* firewall host problem @ 2003-10-19 21:44 David H. Askew 2003-10-20 1:44 ` Mark E. Donaldson 0 siblings, 1 reply; 5+ messages in thread From: David H. Askew @ 2003-10-19 21:44 UTC (permalink / raw) To: netfilter [-- Attachment #1: Type: text/plain, Size: 1993 bytes --] ok .. so 'I'm trying to setup my first iptables firewall .. and I've got a semi functional setup so far ... but I do have one small problem .. my firewall machine .. which is performing NAT for my home network.. cannot access the Internet with any standard tools ... tracepath .. ping .. etc. I know network connectivity is fine .. because my internal machines function properly. My router/firewall has 3 interfaces .... eth0: ISP eth1: Home Subnet 1 eth2: Home Subnet 2 eth2 can ping my ISP gateway eth1 can ping my ISP gateway eth0 can not ping my ISP gateway my firewall script is below ... I've recently switched from an ACCEPT default policy to the DROP default policy below. I didn't have this problem previously, so I know i'I've just forgotten to allow something .. but I'm having trouble coming to a logical conclusion .... ...any help .. critique ... advice you could provide would be helpful -dave iptables --flush iptables --table nat --flush iptables --delete-chain iptables --table nat --delete-chain # Enable packet forwarding in the kernel echo 1 > /proc/sys/net/ipv4/ip_forward # Setup IP FORWARDing and Masquerading iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE iptables --append FORWARD --in-interface eth1 -j ACCEPT iptables --append FORWARD --in-interface eth2 -j ACCEPT #enable connection tracking iptables -I FORWARD -m state --state INVALID -j DROP iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A INPUT -p tcp -i eth0 -s 0/0 -d 0/0 --dport 22 -j ACCEPT iptables -A INPUT -p udp -i eth0 -s 0/0 -d 0/0 --dport 22 -j ACCEPT iptables -A INPUT -p tcp -i eth2 -s 0/0 -d 0/0 --dport 22 -j ACCEPT iptables -A INPUT -p udp -i eth2 -s 0/0 -d 0/0 --dport 22 -j ACCEPT iptables -P INPUT DROP -- How many Microsoft engineers does it take to change a light bulb ? Answer : None, they just declare darkness a new standard. [-- Attachment #2: This is a digitally signed message part --] [-- Type: application/pgp-signature, Size: 189 bytes --] ^ permalink raw reply [flat|nested] 5+ messages in thread
* RE: firewall host problem 2003-10-19 21:44 firewall host problem David H. Askew @ 2003-10-20 1:44 ` Mark E. Donaldson 2003-10-20 1:49 ` David H. Askew 0 siblings, 1 reply; 5+ messages in thread From: Mark E. Donaldson @ 2003-10-20 1:44 UTC (permalink / raw) To: David H. Askew, netfilter David - Where are your OUTPUT chain Rules? If you want to ping (or anything else) your ISP gateway from the firewall itself, you need rules in your OUTPUT chain to permit this. If your OUTPUT default policy is set to DROP, then all packets generated by your firewall are being dropped. -----Original Message----- From: David H. Askew [mailto:daskew2@kc.rr.com] Sent: Sunday, October 19, 2003 2:44 PM To: netfilter@lists.netfilter.org Subject: firewall host problem ok .. so 'I'm trying to setup my first iptables firewall .. and I've got a semi functional setup so far ... but I do have one small problem .. my firewall machine .. which is performing NAT for my home network.. cannot access the Internet with any standard tools ... tracepath .. ping .. etc. I know network connectivity is fine .. because my internal machines function properly. My router/firewall has 3 interfaces .... eth0: ISP eth1: Home Subnet 1 eth2: Home Subnet 2 eth2 can ping my ISP gateway eth1 can ping my ISP gateway eth0 can not ping my ISP gateway my firewall script is below ... I've recently switched from an ACCEPT default policy to the DROP default policy below. I didn't have this problem previously, so I know i'I've just forgotten to allow something .. but I'm having trouble coming to a logical conclusion .... ...any help .. critique ... advice you could provide would be helpful -dave iptables --flush iptables --table nat --flush iptables --delete-chain iptables --table nat --delete-chain # Enable packet forwarding in the kernel echo 1 > /proc/sys/net/ipv4/ip_forward # Setup IP FORWARDing and Masquerading iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE iptables --append FORWARD --in-interface eth1 -j ACCEPT iptables --append FORWARD --in-interface eth2 -j ACCEPT #enable connection tracking iptables -I FORWARD -m state --state INVALID -j DROP iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A INPUT -p tcp -i eth0 -s 0/0 -d 0/0 --dport 22 -j ACCEPT iptables -A INPUT -p udp -i eth0 -s 0/0 -d 0/0 --dport 22 -j ACCEPT iptables -A INPUT -p tcp -i eth2 -s 0/0 -d 0/0 --dport 22 -j ACCEPT iptables -A INPUT -p udp -i eth2 -s 0/0 -d 0/0 --dport 22 -j ACCEPT iptables -P INPUT DROP -- How many Microsoft engineers does it take to change a light bulb ? Answer : None, they just declare darkness a new standard. ^ permalink raw reply [flat|nested] 5+ messages in thread
* RE: firewall host problem 2003-10-20 1:44 ` Mark E. Donaldson @ 2003-10-20 1:49 ` David H. Askew 2003-10-20 2:02 ` Josh Berry 0 siblings, 1 reply; 5+ messages in thread From: David H. Askew @ 2003-10-20 1:49 UTC (permalink / raw) To: markee; +Cc: netfilter users mailing list [-- Attachment #1: Type: text/plain, Size: 3157 bytes --] I thought about that too.. but This output seems to indicate a default policy of ACCEPT on the output chain. I've not yet formulated a set of rules to handle outbound traffic. iptables -L .. partial output ... Chain OUTPUT (policy ACCEPT) target prot opt source destination or .. am I missing your point ? On Sun, 2003-10-19 at 20:44, Mark E. Donaldson wrote: > David - Where are your OUTPUT chain Rules? If you want to ping (or anything > else) your ISP gateway from the firewall itself, you need rules in your > OUTPUT chain to permit this. If your OUTPUT default policy is set to DROP, > then all packets generated by your firewall are being dropped. > > -----Original Message----- > From: David H. Askew [mailto:daskew2@kc.rr.com] > Sent: Sunday, October 19, 2003 2:44 PM > To: netfilter@lists.netfilter.org > Subject: firewall host problem > > > > ok .. so 'I'm trying to setup my first iptables firewall .. and I've got > a semi functional setup so far ... but I do have one small problem .. my > firewall machine .. which is performing NAT for my home network.. cannot > access the Internet with any standard tools ... tracepath .. ping .. > etc. I know network connectivity is fine .. because my internal > machines function properly. > > My router/firewall has 3 interfaces .... > eth0: ISP > eth1: Home Subnet 1 > eth2: Home Subnet 2 > > eth2 can ping my ISP gateway > eth1 can ping my ISP gateway > eth0 can not ping my ISP gateway > > > my firewall script is below ... > > I've recently switched from an ACCEPT default policy to the DROP default > policy below. I didn't have this problem previously, so I know i'I've > just forgotten to allow something .. but I'm having trouble coming to a > logical conclusion .... > > ...any help .. critique ... advice you could provide would be helpful > > -dave > > > iptables --flush > iptables --table nat --flush > iptables --delete-chain > iptables --table nat --delete-chain > > > # Enable packet forwarding in the kernel > echo 1 > /proc/sys/net/ipv4/ip_forward > > # Setup IP FORWARDing and Masquerading > iptables --table nat --append POSTROUTING --out-interface eth0 -j > MASQUERADE > iptables --append FORWARD --in-interface eth1 -j ACCEPT > iptables --append FORWARD --in-interface eth2 -j ACCEPT > > > #enable connection tracking > iptables -I FORWARD -m state --state INVALID -j DROP > iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT > > iptables -A INPUT -p tcp -i eth0 -s 0/0 -d 0/0 --dport 22 -j ACCEPT > iptables -A INPUT -p udp -i eth0 -s 0/0 -d 0/0 --dport 22 -j ACCEPT > > iptables -A INPUT -p tcp -i eth2 -s 0/0 -d 0/0 --dport 22 -j ACCEPT > iptables -A INPUT -p udp -i eth2 -s 0/0 -d 0/0 --dport 22 -j ACCEPT > > iptables -P INPUT DROP > > > -- > How many Microsoft engineers does it take to change a light bulb ? > > Answer : None, they just declare darkness a new standard. > -- How many Microsoft engineers does it take to change a light bulb ? Answer : None, they just declare darkness a new standard. [-- Attachment #2: This is a digitally signed message part --] [-- Type: application/pgp-signature, Size: 189 bytes --] ^ permalink raw reply [flat|nested] 5+ messages in thread
