence, so any input into a resolution and/or pointer to documentation = will=20 keep me from seeking any need for heavy weaponry.
 
Tim Rodriguez-- Mia/Fla.
Network = Security=20 Student
--
90% of networking problems are routing=20 problems.
9 of the remaining 10% are routing problems, but in the = other=20 direction.
The final 1% might not be routing, but check it=20 anyway.
--
 
------=_NextPart_000_001F_01C225D3.EC12FDF0--