* Can someone please explain to a newbie?
2003-08-15 17:55 ` Payal Rathod
@ 2003-08-14 19:36 ` Stephen J. McCracken
0 siblings, 0 replies; 3+ messages in thread
From: Stephen J. McCracken @ 2003-08-14 19:36 UTC (permalink / raw)
To: netfilter
I am using giptables to help setup iptables on two RH7.3 boxes. These
two are sibling proxies in our organization. The two have basically
identical rulesets, but one gets many of the following logged to the
syslog while the other very few:
Aug 11 13:57:10 webfilter2 kernel: giptables-end-of-firewall: IN=
OUT=eth0 SRC=10.129.130.5 DST=10.129.184.28 LEN=40 TOS=0x00 PREC=0x00
TTL=64 ID=33149 DF PROTO=TCP SPT=8080 DPT=1100 WINDOW=5840 RES=0x00 ACK
FIN URGP=0
Aug 11 13:57:12 webfilter2 kernel: giptables-end-of-firewall: IN=
OUT=eth0 SRC=10.129.130.5 DST=10.129.184.31 LEN=40 TOS=0x00 PREC=0x00
TTL=64 ID=37565 DF PROTO=TCP SPT=8080 DPT=1660 WINDOW=5840 RES=0x00 ACK
FIN URGP=0
Aug 11 14:02:43 webfilter2 kernel: giptables-end-of-firewall: IN=
OUT=eth0 SRC=10.129.130.5 DST=10.129.184.22 LEN=40 TOS=0x00 PREC=0x00
TTL=64 ID=646 DF PROTO=TCP SPT=8080 DPT=2163 WINDOW=5840 RES=0x00 ACK
FIN URGP=0
Aug 11 14:04:21 webfilter2 kernel: giptables-end-of-firewall: IN=
OUT=eth0 SRC=10.129.130.5 DST=10.129.134.27 LEN=40 TOS=0x00 PREC=0x00
TTL=64 ID=47763 DF PROTO=TCP SPT=8080 DPT=1308 WINDOW=5840 RES=0x00 ACK
FIN URGP=0
But I have the following rules generated by giptables:
iptables -A interface0_in -p tcp -s 10.129.134.0/23 --sport 1024:65535
-d 10.129.130.5 --dport 8080 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A interface0_out -p tcp -s 10.129.130.5 --sport 8080 -d
10.129.134.0/23 --dport 1024:65535 -m state --state ESTABLISHED -j
ACCEPT
iptables -A interface0_in -p tcp -s 10.129.184.0/23 --sport 1024:65535
-d 10.129.130.5 --dport 8080 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A interface0_out -p tcp -s 10.129.130.5 --sport 8080 -d
10.129.184.0/23 --dport 1024:65535 -m state --state ESTABLISHED -j
ACCEPT
iptables -A interface0_in -p tcp -s 172.16.0.0/25 --sport 1024:65535 -d
10.129.130.5 --dport 8080 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A interface0_out -p tcp -s 10.129.130.5 --sport 8080 -d
172.16.0.0/25 --dport 1024:65535
-m state --state ESTABLISHED -j ACCEPT
^ permalink raw reply [flat|nested] 3+ messages in thread
* Can someone please explain to a newbie?
