not able to ssh from the firewall

not able to ssh from the firewall

[varun]

Hello,

Basically I am allowing internet on the
firewall as well as nating to 2 clients.

I am not able to ssh from the firewall
to a client. Though the reverse is 
working.

I would also like to put :

-A OUTPUT -j DROP

But if I do that clients are not able to connect
to the net. I need add a rule which I could
not figure out.

Please comment and correct.

My rules as follows.


# Generated by iptables-save v1.3.3 on Sat Jul 22 13:14:10 2006
*nat
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o eth0 -s 192.168.15.0/24 -j MASQUERADE
COMMIT
# Completed on Sat Jul 22 13:14:10 2006
# Generated by iptables-save v1.3.3 on Sat Jul 22 13:14:10 2006
*mangle
:PREROUTING ACCEPT [80:13056]
:INPUT ACCEPT [80:13056]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [80:13056]
:POSTROUTING ACCEPT [80:13056]
COMMIT
# Completed on Sat Jul 22 13:14:10 2006
# Generated by iptables-save v1.3.3 on Sat Jul 22 13:14:10 2006
*filter
:INPUT ACCEPT [80:13056]
-A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -p tcp -i eth0 --dport 80 -j ACCEPT
-A INPUT -p tcp -i eth0 --dport 53 -j ACCEPT
-A INPUT -p udp -i eth0 --dport 53 -j ACCEPT
-A INPUT -i eth1 -p tcp --dport 22 -j ACCEPT
-A INPUT -i eth1 -p tcp --dport 21 -j ACCEPT
-A INPUT -j DROP
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [80:13056]
-A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j
ACCEPT
-A FORWARD -i eth1 -o eth0 -s 192.168.15.5 -j ACCEPT
-A FORWARD -i eth1 -o eth0 -s 192.168.15.9 -j ACCEPT
-A FORWARD -i eth1 -o eth0 -p tcp --dport 21 -j ACCEPT
-A FORWARD -i eth1 -o eth0 -p tcp --dport 25 -j ACCEPT
-A FORWARD -i eth1 -o eth0 -p tcp --dport 110 -j ACCEPT
-A FORWARD -i eth1 -o eth0 -p tcp --dport 119 -j ACCEPT
-A FORWARD -p udp --dport 53 -j ACCEPT
-A FORWARD -j DROP
-A OUTPUT -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
COMMIT
# Completed on Sat Jul 22 13:14:10 2006

                       ---------- end rules --------------

 

Thanks

Varun

RE: not able to ssh from the firewall

[Rob Sterenborg]

> Hello,
> 
> Basically I am allowing internet on the
> firewall as well as nating to 2 clients.
> 
> I am not able to ssh from the firewall
> to a client. Though the reverse is
> working.
> 
> I would also like to put :
> 
> -A OUTPUT -j DROP
> 
> But if I do that clients are not able to connect
> to the net. I need add a rule which I could
> not figure out.

You should allow SSH out when you want to be able to use it.
SSH listens on port 22, so this should do it:

-A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -p tcp --dport 22 -j ACCEPT
-A OUTPUT -j DROP

> Please comment and correct.
> 
> My rules as follows.
> 
> 
> # Generated by iptables-save v1.3.3 on Sat Jul 22 13:14:10 2006
> *nat
>: OUTPUT ACCEPT [0:0]
>: PREROUTING ACCEPT [0:0]
>: POSTROUTING ACCEPT [0:0]
> -A POSTROUTING -o eth0 -s 192.168.15.0/24 -j MASQUERADE
> COMMIT
> # Completed on Sat Jul 22 13:14:10 2006
> # Generated by iptables-save v1.3.3 on Sat Jul 22 13:14:10 2006
> *mangle
>: PREROUTING ACCEPT [80:13056]
>: INPUT ACCEPT [80:13056]
>: FORWARD ACCEPT [0:0]
>: OUTPUT ACCEPT [80:13056]
>: POSTROUTING ACCEPT [80:13056]
> COMMIT
> # Completed on Sat Jul 22 13:14:10 2006
> # Generated by iptables-save v1.3.3 on Sat Jul 22 13:14:10 2006
> *filter
>: INPUT ACCEPT [80:13056]
> -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

