Re: portfw on iptables 2.4 kernel problem.

[Raymond Leach <raymondl@knowledgefactory.co.za>]

[-- Attachment #1: Type: text/plain, Size: 4277 bytes --]

Here are the rules I use for ftp outbound from my internal network :

IPTABLES="/usr/sbin/iptables"
NET_INT="10.0.0.0/24"
IFACE_INET="eth0"
IFACE_INT="eth2"
IFACE_DMZ="eth1"
IFACE_LOC="lo"
$ip="10.0.0.67"		# My workstation ip

$IPTABLES -A FORWARD -i $IFACE_INT -p tcp --dport 20:21 -s $ip -m state
--state NEW,ESTABLISHED,RELATED -j ACCEPT
        $IPTABLES -A FORWARD -i $IFACE_INT -p tcp --dport 1024: -s $ip
-m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
        $IPTABLES -A FORWARD -i $IFACE_INT -p udp --dport 1024: -s $ip
-m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

$IPTABLES -A FORWARD -i $IFACE_INET -p tcp --sport 20:21 -d $ip -m state
--state ESTABLISHED,RELATED -j ACCEPT
        $IPTABLES -A FORWARD -i $IFACE_INET -p tcp --sport 1024: -d $ip
-m state --state ESTABLISHED,RELATED -j ACCEPT
        $IPTABLES -A FORWARD -i $IFACE_INET -p udp --sport 1024: -d $ip
-m state --state ESTABLISHED,RELATED -j ACCEPT

$IPTABLES -t nat -A POSTROUTING -o $IFACE_INET -p tcp --dport 20:21 -s
$ip -j SNAT --to-source $IP_INET
        $IPTABLES -t nat -A POSTROUTING -o $IFACE_INET -p tcp --dport
1024: -s $ip -j SNAT --to-source $IP_INET

Enjoy!

Ray

On Wed, 2002-12-11 at 08:08, louie miranda wrote:
> Hi, thanks for all your replies, etc. But my problem is not yet solved. I
> dont know why?!
> Can someone give me how did they did it?
> 
> 
> 
> --
> thanks,
> louie miranda
> 
> 
> ----- Original Message -----
> From: "Jozsef Kadlecsik" <kadlec@blackhole.kfki.hu>
> To: "Raymond Leach" <raymondl@knowledgefactory.co.za>
> Cc: <rsterenborg@xs4all.nl>; "'Paulo Andre'" <pandre@darkstar.nom.za>;
> "'louie miranda'" <lmiranda@chikka.com>; "'netfilter'"
> <netfilter@lists.netfilter.org>
> Sent: Tuesday, December 10, 2002 7:22 PM
> Subject: RE: portfw on iptables 2.4 kernel problem.
> 
> 
> > On 10 Dec 2002, Raymond Leach wrote:
> >
> > > Yes, you do. Port 20 (and/or any other) connections after the control
> > > connection are not 'RELATED, ESTABLISHED' to the control connection.
> > > They are new connections either from the client to the server or vice
> > > versa. You therefore need seperate rules for them.
> >
> > If we are speaking about the data channels of the supported protocols
> > (FTP, IRC and all the other protocols from p-o-m), then this is absolutely
> > false.
> >
> > > Remember connection tracking happens at a pakcet level, i.e all states
> > > relate to packets of a connection, not per protocol.
> >
> > In the case of the supported protocols with additional channels, again,
> > untrue. Please do no spread false info! Why would then the RELATED state
> > exist?
> >
> > > > However, I'm not sure if it's better to split them up into 2 rules :
> > > > iptables -A FORWARD -i eth0 -o eth1 -p tcp --dport 21 -m state --state
> > > > NEW -j ACCEPT
> > > > iptables -A FORWARD -i eth0 -o eth1 -m state --state
> ESTABLISHED,RELATED
> > > > -j ACCEPT
> >
> > Because the destination port of the data channels cannot be port 21,
> > therefore you must use two rules. And because you specify the
> > incoming/outgoing interfaces, you need a third rule for the reply packets
> > as well.
> >
> > Regards,
> > Jozsef
> > -
> > E-mail  : kadlec@blackhole.kfki.hu, kadlec@sunserv.kfki.hu
> > PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
> > Address : KFKI Research Institute for Particle and Nuclear Physics
> >           H-1525 Budapest 114, POB. 49, Hungary
> >
> >
> >
-- 
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
(  Raymond Leach                       )
 ) Knowledge Factory                  (
(                                      )
 ) Tel: +27 11 445 8100               (
(  Fax: +27 11 445 8101                )
 )                                    (
(  http://www.knowledgefactory.co.za/  )
 ) http://www.saptg.co.za/            (
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   o                                o
    o                              o
        .--.                  .--.
       | o_o|                |o_o |
       | \_:|                |:_/ |
      / /   \\              //   \ \
     ( |     |)            (|     | )
     /`\_   _/'\          /'\_   _/`\
     \___)=(___/          \___)=(___/

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]