Re: problem with forward/nat

[Antony Stone <Antony@Soft-Solutions.co.uk>]

On Sunday 07 March 2004 3:13 am, Pierre Gillet wrote:

> hello,
>
> i have a small private network, 192.168.1.0 on eth1
> public network on eth0. the server running a dhcp server for private
> network.
>
> #iptables -A FORWARD -i eth0 -o eth0 -m state --state ESTABLISHED,RELATED
> -j ACCEPT

1. Why have you commented out the above command?   It is necessary for teh 
reply packets to be able to return from the Internet to your LAN clients.

2. The above command should read "-i eth0 -o eth1" so that packets are allowed 
from the Internet (eth0) to your LAN (eth1).

I would recommend also that you change all your INPUT rules:

> iptables -A INPUT -i lo -m state --state RELATED,ESTABLISHED,NEW -j ACCEPT
> iptables -A INPUT -i eth0 -p udp --sport 53 -j ACCEPT
> iptables -A INPUT -i eth0 -p tcp --sport 80 -j ACCEPT
> iptables -A INPUT -i eth0 -p tcp --sport 443 -j ACCEPT
> iptables -A INPUT -i eth1 -s 192.168.1.0/24 -j ACCEPT
> iptables -A INPUT -i eth0 -p tcp --sport 23 -j ACCEPT

For a single rule instead:

> iptables -A INPUT -m state --state RELATED,ESTABLISHED,NEW -j ACCEPT

This will allow reply packets from anywhere in response to requests sent out 
by the firewall itself, without leaving your system vulnerable to, for 
example, port scans or access to services where the remote user just 
"happens" to select source port 443 (or any of the others you have listed).

Regards,

Antony.

-- 
This email is intended for the use of the individual addressee(s) named above 
and may contain information that is confidential, privileged or unsuitable 
for overly sensitive persons with low self-esteem, no sense of humour, or 
irrational religious beliefs.

If you have received this email in error, you are required to shred it 
immediately, add some nutmeg, three egg whites and a dessertspoonful of 
caster sugar.   Whisk until soft peaks form, then place in a warm oven for 40 
minutes.   Remove promptly and let stand for 2 hours before adding some 
decorative kiwi fruit and cream.   Then notify me immediately by return email 
and eat the original message.

                                                     Please reply to the list;
                                                           please don't CC me.