iptable question

iptable question

[Craig]

How can i debug my iptables script?



#!/bin/sh
#
# The location of the IPTables binary file on your
system.
IPT="/sbin/iptables"

# The Internet interface. For ADSL or Dialup users,
this should be "ppp0".
# For a cable modem connection, this will probably be
"eth0".
INT="ppp0"

# Out with the old stuff.
$IPT -F
$IPT -F INPUT
$IPT -F OUTPUT
$IPT -F FORWARD
$IPT -F -t mangle
$IPT -F -t nat
$IPT -X

# These will setup our policies.
$IPT -P INPUT DROP
$IPT -P OUTPUT ACCEPT
$IPT -P FORWARD ACCEPT

# Use this for NAT or IP Masquerading.
echo 1 > /proc/sys/net/ipv4/ip_forward
$IPT -t nat -A POSTROUTING -o $INT -j MASQUERADE

# This rule protects your fowarding rule.
$IPT -A FORWARD -i $INT -m state --state NEW,INVALID
-j DROP

# Port forwarding looks like this.
#$IPT -t nat -A PREROUTING -i $INT -p tcp --dport 25
-j DNAT --to 192.168.0.50
#$IPT -t nat -A PREROUTING -i $INT -p tcp --dport 53
-j DNAT --to 192.168.0.50
#$IPT -t nat -A PREROUTING -i $INT -p udp --dport 53
-j DNAT --to 192.168.0.50
# These two redirect a block of ports, in both udp and
tcp.
#$IPT -t nat -A PREROUTING -i $INT -p tcp --dport
2300:2400 -j DNAT --to 192.168.0.50
#$IPT -t nat -A PREROUTING -i $INT -p udp --dport
2300:2400 -j DNAT --to 192.168.0.50

# This rule will accept connections from local
machines.
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A INPUT -s 192.168.0.0/24 -d 0/0 -p all -j
ACCEPT

# Drop bad packets.
$IPT -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j
DROP
$IPT -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
$IPT -A INPUT -p tcp --tcp-flags ALL
SYN,RST,ACK,FIN,URG -j DROP
$IPT -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
$IPT -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j
DROP
$IPT -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j
DROP

# Drop icmp, but only after letting certain types
through.
$IPT -A INPUT -p icmp --icmp-type 0 -j ACCEPT
$IPT -A INPUT -p icmp --icmp-type 3 -j ACCEPT
$IPT -A INPUT -p icmp --icmp-type 11 -j ACCEPT
$IPT -A INPUT -p icmp --icmp-type 8 -m limit --limit
1/second -j ACCEPT
$IPT -A INPUT -p icmp -j DROP


=====
EliteSyntax  www.linuxnewbie.org





__________________________________
Do you Yahoo!?
SBC Yahoo! DSL - Now only $29.95 per month!
http://sbc.yahoo.com

Re: iptable question

[Alistair Tonner]

On June 18, 2003 09:40 am, Craig wrote:
> How can i debug my iptables script?
>
>
>
> #!/bin/sh
> #
> # The location of the IPTables binary file on your
> system.

<<SNIPPED FOR BREVITY >>

> $IPT -A INPUT -p icmp --icmp-type 11 -j ACCEPT
> $IPT -A INPUT -p icmp --icmp-type 8 -m limit --limit
> 1/second -j ACCEPT
> $IPT -A INPUT -p icmp -j DROP
>
>
> =====
> EliteSyntax  www.linuxnewbie.org
>
>
>

	Depends on what your trying to find, but I've been inclined to put
	"echo" statements between groups of rules to catch where the 
	errors are occurring and then narrow the search from there.
	
	?? 40 character line wrap on your MTA?  or b0rked script?
	if the line wraps are like that in the script ... you need to fix that 
	before anything else.   If the wraps are from your MTA ... thats okay.

	Alistair Tonner
	nerdnet.ca
	Senior Systems Analyst - RSS
	
     Any sufficiently advanced technology will have the appearance of magic.
	Lets get magical!

Re: iptable question

[Elitesyntax]

#!/bin/sh
 #
# The location of the IPTables binary file on your
 system.

<<SNIPPED FOR BREVITY >>

$IPT -A INPUT -p icmp --icmp-type 11 -j ACCEPT
$IPT -A INPUT -p icmp --icmp-type 8 -m limit --limit
1/second -j ACCEPT
$IPT -A INPUT -p icmp -j DROP



Are you saying this where all my error are?This my
first iptables firewall script.So i maybe have some
question on iptables and i do have a red hat linux
firewall book that help me some.



Sorry for send this post out 2 time.

=====
EliteSyntax  www.linuxnewbie.org





__________________________________
Do you Yahoo!?
SBC Yahoo! DSL - Now only $29.95 per month!
http://sbc.yahoo.com

Re: iptable question

[Geffrey Velasquez]

Hi, I use set -x:


C> How can i debug my iptables script?


