Re: trying to get one blessed thing to work

[Jan Humme <jan.humme@xs4all.nl>]

On Monday 08 July 2002 18:32, Mark Tessier wrote:
> I have a PC running rh7.1., which I'm trying to turn into a firewall. The
> firewall stands between a DMZ and a LAN. I have an elaborate script which
> I've been trying to deploy, but so far no luck. Since I really don't know
> where to begin in terms of diagnosing my problem, I decided to see if I
> could just ping one machine on the DMZ from another on the LAN.
>
> The first thing I did was to set the policy to drop for the forward chain
> as in:
>
> iptables --policy FORWARD DROP

=> Response on my machine (and yours) is:
iptables v1.2.1a: Unknown arg '--policy'
Try 'iptables -h` or 'iptables --help' for more information.

Suppose you mean:
#iptables -P FORWARD DROP ?


> Next, I tried to open one door on the forward chain, allowing icmp packets
> of the echo request type to ping any other machine as in:
>
> iptables -A FORWARD -o eth0 -p icmp --icmp-type echo-request -s
> 192.168.0.0/24 -m state --state NEW -j ACCEPT

Assuming that this line properly reflects your network configuration, you may 
also want to allow the reply to come in:

#iptables -A FORWARD -i eth0 -p icmp --icmp-type echo-reply -d 192.168.0.0/24 
-j ACCEPT.


In general though, one good way to debug is to look at the firewall machine, 
and use:
=> iptables -Z FORWARD to clear counter
=> do your ping
=> run iptables -L -v -x to inspect counters to see which rule(s) matched and 
caused your packets to be dropped.
=> also tcpdump may help

Jan Humme.