Filtering in the nat table - opinions wanted

Filtering in the nat table - opinions wanted

[Aldo Lagana]

[-- Attachment #1: Type: text/plain, Size: 595 bytes --]

by default I set the nat chains (PREROUTING POSTROUTING, etc) to ACCEPT.  first off is this bad?

For my web & mail servers using DNAT, I need to add rules - and I do.  Same w/ SNAT rules...

The problem has come up with our mail server - we were getting spam from one IP address - since my DNAT rule was ACCEPT and forward, the mail server kept getting these spam messages.  I stopped the SPAM by adding a rule to the beginning of PREROUTING to DROP packets from that address.

This made me start thinking - am I doing it right by having all the nat chains default ACCEPT?

aldo




[-- Attachment #2: Type: text/html, Size: 1462 bytes --]

Re: Filtering in the nat table - opinions wanted

[Kim Jensen]

Hi Aldo,

You shouldn't drop packets in the prerouting part, use the filtering part to 
do this. in the pre/post routing you should just try to keep things clean.

So, no I don't find it bad to have the nat policy to accept - it is the filter 
policies I would be worried about :-)

/Kim


On Monday 24 March 2003 19:20, Aldo Lagana wrote:
> by default I set the nat chains (PREROUTING POSTROUTING, etc) to ACCEPT. 
> first off is this bad?
>
> For my web & mail servers using DNAT, I need to add rules - and I do.  Same
> w/ SNAT rules...
>
> The problem has come up with our mail server - we were getting spam from
> one IP address - since my DNAT rule was ACCEPT and forward, the mail server
> kept getting these spam messages.  I stopped the SPAM by adding a rule to
> the beginning of PREROUTING to DROP packets from that address.
>
> This made me start thinking - am I doing it right by having all the nat
> chains default ACCEPT?
>
> aldo

Re: Filtering in the nat table - opinions wanted

[Joel Newkirk]

On Monday 24 March 2003 01:20 pm, Aldo Lagana wrote:
> by default I set the nat chains (PREROUTING POSTROUTING, etc) to
> ACCEPT.  first off is this bad?
>
> For my web & mail servers using DNAT, I need to add rules - and I do. 
> Same w/ SNAT rules...
>
> The problem has come up with our mail server - we were getting spam
> from one IP address - since my DNAT rule was ACCEPT and forward, the
> mail server kept getting these spam messages.  I stopped the SPAM by
> adding a rule to the beginning of PREROUTING to DROP packets from that
> address.
>
> This made me start thinking - am I doing it right by having all the
> nat chains default ACCEPT?
>
> aldo

Yes.  ACCEPT policy for nat and mangle chains.  You should look to 
setting a DROP policy on FORWARD, though, and ACCEPT only the traffic 
you want to allow through there.  For something like DROPping a specific 
IP, you should have those rules first in FORWARD, followed by the ACCEPT 
rules to let through classes of traffic.  (IE, email connections to and 
from the mail server and ESTABLISHED & RELATED state connections)

If you don't have anything in FORWARD right now, but an ACCEPT policy, 
you should definitely concentrate there.  Start with rules to accept the 
traffic through that you really need, with a LOG rule at the end if the 
chain.  This way everything will still work as it does now, and you can 
check the rules listing to see what rules are matching packets, and 
check the LOG to see what isn't matching any rule.  (and write a rule to 
ACCEPT it if you need it)

j