Iptables Problems

Iptables Problems

[testmail]

Hi,

Im using Fedora Core 2 and was trying iptables for the first time. I'm setting a firewall between the internet 
and my private network wherein my server(behind firewall) is running FTP(wu-fptd) and SMB

My iptable configuration should be :                    
       
                   1. Filter all incomming FTP request (should have the ability to filter specific ip that is comming from the public network).
                   2. SMB request from the Internet should be block.
                   3. Drop all ports that is not being used by SMB and FTP.
                   4. Can browse the internet

My current iptable config is not working at all.......Please Help!

>>>>>Current Setup<<<<<<

Server Setup

             1 network card with private ip eth0 and behind firewall


Iptable Config from Firewall and used also as a gateway.

    Net Card
                etho -- static ip from isp
                eth1 -- private ip

FromInternetSourceIP = '222.222.222.222'  sample ip
LocalIPFTPSMB = '192.168.0.2'

iptables -F
iptables -t nat -F
iptables -t mangle -F                                                                                 
               
# Set the default policy
iptables -t filter -A INPUT  -j DROP                                                                     
               
#Allow FTP Connection from this source ip
iptables -t filter -A INPUT -p tcp -s 192.168.0.1/24 -d $LocalIPFTPSMB --dport 20:21 -j ACCEPT
iptables -t filter -A INPUT -p tcp -s $FromInternetASourceIP -d LocalIPFTPSMB --dport 20:21 -j ACCEPT
                                                                                                           
# Smb Connections allowed from 192.168.0.1/24 network
iptables -A INPUT -i eth0 -p tcp -s 192.168.0.1/24 -d LocalIPFTPSMB --sport 137:139 -j ACCEPT                                                    

#Connect all WWW traffic using port 80
iptables -t nat -A POSTROUTING -s 192.168.0.1/24 -d 0/0 -p tcp --dport 80 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 192.168.0.1/24 -d 0/0-p tcp --dport 53 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 192.168.0.1/24 -d 0/0-p udp --dport 53 -j MASQUERADE                       
                                                    
#For logging                         
iptables -A OUTPUT -j LOG
iptables -A INPUT -j LOG
iptables -A FORWARD -j LOG


Milo

Re: Iptables Problems

[a.ledvinka]

> # Set the default policy
> iptables -t filter -A INPUT  -j DROP  
iptables -t filter -P INPUT DROP

Re: Iptables Problems

[testmail]

What does -P represent from your iptable command  >>>>> iptables -t
filter -P INPUT DROP ?
And thank you for the docu.link
http://www.netfilter.org/documentation/HOWTO/packet-filtering-HOWTO-6.html

I will try to understand first all the suggestion that you posted.

Thanks,
Milo
----- Original Message -----
From: <a.ledvinka@promon.cz>
To: "testmail" <testmail@peterpaul.com.ph>
Cc: "Netfilter" <netfilter@lists.netfilter.org>
Sent: Thursday, December 02, 2004 04:00 PM
Subject: Re: Iptables Problems


> > # Set the default policy
> > iptables -t filter -A INPUT  -j DROP
> iptables -t filter -P INPUT DROP

Re: Iptables Problems

[a.ledvinka]

as i read through i noticed you miss one realy important thing.
the chain traversal of incoming and outgoing packets.
http://www.netfilter.org/documentation/HOWTO/packet-filtering-HOWTO-6.html
that will teach you where you should add your rules.

don't use MASQUERADE but SNAT if your ip is static.

try to start your forward chain with following rules:
iptables -t filter -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS 
--clamp-mss-to-pmtu
iptables -t filter -A FORWARD -p icmp -m state --state RELATED,ESTABLISHED 
-j ACCEPT
### next rule drops icmp source quench which is not too god idea
### comsider adding rule like 
### iptables -t filter -A FORWARD -p icmp --icmp-type source-quench -j 
ACCEPT
### before next rule and also consider not to do it
iptables -t filter -A FORWARD -m state --state INVALID -j LOGDROP

and try to start your input chain with (same for output in case of drop 
policy):
iptables -t filter -A INPUT -p icmp -m state --state ESTABLISHED,RELATED 
-j ACCEPT

(don't forget to enable ip packets forwarding after you have set up your 
firewall. add line like:
net/ipv4/ip_forward = 1
into /etc/sysctl.conf and run "sysctl -p" 
)