ssh connecting to wrong machine....

ssh connecting to wrong machine....

[George Georgalis]

On a 2 interface firewall, I've set up an alias eth1:1 ($EXT_host04) to
an IP on our T-1, then added a nat which should connect ports $TCP_OPEN
and $UDP_OPEN to the internal IP ($LAN_host04).

But when I go to ssh $EXT_host04 from the internet I end up talking to
the firewall sshd, not the sshd on $LAN_host04. Why is that? Here are my
rules:

LANIF=eth0
EXTIF=eth1
TCP_OPEN="22,25,53,80"
UDP_OPEN="22,53"

iptables -A INPUT -m state --state ESTABLISHED,RELATED \
-j ACCEPT

iptables -A INPUT -i $EXTIF -m state --state NEW \
-p tcp -m multiport --dport $TCP_OPEN -j ACCEPT

iptables -A INPUT -i $EXTIF -m state --state NEW \
-p udp -m multiport --dport $UDP_OPEN -j ACCEPT


iptables -A FORWARD -i $EXTIF -o $LANIF -p tcp \
-m multiport --dport $TCP_OPEN \
-m state --state NEW,RELATED,ESTABLISHED \
-j ACCEPT

iptables -A FORWARD -i $EXTIF -o $LANIF -p udp \
-m multiport --dport $UDP_OPEN \
-m state --state NEW,RELATED,ESTABLISHED \
-j ACCEPT


iptables -t nat -A PREROUTING -p tcp \
-s $EXT_host04 \
-j DNAT --to-destination $LAN_host04

iptables -t nat -A POSTROUTING -o $EXTIF \
-j MASQUERADE


Thanks,
// George

-- 
GEORGE GEORGALIS, System Admin/Architect    cell: 347-451-8229 
Security Services, Web, Mail,            mailto:george@galis.org 
File, Print, DB and DNS Servers.       http://www.galis.org/george 

Re: ssh connecting to wrong machine....

[Matthew Hellman]

George,
The general rule for ip/port forwarding to internal machine is simple. You
have one PREROUTING rule that changes the destination address/port.  You
then have one FORWARD rule that allows the packets to be forwarded (because
you are, or should be, by default dropping everything in the FORWARD chain).

> iptables -t nat -A PREROUTING -p tcp -s $EXT_host04 -j
DNAT --to-destination $LAN_host04

This is the major problem. If you're connection from a host on the Internet
the source address is not going to be your firewall. Change this line to:
iptables -t nat -A PREROUTING -p tcp -j DNAT --to-destination $LAN_host04

I would consider tightening up your forward rules as well:

> iptables -A FORWARD -i $EXTIF -o $LANIF -p tcp -m multiport --dport
$TCP_OPEN -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

Might I suggest doing something similar to what you did for the input rules:

iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $EXTIF -o $LANIF -d $LAN_host04 -p tcp -m
multiport --dport $TCP_OPEN -m state --state NEW -j ACCEPT
iptables -A FORWARD -i $EXTIF -o $LANIF -d $LAN_host04 -p udp -m
multiport --dport $UDP_OPEN -m state --state NEW -j ACCEPT

Notice I added the "-d $LAN_host04"....very important restriction.

Also, what is UDP port 22 for?  Is your firewall running all the same
services as $LAN_host04?  You are allowing the same access to it.

Goodluck,
Matt

Re: ssh connecting to wrong machine....

[George Georgalis]

On Sun, Jun 02, 2002 at 09:58:14PM -0500, Matthew Hellman wrote:
>George,
>The general rule for ip/port forwarding to internal machine is simple. You
>have one PREROUTING rule that changes the destination address/port.  You
>then have one FORWARD rule that allows the packets to be forwarded (because
>you are, or should be, by default dropping everything in the FORWARD chain).

Yes, drop is my default policy for forward and input. Thanks for the
succinct explanation of how input and nat work together! I think I knew,
but didn't understand.

>
>> iptables -t nat -A PREROUTING -p tcp -s $EXT_host04 -j DNAT --to-destination $LAN_host04
>
>This is the major problem. If you're connection from a host on the Internet
>the source address is not going to be your firewall. Change this line to:
>iptables -t nat -A PREROUTING -p tcp -j DNAT --to-destination $LAN_host04

How's this? ($EXT_host04 is just an alias, and there will be more) 

iptables -t nat -A PREROUTING -p tcp -d $EXT_host04 -j DNAT --to-destination $LAN_host04

>
>I would consider tightening up your forward rules as well:
>

Done.