C> #!/bin/sh
C> #
C> # The location of the IPTables binary file on your
C> system.
C> IPT="/sbin/iptables"

set -x

C> # The Internet interface. For ADSL or Dialup users,
C> this should be "ppp0".
C> # For a cable modem connection, this will probably be
C> "eth0".
C> INT="ppp0"

C> # Out with the old stuff.
C> $IPT -F
C> $IPT -F INPUT
C> $IPT -F OUTPUT
C> $IPT -F FORWARD
C> $IPT -F -t mangle
C> $IPT -F -t nat
C> $IPT -X

C> # These will setup our policies.
C> $IPT -P INPUT DROP
C> $IPT -P OUTPUT ACCEPT
C> $IPT -P FORWARD ACCEPT

C> # Use this for NAT or IP Masquerading.
echo 1 >> /proc/sys/net/ipv4/ip_forward
C> $IPT -t nat -A POSTROUTING -o $INT -j MASQUERADE

C> # This rule protects your fowarding rule.
C> $IPT -A FORWARD -i $INT -m state --state NEW,INVALID
C> -j DROP

C> # Port forwarding looks like this.
C> #$IPT -t nat -A PREROUTING -i $INT -p tcp --dport 25
C> -j DNAT --to 192.168.0.50
C> #$IPT -t nat -A PREROUTING -i $INT -p tcp --dport 53
C> -j DNAT --to 192.168.0.50
C> #$IPT -t nat -A PREROUTING -i $INT -p udp --dport 53
C> -j DNAT --to 192.168.0.50
C> # These two redirect a block of ports, in both udp and
C> tcp.
C> #$IPT -t nat -A PREROUTING -i $INT -p tcp --dport
C> 2300:2400 -j DNAT --to 192.168.0.50
C> #$IPT -t nat -A PREROUTING -i $INT -p udp --dport
C> 2300:2400 -j DNAT --to 192.168.0.50

C> # This rule will accept connections from local
C> machines.
C> $IPT -A INPUT -i lo -j ACCEPT
C> $IPT -A INPUT -s 192.168.0.0/24 -d 0/0 -p all -j
C> ACCEPT

C> # Drop bad packets.
C> $IPT -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j
C> DROP
C> $IPT -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
C> $IPT -A INPUT -p tcp --tcp-flags ALL
C> SYN,RST,ACK,FIN,URG -j DROP
C> $IPT -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
C> $IPT -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j
C> DROP
C> $IPT -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j
C> DROP

C> # Drop icmp, but only after letting certain types
C> through.
C> $IPT -A INPUT -p icmp --icmp-type 0 -j ACCEPT
C> $IPT -A INPUT -p icmp --icmp-type 3 -j ACCEPT
C> $IPT -A INPUT -p icmp --icmp-type 11 -j ACCEPT
C> $IPT -A INPUT -p icmp --icmp-type 8 -m limit --limit
C> 1/second -j ACCEPT
C> $IPT -A INPUT -p icmp -j DROP


C> =====
C> EliteSyntax  www.linuxnewbie.org





C> __________________________________
C> Do you Yahoo!?
C> SBC Yahoo! DSL - Now only $29.95 per month!
C> http://sbc.yahoo.com


Regards,
Geffrey Velásquez

Re: iptable question

[Pascal Italiaander]

Op woensdag 18 juni 2003 15:40, schreef Craig:
> How can i debug my iptables script?

put "set -x" on top of your script.
like this:

 #!/bin/sh

set -x

 # The location of the IPTables binary file on your
 system.
 IPT="/sbin/iptables"

 # The Internet interface. For ADSL or Dialup users,
 this should be "ppp0".
 # For a cable modem connection, this will probably be
 "eth0".
 INT="ppp0"

 # Out with the old stuff.
 $IPT -F
 $IPT -F INPUT
 $IPT -F OUTPUT
 $IPT -F FORWARD
 $IPT -F -t mangle
 $IPT -F -t nat
 $IPT -X

 # These will setup our policies.
 $IPT -P INPUT DROP
 $IPT -P OUTPUT ACCEPT
 $IPT -P FORWARD ACCEPT

 # Use this for NAT or IP Masquerading.
 echo 1 > /proc/sys/net/ipv4/ip_forward
 $IPT -t nat -A POSTROUTING -o $INT -j MASQUERADE

 # This rule protects your fowarding rule.
 $IPT -A FORWARD -i $INT -m state --state NEW,INVALID
 -j DROP

 # Port forwarding looks like this.
 #$IPT -t nat -A PREROUTING -i $INT -p tcp --dport 25
 -j DNAT --to 192.168.0.50
 #$IPT -t nat -A PREROUTING -i $INT -p tcp --dport 53
 -j DNAT --to 192.168.0.50
 #$IPT -t nat -A PREROUTING -i $INT -p udp --dport 53
 -j DNAT --to 192.168.0.50
 # These two redirect a block of ports, in both udp and
 tcp.
 #$IPT -t nat -A PREROUTING -i $INT -p tcp --dport
 2300:2400 -j DNAT --to 192.168.0.50
 #$IPT -t nat -A PREROUTING -i $INT -p udp --dport
 2300:2400 -j DNAT --to 192.168.0.50

 # This rule will accept connections from local
 machines.
 $IPT -A INPUT -i lo -j ACCEPT
 $IPT -A INPUT -s 192.168.0.0/24 -d 0/0 -p all -j
 ACCEPT

 # Drop bad packets.
 $IPT -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j
 DROP
 $IPT -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
 $IPT -A INPUT -p tcp --tcp-flags ALL
 SYN,RST,ACK,FIN,URG -j DROP
 $IPT -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
 $IPT -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j
 DROP
 $IPT -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j
 DROP

 # Drop icmp, but only after letting certain types
 through.
 $IPT -A INPUT -p icmp --icmp-type 0 -j ACCEPT
 $IPT -A INPUT -p icmp --icmp-type 3 -j ACCEPT
 $IPT -A INPUT -p icmp --icmp-type 11 -j ACCEPT
 $IPT -A INPUT -p icmp --icmp-type 8 -m limit --limit
 1/second -j ACCEPT
 $IPT -A INPUT -p icmp -j DROP


 =====
 EliteSyntax  www.linuxnewbie.org

have fun.
Pascal

Re: iptable question

[Elitesyntax]

So i see ipt -x is to debug i understand now.Thank for
the information.

=====
EliteSyntax  www.linuxnewbie.org





__________________________________
Do you Yahoo!?
SBC Yahoo! DSL - Now only $29.95 per month!
http://sbc.yahoo.com