I have no idea why this doesn't work...

I have no idea why this doesn't work...

[Garison Piatt]

Aloha.

I'm Garison, a web designer in Hawaii.  My client is setting up a dedicated 
server for several of her clients, and instead of hiring an admin guy to 
maintain it, she's insisting that I do it (not that I can't use the extra 
income, but I have no idea what I'm doing).

I'm trying to set up the firewall for the system.  After reading the Linux 
manual, searching the Web, studying tutorials, and comparing examples, I'm 
actually more confused than I was before.  Below is what I have, which is a 
pared-down combination of several example scripts which did something 
reasonably close to what I want.  When I run this, however, I lose FTP, and 
who-knows-what-else.  Worse, when I try to flush the tables (using 
"/sbin/iptables --flush") the whole system locks up, and has to be rebooted.

Sorry for such a long posting.  Any help you can give em will be appreciated.


-garison



#!/bin/sh
#
# IP Firewall script for iptables
echo "Define IP Firewall"

# ################################################## #
#               Configuration section                #
# ################################################## #
echo " setup..."

# Command definitions
#
IPT="/sbin/iptables"
IPTR="/sbin/iptables-restore"
IPTS="/sbin/iptables-save"
INSMOD="/sbin/modprobe"
DEPMOD="/sbin/depmod"

# Internet definitions
#
NET_IFACE="eth0"
NET_IP="207.36.232.90"
#NET_BROADCAST="207.36.232.255"

# Local-Area Network definitions
#
#LAN_IFACE="eth1"
#LAN_IP=""
#LAN_IP_RANGE=""

# Localhost Configuration.
#
LO_IFACE="lo"
LO_IP="127.0.0.1"


# ################################################## #
#               Module Loading section               #
# ################################################## #
echo " load modules..."

# Pre-load modules
#
$DEPMOD -a

# Required modules
$INSMOD ip_tables
$INSMOD ip_conntrack
$INSMOD ip_conntrack_ftp
$INSMOD ip_nat_ftp
$INSMOD iptable_filter
$INSMOD iptable_mangle
$INSMOD iptable_nat
$INSMOD ipt_LOG
$INSMOD ipt_limit
$INSMOD ipt_state

# Non-Required modules (for reference)
#$INSMOD ipt_owner
#$INSMOD ipt_REJECT
#$INSMOD ipt_MASQUERADE
#$INSMOD ip_conntrack_irc
#$INSMOD ip_nat_irc


# ################################################## #
#               Process Set-up section               #
# ################################################## #
echo " process setup..."
# Required process configuration
#
echo "1" > /proc/sys/net/ipv4/ip_forward

# Non-Required proc configuration (for reference)
#
#echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
#echo "1" > /proc/sys/net/ipv4/conf/all/proxy_arp
#echo "1" > /proc/sys/net/ipv4/ip_dynaddr


# ################################################## #
#                Filter Table section                #
# ################################################## #

# Clear previous policy settings
#
echo " clear policies..."
$IPT -P INPUT DROP
$IPT -P OUTPUT DROP
$IPT -P FORWARD DROP


# ################################ #
#   Create User-Specified Chains   #
# ################################ #
echo " define user chains..."

# Allowed packets
echo " - allowed packets"
$IPT -N allowed
$IPT -A allowed -p TCP --syn -j ACCEPT
$IPT -A allowed -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A allowed -p TCP -j DROP

# Bad TCP packets
echo " - bad tcp packets"
$IPT -N bad_tcp
$IPT -A bad_tcp -p tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW \
      -j REJECT --reject-with tcp-reset
$IPT -A bad_tcp -p tcp ! --syn -m state --state NEW \
      -j LOG --log-prefix "New not syn: "
$IPT -A bad_tcp -p tcp ! --syn -m state --state NEW -j DROP

# TCP packets
echo " - tcp packets"
$IPT -N chktcp
$IPT -A chktcp -p TCP -s 0/0 --dport 21 -j allowed
$IPT -A chktcp -p TCP -s 0/0 --dport 22 -j allowed
$IPT -A chktcp -p TCP -s 0/0 --dport 80 -j allowed
$IPT -A chktcp -p TCP -s 0/0 --dport 113 -j allowed

# UDP packets
echo " - upd packets"
$IPT -N chkudp
#$IPT -A chkudp -p UDP -s 0/0 --destination-port 53 -j ACCEPT
#$IPT -A chkudp -p UDP -s 0/0 --destination-port 123 -j ACCEPT
$IPT -A chkudp -p UDP -s 0/0 --destination-port 2074 -j ACCEPT
$IPT -A chkudp -p UDP -s 0/0 --destination-port 4000 -j ACCEPT

# ICMP packets
echo " - icmp packets"
$IPT -N chkicmp
$IPT -A chkicmp -p ICMP -s 0/0 --icmp-type 8 -j ACCEPT
$IPT -A chkicmp -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT


# ####################### #
#   Define INPUT Chains   #
# ####################### #
echo " define input chains..."

# Check for Bad TCP packets, and junk them
$IPT -A INPUT -p tcp -j bad_tcp

# Rules for special networks not part of the Internet
#$IPT -A INPUT -p ALL -i $LAN_IFACE -s $LAN_IP_RANGE -j ACCEPT
#$IPT -A INPUT -p ALL -i $LO_IFACE -s $LAN_IP -j ACCEPT
$IPT -A INPUT -p ALL -i $LO_IFACE -s $LO_IP -j ACCEPT
$IPT -A INPUT -p ALL -i $LO_IFACE -s $NET_IP -j ACCEPT