It looks like eth0 is connected to the internet and eth1 to your LAN.
Check if outgoing ssh works using:

-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

> -A INPUT -i lo -j ACCEPT
> -A INPUT -p icmp -j ACCEPT
> -A INPUT -p tcp -i eth0 --dport 80 -j ACCEPT
> -A INPUT -p tcp -i eth0 --dport 53 -j ACCEPT
> -A INPUT -p udp -i eth0 --dport 53 -j ACCEPT
> -A INPUT -i eth1 -p tcp --dport 22 -j ACCEPT
> -A INPUT -i eth1 -p tcp --dport 21 -j ACCEPT

So, you are accepting ftp for the firewall on eth1. See below (FORWARD).

> -A INPUT -j DROP
>: FORWARD ACCEPT [0:0]
>: OUTPUT ACCEPT [80:13056]
> -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED
> -j ACCEPT 

I would make that:

-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 

> -A FORWARD -i eth1 -o eth0 -s 192.168.15.5 -j ACCEPT
> -A FORWARD -i eth1 -o eth0 -s 192.168.15.9 -j ACCEPT
> -A FORWARD -i eth1 -o eth0 -p tcp --dport 21 -j ACCEPT

And you allow ftp forwarding on eth1 to eth0.
Either one (see above) is going to work, not both. Since you are
masquerading everything from 192.168.15.0/24 via eth0, I'd say this rule
has hits and the rule in the INPUT chain doesn't.
(Check with "iptables -nvL INPUT" and "iptables -nvL FORWARD".)

> -A FORWARD -i eth1 -o eth0 -p tcp --dport 25 -j ACCEPT
> -A FORWARD -i eth1 -o eth0 -p tcp --dport 110 -j ACCEPT
> -A FORWARD -i eth1 -o eth0 -p tcp --dport 119 -j ACCEPT
> -A FORWARD -p udp --dport 53 -j ACCEPT
> -A FORWARD -j DROP
> -A OUTPUT -j ACCEPT
> -A OUTPUT -o lo -j ACCEPT

This seems useless to me. There are no DROP rules in the OUTPUT chain
and policy is set to ACCEPT. These packets would be accepted anyway.

> COMMIT
> # Completed on Sat Jul 22 13:14:10 2006
> 
>                        ---------- end rules --------------

Instead of have a last rule with a DROP target, you can also just set
the chain policy to DROP.


Gr,
Rob

RE: not able to ssh from the firewall

[varun]

On Wed, 2006-09-06 at 07:31 +0200, Rob Sterenborg wrote:
> > Hello,
> > 
> > Basically I am allowing internet on the
> > firewall as well as nating to 2 clients.
> > 
> > I am not able to ssh from the firewall
> > to a client. Though the reverse is
> > working.
> > 
> > I would also like to put :
> > 
> > -A OUTPUT -j DROP
> > 
> > But if I do that clients are not able to connect
> > to the net. I need add a rule which I could
> > not figure out.
> 
> You should allow SSH out when you want to be able to use it.
> SSH listens on port 22, so this should do it:
> 
> -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
> -A OUTPUT -p tcp --dport 22 -j ACCEPT
> -A OUTPUT -j DROP

