* ping to internet hosts through NameServer of provider
@ 2004-03-09 9:29 Stanislav Puffler DiS.
2004-03-09 10:40 ` Antony Stone
0 siblings, 1 reply; 8+ messages in thread
From: Stanislav Puffler DiS. @ 2004-03-09 9:29 UTC (permalink / raw)
To: netfilter
Hi all,
i´m newbie to fw, have just installed iptables and configured. Have 3
interfaces, eth0 - internet, eth1 - DMZ (squid, postfix), eth2 - LAN. My
provider has connected my firewall to the Internet via 1 public IP (on
eth0). Internet hosts are resolved via provider´s Name Server (this IP
is in /etc/resolv.conf). If I tried ping to (for example) www.rb.cz
before installing iptables, there was no problem. Now, after installing
iptables, I can´t ping to internet hosts correctly (only on IP - it is
without need of contacting providers NS) - it is working like this :
[user@machine]$ ping www.rb.cz
IN=eth0 OUT= MAC=.............. SRC="my_providers_nameserver_ip"
DST="ip_on_my_eth0" LEN=127 TOS=0x00 PREC=0x00 TTL=61 ID=3268 DF
PROTO=UDP SPT=53 DPT=32792 LEN=107
Ping to resolved IP of www.rb.cz is no problem (ping 193.86.103.40 -
returns a normal replay). Could anyone help me please how to set up
carefully and secure rule to maintain this problem - to permit my
provider´s NS to resolv internet hosts ?
PS : The same problem is when I ping to localhost or 127.0.0.1 (lo), my
own public ip (eth0), my DMZ ip (eth1), my LAN ip (eth2). And the very
strange thing is that when I´m not working in shell (only prompt is
visible) it starts time to time showing some strings (the same as I have
described above), looking like pinging my machine from some public ip in
internet. I can see these strange things in /var/log/messages. Have
tried to find anything similar in mailing list archive, nothing is there...
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: ping to internet hosts through NameServer of provider
2004-03-09 9:29 ping to internet hosts through NameServer of provider Stanislav Puffler DiS.
@ 2004-03-09 10:40 ` Antony Stone
2004-03-09 13:00 ` ping to internet hosta " Stanislav Puffler DiS.
0 siblings, 1 reply; 8+ messages in thread
From: Antony Stone @ 2004-03-09 10:40 UTC (permalink / raw)
To: netfilter
On Tuesday 09 March 2004 9:29 am, Stanislav Puffler DiS. wrote:
> Hi all,
> i´m newbie to fw, have just installed iptables and configured. Have 3
> interfaces, eth0 - internet, eth1 - DMZ (squid, postfix), eth2 - LAN. My
> provider has connected my firewall to the Internet via 1 public IP (on
> eth0). Internet hosts are resolved via provider´s Name Server (this IP
> is in /etc/resolv.conf). If I tried ping to (for example) www.rb.cz
> before installing iptables, there was no problem. Now, after installing
> iptables, I can´t ping to internet hosts correctly (only on IP - it is
> without need of contacting providers NS) - it is working like this :
>
> [user@machine]$ ping www.rb.cz
> IN=eth0 OUT= MAC=.............. SRC="my_providers_nameserver_ip"
> DST="ip_on_my_eth0" LEN=127 TOS=0x00 PREC=0x00 TTL=61 ID=3268 DF
> PROTO=UDP SPT=53 DPT=32792 LEN=107
So you have a LOGging rule (presumably some time before a DROP rule - not many
people LOG ACCEPTed packets), which shows that you are blocking DNS replies
from your ISP. Hence you cannot resolve IP addresses.
> Ping to resolved IP of www.rb.cz is no problem (ping 193.86.103.40 -
> returns a normal replay). Could anyone help me please how to set up
> carefully and secure rule to maintain this problem - to permit my
> provider´s NS to resolv internet hosts ?
Please tell us your ruleset (either the iptables commands you use to set up
the rules, or the output of "iptables -L -nv; iptables -L -t nat -nv") and we
can suggest what might be wrong.
If you are new to networking as well as netfilter, please read one of the
excellent tutorials accessible from http://www.netfilter.org and this will
help you get a basic setup working. I can recommend Oskar Andreasson's
tutorial at http://iptables-tutorial.frozentux.net
Regards,
Antony.
--
Most people are aware that the Universe is big.
- Paul Davies, Professor of Theoretical Physics
Please reply to the list;
please don't CC me.
^ permalink raw reply [flat|nested] 8+ messages in thread
* RE: ping to internet hosta through NameServer of provider
2004-03-09 10:40 ` Antony Stone
@ 2004-03-09 13:00 ` Stanislav Puffler DiS.