@ 2003-08-14 19:43 Stephen J. McCracken
0 siblings, 0 replies; 3+ messages in thread
From: Stephen J. McCracken @ 2003-08-14 19:43 UTC (permalink / raw)
To: Netfilter List
I am using giptables to help setup iptables on two RH7.3 boxes. These
two are sibling proxies in our organization. The two have basically
identical rulesets, but one gets many of the following logged to the
syslog while the other very few:
Aug 11 13:57:10 webfilter2 kernel: giptables-end-of-firewall: IN=
OUT=eth0 SRC=10.129.130.5 DST=10.129.184.28 LEN=40 TOS=0x00 PREC=0x00
TTL=64 ID=33149 DF PROTO=TCP SPT=8080 DPT=1100 WINDOW=5840 RES=0x00 ACK
FIN URGP=0
Aug 11 13:57:12 webfilter2 kernel: giptables-end-of-firewall: IN=
OUT=eth0 SRC=10.129.130.5 DST=10.129.184.31 LEN=40 TOS=0x00 PREC=0x00
TTL=64 ID=37565 DF PROTO=TCP SPT=8080 DPT=1660 WINDOW=5840 RES=0x00 ACK
FIN URGP=0
Aug 11 14:02:43 webfilter2 kernel: giptables-end-of-firewall: IN=
OUT=eth0 SRC=10.129.130.5 DST=10.129.184.22 LEN=40 TOS=0x00 PREC=0x00
TTL=64 ID=646 DF PROTO=TCP SPT=8080 DPT=2163 WINDOW=5840 RES=0x00 ACK
FIN URGP=0
Aug 11 14:04:21 webfilter2 kernel: giptables-end-of-firewall: IN=
OUT=eth0 SRC=10.129.130.5 DST=10.129.134.27 LEN=40 TOS=0x00 PREC=0x00
TTL=64 ID=47763 DF PROTO=TCP SPT=8080 DPT=1308 WINDOW=5840 RES=0x00 ACK
FIN URGP=0
But I have the following rules generated by giptables:
iptables -A interface0_in -p tcp -s 10.129.134.0/23 --sport 1024:65535
-d 10.129.130.5 --dport 8080 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A interface0_out -p tcp -s 10.129.130.5 --sport 8080 -d
10.129.134.0/23 --dport 1024:65535 -m state --state ESTABLISHED -j
ACCEPT
iptables -A interface0_in -p tcp -s 10.129.184.0/23 --sport 1024:65535
-d 10.129.130.5 --dport 8080 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A interface0_out -p tcp -s 10.129.130.5 --sport 8080 -d
10.129.184.0/23 --dport 1024:65535 -m state --state ESTABLISHED -j
ACCEPT
iptables -A interface0_in -p tcp -s 172.16.0.0/25 --sport 1024:65535 -d
10.129.130.5 --dport 8080 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A interface0_out -p tcp -s 10.129.130.5 --sport 8080 -d
172.16.0.0/25 --dport 1024:65535
-m state --state ESTABLISHED -j ACCEPT
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: Can someone please explain to a newbie?
[not found] <Pine.LNX.4.44.0308141353360.23765-100000@nwallwo-linux.corp.pnm.com>
@ 2003-08-14 22:21 ` Stephen J. McCracken
0 siblings, 0 replies; 3+ messages in thread
From: Stephen J. McCracken @ 2003-08-14 22:21 UTC (permalink / raw)
To: Wallwork, Nathan; +Cc: Netfilter List
On Thu, 2003-08-14 at 14:59, Wallwork, Nathan wrote:
> On 14 Aug 2003, Stephen J. McCracken wrote:
> > Subject: Can someone please explain to a newbie?
> >
> > one gets many of the following logged to the syslog while the other
> > very few:
>
> Have you reloaded the rules on webfilter2 since the last rules change?
yes.
>
> > Aug 11 13:57:10 webfilter2 kernel: giptables-end-of-firewall: IN=
> > OUT=eth0 SRC=10.129.130.5 DST=10.129.184.28 LEN=40 TOS=0x00 PREC=0x00
> > TTL=64 ID=33149 DF PROTO=TCP SPT=8080 DPT=1100 WINDOW=5840 RES=0x00 ACK
> > FIN URGP=0
> >
> > But I have the following rules generated by giptables:
> >
> > iptables -A interface0_out -p tcp -s 10.129.130.5 --sport 8080 -d
> > 10.129.184.0/23 --dport 1024:65535 -m state --state ESTABLISHED -j
> > ACCEPT
>
> It looks like this should match, assuming the ESTABLISH part matches.
That's what I thought. What defines "ESTABLISHED"?
>
> Consider setting up a copy of that rul without the --state ESTABLISHED,
> place that right below, and see if it catches any packets.
The problem is that, being a newbie, I use giptables to set up the
iptables rules and I'm not sure where to do this. Also, I would like to
understand the "why" and not just get around it especially as one box,
using the same ruleset hardly gets any of these while the other quite a
few.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2003-08-14 22:21 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <Pine.LNX.4.44.0308141353360.23765-100000@nwallwo-linux.corp.pnm.com>
2003-08-14 22:21 ` Can someone please explain to a newbie? Stephen J. McCracken
2003-08-14 19:43 Stephen J. McCracken
-- strict thread matches above, loose matches on Subject: below --
2003-08-13 22:39 can someone check this simple firewall? Daniel Chemko
2003-08-15 17:55 ` Payal Rathod
2003-08-14 19:36 ` Can someone please explain to a newbie? Stephen J. McCracken
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox