From mboxrd@z Thu Jan  1 00:00:00 1970
From: Ramin Alidousti <ramin@cannon.eng.us.uu.net>
Subject: Re: (no subject)
Date: Mon, 17 Jun 2002 15:30:01 -0400
Sender: netfilter-admin@lists.samba.org
Message-ID: <20020617193001.GF22025@cannon.eng.us.uu.net>
References: <000d01c21630$635a51a0$8147370a@washingtghv9lt> <20020617191041.GE22025@cannon.eng.us.uu.net> <200206171917.g5HJHBA16918@Networker.rockstone.co.uk>
Mime-Version: 1.0
Return-path: <netfilter-admin@lists.samba.org>
Content-Disposition: inline
In-Reply-To: <200206171917.g5HJHBA16918@Networker.rockstone.co.uk>
Errors-To: netfilter-admin@lists.samba.org
List-Help: <mailto:netfilter-request@lists.samba.org?subject=help>
List-Post: <mailto:netfilter@lists.samba.org>
List-Subscribe: <http://lists.samba.org/listinfo/netfilter>,
	<mailto:netfilter-request@lists.samba.org?subject=subscribe>
List-Id: <netfilter.vger.kernel.org>
List-Unsubscribe: <http://lists.samba.org/listinfo/netfilter>,
	<mailto:netfilter-request@lists.samba.org?subject=unsubscribe>
List-Archive: <http://lists.samba.org/pipermail/netfilter/>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
To: Antony Stone <Antony@Soft-Solutions.co.uk>
Cc: netfilter@lists.samba.org

On Mon, Jun 17, 2002 at 08:17:10PM +0100, Antony Stone wrote:

> On Monday 17 June 2002 8:10 pm, Ramin Alidousti wrote:
> 
> > What you're missing is:
> >
> > -A OUTPUT -m state --state ESTABLISHED -j ACCEPT
> >
> > so the SYN,ACK and all the replies from your box would bve
> > allowed to be sent out to the client.
> 
> Um, no - the default policy on the OUTPUT chain is ACCEPT, so there's no 
> problem with the packets getting *out* of the machine - they're just not 
> being allowed back *in* again in the INPUT chain....

Correct. Scanned through the rules and the log too fast...
Still, I'd recommend to have "-m state --state ESTABLISHED,RELATED"
for all the predefined chains in the filter table. One should enforce
the security on "NEW". Much less headache that way...

Ramin

> 
> Antony.
> 
> > I'd advise you to have RELATED in the rule as well.
> >
> > Ramin
> >
> > On Mon, Jun 17, 2002 at 11:54:18AM -0700, James Mello wrote:
> > > I've set up the following iptables chains on my box,  but I'm getting
> > > denies that I'm not expecting. Below is a copy of the config as well as
> > > the deny log that I'm seeing.
> > >
> > > # Generated by iptables-save v1.2.3 on Mon Jun 17 11:11:02 2002
> > > *filter
> > >
> > > :INPUT DROP [0:0]
> > > :FORWARD DROP [0:0]
> > > :OUTPUT ACCEPT [199:15749]
> > > :LOGDENY - [0:0]
> > >
> > > -A INPUT -i eth0 -p udp -m udp --sport 53 -j ACCEPT
> > > -A INPUT -i eth0 -p tcp -m tcp --sport 53 -j ACCEPT
> > > -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
> > > -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
> > > -A INPUT -i eth0 -p udp -m udp --sport 67:68 -j ACCEPT
> > > -A INPUT -i eth0 -p tcp -m tcp --sport 67:68 -j ACCEPT
> > > -A INPUT -p tcp -j LOGDENY
> > > -A INPUT -p udp -j LOGDENY
> > > -A LOGDENY -p udp -m udp --dport 137:139 -j DROP
> > > -A LOGDENY -p tcp -m tcp --dport 137:139 -j DROP
> > > -A LOGDENY -j LOG --log-prefix "IPTABLES DENY "
> > > -A LOGDENY -j DROP
> > > COMMIT
> > > # Completed on Mon Jun 17 11:11:02 2002
> > >
> > > root# ssh localhost
> > > root# tail -f /var/log/messages
> > >
> > > Jun 17 11:51:54 localhost kernel: IPTABLES DENY IN=lo OUT=
> > > MAC=00:00:00:00:00:00:00:00:00:00:00:00:08:00 SRC=127.0.0.1
> > > DST=127.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=TCP SPT=22
> > > DPT=32783 WINDOW=32767 RES=0x00 ACK SYN URGP=0
> > >
> > >
> > > What confuses me the most is the fact that I'm getting denied on the
> > > SYN/ACK rather than on the initial connection. Can someone please shed
> > > some light on this?