# Special rule for DHCP requests from LAN,
# which are not caught properly otherwise.
#$IPT -A INPUT -p UDP -i $LAN_IFACE --dport 67 --sport 68 -j ACCEPT

# Rules for incoming packets from the internet.
$IPT -A INPUT -p ALL -d $NET_IP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPT -A INPUT -p TCP -i $NET_IFACE -j chktcp
$IPT -A INPUT -p UDP -i $NET_IFACE -j chkudp
$IPT -A INPUT -p ICMP -i $NET_IFACE -j chkicmp

# Log weird packets that don't match the above.
$IPT -A INPUT -m limit --limit 3/minute --limit-burst 3 \
      -j LOG --log-level DEBUG --log-prefix "IPT INPUT packet died: "

# ######################### #
#   Define FORWARD Chains   #
# ######################### #
echo " define forward chains..."

# Bad TCP packets we don't want
$IPT -A FORWARD -p tcp -j bad_tcp

# Accept the packets we actually want to forward
#$IPT -A FORWARD -i $LAN_IFACE -j ACCEPT
$IPT -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# Log weird packets that don't match the above.
$IPT -A FORWARD -m limit --limit 3/minute --limit-burst 3 \
      -j LOG --log-level DEBUG --log-prefix "IPT FORWARD packet died: "

# ######################## #
#   Define OUTPUT Chains   #
# ######################## #
echo " define output chains..."

# Bad TCP packets we don't want.
$IPT -A OUTPUT -p tcp -j bad_tcp

# Special OUTPUT rules to decide which IP's to allow.
$IPT -A OUTPUT -p ALL -s $LO_IP -j ACCEPT
$IPT -A OUTPUT -p ALL -s $NET_IP -j ACCEPT
#$IPT -A OUTPUT -p ALL -s $LAN_IP -j ACCEPT

# Log weird packets that don't match the above.
$IPT -A OUTPUT -m limit --limit 3/minute --limit-burst 3 \
      -j LOG --log-level DEBUG --log-prefix "IPT OUTPUT packet died: "


# ############################# #
#   Define POSTROUTING Chains   #
# ############################# #
echo " define postrouting chains..."

# Enable simple IP Forwarding and Network Address Translation
$IPT -t nat -A POSTROUTING -o $NET_IFACE -j SNAT --to-source $NET_IP

Re: I have no idea why this doesn't work...

[Antony Stone]

On Thursday 22 April 2004 7:58 pm, Garison Piatt wrote:

> Aloha.

G'day.

> I'm Garison, a web designer in Hawaii.

Hi.

> Below is a pared-down combination of several example scripts which did
> something reasonably close to what I want.  When I run this, however, I lose
> FTP, and who-knows-what-else.

Your posted ruleset *is* very long, yes, and by your own admission you're not 
quite sure what you're doing, so I recommend that you start simple and build 
up, ensuring there are no problems at each stage, so that when a problem does 
crop up, you know it must be the small part you just changed, rather than 
"somewhere in this great long script I've got".

Also, if you want help from this list, you'll have to be a bit clearer about 
what you are trying to do - specifically, what you want to allow, and what 
you want to block, so that we can understand why you have certain things in 
your ruleset (for example, you have some pretty strange destination port 
numbers in there, and I can't begin to guess why).

I recommend the following:

1. Describe your network setup to us so that we know what clients & servers 
you have on what network segments.

2. Explain what traffic you want to allow and what traffic you want to block 
(and what you want to log).

3. If you feel able to do so, show us a very simple script which does most of 
what you need, but falls down somewhere, and ask for guidance with the bit 
which doesn't work.   If you don't feel able to do this, don't worry, just 
ask for guidance on how to do what you described in (2), given the sitiuation 
in (1).

It's actually far easier to say "this is how I would go about what you 
require" than it is to say "this is where I think there's an error in your 
existing script which I don't fully understand".

Hope this helps,

Antony.

-- 
The difference between theory and practice is that in theory there is no 
difference, whereas in practice there is.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: I have no idea why this doesn't work...

[Antony Stone]

On Thursday 22 April 2004 8:23 pm, Antony Stone wrote:

> On Thursday 22 April 2004 7:58 pm, Garison Piatt wrote:
>
> > Below is a pared-down combination of several example scripts which did
> > something reasonably close to what I want.  When I run this, however, I
> > lose FTP, and who-knows-what-else.
>
> Your posted ruleset *is* very long, yes, and by your own admission you're
> not quite sure what you're doing, so I recommend that you start simple and
> build up, ensuring there are no problems at each stage, so that when a
> problem does crop up, you know it must be the small part you just changed,
> rather than "somewhere in this great long script I've got".

Sorry for replying to my own posting, but I've just looked at your script in a 
bit more detail, and I immediately notice how many user-defined chains you 
have.   I think this is unnecessarily complicating things for you (and us, 
trying to read the script), so I suggest you remove (comment-out) as many as 
possible (the ones which block 'bad' packets for example - you can do without 
those whilst you're getting the firewall working, and then add them in again 
later to add some bells & whistles to a system which is by then doing the 
basic job okay).

I'm sticking to my previously-stated philosophy of "start simple and build up 
gradually, checking for problems at each stage", since it makes the debuggign 
process of working out where the problem crept in much easier.

Regards,

Antony.

-- 
The truth is rarely pure, and never simple.

 - Oscar Wilde

                                                     Please reply to the list;
                                                           please don't CC me.