SSL and TLS not working on FIrewall machine?

SSL and TLS not working on FIrewall machine?

[Tasha Smith]

Hiii,
1.>Umm i was wandering how come SSL or TSL doesnt connect to my banks website
from the firewall machine. But i can connect with my machines on my LAN to the
Banks website....I put  #<----- near port 443 and you can see how open i lift
it? I get a error of 
"operation timed out when attempting to" from my browser??? 
2.>Why CAN i acccess it from my LAN machines and NOT from my firewall machine??
HERE is my script: 


#!/bin/bash

# Enable broadcast echo protection
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

# Disable source routed packets
for f in /proc/sys/net/ipv4/conf/*/accept_source_route; do
	echo 0 > $f
done

# Enable syn cookie protection.
echo 1 > /proc/sys/net/ipv4/tcp_syncookies

# Disable ICMP Redirect Acceptence
for f in /proc/sys/net/ipv4/conf/*/accept_redirects; do
	echo 0 > $f
done

# Drop spoofed packets comeing in on an interface, ehich if replied 
# to,would result the reply going out another interface.
for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
     echo 1 > $f
done

# Dont't send Redirect Messages
for f in /proc/sys/net/ipv4/conf/*/send_redirects; do
	echo 0 > $f
done

# Log packets with impossiable addreses.
for f in /proc/sys/net/ipv4/conf/*/log_martians; do
    echo 1 > $f
done

# This will help me with mmy Dynammic ip address
eth0_address=`ifconfig eth0 | grep "inet addr" | awk '{print $2} ' | sed
's/addr://'` 
# This will also update my ipaddress.
IP_INET=`/sbin/ifconfig eth0 | grep inet | cut -d: -f2 | cut -d\  -f1`
# This will will grab it too
#INET_IP=`ifconfig eth0 | grep "inet addr"|awk -F : '{ print $2 }'|cut -d \ -f
1`;

# Remove any existing rules from all chains.
iptables --flush
iptables -t nat --flush
iptables -t mangle --flush

# Unlimited access on the loopback interface.
iptables -A INPUT  -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

	
# Set the default policy to drop.
iptables --policy INPUT DROP
iptables --policy FORWARD DROP
iptables --policy OUTPUT DROP

# All of the bits are cleared
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
iptables -A FORWARD -p tcp --tcp-flags ALL NONE -j DROP
# SYN and FIN are both set
iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
iptables -A FORWARD -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
# SYN and RST are both set.
iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
# FIN and RST are both set
iptables -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j REJECT
iptables -A FORWARD -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
# FIN is the only bit set, without the expected accompanyuing ACK
iptables -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j DROP
iptables -A FORWARD -p tcp --tcp-flags ACK,FIN FIN -j REJECT
# PSH is the only bit set, without the expected accompaying ACK
iptables -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j DROP
iptables -A FORWARD -p tcp --tcp-flags ACK,PSH PSH -j REJECT
# URG is the only bit set, without the expected accompayning ACK
iptables -A INPUT -p tcp --tcp-flags ACK,URG URG -j DROP
iptables -A FORWARD -p tcp --tcp-flags ACK,URG URG -j DROP

# Log Policy for first 25 ports UDP/TCP.
iptables -I INPUT -i eth0 -p tcp \
         --dport 0:25 -j LOG --log-prefix "PortScans to 0-25TCP: "

iptables -I INPUT -i eth0 -p udp \
         --dport 0:25 -j LOG --log-prefix "PortScan-to 0-25UDP: "

# Allow stateful connections 
iptables -A INPUT   -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT  -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# Drop Invalid connection
iptables -A INPUT -m state --state INVALID -j LOG \
         --log-prefix "Invalid input: "
iptables -A INPUT -m state --state INVALID -j DROP
         
iptables -A OUTPUT -m state --state INVALID -j LOG \
         --log-prefix "Invalid output: " 
iptables -A OUTPUT -m state --state INVALID -j DROP

iptables -A FORWARD -m state --state INVALID -j LOG \
         --log-prefix "Invalid forward: "
iptables -A FORWARD -m state --state INVALID -j DROP
 

# Dropped packets that pretend to be coming in from PRIVATE ADDRESSes.
iptables -A INPUT   -i eth0 -s 10.0.0.1/8     -j DROP
iptables -A FORWARD -i eth0 -s 10.0.0.1/8     -j DROP
iptables -A INPUT   -i eth0 -s 169.254.0.0/16 -j DROP
iptables -A FORWARD -i eth0 -s 169.254.0.0/16 -j DROP
iptables -A INPUT   -i eth0 -s 172.16.0.0/12  -j DROP
iptables -A FORWARD -i eth0 -s 172.16.0.0/12  -j DROP
iptables -A INPUT   -i eth0 -s 192.168.0.0/24 -j DROP
iptables -A FORWARD -i eth0 -s 192.168.0.0/24 -j DROP
iptables -A INPUT   -i eth0 -s 127.0.0.1/8    -j DROP
iptables -A FORWARD -i eth0 -s 127.0.0.1/8    -j DROP

# Allow Access for DNS UDP for my ISP DNS server.
if [ "$CONNECTION_TRACKING" = "1" ]; then
   iptables -A OUTPUT -o eth0 -p udp \
            -s $IP_INET --sport 1024:65535 \
            -d 239.73.4.130 --dport 53 \
            -m state --state NEW -j ACCEPT
fi

iptables -A OUTPUT -o eth0 -p udp \
         -s $IP_INET     --sport 1024:65535 \
         -d 239.73.4.130 --dport 53 -j ACCEPT


if [ "$CONNECTION_TRACKING" = "1" ]; then
    iptables -A OUTPUT -o eth0 -p udp \
             -s $IP_INET --sport 1024:65535 \
             -d 239.73.4.150 --dport 53 \
             -m state --state NEW -j ACCEPT
fi

iptables -A OUTPUT -o eth0 -p udp \
         -s $IP_INET --sport 1024:65535 \
         -d 239.73.4.150 --dport 53 -j ACCEPT
       
# Allow access for my ISP DHCP server.
if [ "$CONNECTION_TRACKING" = "1" ]; then
    iptables -A OUTPUT -o eth0 -p udp \
             -s $IP_NET --sport 1024:65535 \
             -d 239.73.4.129 --dport 67 \
             -m state --state NEW -j ACCEPT
fi

iptables -A OUTPUT -o eth0 -p udp \
         -s $IP_INET      --sport 1024:65535 \
         -d 239.73.4.129  --dport 67 -j ACCEPT

iptables -A INPUT -i eth0 -p udp \
         -s 239.73.4.129 --sport 67 \
         -d $IP_INET     --dport 1024:65535 -j ACCEPT

# Allow access to remote webservers PORT 80.
if [ "$CONNECTION_TRACKING" = "1" ]; then
    iptables -A OUTPUT -o eth0 -p tcp \
             -s $IP_INET --sport 1024:65535 \
             --dport 80 -m state --state NEW -j ACCEPT
fi

iptables -A OUTPUT -o eth0 -p tcp \
         -s $IP_INET --sport 1024:65535 \
         --dport 80 -j ACCEPT

iptables -A INPUT -i eth0 -p tcp ! --syn \
         --sport 80 \
         -d $IP_INET --dport 1024:65535 -j ACCEPT

# Allow access for SSL and TLS on Port 443.
if [ "$CONNECTION_TRACKING" = "1" ]; then
    iptables -A OUTPUT -o eth0 -p tcp \ #<------------------
             -s $IP_INET --sport 1024:65535 \
             --dport 443 -m state --state NEW -j ACCEPT
fi

iptables -A OUTPUT -o eth0 -p tcp \
         -s $IP_INET --sport 1024:65535 \   #<----------------
         --dport 443 -j ACCEPT   

iptables -A INPUT -i eth0 -p tcp ! --syn \
         --sport 443 \
         -d $IP_INET --dport 1024:65535 -j ACCEPT #<-----------------

iptables -A OUTPUT -o eth0 \
        -p tcp -m multiport --dport 80,443 \
        ! --syn -s $IP_INET --sport 1024:65535 -j ACCEPT  #<--------------

iptables -A INPUT -i eth0 -p tcp -m multiport \
        --sport 80,443 \
       ! --syn -s $IP_INET --dport 1024:65535 -j ACCEPT  #<------------

# Forwarding is allowed in the direction
iptables -A FORWARD -i eth1 -o eth0 -s 192.168.0.0/24 -j ACCEPT 

# Enables Packet Forwarding
iptables -t nat -A POSTROUTING -o eth0  -j MASQUERADE

echo 1 > /proc/sys/net/ipv4/ip_forward 


__________________________________________________
Do you Yahoo!?
HotJobs - Search new jobs daily now
http://hotjobs.yahoo.com/

Re: SSL and TLS not working on FIrewall machine?

[Matthew Hellman]

just my opinion, but your script is complicated and not for the right
reasons.  I'm a big proponent of keeping it simple

> 1.>Umm i was wandering how come SSL or TSL doesnt connect to my banks
website
> from the firewall machine.

iptables knows nothing about SSL and TLS. You want to know why you can't
connect on port 443;-)

> # Enable broadcast echo protection
> echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
>
<snip of sysctl parameters>

You might consider creating a separate file for these kernel parameters and
then sourcing the file from the script. Anymore, I just edit
/etc/sysctl.conf.  That might be a Redhat thing though, not sure. Another
suggestion is to keep all your INPUT, OUTPUT, and FORWARD rules together.
Makes the script much more readable. In some cases, I've even created a very
short 1 page main script that calls separate files for INPUT,OUTPUT, and
FORWARD.  When you want to change your INPUT rules, for instance, you don't
have any irrelevant clutter confusing things.

> # All of the bits are cleared
> iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
> iptables -A FORWARD -p tcp --tcp-flags ALL NONE -j DROP
> # SYN and FIN are both set
> iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
> iptables -A FORWARD -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
> # SYN and RST are both set.
> iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
> iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
> # FIN and RST are both set
<snip>

bleh.  I would axe the above section entirely myself....has little value.
Aren't these are all taken care of with a default DROP policy and by only
allowing NEW,EST, REL?

> # Log Policy for first 25 ports UDP/TCP.
> iptables -I INPUT -i eth0 -p tcp \
>          --dport 0:25 -j LOG --log-prefix "PortScans to 0-25TCP: "
>
> iptables -I INPUT -i eth0 -p udp \
>          --dport 0:25 -j LOG --log-prefix "PortScan-to 0-25UDP: "

This is probably not doing what you think it is.  This will log any input on
eth0 with a destination port of 0 thru 25.  Not very useful.

> # Drop Invalid connection
> iptables -A INPUT -m state --state INVALID -j LOG \
>          --log-prefix "Invalid input: "
> iptables -A INPUT -m state --state INVALID -j DROP
<snip>

A lot of these INVALID packets were dropped already in earlier INPUT/FORWARD
rules.  So this isn't logging everything. Do keep the OUTPUT rules however.

> # Allow Access for DNS UDP for my ISP DNS server.
> if [ "$CONNECTION_TRACKING" = "1" ]; then
>    iptables -A OUTPUT -o eth0 -p udp \
>             -s $IP_INET --sport 1024:65535 \
>             -d 239.73.4.130 --dport 53 \
>             -m state --state NEW -j ACCEPT
> fi
>
> iptables -A OUTPUT -o eth0 -p udp \
>          -s $IP_INET     --sport 1024:65535 \
>          -d 239.73.4.130 --dport 53 -j ACCEPT
>
>
> if [ "$CONNECTION_TRACKING" = "1" ]; then
>     iptables -A OUTPUT -o eth0 -p udp \
>              -s $IP_INET --sport 1024:65535 \
>              -d 239.73.4.150 --dport 53 \
>              -m state --state NEW -j ACCEPT
> fi
>
> iptables -A OUTPUT -o eth0 -p udp \
>          -s $IP_INET --sport 1024:65535 \
>          -d 239.73.4.150 --dport 53 -j ACCEPT

I don't get these rules. More unecessary complication IMHO. Either take
advantage of connection tracking or don't. Is there some scenario where you
might want to quickly change from using it to not using it (testing, etc)? I
don't see where you've set this variable (so presumably your not using
connection tracking).

> # Allow access to remote webservers PORT 80.
> if [ "$CONNECTION_TRACKING" = "1" ]; then
>     iptables -A OUTPUT -o eth0 -p tcp \
>              -s $IP_INET --sport 1024:65535 \
>              --dport 80 -m state --state NEW -j ACCEPT
> fi
>
> iptables -A OUTPUT -o eth0 -p tcp \
>          -s $IP_INET --sport 1024:65535 \
>          --dport 80 -j ACCEPT
>
> iptables -A INPUT -i eth0 -p tcp ! --syn \
>          --sport 80 \
>          -d $IP_INET --dport 1024:65535 -j ACCEPT
>
> # Allow access for SSL and TLS on Port 443.
> if [ "$CONNECTION_TRACKING" = "1" ]; then
>     iptables -A OUTPUT -o eth0 -p tcp \ #<------------------
>              -s $IP_INET --sport 1024:65535 \
>              --dport 443 -m state --state NEW -j ACCEPT
> fi
>
> iptables -A OUTPUT -o eth0 -p tcp \
>          -s $IP_INET --sport 1024:65535 \   #<----------------
>          --dport 443 -j ACCEPT
>
> iptables -A INPUT -i eth0 -p tcp ! --syn \
>          --sport 443 \
>          -d $IP_INET --dport 1024:65535 -j ACCEPT #<-----------------
>
> iptables -A OUTPUT -o eth0 \
>         -p tcp -m multiport --dport 80,443 \
>         ! --syn -s $IP_INET --sport 1024:65535 -j ACCEPT  #<--------------
>
> iptables -A INPUT -i eth0 -p tcp -m multiport \
>         --sport 80,443 \
>        ! --syn -s $IP_INET --dport 1024:65535 -j ACCEPT  #<------------

umm....okay.  maybe it's a display issue , but where exactly are you putting
those pound signs?  In any event, for a connection-tracking based rule:
iptables -A OUTPUT -o $EXTIF -m state --state NEW -p tcp -m
multiport --dports 80,443 -j ACCEPT

If you don't want to use connection tracking:
iptables -A OUTPUT -o $EXTIF -p tcp -m multiport --dports 80,443 -j ACCEPT

Anything else is probably more complicated that its worth.

Re: SSL and TLS not working on FIrewall machine?

[Tasha Smith]

Hmmm, that didnt work...i even tryed to see the default INPUT rule from DROP to
ACCEPT just for testing and still it wont let me connect? the site im tyring to
connect to is
www.tdcanadatrust.com   
and then for the SSL you have to click the orange "NOW" button on the top right
hand corner? Something else i can try?? 


--- Matthew Hellman <mhellman@raccoon.com> wrote:
> just my opinion, but your script is complicated and not for the right
> reasons.  I'm a big proponent of keeping it simple
> 
> > 1.>Umm i was wandering how come SSL or TSL doesnt connect to my banks
> website
> > from the firewall machine.
> 
> iptables knows nothing about SSL and TLS. You want to know why you can't
> connect on port 443;-)
> 
> > # Enable broadcast echo protection
> > echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
> >
> <snip of sysctl parameters>
> 
> You might consider creating a separate file for these kernel parameters and
> then sourcing the file from the script. Anymore, I just edit
> /etc/sysctl.conf.  That might be a Redhat thing though, not sure. Another
> suggestion is to keep all your INPUT, OUTPUT, and FORWARD rules together.
> Makes the script much more readable. In some cases, I've even created a very
> short 1 page main script that calls separate files for INPUT,OUTPUT, and
> FORWARD.  When you want to change your INPUT rules, for instance, you don't
> have any irrelevant clutter confusing things.
> 
> > # All of the bits are cleared
> > iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
> > iptables -A FORWARD -p tcp --tcp-flags ALL NONE -j DROP
> > # SYN and FIN are both set
> > iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
> > iptables -A FORWARD -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
> > # SYN and RST are both set.
> > iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
> > iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
> > # FIN and RST are both set
> <snip>
> 
> bleh.  I would axe the above section entirely myself....has little value.
> Aren't these are all taken care of with a default DROP policy and by only
> allowing NEW,EST, REL?
> 
> > # Log Policy for first 25 ports UDP/TCP.
> > iptables -I INPUT -i eth0 -p tcp \
> >          --dport 0:25 -j LOG --log-prefix "PortScans to 0-25TCP: "
> >
> > iptables -I INPUT -i eth0 -p udp \
> >          --dport 0:25 -j LOG --log-prefix "PortScan-to 0-25UDP: "
> 
> This is probably not doing what you think it is.  This will log any input on
> eth0 with a destination port of 0 thru 25.  Not very useful.
> 
> > # Drop Invalid connection
> > iptables -A INPUT -m state --state INVALID -j LOG \
> >          --log-prefix "Invalid input: "
> > iptables -A INPUT -m state --state INVALID -j DROP
> <snip>
> 
> A lot of these INVALID packets were dropped already in earlier INPUT/FORWARD
> rules.  So this isn't logging everything. Do keep the OUTPUT rules however.
> 
> > # Allow Access for DNS UDP for my ISP DNS server.
> > if [ "$CONNECTION_TRACKING" = "1" ]; then
> >    iptables -A OUTPUT -o eth0 -p udp \
> >             -s $IP_INET --sport 1024:65535 \
> >             -d 239.73.4.130 --dport 53 \
> >             -m state --state NEW -j ACCEPT
> > fi
> >
> > iptables -A OUTPUT -o eth0 -p udp \
> >          -s $IP_INET     --sport 1024:65535 \
> >          -d 239.73.4.130 --dport 53 -j ACCEPT
> >
> >
> > if [ "$CONNECTION_TRACKING" = "1" ]; then
> >     iptables -A OUTPUT -o eth0 -p udp \
> >              -s $IP_INET --sport 1024:65535 \
> >              -d 239.73.4.150 --dport 53 \
> >              -m state --state NEW -j ACCEPT
> > fi
> >
> > iptables -A OUTPUT -o eth0 -p udp \
> >          -s $IP_INET --sport 1024:65535 \
> >          -d 239.73.4.150 --dport 53 -j ACCEPT
> 
> I don't get these rules. More unecessary complication IMHO. Either take
> advantage of connection tracking or don't. Is there some scenario where you
> might want to quickly change from using it to not using it (testing, etc)? I
> don't see where you've set this variable (so presumably your not using
> connection tracking).
> 
> > # Allow access to remote webservers PORT 80.
> > if [ "$CONNECTION_TRACKING" = "1" ]; then
> >     iptables -A OUTPUT -o eth0 -p tcp \
> >              -s $IP_INET --sport 1024:65535 \
> >              --dport 80 -m state --state NEW -j ACCEPT
> > fi
> >
> > iptables -A OUTPUT -o eth0 -p tcp \
> >          -s $IP_INET --sport 1024:65535 \
> >          --dport 80 -j ACCEPT
> >
> > iptables -A INPUT -i eth0 -p tcp ! --syn \
> >          --sport 80 \
> >          -d $IP_INET --dport 1024:65535 -j ACCEPT
> >
> > # Allow access for SSL and TLS on Port 443.
> > if [ "$CONNECTION_TRACKING" = "1" ]; then
> >     iptables -A OUTPUT -o eth0 -p tcp \ #<------------------
> >              -s $IP_INET --sport 1024:65535 \
> >              --dport 443 -m state --state NEW -j ACCEPT
> > fi
> >
> > iptables -A OUTPUT -o eth0 -p tcp \
> >          -s $IP_INET --sport 1024:65535 \   #<----------------
> >          --dport 443 -j ACCEPT
> >
> > iptables -A INPUT -i eth0 -p tcp ! --syn \
> >          --sport 443 \
> >          -d $IP_INET --dport 1024:65535 -j ACCEPT #<-----------------
> >
> > iptables -A OUTPUT -o eth0 \
> >         -p tcp -m multiport --dport 80,443 \
> >         ! --syn -s $IP_INET --sport 1024:65535 -j ACCEPT  #<--------------
> >
> > iptables -A INPUT -i eth0 -p tcp -m multiport \
> >         --sport 80,443 \
> >        ! --syn -s $IP_INET --dport 1024:65535 -j ACCEPT  #<------------
> 
> umm....okay.  maybe it's a display issue , but where exactly are you putting
> those pound signs?  In any event, for a connection-tracking based rule:
> iptables -A OUTPUT -o $EXTIF -m state --state NEW -p tcp -m
> multiport --dports 80,443 -j ACCEPT
> 
> If you don't want to use connection tracking:
> iptables -A OUTPUT -o $EXTIF -p tcp -m multiport --dports 80,443 -j ACCEPT
> 
> Anything else is probably more complicated that its worth.
> 
> 


__________________________________________________
Do you Yahoo!?
HotJobs - Search new jobs daily now
http://hotjobs.yahoo.com/