problem with forward and iptables

problem with forward and iptables

[=?unknown-8bit?q?J=F6rgen?= Danielsson]

This is part of the rules

PROG="/usr/sbin/iptables"

$PROG -t nat -A POSTROUTING -j SNAT --source
iii.iii.iii.0/255.255.255.128 --to-source
ooo.ooo.*17.*50 -o eth1

### Set a default policy of DROP
$PROG -P FORWARD DROP
$PROG -P INPUT DROP
$PROG -P OUTPUT DROP


## navgw

# mail
$PROG  -t nat -A PREROUTING -p tcp -d ooo.ooo.*17.*54
--dport 25 -j DNAT --to iii.iii.iii.*15:25
$PROG -A FORWARD -p tcp -d iii.iii.iii.*15 --dport 25
-j ACCEPT
$PROG -A INPUT -p tcp --destination ooo.ooo.*17.*54
--destination-port 25 -j ACCEPT

# Allow SMTP 
$PROG -A FORWARD -j ACCEPT -i eth1 -o eth0
--destination iii.iii.iii.*15 -p tcp --dport 25
$PROG -A FORWARD -j ACCEPT -i eth1 -o eth0
--destination iii.iii.iii.*15 -p tcp --sport 25
$PROG -A FORWARD -j ACCEPT -i eth0 -o eth1 --source
iii.iii.iii.*15 -p tcp --dport 25
$PROG -A FORWARD -j ACCEPT -i eth0 -o eth1 --source
iii.iii.iii.*15 -p tcp --sport 25


ooo.ooo.*17.*50 is on eth1 (outside)
ooo.ooo.*17.*54 is another ip on eth1 (outside)

iii.iii.iii.*15 is a ip on a masq network (behind the
fw)

both ooo.ooo.ooo.ooo and iii.iii.iii.iii is real class
c-net (even though iii.iii.iii.iii is being masqed),
which mean no net is a 192.168.0.0/255.255.0.0 or
10.0.0.0/255.0.0.0 or 172.16.0.0/255.255.255.0

The problem:

Telnet from the outside to ooo.ooo.*17.*54 : 25 does
what its supposed to do, i get a reply from a smtp
server. But then i noticed that iii.iii.iii.*15 : 25
gives the same reply. How come ? No other ip on the
iii.iii.iii.iii net is reachable. Is the forward rule
opening for access directly to the masqed ip ? and how
do i stop that ?

/Jörgen



__________________________________________________
Do You Yahoo!?
Sign up for SBC Yahoo! Dial - First Month Free
http://sbc.yahoo.com

Re: problem with forward and iptables

[Antony Stone]

On Wednesday 03 July 2002 4:57 pm, "Jörgen" Danielsson wrote:

> This is part of the rules
>
> $PROG  -t nat -A PREROUTING -p tcp -d ooo.ooo.*17.*54
> --dport 25 -j DNAT --to iii.iii.iii.*15:25

Any packets coming in to ooo.oo.*17.*54 TCP port 25 get destination 
translated to iii.iii.iii.*15 port 25.

> $PROG -A FORWARD -p tcp -d iii.iii.iii.*15 --dport 25
> -j ACCEPT

Any packets for iii.iii.iii.*15 TCP port 25 are allowed through.

> $PROG -A INPUT -p tcp --destination ooo.ooo.*17.*54
> --destination-port 25 -j ACCEPT

I don't think you want this rule - you're not running a mail server on the 
Firewall, are you ?

> both ooo.ooo.ooo.ooo and iii.iii.iii.iii is real class
> c-net (even though iii.iii.iii.iii is being masqed),
> which mean no net is a 192.168.0.0/255.255.0.0 or
> 10.0.0.0/255.0.0.0 or 172.16.0.0/255.255.255.0

This means that ooo.ooo.ooo.ooo is routable across the Internet (and will get 
translated by your DNAT rule and sent on the iii.iii.iii.iii), and also 
iii.iii.iii.iii is routable across the Internet, so when it arrives at the 
Firewall it will simply get forwarded through to the server with that address.

> The problem:
>
> Telnet from the outside to ooo.ooo.*17.*54 : 25 does
> what its supposed to do, i get a reply from a smtp
> server. But then i noticed that iii.iii.iii.*15 : 25
> gives the same reply. How come ?

Hopefully the above explains why ?

> No other ip on the
> iii.iii.iii.iii net is reachable. Is the forward rule
> opening for access directly to the masqed ip ? and how
> do i stop that ?

Why do you want to stop it ?   If the mail server is accessible from the 
outside (as ooo.ooo.*17.*54), then why are you bothered about it also being 
accessible as iii.iii.iii.*15 ?   No-one can do any more damage to it on one 
IP than the other, so there's no loss of security here.

If you don't want its real IP address to be accessible from the outside, why 
have you given it a routable IP address at all, instead of a private 
10.0.0.0, 172.16.0.0 or 192.168.0.0 address ?

 

Antony.

Re: problem with forward and iptables (added one more prob in here)

[=?unknown-8bit?q?J=F6rgen?= Danielsson]

Thanks for the reply

I asked the company earlier why they don't put it on
the 172 net they have aswell, the explanation will be
abit too long to get here, but the answer is that they
must have a real c-net behind the firewall since they
are connected to another net aswell that requires real
ips (short version).

And they don't want the iii.iii.iii.iii net to be
accessible from the outside, thats why i am stuck.

Checking a little more and we hava similair rule for
port 80 and 443, and just noticed that other hosts on
the iii.iii.iii.iii net is now accessible from the
outside on port 80, not just iii.iii.iii.*15, even
though i added the destination part for that one
aswell, isn't that even more weird.


--- Antony Stone <Antony@Soft-Solutions.co.uk> wrote:
> On Wednesday 03 July 2002 4:57 pm, "Jörgen"
> Danielsson wrote:
> 
> > This is part of the rules
> >
> > $PROG  -t nat -A PREROUTING -p tcp -d
> ooo.ooo.*17.*54
> > --dport 25 -j DNAT --to iii.iii.iii.*15:25
> 
> Any packets coming in to ooo.oo.*17.*54 TCP port 25
> get destination 
> translated to iii.iii.iii.*15 port 25.
> 
> > $PROG -A FORWARD -p tcp -d iii.iii.iii.*15 --dport
> 25
> > -j ACCEPT
> 
> Any packets for iii.iii.iii.*15 TCP port 25 are
> allowed through.
> 
> > $PROG -A INPUT -p tcp --destination
> ooo.ooo.*17.*54
> > --destination-port 25 -j ACCEPT
> 
> I don't think you want this rule - you're not
> running a mail server on the 
> Firewall, are you ?
> 
> > both ooo.ooo.ooo.ooo and iii.iii.iii.iii is real
> class
> > c-net (even though iii.iii.iii.iii is being
> masqed),
> > which mean no net is a 192.168.0.0/255.255.0.0 or
> > 10.0.0.0/255.0.0.0 or 172.16.0.0/255.255.255.0
> 
> This means that ooo.ooo.ooo.ooo is routable across
> the Internet (and will get 
> translated by your DNAT rule and sent on the
> iii.iii.iii.iii), and also 
> iii.iii.iii.iii is routable across the Internet, so
> when it arrives at the 
> Firewall it will simply get forwarded through to the
> server with that address.
> 
> > The problem:
> >
> > Telnet from the outside to ooo.ooo.*17.*54 : 25
> does
> > what its supposed to do, i get a reply from a smtp
> > server. But then i noticed that iii.iii.iii.*15 :
> 25
> > gives the same reply. How come ?
> 
> Hopefully the above explains why ?
> 
> > No other ip on the
> > iii.iii.iii.iii net is reachable. Is the forward
> rule
> > opening for access directly to the masqed ip ? and
> how
> > do i stop that ?
> 
> Why do you want to stop it ?   If the mail server is
> accessible from the 
> outside (as ooo.ooo.*17.*54), then why are you
> bothered about it also being 
> accessible as iii.iii.iii.*15 ?   No-one can do any
> more damage to it on one 
> IP than the other, so there's no loss of security
> here.
> 
> If you don't want its real IP address to be
> accessible from the outside, why 
> have you given it a routable IP address at all,
> instead of a private 
> 10.0.0.0, 172.16.0.0 or 192.168.0.0 address ?
> 
>  
> 
> Antony.
> 


__________________________________________________
Do You Yahoo!?
Sign up for SBC Yahoo! Dial - First Month Free
http://sbc.yahoo.com

Re: problem with forward and iptables (added one more prob in here)

[Antony Stone]

On Wednesday 03 July 2002 5:39 pm, "Jörgen" Danielsson wrote:

> Thanks for the reply
>
> I asked the company earlier why they don't put it on
> the 172 net they have aswell, the explanation will be
> abit too long to get here, but the answer is that they
> must have a real c-net behind the firewall since they
> are connected to another net aswell that requires real
> ips (short version).
>
> And they don't want the iii.iii.iii.iii net to be
> accessible from the outside, thats why i am stuck.

Okay, I'll accept that you have some frustrating reasons why things just have 
to be this way.

Here's a suggestion for how to solve things:

iptables -A PREROUTING -i eth1 -t nat -d iii.iii.iii.0/24 -j DROP

*before* the rule which says

iptables -A PREROUTING -t nat -d ooo.ooo.*17.*54 -p tcp --dport 25 -j SNAT 
--to iii.iii.iii.*15:25

These rules will:

1. Drop any incoming packets originally addressed to iii.iii.iii.iii IPs
2. Translate packets for ooo.ooo.17.54 port 25 to iii.iii.iii.15

Forwarding remains the same.

 

Antony.