Re: Help: Iptables rules

Re: Help: Iptables rules

[Antony Stone]

On Thursday 15 January 2004 1:33 am, Minh Cao wrote:

> Antony,
>
> Thanks for your help !
> This machine already placed behind the checkpoint firewall.
> All I need is NATing to work, but firewall protection.
>
> How do I void the iptables's firewall default rules, which load from
> kernel.

There are no "default rules which load from the kernel".

Please answer the questions I asked, and please reply to the list.

Antony.

> > What I have but not worked:
> > iptables -A FORWARD -i $EXTIF -o $INTIF -j ACCEPT
> > iptables -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
> >
> > iptables -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE
>
> What you have shown above looks as though it will do what you want (it is,
> of
> course just a router, very insecure, and does not qualify as a firewall,
> but
> it meets your specification).
>
> Some questions:
>
> 1. Do you have packet forwarding turned on in the kernel (cat
> /proc/sys/net/ipv4/ip_forward)?
>
> 2. What are the default policies on your netfilter chains (iptables -L)?
>
> 3. You say the above has not worked - how have you tested it?
>
> 4. Do packets get across the router in either direction (internal to
> external?
> external to internal)?
>
> 5. Have you read Oskar Andreasson's netfilter tutorial at
> http://iptables-tutorial.frozentux.net, referenced on the netfilter home
> page
> http://www.netfilter.org/documentation/index.html#documentation-tutorials?
>
> 6. Did the machine work as a simple router before you tried adding
> netfilter
> rules?
>
> Regards,
>
> Antony.

-- 
The difference between theory and practice is that in theory there is no 
difference, whereas in practice there is.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: Help: Iptables rules

[Antony Stone]

On Thursday 15 January 2004 1:33 am, Minh Cao wrote:

> Antony,
>
> Thanks for your help !
> This machine already placed behind the checkpoint firewall.
> All I need is NATing to work, but firewall protection.

CheckPoint Firewalls can do NAT as well :)   I assume you are using netfilter 
for NAT so that you don't need a more expensive licence for your CheckPoint 
product (since that is licenced by the number of protected IP addresses)?

Antony.

-- 
Most people are aware that the Universe is big.

 - Paul Davies, Professor of Theoretical Physics

                                                     Please reply to the list;
                                                           please don't CC me.

Re: Help: Iptables rules

[Minh Cao]

Most of the net applications are working fine,  web browser, ftp, telnet,
ssh, ping, Cisco VPN.
I only have problem with VPN using PPTP protocol.

Please let me know which modules to get pptp to work.

Thanks
Minh




                                                                                                                           
                      Antony Stone                                                                                         
                      <Antony@Soft-Solutions.c        To:       netfilter@lists.netfilter.org                              
                      o.uk>                           cc:                                                                  
                      Sent by:                        Subject:  Re: Help: Iptables rules                                   
                      netfilter-admin@lists.ne                                                                             
                      tfilter.org                                                                                          
                                                                                                                           
                                                                                                                           
                      01/15/2004 01:53 PM                                                                                  
                                                                                                                           
                                                                                                                           




On Thursday 15 January 2004 7:57 pm, Minh Cao wrote:

> > 3. You say the above has not worked - how have you tested it?
>
> Yes, I tested
> I used VPN client, which connected to remote side. After connected, the
> password authentication is timeout in 2 minutes.

I really would recommend testing the setup with something a lot simpler
than a
VPN client :)

For example, a web browser, email, ssh, ftp - something which uses fairly
standard TCP connections, and is likely to work through NAT.

Depending on what sort of VPN you are trying to use, you may have
significant
problems getting it work (but then again you may not - as I say it depends
what sort of VPN it is).   For example, IPsec ESP (tunnel mode) is not too
difficult to get working, IPsec AH (transport mode) will not work across
NAT.
PPTP requires a special helper module, and there are other sorts of VPN
about
which I have no idea.

Start with something easy and work your way up to a VPN gradually.

> > 6. Did the machine work as a simple router before you tried adding
> > netfilter rules?
>
> Two NICs are on different subnet. Can I config as a router w/o using
> netfilter ?

Er, yes :)   You really should make sure the machine will route packets
properly before setting up netfilter, which (basically) blocks things.

It sounds as though you might benefit from reading the standard Linux
Networking HOWTO befoer tackling Oska Andreassen's netfilter tutorial which
I
recommended to you yesterday.

Regards,

Antony.

--
"Note: Windows 98, Windows 98SE and Windows 95 are not affected by [MS
Blaster].   However, these products are no longer supported.   Users of
these
products are strongly encouraged to upgrade to later versions."

(which *are* affected by MS Blaster...)

http://www.microsoft.com/security/security_bulletins/ms03-026.asp

                                                     Please reply to the
list;
                                                           please don't CC
me.

Re: Help: Iptables rules

[Antony Stone]

On Thursday 15 January 2004 11:13 pm, Minh Cao wrote:

> Most of the net applications are working fine,  web browser, ftp, telnet,
> ssh, ping, Cisco VPN.
> I only have problem with VPN using PPTP protocol.
>
> Please let me know which modules to get pptp to work.

Well, er, the PPTP modules (now part of the standard kernel compile options, 
but see http://cvs.netfilter.org/netfilter-extensions/helpers/pptp for more 
technical details).

A Google search for "netfilter pptp" may help you considerably, I think.

Antony.

-- 
This email is intended for the use of the individual addressee(s) named above 
and may contain information that is confidential, privileged or unsuitable 
for overly sensitive persons with low self-esteem, no sense of humour, or 
irrational religious beliefs.

If you have received this email in error, you are required to shred it 
immediately, add some nutmeg, three egg whites and a dessertspoonful of 
caster sugar.   Whisk until soft peaks form, then place in a warm oven for 40 
minutes.   Remove promptly and let stand for 2 hours before adding some 
decorative kiwi fruit and cream.   Then notify me immediately by return email 
and eat the original message.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: Help: Iptables rules

[Alexis]

maybe pptp patch.

if you plan to use all hosts inside the LAN as pptp clients, you will need
this patch

a better aproach is to convert your firewall box as a pptp client, in this
case you could restric who uses the tunnel and a patch is not necesary.

other case could be use a single host in the LAN as client, in this case
forward tcp/1723 and ip/47 (gre) to this host and pptp will work



----- Original Message ----- 
From: "Minh Cao" <caom@statsus.com>
To: <netfilter@lists.netfilter.org>
Sent: Thursday, January 15, 2004 8:13 PM
Subject: Re: Help: Iptables rules


>
> Most of the net applications are working fine,  web browser, ftp, telnet,
> ssh, ping, Cisco VPN.
> I only have problem with VPN using PPTP protocol.
>
> Please let me know which modules to get pptp to work.
>
> Thanks
> Minh
>
>
>
>
>
>                       Antony Stone
>                       <Antony@Soft-Solutions.c        To:
netfilter@lists.netfilter.org
>                       o.uk>                           cc:
>                       Sent by:                        Subject:  Re: Help:
Iptables rules
>                       netfilter-admin@lists.ne
>                       tfilter.org
>
>
>                       01/15/2004 01:53 PM
>
>
>
>
>
>
> On Thursday 15 January 2004 7:57 pm, Minh Cao wrote:
>
> > > 3. You say the above has not worked - how have you tested it?
> >
> > Yes, I tested
> > I used VPN client, which connected to remote side. After connected, the
> > password authentication is timeout in 2 minutes.
>
> I really would recommend testing the setup with something a lot simpler
> than a
> VPN client :)
>
> For example, a web browser, email, ssh, ftp - something which uses fairly
> standard TCP connections, and is likely to work through NAT.
>
> Depending on what sort of VPN you are trying to use, you may have
> significant
> problems getting it work (but then again you may not - as I say it depends
> what sort of VPN it is).   For example, IPsec ESP (tunnel mode) is not too
> difficult to get working, IPsec AH (transport mode) will not work across
> NAT.
> PPTP requires a special helper module, and there are other sorts of VPN
> about
> which I have no idea.
>
> Start with something easy and work your way up to a VPN gradually.
>
> > > 6. Did the machine work as a simple router before you tried adding
> > > netfilter rules?
> >
> > Two NICs are on different subnet. Can I config as a router w/o using
> > netfilter ?
>
> Er, yes :)   You really should make sure the machine will route packets
> properly before setting up netfilter, which (basically) blocks things.
>
> It sounds as though you might benefit from reading the standard Linux
> Networking HOWTO befoer tackling Oska Andreassen's netfilter tutorial
which
> I
> recommended to you yesterday.
>
> Regards,
>
> Antony.
>
> --
> "Note: Windows 98, Windows 98SE and Windows 95 are not affected by [MS
> Blaster].   However, these products are no longer supported.   Users of
> these
> products are strongly encouraged to upgrade to later versions."
>
> (which *are* affected by MS Blaster...)
>
> http://www.microsoft.com/security/security_bulletins/ms03-026.asp
>
>                                                      Please reply to the
> list;
>                                                            please don't CC
> me.
>
>
>
>
>
>
>
>
>

