Help!!!

Help!!!

[radu]

Hello all,

      My networck config:

  Internet -> linux box -> My PC(192.168.50.101)

  linux box
  eth0 local 192.168.50.0/24
  eth1 Internet
  
  my iptables config:

iptables -P FORWARD DROP
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 4662 -j DNAT --to 192.168.50.101
iptables -I FORWARD  -d 192.168.50.101 -p tcp --dport 4662 -j ACCEPT
iptables -I FORWARD -i eth1 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -I FORWARD -s 192.168.50.101 -j ACCEPT
iptables -t nat -I POSTROUTING -o eth1 -j MASQUERADE
  
why I'm receiving on my PC  packages  with external ip on
4690,4544,4581.. ports???

-- 
Best regards,
 Radu                          mailto:radu@adm.utm.md

Re: Help!!!

[/dev/rob0]

On Thursday 23 June 2005 06:50, radu wrote:
> why I'm receiving on my PC  packages  with external ip on
> 4690,4544,4581.. ports???

That would be me. I was trying to lure you into posting something on 
this list. ;)

>   Internet -> linux box -> My PC(192.168.50.101)
>
>   linux box
>   eth0 local 192.168.50.0/24
>   eth1 Internet
>
>   my iptables config:
>
> iptables -P FORWARD DROP

good

> iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 4662 -j DNAT
> --to 192.168.50.101

4662/tcp packet arriving at the external interface should have their 
destination changed to Radu's computer ...

> iptables -I FORWARD  -d 192.168.50.101 -p tcp 
> --dport 4662 -j ACCEPT

... and those packets should be accepted.

> iptables -I FORWARD -i eth1 -o eth0 -m state 
> --state ESTABLISHED,RELATED -j ACCEPT

Any replies to established or related connections arriving at the 
external interface, destined to the internal interface, should be 
accepted.

This is surely the rule letting those in. Check the connection tracking 
table when you see them come in.
-- 
    mail to this address is discarded unless "/dev/rob0"
    or "not-spam" is in Subject: header

Re[2]: Help!!!

[radu]

Hello /dev/rob0,

ok.
      I modify the rule
>> iptables -I FORWARD -i eth1 -o eth0 -m state
>> --state ESTABLISHED,RELATED -j ACCEPT      
      in
>> iptables -I FORWARD -i eth1 -o eth0 -d 192.168.50.0/24 -m state
>> --state ESTABLISHED,RELATED -j ACCEPT      
     and this don't work...

[23/Jun/2005 16:00:34] "Network" action = 'denied',
descr = 'Unopened port', proto = 6, laddr = 192.168.50.101,
raddr = 217.132.77.214, lport = 2276, rport = 4662,
direc = 'in', ruleId = 0, proc = 'N/A'
     
     Q. why rule don't work ?
     Q. why this packages with flag ESTABLISHED come to me?





Thursday, June 23, 2005, 3:14:24 PM, you wrote:

dr> On Thursday 23 June 2005 06:50, radu wrote:
>> why I'm receiving on my PC  packages  with external ip on
>> 4690,4544,4581.. ports???

dr> That would be me. I was trying to lure you into posting something on
dr> this list. ;)

>>   Internet -> linux box -> My PC(192.168.50.101)
>>
>>   linux box
>>   eth0 local 192.168.50.0/24
>>   eth1 Internet
>>
>>   my iptables config:
>>
>> iptables -P FORWARD DROP

dr> good

>> iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 4662 -j DNAT
>> --to 192.168.50.101

dr> 4662/tcp packet arriving at the external interface should have their
dr> destination changed to Radu's computer ...

>> iptables -I FORWARD  -d 192.168.50.101 -p tcp 
>> --dport 4662 -j ACCEPT

dr> ... and those packets should be accepted.

>> iptables -I FORWARD -i eth1 -o eth0 -m state 
>> --state ESTABLISHED,RELATED -j ACCEPT

dr> Any replies to established or related connections arriving at the 
dr> external interface, destined to the internal interface, should be 
dr> accepted.

dr> This is surely the rule letting those in. Check the connection tracking
dr> table when you see them come in.



-- 
Best regards,
 radu                            mailto:radu@adm.utm.md

Re: Help!!!

[Jason Opperisano]

On Thu, Jun 23, 2005 at 02:50:54PM +0300, radu wrote:
> Hello all,
> 
>       My networck config:
> 
>   Internet -> linux box -> My PC(192.168.50.101)
> 
>   linux box
>   eth0 local 192.168.50.0/24
>   eth1 Internet
>   
>   my iptables config:
> 
> iptables -P FORWARD DROP
> iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 4662 -j DNAT --to 192.168.50.101
> iptables -I FORWARD  -d 192.168.50.101 -p tcp --dport 4662 -j ACCEPT
> iptables -I FORWARD -i eth1 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
> iptables -I FORWARD -s 192.168.50.101 -j ACCEPT
> iptables -t nat -I POSTROUTING -o eth1 -j MASQUERADE

a cleaned-up version of your script:

  iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 4662 \
    -j DNAT --to 192.168.50.101
  iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

  iptables -P FORWARD DROP
  iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
  iptables -A FORWARD -p tcp -d 192.168.50.101 --dport 4662 -j ACCEPT
  iptables -A FORWARD -s 192.168.50.101 -j ACCEPT

-j

--
"Meg: Oh no! I'm missing the news!
 Peter: We all miss The News, Meg, but Huey Lewis needs time to create,
 and we need to be patient."
        --Family Guy