Bridging firewall setup

Bridging firewall setup

[Chris Brown]

Hi all, new to the list. I'm trying to get a bridging firewall setup on 
a RH 9 box and I'm not having much luck. The bridge itself works fine 
but when I try to add rules using netfilter they seem to be ignored and 
packets I'm trying to block go on through. I've been digging through the 
list archives, google, various forums and HOWTOs and I still haven't 
found the answer so I'm hoping someone here can point out what I'm doing 
wrong :)

Here's what I have. The bridge is nothing special, its not the gateway 
and it doesn't do NAT. It does do traffic shapping but turning that part 
on/off didn't seem to make a difference here.

I decided to start simple by blocking some (presumably) msblast traffic 
on port 135. From the HOWTOs I've been reading all rules on the bridge 
should be in chain FORWARD so I did:

iptables -F
iptables -X # RH has some user-defined chains and i just dumped those
iptables -A FORWARD -p udp --dport 135 -j DROP
iptables -A FORWARD -p tcp --dport 135 -j DROP

Nothing ... traffic still gets through ... so I explicitly added the 
interface

iptables -i br0 -A FORWARD -p udp --dport 135 -j DROP
# same for tcp

Still nothing.
Next I tried filtering connection attempts to mysql from the outside 
world (something I want to do anyway) (IP address hidden to protect the 
innocent :) )
iptables -A FORWARD -d x.x.x.x/24 -p tcp --dport 3306 -j DROP

Tried to connect to mysql from the outside world. No luck I can still 
get to it.

For grins I also tried the rules on INPUT and on OUTPUT with the same 
results. I tried enabling ip forwarding which some of HOWTOs I read said 
was an optional step but that didn't make a difference either, that also 
seemed to be if I were to be using the machine as the gateway. A friend 
of mine even suggested using -t nat -A PREROUTING which didn't make a 
lot of sense to me but I tried it anyway, still with the same result.

I don't see any errors when I execute the commands and I can see all the 
rules in iptables -L but they don't seem to do anything ... its very 
perplexing, any ideas?

thanks in advance
Chris

-- 
Chris Brown
System Administrator / Web Application Developer
Wavetex Inc.
903-533-1700
http://wavetex.com/

Re: Bridging firewall setup

[Antony Stone]

On Tuesday 16 December 2003 4:55 pm, Chris Brown wrote:

> Hi all, new to the list. I'm trying to get a bridging firewall setup on
> a RH 9 box and I'm not having much luck. The bridge itself works fine
> but when I try to add rules using netfilter they seem to be ignored and
> packets I'm trying to block go on through.
>
> I decided to start simple by blocking some (presumably) msblast traffic
> on port 135. From the HOWTOs I've been reading all rules on the bridge
> should be in chain FORWARD so I did:
>
> iptables -F
> iptables -X # RH has some user-defined chains and i just dumped those
> iptables -A FORWARD -p udp --dport 135 -j DROP
> iptables -A FORWARD -p tcp --dport 135 -j DROP
>
> Nothing ... traffic still gets through ... so I explicitly added the
> interface
>
> iptables -i br0 -A FORWARD -p udp --dport 135 -j DROP
>
> Still nothing.

I don't know the answer to your question, but in situations like this I always 
think it's a good idea to turn on some LOGging so you can see where the 
packets are, and then you can try filtering them.

One thing you could do straight off is just request a detailed listing of the 
chains, to see if you have any packet counts at all:

iptables -L -n -v -x

will print out the filter tables in the INPUT, FORWARD and OUTPUT chains, and 
you should see from the byte & packet counters whether packets seem to have 
been going past.

You can do the same thing with the nat tables to see what happens just before 
& after the above:

iptables -L -t nat -n -v -x

However, if you simply put a LOG rule into all five chains, and then send some 
packet through the bridge, see what gets logged where:

iptables -I INPUT -j LOG
iptables -I FORWARD -j LOG
iptables -I OUTPUT -j LOG
iptables -I PREROUTING -t nat -j LOG
iptables -I POSTROUTING -t nat -j LOG

Let us know what you find....

Antony.