Re: Help: Iptables rules

[Minh Cao]

> Some questions:
>
> 1. Do you have packet forwarding turned on in the kernel (cat
> /proc/sys/net/ipv4/ip_forward)?

Yes, I have ip_forward

>
> 2. What are the default policies on your netfilter chains (iptables -L)?

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
LOG        all  --  anywhere             anywhere           LOG level
warning

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

>
> 3. You say the above has not worked - how have you tested it?

Yes, I tested
I used VPN client, which connected to remote side. After connected, the
password authentication is timeout in 2 minutes.

Here is my network diagram

Internet --> CheckPoint Firewall --> (linux/NAT/IPtables/DHCP with 2 NICs)
--> DHCP/VPN client

To verify the packets at Checkpoint firewall, I connect VPN-client before
IPtables hosts (right after the Checkpoint firewall) , the VPN client
connected and password auth. w/o a problem.

>
> 4. Do packets get across the router in either direction (internal to
> external?
> external to internal)?

How do I check this ?
Telnet, ftp, ping all working

>
> 5. Have you read Oskar Andreasson's netfilter tutorial at
> http://iptables-tutorial.frozentux.net, referenced on the netfilter home
> page
>
http://www.netfilter.org/documentation/index.html#documentation-tutorials?

I will read

>
> 6. Did the machine work as a simple router before you tried adding
> netfilter
> rules?

Two NICs are on different subnet. Can I config as a router w/o using
netfilter ?


>
> Regards,
>
> Antony.

--
The difference between theory and practice is that in theory there is no
difference, whereas in practice there is.

                                                     Please reply to the
list;
                                                           please don't CC
me.

RE: Help: Iptables rules

[Aldo S. Lagana]

Ip_forward allows packets to go from one interface to another - without
netfilter.  So your setup should allow all packets - it should be acting
just like a router

-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Minh Cao
Sent: Thursday, January 15, 2004 2:57 PM
To: netfilter@lists.netfilter.org
Subject: Re: Help: Iptables rules








> Some questions:
>
> 1. Do you have packet forwarding turned on in the kernel (cat
> /proc/sys/net/ipv4/ip_forward)?

Yes, I have ip_forward

>
> 2. What are the default policies on your netfilter chains (iptables -L)?

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
LOG        all  --  anywhere             anywhere           LOG level
warning

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

>
> 3. You say the above has not worked - how have you tested it?

Yes, I tested
I used VPN client, which connected to remote side. After connected, the
password authentication is timeout in 2 minutes.

Here is my network diagram

Internet --> CheckPoint Firewall --> (linux/NAT/IPtables/DHCP with 2 NICs)
--> DHCP/VPN client

To verify the packets at Checkpoint firewall, I connect VPN-client before
IPtables hosts (right after the Checkpoint firewall) , the VPN client
connected and password auth. w/o a problem.

>
> 4. Do packets get across the router in either direction (internal to
> external?
> external to internal)?

