iptables on DLink DSL-502T Modem/Router

iptables on DLink DSL-502T Modem/Router

[Paul Goodyear]

Hi all,

Does iptables version v1.2.6a support forwarding from a source IP?

The reason I ask, is I have a DLink DSL-502T modem router, the router
has linux on and running iptables.

The webadmin for the router does not allow you to create ip filters,
port forwarding is there but not filtering.

I want to allow access to port 3389 from only 1 internet IP address.
Should this work? (81.81.81.81 being an example)

iptables -A INPUT -s 81.81.81.81 -d 192.168.1.2 -p tcp --dport 3389 -j ACCEPT

The router does no allow me to connect in once this rule is in iptables.

Thanks.

Paul.

Re: iptables on DLink DSL-502T Modem/Router

[/dev/rob0]

On Monday 2005-November-07 19:47, Paul Goodyear wrote:
> Does iptables version v1.2.6a support forwarding from a source IP?

I cannot parse this. Please rephrase (although I think I've answered 
your question below.)

> The reason I ask, is I have a DLink DSL-502T modem router, the router
> has linux on and running iptables.

General note about embedded devices: you're limited to the netfilter 
drivers that the developer saw fit to include. My Linksys w/Sveasoft 
firmware lacks some of the more recent and better toys. (I'm planning 
to upgrade to OpenWRT.)

> The webadmin for the router does not allow you to create ip filters,
> port forwarding is there but not filtering.

But apparently you can get to a shell?

> I want to allow access to port 3389 from only 1 internet IP address.
> Should this work? (81.81.81.81 being an example)
>
> iptables -A INPUT -s 81.81.81.81 -d 192.168.1.2 -p tcp --dport 3389
> -j ACCEPT

Without seeing your rules I can only guess. I have 3 guesses, in the 
order they appear on the command line:

1. "-A" : order matters. If an earlier rule does something else with 
your MS-RDP traffic from 81.81.81.81 destined to 192.168.1.2, this is 
never hit.

2. "INPUT" : If 192.168.1.2 is not a local IP on the router, this rule 
can never be hit. Try "FORWARD".

3. "-d 192.168.1.2" : That's a non-routable RFC 1918 address. You have 
to perform DNAT in the nat table prior to this. You implied that this 
has been done, but you were not explicit.

Given the topology you described (the rules being on a DSL router) I 
would guess number 2 is your problem. Embedded devices are not likely 
to be running RDP servers.
-- 
    mail to this address is discarded unless "/dev/rob0"
    or "not-spam" is in Subject: header

Re: iptables on DLink DSL-502T Modem/Router

[Paul Goodyear]

Thanks for the reply, that would explain a few things. I did try the
rule in both INPUT and FORWARD chains, but neither worked, I took a
guess that it would be INPUT to use so I posted with that chain.

Order, when I do a iptables -L -n I can see my rule, but it is always
at the bottom of the pile, so this might be the whole issue. How do I
know what <ruleid> the other rules are so I can add above them?

I have read the -A param is "to add a rule at the end of the chain"
how do I add at the begining of the chain?

Thanks again.

On 11/8/05, /dev/rob0 <rob0@gmx.co.uk> wrote:
> On Monday 2005-November-07 19:47, Paul Goodyear wrote:
> > Does iptables version v1.2.6a support forwarding from a source IP?
>
> I cannot parse this. Please rephrase (although I think I've answered
> your question below.)
>
> > The reason I ask, is I have a DLink DSL-502T modem router, the router
> > has linux on and running iptables.
>
> General note about embedded devices: you're limited to the netfilter
> drivers that the developer saw fit to include. My Linksys w/Sveasoft
> firmware lacks some of the more recent and better toys. (I'm planning
> to upgrade to OpenWRT.)
>
> > The webadmin for the router does not allow you to create ip filters,
> > port forwarding is there but not filtering.
>
> But apparently you can get to a shell?
>
> > I want to allow access to port 3389 from only 1 internet IP address.
> > Should this work? (81.81.81.81 being an example)
> >
> > iptables -A INPUT -s 81.81.81.81 -d 192.168.1.2 -p tcp --dport 3389
> > -j ACCEPT
>
> Without seeing your rules I can only guess. I have 3 guesses, in the
> order they appear on the command line:
>
> 1. "-A" : order matters. If an earlier rule does something else with
> your MS-RDP traffic from 81.81.81.81 destined to 192.168.1.2, this is
> never hit.
>
> 2. "INPUT" : If 192.168.1.2 is not a local IP on the router, this rule
> can never be hit. Try "FORWARD".
>
> 3. "-d 192.168.1.2" : That's a non-routable RFC 1918 address. You have
> to perform DNAT in the nat table prior to this. You implied that this
> has been done, but you were not explicit.
>
> Given the topology you described (the rules being on a DSL router) I
> would guess number 2 is your problem. Embedded devices are not likely
> to be running RDP servers.
> --
>     mail to this address is discarded unless "/dev/rob0"
>     or "not-spam" is in Subject: header
>
>