No that did not work.
> 
> > Please comment and correct.
> > 
> > My rules as follows.
> > 
> > 
> > # Generated by iptables-save v1.3.3 on Sat Jul 22 13:14:10 2006
> > *nat
> >: OUTPUT ACCEPT [0:0]
> >: PREROUTING ACCEPT [0:0]
> >: POSTROUTING ACCEPT [0:0]
> > -A POSTROUTING -o eth0 -s 192.168.15.0/24 -j MASQUERADE
> > COMMIT
> > # Completed on Sat Jul 22 13:14:10 2006
> > # Generated by iptables-save v1.3.3 on Sat Jul 22 13:14:10 2006
> > *mangle
> >: PREROUTING ACCEPT [80:13056]
> >: INPUT ACCEPT [80:13056]
> >: FORWARD ACCEPT [0:0]
> >: OUTPUT ACCEPT [80:13056]
> >: POSTROUTING ACCEPT [80:13056]
> > COMMIT
> > # Completed on Sat Jul 22 13:14:10 2006
> > # Generated by iptables-save v1.3.3 on Sat Jul 22 13:14:10 2006
> > *filter
> >: INPUT ACCEPT [80:13056]
> > -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
> 
> It looks like eth0 is connected to the internet and eth1 to your LAN.
> Check if outgoing ssh works using:
> 
> -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
> 
> > -A INPUT -i lo -j ACCEPT
> > -A INPUT -p icmp -j ACCEPT
> > -A INPUT -p tcp -i eth0 --dport 80 -j ACCEPT
> > -A INPUT -p tcp -i eth0 --dport 53 -j ACCEPT
> > -A INPUT -p udp -i eth0 --dport 53 -j ACCEPT
> > -A INPUT -i eth1 -p tcp --dport 22 -j ACCEPT
> > -A INPUT -i eth1 -p tcp --dport 21 -j ACCEPT
> 
> So, you are accepting ftp for the firewall on eth1. See below (FORWARD).
> 
> > -A INPUT -j DROP
> >: FORWARD ACCEPT [0:0]
> >: OUTPUT ACCEPT [80:13056]
> > -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED
> > -j ACCEPT 
> 
> I would make that:
> 
> -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 
> 
> > -A FORWARD -i eth1 -o eth0 -s 192.168.15.5 -j ACCEPT
> > -A FORWARD -i eth1 -o eth0 -s 192.168.15.9 -j ACCEPT
> > -A FORWARD -i eth1 -o eth0 -p tcp --dport 21 -j ACCEPT
> 
> And you allow ftp forwarding on eth1 to eth0.
> Either one (see above) is going to work, not both. Since you are
> masquerading everything from 192.168.15.0/24 via eth0, I'd say this rule
> has hits and the rule in the INPUT chain doesn't.
> (Check with "iptables -nvL INPUT" and "iptables -nvL FORWARD".)
> 
> > -A FORWARD -i eth1 -o eth0 -p tcp --dport 25 -j ACCEPT
> > -A FORWARD -i eth1 -o eth0 -p tcp --dport 110 -j ACCEPT
> > -A FORWARD -i eth1 -o eth0 -p tcp --dport 119 -j ACCEPT
> > -A FORWARD -p udp --dport 53 -j ACCEPT
> > -A FORWARD -j DROP
> > -A OUTPUT -j ACCEPT
> > -A OUTPUT -o lo -j ACCEPT
> 
> This seems useless to me. There are no DROP rules in the OUTPUT chain
> and policy is set to ACCEPT. These packets would be accepted anyway.
> 
> > COMMIT
> > # Completed on Sat Jul 22 13:14:10 2006
> > 
> >                        ---------- end rules --------------
> 
> Instead of have a last rule with a DROP target, you can also just set
> the chain policy to DROP.
> 
> 
> Gr,
> Rob
> 
> 
> 

RE: not able to ssh from the firewall

[Rob Sterenborg]

>>> I am not able to ssh from the firewall
>>> to a client. Though the reverse is
>>> working.
>>> 
>>> I would also like to put :
>>> 
>>> -A OUTPUT -j DROP
>>> 
>>> But if I do that clients are not able to connect
>>> to the net. I need add a rule which I could
>>> not figure out.
>> 
>> You should allow SSH out when you want to be able to use it.
>> SSH listens on port 22, so this should do it:
>> 
>> -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
>> -A OUTPUT -p tcp --dport 22 -j ACCEPT
>> -A OUTPUT -j DROP
> 
> No that did not work.

