Re: Testing iptables setup

[Ted Kaczmarek <tedkaz@optonline.net>]

hping and nmap do wonders for me :-)

Ted
On Mon, 2004-03-08 at 15:18 +0000, Antony Stone wrote:

> On Monday 08 March 2004 3:00 pm, Richard L. Dery wrote:
> 
> > I have the following setup in my /etc/ppp/ip-up.d directory:
> >
> > ## Create chain which blocks new connections, except if coming from inside.
> > # iptables -N block
> > # iptables -A block -m state --state ESTABLISHED,RELATED -j ACCEPT
> > # iptables -A block -m state --state NEW -i ! ppp0 -j ACCEPT
> > # iptables -A block -j DROP
> >
> > ## Jump to that chain from INPUT and FORWARD chains.
> > # iptables -A INPUT -j block
> > # iptables -A FORWARD -j block
> >
> > When I run iptables -L after connecting these rules are displayed.
> >
> > Is there a way to test to show that these rules work?
> 
> I can think of two meanings of the word "work" here:
> 
> 1. Do they allow the traffic you want?
> 2. Do they block the traffic you don't want?
> 
> I suggest you test them by setting the packet counters to zero ("iptables 
> -Z"), then sending some traffic through your firewall which is expected to 
> work (eg: browse an Internet website from a LAN client), and make sure you 
> see a small increase in the packet counters for the NEW rule in the 
> user-defined chain (using "iptables -L -nvx"), and a larger increase in the 
> counters for the ESTABLISHED rule (since this is where the reply packets, and 
> further request packets, will go after the initial connection is made).
> 
> Then try something which should be blocked by the above rules (eg: try to 
> connect to your public IP address from somewhere else on the Internet - it 
> doesn't matter what protocol you try to use - HTTP, telnet, SSH, POP3 etc 
> should all be blocked), and make sure (a) you can't connect, and (b) you see 
> some packets build up in the counters for the DROP rule.
> 
> If in doubt, put a LOG rule just before the DROP rule, and you'll sson see 
> packets from all over the Internet trying to connect to your address, and 
> failing :)
> 
> Regards,
> 
> Antony.
> 
> -- 
> The words "e pluribus unum" on the Great Seal of the United States are from a 
> poem by Virgil entitled "Moretum", which is about cheese and garlic salad 
> dressing.
> 
>                                                      Please reply to the list;
>                                                            please don't CC me.
>