Re: iptables on DLink DSL-502T Modem/Router (nfcan: addressed to exclusive sender for this address)

[Jim Laurino]

On 2005.11.08 15:39, Paul Goodyear - pgudge@gmail.com wrote:
> Thanks for the reply, that would explain a few things. I did try the
> rule in both INPUT and FORWARD chains, but neither worked, I took a
> guess that it would be INPUT to use so I posted with that chain.
> 
> Order, when I do a iptables -L -n I can see my rule, but it is always
> at the bottom of the pile, so this might be the whole issue. How do I
> know what <ruleid> the other rules are so I can add above them?
> 
> I have read the -A param is "to add a rule at the end of the chain"
> how do I add at the begining of the chain?

 -I instead of -A

> 
> Thanks again.
>
.........
-- 
Jim Laurino
nfcan.x.jimlaur@dfgh.net
Please reply to the list.
Only mail from the listserver reaches this address.

Re: iptables on DLink DSL-502T Modem/Router

[/dev/rob0]

Please do not top-post. Thank you.

On Tuesday 2005-November-08 14:39, Paul Goodyear wrote:
> Thanks for the reply, that would explain a few things. I did try the
> rule in both INPUT and FORWARD chains, but neither worked, I took a
> guess that it would be INPUT to use so I posted with that chain.

There is no need to guess when we have "man iptables" at our 
fingertips. :)

> Order, when I do a iptables -L -n I can see my rule, but it is always
> at the bottom of the pile, so this might be the whole issue. How do I
> know what <ruleid> the other rules are so I can add above them?

"iptables -h" gives a brief syntax overview. The "--line-numbers" 
option, available in recent versions of iptables, can help. With older 
versions, I just list the rules and count them manually!

> I have read the -A param is "to add a rule at the end of the chain"
> how do I add at the begining of the chain?

In Jim's reply and also in "iptables -h" and "man iptables".
-- 
    mail to this address is discarded unless "/dev/rob0"
    or "not-spam" is in Subject: header

Re: iptables on DLink DSL-502T Modem/Router

[Paul Goodyear]

On 11/8/05, /dev/rob0 <rob0@gmx.co.uk> wrote:
> Please do not top-post. Thank you.
>
> On Tuesday 2005-November-08 14:39, Paul Goodyear wrote:
> > Thanks for the reply, that would explain a few things. I did try the
> > rule in both INPUT and FORWARD chains, but neither worked, I took a
> > guess that it would be INPUT to use so I posted with that chain.
>
> There is no need to guess when we have "man iptables" at our
> fingertips. :)
>
> > Order, when I do a iptables -L -n I can see my rule, but it is always
> > at the bottom of the pile, so this might be the whole issue. How do I
> > know what <ruleid> the other rules are so I can add above them?
>
> "iptables -h" gives a brief syntax overview. The "--line-numbers"
> option, available in recent versions of iptables, can help. With older
> versions, I just list the rules and count them manually!
>
> > I have read the -A param is "to add a rule at the end of the chain"
> > how do I add at the begining of the chain?
>
> In Jim's reply and also in "iptables -h" and "man iptables".
> --
>     mail to this address is discarded unless "/dev/rob0"
>     or "not-spam" is in Subject: header
>
>
Sry about the top posting.

Thanks for that, I used the -I chain <ruleid> successfully. And added
the rule 2 down, but the router still does not let me in. Could it be
possible that the iptables rule is in place, but the manufactures
(DLink) have done something to stop this working?

I have a Safecom router also, with the same embeded linux version and
this supports ip filtering and the iptables commands.

Thanks again.

Re: iptables on DLink DSL-502T Modem/Router

[/dev/rob0]

On Tuesday 2005-November-08 15:57, Paul Goodyear wrote:
> Thanks for that, I used the -I chain <ruleid> successfully. And added
> the rule 2 down, but the router still does not let me in. Could it be

Being an embedded device means this won't be as easy to debug. On a 
regular system I would suggest using a -j LOG rule before your ACCEPT 
rule to see what's happening. It might work on this, hard to say.

You can also use -v with the -L option to list rules. See if anything 
matched your rule. If not, your rule is wrong, or in the wrong place.