Of course not. AFAIK your current OUTPUT policy is still ACCEPT (see
below) so that should not be the problem. (Don't mess with the OUTPUT
chain untill your INPUT chain is working as you want it to.)

>>> :INPUT ACCEPT [80:13056]
>>> -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
>> 
>> It looks like eth0 is connected to the internet and eth1 to your LAN.
>> Check if outgoing ssh works using:
>> 
>> -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Did you try this?
If it doesn't work, put a LOG rule just before the DROP rule to see what
get's dropped when you're trying to setup an ssh session.

>>> :OUTPUT ACCEPT [80:13056]
>>> -A OUTPUT -j ACCEPT
>>> -A OUTPUT -o lo -j ACCEPT

Here is where I see you're not dropping anything in the OUTPUT chain.
The first rule accepts everything so the second will never match and is
useless. Further, your chain polocy is ACCEPT, so if you're not going to
drop anything: why have rules in that chain to accept packets that would
be accepted anyway? Just get rid of the OUTPUT rules for now and leave
it's policy ACCEPT.


Gr,
Rob

RE: not able to ssh from the firewall

[varun]

On Thu, 2006-09-07 at 22:57 +0200, Rob Sterenborg wrote:
> >>> I am not able to ssh from the firewall
> >>> to a client. Though the reverse is
> >>> working.
> >>> 
> >>> I would also like to put :
> >>> 
> >>> -A OUTPUT -j DROP
> >>> 
> >>> But if I do that clients are not able to connect
> >>> to the net. I need add a rule which I could
> >>> not figure out.
> >> 
> >> You should allow SSH out when you want to be able to use it.
> >> SSH listens on port 22, so this should do it:
> >> 
> >> -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
> >> -A OUTPUT -p tcp --dport 22 -j ACCEPT
> >> -A OUTPUT -j DROP
> > 
> > No that did not work.
> 
> Of course not. AFAIK your current OUTPUT policy is still ACCEPT (see
> below) so that should not be the problem. (Don't mess with the OUTPUT
> chain untill your INPUT chain is working as you want it to.)
> 
> >>> :INPUT ACCEPT [80:13056]
> >>> -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
> >> 
> >> It looks like eth0 is connected to the internet and eth1 to your LAN.
> >> Check if outgoing ssh works using:
> >> 
> >> -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
> 
> Did you try this?
> If it doesn't work, put a LOG rule just before the DROP rule to see what
> get's dropped when you're trying to setup an ssh session.
> 
> >>> :OUTPUT ACCEPT [80:13056]
> >>> -A OUTPUT -j ACCEPT
> >>> -A OUTPUT -o lo -j ACCEPT

OK, I had set :

-A OUTPUT -j DROP

So nothing worked.

If OUTPUT is set to :

-A OUTPUT -j ACCEPT

Then everthing works. I can ssh, ping to clients .

So how do I get it working with OUTPUT as DROP ?



> 
> Here is where I see you're not dropping anything in the OUTPUT chain.
> The first rule accepts everything so the second will never match and is
> useless. Further, your chain polocy is ACCEPT, so if you're not going to
> drop anything: why have rules in that chain to accept packets that would
> be accepted anyway? Just get rid of the OUTPUT rules for now and leave
> it's policy ACCEPT.
> 
> 
> Gr,
> Rob
> 
> 
> 

RE: not able to ssh from the firewall

[Rob Sterenborg]

> OK, I had set :
> 
> -A OUTPUT -j DROP
> 
> So nothing worked.
> 
> If OUTPUT is set to :
> 
> -A OUTPUT -j ACCEPT
> 
> Then everthing works. I can ssh, ping to clients .
> 
> So how do I get it working with OUTPUT as DROP ?

I take it you have:
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
as your first INPUT rule to take care of returning packets.