>Also, what is UDP port 22 for?  Is your firewall running all the same
>services as $LAN_host04?  You are allowing the same access to it.

Well, don't know that openssh uses it, but since 22/udp is in
/etc/services I thought it might be implemented in some curcumstance...
all the boxes are secured, so I'm not too worried about letting in
ports now, just trying to to manage a smooth production migration (the
$LAN_host04 functions will split to other machines, just want a sound
firewall script now, before it gets long).  The firewall is actually
running dns and smtp now too. Once I get all the services packaged,
portable and on $LAN_host04, I'm going to use an old box for the
firewall (with LEAF) and turn the firewall into a LAN server. The setup
should (hopefully) scale additional Internet IPs and LAN computers well,
someday we may even setup a DMZ :)

This seems to be doing the job :-} I added another nat rule, does it
look okay?

LANIF=eth0
EXTIF=eth1
TCP_OPEN="22,25,53,80"
UDP_OPEN="53"
LAN_host04=192.168.xx.xx
EXT_host04=xx.xx.xx.xx  

iptables -P INPUT DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i $EXTIF -m state --state NEW -p tcp -m multiport --dport $TCP_OPEN -j ACCEPT
iptables -A INPUT -i $EXTIF -m state --state NEW -p udp -m multiport --dport $UDP_OPEN -j ACCEPT
iptables -A INPUT -i $LANIF -m state --state NEW -j ACCEPT
iptables -A INPUT -i lo     -m state --state NEW -j ACCEPT
iptables -A INPUT -j LOG --log-prefix "INPUT-DROP "
iptables -A INPUT -j REJECT

iptables -t nat -A PREROUTING -d $EXT_host04 -j DNAT --to-destination $LAN_host04

iptables -P FORWARD DROP
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $EXTIF -o $LANIF -d $LAN_host04 -p tcp -m multiport --dport $TCP_OPEN -m state --state NEW -j ACCEPT
iptables -A FORWARD -i $EXTIF -o $LANIF -d $LAN_host04 -p udp -m multiport --dport $UDP_OPEN -m state --state NEW -j ACCEPT
iptables -A FORWARD -j LOG --log-prefix "FORWARD-DROP "

iptables -t nat -A POSTROUTING -s $LAN_host04 -j SNAT --to-source $EXT_host04
iptables -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE

iptables -P OUTPUT ACCEPT


Thanks again,
// George


-- 
GEORGE GEORGALIS, System Admin/Architect    cell: 347-451-8229 
Security Services, Web, Mail,            mailto:george@galis.org 
File, Print, DB and DNS Servers.       http://www.galis.org/george 

Re: ssh connecting to wrong machine....

[Matthew Hellman]

> >> iptables -t nat -A PREROUTING -p tcp -s $EXT_host04 -j
DNAT --to-destination $LAN_host04
> >
> >This is the major problem. If you're connection from a host on the
Internet
> >the source address is not going to be your firewall. Change this line to:
> >iptables -t nat -A PREROUTING -p tcp -j DNAT --to-destination $LAN_host04
>
> How's this? ($EXT_host04 is just an alias, and there will be more)
>
> iptables -t nat -A PREROUTING -p tcp -d $EXT_host04 -j
DNAT --to-destination $LAN_host04
>

Good catch....I left an imporant piece out.  You'll definetely want the "-d
xxx" in the rule.

<snip>
> This seems to be doing the job :-} I added another nat rule, does it
> look okay?
>
> LANIF=eth0
> EXTIF=eth1
> TCP_OPEN="22,25,53,80"
> UDP_OPEN="53"
> LAN_host04=192.168.xx.xx
> EXT_host04=xx.xx.xx.xx
>
> iptables -P INPUT DROP
<snip>
> iptables -P OUTPUT ACCEPT

Looks good.  The only other thing I'd do is change your default OUTPUT
policy to DROP and add this:
iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

There was a recent bug in the iptables code that had some security
implications (information disclosure), but I don't recall the details at the
moment. The suggestion was to drop INVALID output, which this does.