Don't use Microsoft tools for debugging. Try to telnet(1) to your RDP 
port from outside. Does telnet connect? Check /proc/net/ip_conntrack. 
Is your connection listed?

> possible that the iptables rule is in place, but the manufactures
> (DLink) have done something to stop this working?

I don't know what it would be. But on further thought I realised that 
some ISP's block RDP. Comcast does, both RDP and PPTP, likely to 
"encourage" residential users to upgrade to "business" service (the 
same hit-or-miss service for more money.)

Use nmap(8) to scan your router from outside. Is RDP open? Insert an 
INPUT and FORWARD rule to ACCEPT everything from the IP address where 
you are doing the scan. If anything shows as "filtered" it means either 
your ISP is blocking it or you're DNAT'ing to a closed host:port.

> I have a Safecom router also, with the same embeded linux version and
> this supports ip filtering and the iptables commands.

And you tested with that, and you found ... ?
-- 
    mail to this address is discarded unless "/dev/rob0"
    or "not-spam" is in Subject: header

Re: iptables on DLink DSL-502T Modem/Router

[Paul Goodyear]

On 11/8/05, /dev/rob0 <rob0@gmx.co.uk> wrote:
> On Tuesday 2005-November-08 15:57, Paul Goodyear wrote:
> > Thanks for that, I used the -I chain <ruleid> successfully. And added
> > the rule 2 down, but the router still does not let me in. Could it be
>
> Being an embedded device means this won't be as easy to debug. On a
> regular system I would suggest using a -j LOG rule before your ACCEPT
> rule to see what's happening. It might work on this, hard to say.
>

Just get a unknown target with -j LOG

> You can also use -v with the -L option to list rules. See if anything
> matched your rule. If not, your rule is wrong, or in the wrong place.
>

Very nice, it says 0 0 for my rule, so thats good indication nothing
is coming in.

> Don't use Microsoft tools for debugging. Try to telnet(1) to your RDP
> port from outside. Does telnet connect? Check /proc/net/ip_conntrack.
> Is your connection listed?
>

nothing :(

> > possible that the iptables rule is in place, but the manufactures
> > (DLink) have done something to stop this working?
>
> I don't know what it would be. But on further thought I realised that
> some ISP's block RDP. Comcast does, both RDP and PPTP, likely to
> "encourage" residential users to upgrade to "business" service (the
> same hit-or-miss service for more money.)
>

My ISP doesn't block anything as yet, and if I open the port to
everyone, the RDP connection is fine.

> Use nmap(8) to scan your router from outside. Is RDP open? Insert an
> INPUT and FORWARD rule to ACCEPT everything from the IP address where
> you are doing the scan. If anything shows as "filtered" it means either
> your ISP is blocking it or you're DNAT'ing to a closed host:port.
>

VERY nice tool, tried nmap from a remote host and only found my ftp,
imap ports open, no RDP

> > I have a Safecom router also, with the same embeded linux version and
> > this supports ip filtering and the iptables commands.
>
> And you tested with that, and you found ... ?
> --

The Safecom router allows the ip filtering in the web admin, and after
checking the iptables -L the rule is identical to the one entered on
the dlink DSL-502T.

Thank you so much for all the help, and direction, i really do appreciate it.

RE: iptables on DLink DSL-502T Modem/Router

[Anthony Sadler]

I would personally filter either in the PREROUTING table:
iptables -t nat -I PREROUTING -p tcp -s SOURCEIP -d EXT_INTERFACE --dport PORT -j DNAT --to INTERNALIP:PORT
Or on the FORWARD table:
iptables -I FORWARD -p $PROTO -s $SOURCEIP -d $INTERNALIP --dport $PORTINT -j ACCEPT

This is assuming you have a default rule of drop or deny on your FORWARD table.

Anthony Sadler
Far Edge Technology
w: (02) 8425 1400
 
-----Original Message-----
From: netfilter-bounces@lists.netfilter.org [mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Paul Goodyear
Sent: Tuesday, 8 November 2005 12:47 
To: netfilter@lists.netfilter.org
Subject: iptables on DLink DSL-502T Modem/Router

Hi all,

Does iptables version v1.2.6a support forwarding from a source IP?

The reason I ask, is I have a DLink DSL-502T modem router, the router
has linux on and running iptables.

The webadmin for the router does not allow you to create ip filters,
port forwarding is there but not filtering.

I want to allow access to port 3389 from only 1 internet IP address.
Should this work? (81.81.81.81 being an example)

iptables -A INPUT -s 81.81.81.81 -d 192.168.1.2 -p tcp --dport 3389 -j ACCEPT

The router does no allow me to connect in once this rule is in iptables.

Thanks.

Paul.