-- 
Never write it in Perl if you can do it in Awk.
Never do it in Awk if sed can handle it.
Never use sed when tr can do the job.
Never invoke tr when cat is sufficient.
Avoid using cat whenever possible.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: Bridging firewall setup

[Chris Brown]

Antony Stone wrote:

>
>I don't know the answer to your question, but in situations like this I always 
>think it's a good idea to turn on some LOGging so you can see where the 
>packets are, and then you can try filtering them.
>
>One thing you could do straight off is just request a detailed listing of the 
>chains, to see if you have any packet counts at all:
>
>iptables -L -n -v -x
>  
>
>will print out the filter tables in the INPUT, FORWARD and OUTPUT chains, and 
>you should see from the byte & packet counters whether packets seem to have 
>been going past.
>
>You can do the same thing with the nat tables to see what happens just before 
>& after the above:
>
>iptables -L -t nat -n -v -x
>  
>
Thanks for the suggestions. I tried these two commands and on both it 
shows 0 packets being filtered. I took the rules out of nat as they 
didn't seem to be doing anything

>However, if you simply put a LOG rule into all five chains, and then send some 
>packet through the bridge, see what gets logged where:
>
>iptables -I INPUT -j LOG
>iptables -I FORWARD -j LOG
>iptables -I OUTPUT -j LOG
>iptables -I PREROUTING -t nat -j LOG
>iptables -I POSTROUTING -t nat -j LOG
>
>  
>
This is a production machine so leaving logging on for extended periods 
isn't an option since it would quickly fill up the logs. However I 
turned in on briefly and even though using tcpdump I see constant 
traffic through the bridge the logs only show traffic going in and out 
to the bridge's IP that I have setup for maintenence, mostly my SSH 
session. Any ideas how I can get it to see the traffic going through?

Chris

-- 
Chris Brown
System Administrator / Web Application Developer
Wavetex Inc.
903-533-1700
http://wavetex.com/

RE: Bridging firewall setup

[Mark Weaver]

>
> This is a production machine so leaving logging on for extended periods 
> isn't an option since it would quickly fill up the logs. However I 
> turned in on briefly and even though using tcpdump I see constant 
> traffic through the bridge the logs only show traffic going in and out 
> to the bridge's IP that I have setup for maintenence, mostly my SSH 
> session. Any ideas how I can get it to see the traffic going through?
> 
You can filter tcpdump, e.g.:

tcpdump port not ssh

tcpdump -i eth0 port 135 and host a.b.c.d

tcpdump -p tcp -i any net a.b.c.d/e

Also man tcpdump, for more detail than you probably ever wanted.

Re: Bridging firewall setup

[Richard Doyle]

On Tue, 2003-12-16 at 08:55, Chris Brown wrote:
> Hi all, new to the list. I'm trying to get a bridging firewall setup on 
> a RH 9 box and I'm not having much luck. The bridge itself works fine 
> but when I try to add rules using netfilter they seem to be ignored and 
> packets I'm trying to block go on through. I've been digging through the 
> list archives, google, various forums and HOWTOs and I still haven't 
> found the answer so I'm hoping someone here can point out what I'm doing 
> wrong :)
Did you patch the kernel to support this? The bridging code in the stock
2.4 kernels doesn't support firewalling,

RE: Bridging firewall setup

[bmcdowell]

This should be emphasized, as there seems to be a good deal of confusion about what's included in the kernel and what isn't.

1)  Bridging is included in the kernel
2)  Using iptables (or ebtables for that matter) to filter bridge traffic is not included and must be patched in.

Check out http://bridge.sourceforge.net/docs.html or http://ebtables.sourceforge.net/documentation.html for more details.

-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org]On Behalf Of Richard Doyle
Sent: Tuesday, December 16, 2003 11:35 AM
To: netfilter@lists.netfilter.org
Subject: Re: Bridging firewall setup


On Tue, 2003-12-16 at 08:55, Chris Brown wrote:
> Hi all, new to the list. I'm trying to get a bridging firewall setup on 
> a RH 9 box and I'm not having much luck. The bridge itself works fine 
> but when I try to add rules using netfilter they seem to be ignored and 
> packets I'm trying to block go on through. I've been digging through the 
> list archives, google, various forums and HOWTOs and I still haven't 
> found the answer so I'm hoping someone here can point out what I'm doing 
> wrong :)
Did you patch the kernel to support this? The bridging code in the stock
2.4 kernels doesn't support firewalling,