An SSH server binds to port 22/tcp: you will be connecting to
destination port 22/tcp which is what you'll have to ACCEPT. Therefore
this should do it:

:OUTPUT DROP [80:13056]
-A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -m state --state NEW -o lo -j ACCEPT
-A OUTPUT -m state --state NEW -p tcp --dport 22 -j ACCEPT

This way you'll be blocking *everything* else, including DNS lookups.
So, before you say it doesn't work, without these rules you'd only be
able to connect using an IP address:
-A OUTPUT -m state --state NEW -p tcp --dport 53 -j ACCEPT
-A OUTPUT -m state --state NEW -p udp --dport 53 -j ACCEPT

If it doesn't work , add this to see what packets get logged when you're
trying to connect to the SSH server:
-A OUTPUT -j LOG --log-prefix "IPT: "

If you want to be able to do *anything* else, you must write a rule to
accept it.


Gr,
Rob

RE: not able to ssh from the firewall

[Rob Sterenborg]

On Sun, September 10, 2006 04:21, varun wrote:
> Yes I did all that you suggested.
> I think OUTPUT should allow tcp and udp out ? What do you think ?

It should allow out what you need, but most people leave it's policy to ACCEPT
without any rules because it's easier.
AFAICS, when you have the appropriate state rules in the INPUT and OUTPUT
chain, having an ACCEPT rule for tcp dport 22 should allow you to setup a ssh
connection to a remote server. Having ACCEPT rules for tcp/udp dport 53 should
enable you to do DNS lookups.

Again, if that doesn't work, insert a logging rule to the end (before the
DROP) of the chain to see *what* get's dropped (and post it here).


Gr,
Rob

connrate and Linux 2.6.14 and 2.6.16

[Pablo Sanchez]

Howdy,

I'm looking for POM documentation which will tell me how to patch my two
kernels with connrate.

When I run ./runme extra, I don't see connrate as an option.  

I'm looking at this doc:

	
<http://www.netfilter.org/documentation/HOWTO/netfilter-extensions-HOWTO.htm
l>

Cheers,
---
Pablo Sanchez - Blueoak Database Engineering, Inc
Ph:    819.459.1926          Toll free:  888.459.1926
Cell:  819.918.9731                Pgr:  pablo_p@blueoakdb.com
Fax:   603.720.7723 (US)

RE: not able to ssh from the firewall

[varun]

Thanks a lot Rob,

I did manage to figure that out.

Varun


On Fri, 2006-09-08 at 07:29 +0200, Rob Sterenborg wrote:
> > OK, I had set :
> > 
> > -A OUTPUT -j DROP
> > 
> > So nothing worked.
> > 
> > If OUTPUT is set to :
> > 
> > -A OUTPUT -j ACCEPT
> > 
> > Then everthing works. I can ssh, ping to clients .
> > 
> > So how do I get it working with OUTPUT as DROP ?
> 
> I take it you have:
> -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
> as your first INPUT rule to take care of returning packets.
> 
> An SSH server binds to port 22/tcp: you will be connecting to
> destination port 22/tcp which is what you'll have to ACCEPT. Therefore
> this should do it:
> 
> :OUTPUT DROP [80:13056]
> -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
> -A OUTPUT -m state --state NEW -o lo -j ACCEPT
> -A OUTPUT -m state --state NEW -p tcp --dport 22 -j ACCEPT
> 
> This way you'll be blocking *everything* else, including DNS lookups.
> So, before you say it doesn't work, without these rules you'd only be
> able to connect using an IP address:
> -A OUTPUT -m state --state NEW -p tcp --dport 53 -j ACCEPT
> -A OUTPUT -m state --state NEW -p udp --dport 53 -j ACCEPT
> 
> If it doesn't work , add this to see what packets get logged when you're
> trying to connect to the SSH server:
> -A OUTPUT -j LOG --log-prefix "IPT: "
> 
> If you want to be able to do *anything* else, you must write a rule to
> accept it.
> 
> 
> Gr,
> Rob
> 
> 
>