Problems removing rules

Problems removing rules

[Intercomax]

I'm having a huge problem:

I have those rules:

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
DNAT       tcp  --  anywhere             anywhere     
     tcp dpt:www
to:192.168.0.1:80

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
MASQUERADE  all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

I inserted iptables -t nat -I PREROUTING -s
xxx.xxx.xxx.xxx -j RETURN

OK. The rules works fine.

Then I removed the RETURN iptables -t nat -D
PREROUTING -s 
xxx.xxx.xxx.xxx -j
RETURN and... The IP still access some pages that
accessed before!

Why?

I need to redirect all internal requests to a specific
page and then, 
after a
login, masquerade them to the Internet...

That's it.

Thanks in advance.

Maurício S. Mudrik

_______________________________________________________________________
Yahoo! Mail
O melhor e-mail gratuito da internet: 6MB de espaço, antivírus, acesso POP3, filtro contra spam. 
http://br.mail.yahoo.com/

Re: Problems removing rules

[SaVaGE]

Op donderdag 1 mei 2003 02:07, schreef Intercomax:
> I'm having a huge problem:
>
> I have those rules:
>
> Chain PREROUTING (policy ACCEPT)
> target     prot opt source               destination
> DNAT       tcp  --  anywhere             anywhere
>      tcp dpt:www
> to:192.168.0.1:80
>
> Chain POSTROUTING (policy ACCEPT)
> target     prot opt source               destination
> MASQUERADE  all  --  anywhere             anywhere
>
> Chain OUTPUT (policy ACCEPT)
> target     prot opt source               destination
>
> I inserted iptables -t nat -I PREROUTING -s
> xxx.xxx.xxx.xxx -j RETURN
>
> OK. The rules works fine.
>
> Then I removed the RETURN iptables -t nat -D
> PREROUTING -s
> xxx.xxx.xxx.xxx -j
> RETURN and... The IP still access some pages that
> accessed before!
>
> Why?
>
> I need to redirect all internal requests to a specific
> page and then,
> after a
> login, masquerade them to the Internet...
>
> That's it.
>
> Thanks in advance.
>
> Maurício S. Mudrik
>
> _______________________________________________________________________
> Yahoo! Mail
> O melhor e-mail gratuito da internet: 6MB de espaço, antivírus, acesso
> POP3, filtro contra spam. http://br.mail.yahoo.com/

As far I can see by your rules , your running a Web-server on 192.168.0.1:80  
, not specific a rule to aply local acces to the internet.

But as i see the POSTROUTING chain , i miss something namely your output 
interface !!  like this ::;
Chain POSTROUTING (policy DROP)
num  pkts bytes target        prot       opt      in   out     source      
  *        *     * MASQUERADE  all  --  *         *    eth0    0.0.0.0/0            

destination
0.0.0.0/0

what about that login , i think Squid could do something like that , so you 
have to use a proxy for that.

Pascal

RE: Local rule for Port Forward

[Andy Wood]

	...perhaps it is self-governing.  Best practices would dictate that
instant messaging on a firewall is a bad idea.  The idea for a FW is minimal
packages, no permanent compilers, certainly not X and all of its user-ware.
It's remote-code-execution waitin' to happen.

	Question, why do you SNAT external Jabber traffic to your FW's
internal IP?  In doing that your server sees the traffic as originating from
$InIP, vice its true source.


>  I'm doing port forwarding to a server that runs jabber and everything  
> works fine, I did notice that if I bring up a jabber client on the  
> firewall itself I do not get connected.  While this isn't really  
> needed... I don't totally understand why it doesn't work.  Being  
> inquisitive... well I just gots to know why!  Can anyone shed some  
> light?
> 
>  My rules for the jabber port forward are:
> 
>  iptables -A FORWARD
>           -i $ExIF -d $JabIP -p tcp --dport $JabPort
>           -j ACCEPT
>  iptables -A PREROUTING
>           -t nat -d $ExIP -p tcp --dport $JabPort
>           -j DNAT --to-destination $JabIP  iptables -A POSTROUTING
>           -t nat -d $JabIP -p tcp --dport $JabPort
>           -j SNAT --to-source $InIP

RE: Local rule for Port Forward

[Patrick Nelson]

On Sat, 2003-04-26 at 10:35, Andy Wood wrote:
> 	...perhaps it is self-governing.  Best practices would dictate that
> instant messaging on a firewall is a bad idea.  The idea for a FW is minimal
> packages, no permanent compilers, certainly not X and all of its user-ware.
> It's remote-code-execution waitin' to happen.
> 
> 	Question, why do you SNAT external Jabber traffic to your FW's
> internal IP?  In doing that your server sees the traffic as originating from
> $InIP, vice its true source.
> 
> 
> >  I'm doing port forwarding to a server that runs jabber and everything  
> > works fine, I did notice that if I bring up a jabber client on the  
> > firewall itself I do not get connected.  While this isn't really  
> > needed... I don't totally understand why it doesn't work.  Being  
> > inquisitive... well I just gots to know why!  Can anyone shed some  
> > light?
> > 
> >  My rules for the jabber port forward are:
> > 
> >  iptables -A FORWARD
> >           -i $ExIF -d $JabIP -p tcp --dport $JabPort
> >           -j ACCEPT
> >  iptables -A PREROUTING
> >           -t nat -d $ExIP -p tcp --dport $JabPort
> >           -j DNAT --to-destination $JabIP  iptables -A POSTROUTING
> >           -t nat -d $JabIP -p tcp --dport $JabPort
> >           -j SNAT --to-source $InIP
> 

Well good question.  At first I was going to say because it's the only
thing that made it work...  I tried dropping the snat and this shut
everything down.  So at first I was going to say, not sure why but its
the only way it works...  However...

I did notice that the jabber server itself locked up too.  But this time
I left just the 2 rules in place with out the snat, when I restarted the
server.  Oh my all systems were able to connect.  All in all I guess I
just put that rule in there because someone said... these are what I
use.

I think I understand a bit better how the dnat and snat stuff works.
Thanks for questioning it.

Problems removing rules

[Maurício S. Mudrik]

I'm having a huge problem:

I have those rules:

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
DNAT       tcp  --  anywhere             anywhere           tcp dpt:www 
to:192.168.0.1:80

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
MASQUERADE  all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

I inserted iptables -t nat -I PREROUTING -s xxx.xxx.xxx.xxx -j RETURN

OK. The rules works fine.

Then I removed the RETURN iptables -t nat -D PREROUTING -s xxx.xxx.xxx.xxx -j 
RETURN and... The IP still access some pages that accessed before!

Why?

I need to redirect all internal requests to a specific page and then, after a 
login, masquerade them to the Internet...

That's it.

Thanks in advance.

Maurício S. Mudrik