* RE: firewall host problem 2003-10-20 1:49 ` David H. Askew @ 2003-10-20 2:02 ` Josh Berry 2003-10-20 3:01 ` David H. Askew 0 siblings, 1 reply; 5+ messages in thread From: Josh Berry @ 2003-10-20 2:02 UTC (permalink / raw) To: David H. Askew; +Cc: markee, netfilter users mailing list You are only allowing port 22 for input, you have to allow related traffic back. Something like: iptables -A FORWARD -p tcp -i <input interface> -m state --state ESTABLISHED,RELATED -j ACCEPT > I thought about that too.. but > > This output seems to indicate a default policy of ACCEPT on the output > chain. I've not yet formulated a set of rules to handle outbound > traffic. > > iptables -L .. partial output ... > > Chain OUTPUT (policy ACCEPT) > target prot opt source destination > > or .. am I missing your point ? > > On Sun, 2003-10-19 at 20:44, Mark E. Donaldson wrote: >> David - Where are your OUTPUT chain Rules? If you want to ping (or >> anything >> else) your ISP gateway from the firewall itself, you need rules in your >> OUTPUT chain to permit this. If your OUTPUT default policy is set to >> DROP, >> then all packets generated by your firewall are being dropped. >> >> -----Original Message----- >> From: David H. Askew [mailto:daskew2@kc.rr.com] >> Sent: Sunday, October 19, 2003 2:44 PM >> To: netfilter@lists.netfilter.org >> Subject: firewall host problem >> >> >> >> ok .. so 'I'm trying to setup my first iptables firewall .. and I've got >> a semi functional setup so far ... but I do have one small problem .. my >> firewall machine .. which is performing NAT for my home network.. cannot >> access the Internet with any standard tools ... tracepath .. ping .. >> etc. I know network connectivity is fine .. because my internal >> machines function properly. >> >> My router/firewall has 3 interfaces .... >> eth0: ISP >> eth1: Home Subnet 1 >> eth2: Home Subnet 2 >> >> eth2 can ping my ISP gateway >> eth1 can ping my ISP gateway >> eth0 can not ping my ISP gateway >> >> >> my firewall script is below ... >> >> I've recently switched from an ACCEPT default policy to the DROP default >> policy below. I didn't have this problem previously, so I know i'I've >> just forgotten to allow something .. but I'm having trouble coming to a >> logical conclusion .... >> >> ...any help .. critique ... advice you could provide would be helpful >> >> -dave >> >> >> iptables --flush >> iptables --table nat --flush >> iptables --delete-chain >> iptables --table nat --delete-chain >> >> >> # Enable packet forwarding in the kernel >> echo 1 > /proc/sys/net/ipv4/ip_forward >> >> # Setup IP FORWARDing and Masquerading >> iptables --table nat --append POSTROUTING --out-interface eth0 -j >> MASQUERADE >> iptables --append FORWARD --in-interface eth1 -j ACCEPT >> iptables --append FORWARD --in-interface eth2 -j ACCEPT >> >> >> #enable connection tracking >> iptables -I FORWARD -m state --state INVALID -j DROP >> iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT >> >> iptables -A INPUT -p tcp -i eth0 -s 0/0 -d 0/0 --dport 22 -j ACCEPT >> iptables -A INPUT -p udp -i eth0 -s 0/0 -d 0/0 --dport 22 -j ACCEPT >> >> iptables -A INPUT -p tcp -i eth2 -s 0/0 -d 0/0 --dport 22 -j ACCEPT >> iptables -A INPUT -p udp -i eth2 -s 0/0 -d 0/0 --dport 22 -j ACCEPT >> >> iptables -P INPUT DROP >> >> >> -- >> How many Microsoft engineers does it take to change a light bulb ? >> >> Answer : None, they just declare darkness a new standard. >> > -- > How many Microsoft engineers does it take to change a light bulb ? > > Answer : None, they just declare darkness a new standard. > > Thanks, Josh Berry, CTO LinkNet-Solutions 469-831-8543 josh.berry@linknet-solutions.com ^ permalink raw reply [flat|nested] 5+ messages in thread