Goodluck,
Matt

Re: ssh connecting to wrong machine....

[George Georgalis]

On Mon, Jun 03, 2002 at 07:13:17AM -0500, Matthew Hellman wrote:
>
>Looks good.  The only other thing I'd do is change your default OUTPUT
>policy to DROP and add this:
>iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
>
>There was a recent bug in the iptables code that had some security
>implications (information disclosure), but I don't recall the details at the
>moment. The suggestion was to drop INVALID output, which this does.

I think I heard about that, disclosing LAN IPs? I didn't really pay
attention at the time, thanks, it's fixed now.

// George


-- 
GEORGE GEORGALIS, System Admin/Architect    cell: 347-451-8229 
Security Services, Web, Mail,            mailto:george@galis.org 
File, Print, DB and DNS Servers.       http://www.galis.org/george 

Re: ssh connecting to wrong machine....

[George Georgalis]

I tried adding this to the nat but it didn't fix it...

iptables -t nat -A POSTROUTING -p tcp -s $LAN_host04 -j SNAT --to-source $EXT_host04

:-\

Is my masq getting in the way? What's the best way to fix?


# iptables -t nat -vL
Chain PREROUTING (policy ACCEPT 815K packets, 38M bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DNAT       tcp  --  any    any     $EXT_host04	  anywhere           to:$LAN_host04
    0     0 DNAT       tcp  --  any    any     anywhere             anywhere           tcp dpt:50422 to:$LAN_host04:22

Chain POSTROUTING (policy ACCEPT 5896 packets, 363K bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 SNAT       tcp  --  any    any     us04                 anywhere           to:$EXT_host04
    0     0 MASQUERADE  all  --  any    eth1    anywhere             anywhere

Chain OUTPUT (policy ACCEPT 58945 packets, 3850K bytes)
 pkts bytes target     prot opt in     out     source               destination


Thanks,
// George


On Sun, Jun 02, 2002 at 07:21:57PM -0400, George Georgalis wrote:
>On a 2 interface firewall, I've set up an alias eth1:1 ($EXT_host04) to
>an IP on our T-1, then added a nat which should connect ports $TCP_OPEN
>and $UDP_OPEN to the internal IP ($LAN_host04).
>
>But when I go to ssh $EXT_host04 from the internet I end up talking to
>the firewall sshd, not the sshd on $LAN_host04. Why is that? Here are my
>rules:
>
>LANIF=eth0
>EXTIF=eth1
>TCP_OPEN="22,25,53,80"
>UDP_OPEN="22,53"
>
>iptables -A INPUT -m state --state ESTABLISHED,RELATED \
>-j ACCEPT
>
>iptables -A INPUT -i $EXTIF -m state --state NEW \
>-p tcp -m multiport --dport $TCP_OPEN -j ACCEPT
>
>iptables -A INPUT -i $EXTIF -m state --state NEW \
>-p udp -m multiport --dport $UDP_OPEN -j ACCEPT
>
>
>iptables -A FORWARD -i $EXTIF -o $LANIF -p tcp \
>-m multiport --dport $TCP_OPEN \
>-m state --state NEW,RELATED,ESTABLISHED \
>-j ACCEPT
>
>iptables -A FORWARD -i $EXTIF -o $LANIF -p udp \
>-m multiport --dport $UDP_OPEN \
>-m state --state NEW,RELATED,ESTABLISHED \
>-j ACCEPT
>
>
>iptables -t nat -A PREROUTING -p tcp \
>-s $EXT_host04 \
>-j DNAT --to-destination $LAN_host04
>
>iptables -t nat -A POSTROUTING -o $EXTIF \
>-j MASQUERADE
>
>
>Thanks,
>// George
>
>-- 
>GEORGE GEORGALIS, System Admin/Architect    cell: 347-451-8229 
>Security Services, Web, Mail,            mailto:george@galis.org 
>File, Print, DB and DNS Servers.       http://www.galis.org/george 
>

-- 
GEORGE GEORGALIS, System Admin/Architect    cell: 347-451-8229 
Security Services, Web, Mail,            mailto:george@galis.org 
File, Print, DB and DNS Servers.       http://www.galis.org/george