How do I check this ?
Telnet, ftp, ping all working

>
> 5. Have you read Oskar Andreasson's netfilter tutorial at
> http://iptables-tutorial.frozentux.net, referenced on the netfilter home
> page
>
http://www.netfilter.org/documentation/index.html#documentation-tutorials?

I will read

>
> 6. Did the machine work as a simple router before you tried adding
> netfilter
> rules?

Two NICs are on different subnet. Can I config as a router w/o using
netfilter ?


>
> Regards,
>
> Antony.

--
The difference between theory and practice is that in theory there is no
difference, whereas in practice there is.

                                                     Please reply to the
list;
                                                           please don't CC
me.

Re: Help: Iptables rules

[Antony Stone]

On Thursday 15 January 2004 7:57 pm, Minh Cao wrote:

> > 3. You say the above has not worked - how have you tested it?
>
> Yes, I tested
> I used VPN client, which connected to remote side. After connected, the
> password authentication is timeout in 2 minutes.

I really would recommend testing the setup with something a lot simpler than a 
VPN client :)

For example, a web browser, email, ssh, ftp - something which uses fairly 
standard TCP connections, and is likely to work through NAT.

Depending on what sort of VPN you are trying to use, you may have significant 
problems getting it work (but then again you may not - as I say it depends 
what sort of VPN it is).   For example, IPsec ESP (tunnel mode) is not too 
difficult to get working, IPsec AH (transport mode) will not work across NAT.   
PPTP requires a special helper module, and there are other sorts of VPN about 
which I have no idea.

Start with something easy and work your way up to a VPN gradually.

> > 6. Did the machine work as a simple router before you tried adding
> > netfilter rules?
>
> Two NICs are on different subnet. Can I config as a router w/o using
> netfilter ?

Er, yes :)   You really should make sure the machine will route packets 
properly before setting up netfilter, which (basically) blocks things.

It sounds as though you might benefit from reading the standard Linux 
Networking HOWTO befoer tackling Oska Andreassen's netfilter tutorial which I 
recommended to you yesterday.

Regards,

Antony.

-- 
"Note: Windows 98, Windows 98SE and Windows 95 are not affected by [MS
Blaster].   However, these products are no longer supported.   Users of these
products are strongly encouraged to upgrade to later versions."

(which *are* affected by MS Blaster...)

http://www.microsoft.com/security/security_bulletins/ms03-026.asp

                                                     Please reply to the list;
                                                           please don't CC me.

Help: Iptables rules

[Minh Cao]

Hi,

I am new to iptables.
Please help me to create a rules, which allows everything in and out both
interfaces.

What I have but not worked:
iptables -A FORWARD -i $EXTIF -o $INTIF -j ACCEPT
iptables -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT

iptalbles -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE


Thanks
Minh

Re: Help: Iptables rules

[Antony Stone]

On Thursday 15 January 2004 1:04 am, Minh Cao wrote:

> Hi,
>
> I am new to iptables.
> Please help me to create a rules, which allows everything in and out both
> interfaces.

I wonder why you want this - because it is an open router - there is no point 
in using netfilter (which is used to block things) if you want to allow 
everything....

> What I have but not worked:
> iptables -A FORWARD -i $EXTIF -o $INTIF -j ACCEPT
> iptables -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
>
> iptables -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE

What you have shown above looks as though it will do what you want (it is, of 
course just a router, very insecure, and does not qualify as a firewall, but 
it meets your specification).

Some questions:

1. Do you have packet forwarding turned on in the kernel (cat 
/proc/sys/net/ipv4/ip_forward)?

2. What are the default policies on your netfilter chains (iptables -L)?

3. You say the above has not worked - how have you tested it?

4. Do packets get across the router in either direction (internal to external? 
external to internal)?

5. Have you read Oskar Andreasson's netfilter tutorial at 
http://iptables-tutorial.frozentux.net, referenced on the netfilter home page 
http://www.netfilter.org/documentation/index.html#documentation-tutorials?

6. Did the machine work as a simple router before you tried adding netfilter 
rules?

Regards,

Antony.

-- 
Software development can be quick, high quality, or low cost.

The customer gets to pick any two out of three.

                                                     Please reply to the list;
                                                           please don't CC me.