* RE: firewall host problem 2003-10-20 2:02 ` Josh Berry @ 2003-10-20 3:01 ` David H. Askew 0 siblings, 0 replies; 5+ messages in thread From: David H. Askew @ 2003-10-20 3:01 UTC (permalink / raw) To: netfilter users mailing list [-- Attachment #1: Type: text/plain, Size: 4093 bytes --] This is the line I added .. thank you for your suggestion anyway iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT On Sun, 2003-10-19 at 21:02, Josh Berry wrote: > You are only allowing port 22 for input, you have to allow related traffic > back. Something like: > > iptables -A FORWARD -p tcp -i <input interface> -m state --state > ESTABLISHED,RELATED -j ACCEPT > > > > I thought about that too.. but > > > > This output seems to indicate a default policy of ACCEPT on the output > > chain. I've not yet formulated a set of rules to handle outbound > > traffic. > > > > iptables -L .. partial output ... > > > > Chain OUTPUT (policy ACCEPT) > > target prot opt source destination > > > > or .. am I missing your point ? > > > > On Sun, 2003-10-19 at 20:44, Mark E. Donaldson wrote: > >> David - Where are your OUTPUT chain Rules? If you want to ping (or > >> anything > >> else) your ISP gateway from the firewall itself, you need rules in your > >> OUTPUT chain to permit this. If your OUTPUT default policy is set to > >> DROP, > >> then all packets generated by your firewall are being dropped. > >> > >> -----Original Message----- > >> From: David H. Askew [mailto:daskew2@kc.rr.com] > >> Sent: Sunday, October 19, 2003 2:44 PM > >> To: netfilter@lists.netfilter.org > >> Subject: firewall host problem > >> > >> > >> > >> ok .. so 'I'm trying to setup my first iptables firewall .. and I've got > >> a semi functional setup so far ... but I do have one small problem .. my > >> firewall machine .. which is performing NAT for my home network.. cannot > >> access the Internet with any standard tools ... tracepath .. ping .. > >> etc. I know network connectivity is fine .. because my internal > >> machines function properly. > >> > >> My router/firewall has 3 interfaces .... > >> eth0: ISP > >> eth1: Home Subnet 1 > >> eth2: Home Subnet 2 > >> > >> eth2 can ping my ISP gateway > >> eth1 can ping my ISP gateway > >> eth0 can not ping my ISP gateway > >> > >> > >> my firewall script is below ... > >> > >> I've recently switched from an ACCEPT default policy to the DROP default > >> policy below. I didn't have this problem previously, so I know i'I've > >> just forgotten to allow something .. but I'm having trouble coming to a > >> logical conclusion .... > >> > >> ...any help .. critique ... advice you could provide would be helpful > >> > >> -dave > >> > >> > >> iptables --flush > >> iptables --table nat --flush > >> iptables --delete-chain > >> iptables --table nat --delete-chain > >> > >> > >> # Enable packet forwarding in the kernel > >> echo 1 > /proc/sys/net/ipv4/ip_forward > >> > >> # Setup IP FORWARDing and Masquerading > >> iptables --table nat --append POSTROUTING --out-interface eth0 -j > >> MASQUERADE > >> iptables --append FORWARD --in-interface eth1 -j ACCEPT > >> iptables --append FORWARD --in-interface eth2 -j ACCEPT > >> > >> > >> #enable connection tracking > >> iptables -I FORWARD -m state --state INVALID -j DROP > >> iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT > >> > >> iptables -A INPUT -p tcp -i eth0 -s 0/0 -d 0/0 --dport 22 -j ACCEPT > >> iptables -A INPUT -p udp -i eth0 -s 0/0 -d 0/0 --dport 22 -j ACCEPT > >> > >> iptables -A INPUT -p tcp -i eth2 -s 0/0 -d 0/0 --dport 22 -j ACCEPT > >> iptables -A INPUT -p udp -i eth2 -s 0/0 -d 0/0 --dport 22 -j ACCEPT > >> > >> iptables -P INPUT DROP > >> > >> > >> -- > >> How many Microsoft engineers does it take to change a light bulb ? > >> > >> Answer : None, they just declare darkness a new standard. > >> > > -- > > How many Microsoft engineers does it take to change a light bulb ? > > > > Answer : None, they just declare darkness a new standard. > > > > > > > Thanks, > Josh Berry, CTO > LinkNet-Solutions > 469-831-8543 > josh.berry@linknet-solutions.com -- How many Microsoft engineers does it take to change a light bulb ? Answer : None, they just declare darkness a new standard. [-- Attachment #2: This is a digitally signed message part --] [-- Type: application/pgp-signature, Size: 189 bytes --] ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2003-10-20 3:01 UTC | newest] Thread overview: 5+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2003-10-19 21:44 firewall host problem David H. Askew 2003-10-20 1:44 ` Mark E. Donaldson 2003-10-20 1:49 ` David H. Askew 2003-10-20 2:02 ` Josh Berry 2003-10-20 3:01 ` David H. Askew
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox