ULOG with -m state

ULOG with -m state

[Iva Cabric Cabric]

Hello,
I have found a bug in iptables when "-j ULOG" and "-m state" are
used together, for example:

$ iptables -A ssh -j ULOG -p tcp -m state --state NEW

reports:

iptables v1.2.6a: You must specify `--state'
Try `iptables -h' or 'iptables --help' for more information.

but using DROP works fine:

$ iptables -A ssh -j DROP -p tcp -m state --state NEW
(no error)

$ iptables -L ssh
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             xxx.xxx.xxx.xxx    state ESTABLISHED
DROP       tcp  --  anywhere             anywhere           state NEW 
(first rule is not important...)

Kernel is 2.4.19, iptables are v1.2.6a and system is Debian based
(iptables are from .deb packet, and kernel is manually bulit from
kernel-source-2.4.19).

I haven't found anything about that in changelog for v1.2.7a, but
maybe it has been already fixed. Anyone else with same problem?

p.s.

It could also be Debian specific problem, in that case I'll send
bug report to them, but I would like to check with you first.

TIA

Re: ULOG with -m state

[Joel Newkirk]

On Friday 22 November 2002 10:53 am, Iva "Cabric" Cabric wrote:
> Hello,
> I have found a bug in iptables when "-j ULOG" and "-m state" are
> used together, for example:
>
> $ iptables -A ssh -j ULOG -p tcp -m state --state NEW
>
> reports:
>
> iptables v1.2.6a: You must specify `--state'
> Try `iptables -h' or 'iptables --help' for more information.
>
> but using DROP works fine:
>
> $ iptables -A ssh -j DROP -p tcp -m state --state NEW

Does the ULOG target work in other uses, IE "iptables -A FORWARD -j ULOG" ?

j

Re: ULOG with -m state

[Iva Cabric Cabric]

On Sun, Nov 24, 2002 at 07:45:38PM -0500, Joel Newkirk wrote:
> > $ iptables -A ssh -j ULOG -p tcp -m state --state NEW
> >
> > reports:
> >
> > iptables v1.2.6a: You must specify `--state'
> > Try `iptables -h' or 'iptables --help' for more information.
> >
> > but using DROP works fine:
> >
> > $ iptables -A ssh -j DROP -p tcp -m state --state NEW
> 
> Does the ULOG target work in other uses, IE "iptables -A FORWARD -j ULOG" ?

Nope, it gives same error:

$ iptables -A FORWARD -j ULOG -p tcp -m state --state NEW
iptables v1.2.6a: You must specify `--state'

with INPUT and OUTPUT, also same thing. I'm not doing anything special
(like NAT, conntrack, ftp, ...), just plain INPUT filtering.

-- 
@

Re: ULOG with -m state

[Iva Cabric Cabric]

Since mailman is blocking me here is reply again...

On Sun, Nov 24, 2002 at 07:45:38PM -0500, Joel Newkirk wrote:
> > $ iptables -A ssh -j ULOG -p tcp -m state --state NEW
> >
> > reports:
> >
> > iptables v1.2.6a: You must specify `--state'
> > Try `iptables -h' or 'iptables --help' for more information.
> >
> > but using DROP works fine:
> >
> > $ iptables -A ssh -j DROP -p tcp -m state --state NEW
> 
> Does the ULOG target work in other uses, IE "iptables -A FORWARD -j ULOG" ?

Nope, it gives same error:

$ iptables -A FORWARD -j ULOG -p tcp -m state --state NEW
iptables v1.2.6a: You must specify `--state'

with INPUT and OUTPUT, also same thing. I'm not doing anything special
(like NAT, conntrack, ftp, ...), just plain INPUT filtering.

-- 
@

Re: ULOG with -m state

[Joel Newkirk]

On Tuesday 26 November 2002 05:54 am, Iva "Cabric" Cabric wrote:
> Since mailman is blocking me here is reply again...
>
> On Sun, Nov 24, 2002 at 07:45:38PM -0500, Joel Newkirk wrote:
> > > $ iptables -A ssh -j ULOG -p tcp -m state --state NEW
> > >
> > > reports:
> > >
> > > iptables v1.2.6a: You must specify `--state'
> > > Try `iptables -h' or 'iptables --help' for more information.
> > >
> > > but using DROP works fine:
> > >
> > > $ iptables -A ssh -j DROP -p tcp -m state --state NEW
> >
> > Does the ULOG target work in other uses, IE "iptables -A FORWARD -j ULOG"
> > ?
>
> Nope, it gives same error:
>
> $ iptables -A FORWARD -j ULOG -p tcp -m state --state NEW
> iptables v1.2.6a: You must specify `--state'
>
> with INPUT and OUTPUT, also same thing. I'm not doing anything special
> (like NAT, conntrack, ftp, ...), just plain INPUT filtering.

Well, did you try the example I asked about?  I suspect not, because the 
problem here seems to be that "-j ULOG" should be AFTER the state matching 
part of the rule...  If I enter the line you used, I get the same '--state' 
error, but if I put the target after the match (or remove the match, as per 
my debugging suggestion above) it does NOT.

j

Re: ULOG with -m state

[Iva Cabric Cabric]

On Tue, Nov 26, 2002 at 08:53:46AM -0500, Joel Newkirk wrote:
> > >
> > > Does the ULOG target work in other uses, IE "iptables -A FORWARD -j ULOG"
> > > ?
> >
> > Nope, it gives same error:
> >
> > $ iptables -A FORWARD -j ULOG -p tcp -m state --state NEW
> > iptables v1.2.6a: You must specify `--state'
> >
> > with INPUT and OUTPUT, also same thing. I'm not doing anything special
> > (like NAT, conntrack, ftp, ...), just plain INPUT filtering.
> 
> Well, did you try the example I asked about?  I suspect not, because the 

Oh, I thought that you were referring to other chains...

> problem here seems to be that "-j ULOG" should be AFTER the state matching 
> part of the rule...  If I enter the line you used, I get the same '--state' 
> error, but if I put the target after the match (or remove the match, as per 
> my debugging suggestion above) it does NOT.

When using reversed order (first state, then ULOG) it works fine, thanks
for resolving this.

-- 
@

Still an IPTABLES newbie

[Bob Avery-Babel]

Thanks to everyone for the tips on my last question. If anyone on this list
lives close to Columbia, MO, and would like to tutor me just give me a
holler. :-) Here are my new questions, after reading and re-reading the
first 128 pages of "Linux Firewalls" by Robert Ziegler.

My setup is a RH 8 box with an internal and an external nic. I also run all
my services (ssh, http, samba) on this box, as I am poor and this is only a
test box. :-). I have set all of my initial policies to drop as was
suggested here. Now I've slowly been trying to learn how to add exceptions
and understand just how the rules are constructed.

Many of the scripts I've looked at, and in Ziegler's book, they mention
"Symbolic Constants" that look like this:

INTERNET="eth0"        #Internet connected interface

Does IPTABLES recognize things like this, or is this just a convention to
help humans read the rules easier? If I defined all of the symbolic
constants at the start, where in the iptables script would I specifically
put them? Is there a command line option to add them or do I edit the file
directly to add the constants? When I tried to add the constants to the
beginning of my script it errored out on me.

Another question I have is how to add iptable rules. Usually when I set up
the first script I enter in the lines one at a time, and then when I've
added all of the lines I want I'll enter a command like:

iptables-save > /etc/sysconfig/iptables

Then I'll have a working iptables script. However, if I want to add
additional rules one by one at the cli and then do another iptables-save it
overwrites what I originally had. Are there easier options to do this, or is
it best just to edit the file itself?

My third question is about the format of the examples Robert Zeigler gives
in his Linux Firewalls book. He writes all of his rules like this, without
any explanation as to why. I guess it is supposed to be obvious? For
example:

iptables -A OUTPUT -o $INTERNET -p tcp \
-m multiport --destination-port \
$NFS_PORT,$OPENWINDS_PORT,$SOCKS_PORT,SQUID_PORT \
--syn -j DROP

Are these "\" just to indicate line breaks? Sorry if that is an obvious
question. oy!

Final question for the month, I swear...

In trying to understand forwarding the packets from my internal nic to my
public nic and vice versa. Do I need to make a rule for both inbound and
outbound traffic to each nic?

For instance, to allow Samba traffic to flow, here is what I am thinking:

Allow Internal network traffic to my internal nic card, does the traffic
need to flow to my public IP? I've only bound my samba server on my internal
nic and localhost.

Do I need to put a rule in place that looks something like:

-A OUTPUT -o eth1 -p tcp --sport 445 -j ACCEPT
#Anything headed outbound to the private nic, destined for port 445, Accept

I don't think that is right, but it is kind of how I understand (or don't
understand) the concept.

Thanks in advance to everyone!

Bob

Re: Still an IPTABLES newbie

[Dan Egli]

I have that book too and I find it confusing. I answer some questions best I
can. I'm a newbie too.

As far as editing rules, iptables-save will save the current setup. So if
you run your script, then add an additional set of rules and rerun
iptables-save then your new file will contain all the rules combined.

In the UNIX world, \ is commonly used as a line continuation. For example:
iptables -A INPUT -p tcp -i eth0 \
-m multiport smtp,imap,pop3 -j ACCEPT

would translate to:
iptables -A INPUT -p tcp -i eth0 -m multiport smtp,imap,pop3 -j ACCEPT

it's used for when one line is too long for the screen.

the INTERNET things are for human readability and simplicity of change. It's
an environment variable assignment. When you see the lines:

PORTS="telnet,ftp,ssh,smtp"
/sbin/iptables -A INPUT -p TCP -m multiport --dports $PORTS -j ACCEPT
that is what YOU See. The command that is actually executed is:
/sbin/iptables -A INPUT -p TCP -m multiport --dports telnet,ftp,ssh,smtp -j
ACCEPT

hope this helps!

-- Dan
----- Original Message -----
From: "Bob Avery-Babel" <Bob@yellowbugcomputers.com>
To: <netfilter@lists.netfilter.org>
Sent: Tuesday, November 26, 2002 12:49 PM
Subject: Still an IPTABLES newbie


> Thanks to everyone for the tips on my last question. If anyone on this
list
> lives close to Columbia, MO, and would like to tutor me just give me a
> holler. :-) Here are my new questions, after reading and re-reading the
> first 128 pages of "Linux Firewalls" by Robert Ziegler.
>
> My setup is a RH 8 box with an internal and an external nic. I also run
all
> my services (ssh, http, samba) on this box, as I am poor and this is only
a
> test box. :-). I have set all of my initial policies to drop as was
> suggested here. Now I've slowly been trying to learn how to add exceptions
> and understand just how the rules are constructed.
>
> Many of the scripts I've looked at, and in Ziegler's book, they mention
> "Symbolic Constants" that look like this:
>
> INTERNET="eth0"        #Internet connected interface
>
> Does IPTABLES recognize things like this, or is this just a convention to
> help humans read the rules easier? If I defined all of the symbolic
> constants at the start, where in the iptables script would I specifically
> put them? Is there a command line option to add them or do I edit the file
> directly to add the constants? When I tried to add the constants to the
> beginning of my script it errored out on me.
>
> Another question I have is how to add iptable rules. Usually when I set up
> the first script I enter in the lines one at a time, and then when I've
> added all of the lines I want I'll enter a command like:
>
> iptables-save > /etc/sysconfig/iptables
>
> Then I'll have a working iptables script. However, if I want to add
> additional rules one by one at the cli and then do another iptables-save
it
> overwrites what I originally had. Are there easier options to do this, or
is
> it best just to edit the file itself?
>
> My third question is about the format of the examples Robert Zeigler gives
> in his Linux Firewalls book. He writes all of his rules like this, without
> any explanation as to why. I guess it is supposed to be obvious? For
> example:
>
> iptables -A OUTPUT -o $INTERNET -p tcp \
> -m multiport --destination-port \
> $NFS_PORT,$OPENWINDS_PORT,$SOCKS_PORT,SQUID_PORT \
> --syn -j DROP
>
> Are these "\" just to indicate line breaks? Sorry if that is an obvious
> question. oy!
>
> Final question for the month, I swear...
>
> In trying to understand forwarding the packets from my internal nic to my
> public nic and vice versa. Do I need to make a rule for both inbound and
> outbound traffic to each nic?
>
> For instance, to allow Samba traffic to flow, here is what I am thinking:
>
> Allow Internal network traffic to my internal nic card, does the traffic
> need to flow to my public IP? I've only bound my samba server on my
internal
> nic and localhost.
>
> Do I need to put a rule in place that looks something like:
>
> -A OUTPUT -o eth1 -p tcp --sport 445 -j ACCEPT
> #Anything headed outbound to the private nic, destined for port 445,
Accept
>
> I don't think that is right, but it is kind of how I understand (or don't
> understand) the concept.
>
> Thanks in advance to everyone!
>
> Bob
>
>
>
>
>

Re: ULOG with -m state

[Iva Cabric Cabric]

More update,....
I have put new iptables version (1.2.7a-7 from Debian), and no
change:

$ iptables -A INPUT -j ULOG -p tcp -m state --state NEW
iptables v1.2.7a: You must specify `--state'
Try `iptables -h' or 'iptables --help' for more information.

also it looks that ULOG is not working at all:

Chain INPUT (policy ACCEPT 128K packets, 77M bytes)
 pkts bytes target     prot opt in     out     source               destination         
 5065  374K ACCEPT     all  --  *      *       xxx.xxx.xxx.xxx/19     xxx.xxx.xxx.xxx    
    0     0 ACCEPT     all  --  *      *       xxx.xxx.xxx.xxx/18     xxx.xxx.xxx.xxx    
 4022  338K ULOG       all  --  *      *       0.0.0.0/0            0.0.0.0/0          ULOG copy_range 0 nlgroup 1 prefix `INPUT:DROP' queue_threshold 1 
12630 1061K ULOG       all  --  *      *       0.0.0.0/0            0.0.0.0/0          ULOG copy_range 0 nlgroup 1 prefix `INPUT:DROP' queue_threshold 50 
12630 1061K DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0          

kernel is matching packets but ulogd doesnt produce any output in log
files. I have tried to strace ulogd but it just waits in "recvfrom(6,",
and according to lsof descriptor 6 is:

ulogd   21070 root    6u  sock    0,0         322745 can't identify protocol

Any help appreciated.

-- 
@