2004-03-09 13:22 ` Antony Stone
0 siblings, 1 reply; 8+ messages in thread
From: Stanislav Puffler DiS. @ 2004-03-09 13:00 UTC (permalink / raw)
To: netfilter
It seems like anything you´ve described. Here is the ruleset :
iptables -L -nv
Chain INPUT (policy ACCEPT 66 packets, 2754 bytes)
pkts bytes target prot opt in out source
destination
1332 179K RH-Lokkit-0-50-INPUT all -- * * 0.0.0.0/0
0.0.0.0/0
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
Chain OUTPUT (policy ACCEPT 85 packets, 5151 bytes)
pkts bytes target prot opt in out source
destination
Chain RH-Lokkit-0-50-INPUT (1 references)
pkts bytes target prot opt in out source
destination
0 0 ACCEPT udp -- * * 80.95.96.7
0.0.0.0/0 udp spt:53 dpts:1025:65535
10 700 ACCEPT all -- lo * 0.0.0.0/0
0.0.0.0/0
0 0 ACCEPT udp -- * * 192.168.0.11
0.0.0.0/0 udp spt:53
0 0 REJECT tcp -- * * 0.0.0.0/0
0.0.0.0/0 tcp flags:0x16/0x02 reject-with icmp-port-unreachable
1256 175K REJECT udp -- * * 0.0.0.0/0
0.0.0.0/0 udp reject-with icmp-port-unreachable
iptables -L -t nat -nv
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
As for tutorials - I have read some czech one, I´ll read those from
netfilter.org too of course... Thanks in advance,
Stanley.
-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Antony Stone
Sent: Tuesday, March 09, 2004 11:40 AM
To: netfilter@lists.netfilter.org
Subject: Re: ping to internet hosts through NameServer of provider
On Tuesday 09 March 2004 9:29 am, Stanislav Puffler DiS. wrote:
> Hi all,
> i´m newbie to fw, have just installed iptables and configured. Have 3
> interfaces, eth0 - internet, eth1 - DMZ (squid, postfix), eth2 - LAN. My
> provider has connected my firewall to the Internet via 1 public IP (on
> eth0). Internet hosts are resolved via provider´s Name Server (this IP
> is in /etc/resolv.conf). If I tried ping to (for example) www.rb.cz
> before installing iptables, there was no problem. Now, after installing
> iptables, I can´t ping to internet hosts correctly (only on IP - it is
> without need of contacting providers NS) - it is working like this :
>
> [user@machine]$ ping www.rb.cz
> IN=eth0 OUT= MAC=.............. SRC="my_providers_nameserver_ip"
> DST="ip_on_my_eth0" LEN=127 TOS=0x00 PREC=0x00 TTL=61 ID=3268 DF
> PROTO=UDP SPT=53 DPT=32792 LEN=107
So you have a LOGging rule (presumably some time before a DROP rule - not
many
people LOG ACCEPTed packets), which shows that you are blocking DNS replies
from your ISP. Hence you cannot resolve IP addresses.
> Ping to resolved IP of www.rb.cz is no problem (ping 193.86.103.40 -
> returns a normal replay). Could anyone help me please how to set up
> carefully and secure rule to maintain this problem - to permit my
> provider´s NS to resolv internet hosts ?
Please tell us your ruleset (either the iptables commands you use to set up
the rules, or the output of "iptables -L -nv; iptables -L -t nat -nv") and
we
can suggest what might be wrong.
If you are new to networking as well as netfilter, please read one of the
excellent tutorials accessible from http://www.netfilter.org and this will
help you get a basic setup working. I can recommend Oskar Andreasson's
tutorial at http://iptables-tutorial.frozentux.net
Regards,
Antony.
--
Most people are aware that the Universe is big.
- Paul Davies, Professor of Theoretical Physics
Please reply to the
list;
please don't CC
me.
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: ping to internet hosta through NameServer of provider
2004-03-09 13:00 ` ping to internet hosta " Stanislav Puffler DiS.
@ 2004-03-09 13:22 ` Antony Stone
2004-03-10 10:22 ` Stanislav Puffler DiS.
0 siblings, 1 reply; 8+ messages in thread
From: Antony Stone @ 2004-03-09 13:22 UTC (permalink / raw)
To: netfilter
On Tuesday 09 March 2004 1:00 pm, Stanislav Puffler DiS. wrote:
> It seems like anything you´ve described. Here is the ruleset :
>
> iptables -L -nv
<snip>
If this is your ruleset, where is the LOG rule which produced the output you
posted earlier?
> > IN=eth0 OUT= MAC=.............. SRC="my_providers_nameserver_ip"
> > DST="ip_on_my_eth0" LEN=127 TOS=0x00 PREC=0x00 TTL=61 ID=3268 DF
> > PROTO=UDP SPT=53 DPT=32792 LEN=107
Antony.
--
People who use Microsoft software should be certified.
Please reply to the list;
please don't CC me.
^ permalink raw reply [flat|nested] 8+ messages in thread
* RE: ping to internet hosta through NameServer of provider
2004-03-09 13:22 ` Antony Stone
@ 2004-03-10 10:22 ` Stanislav Puffler DiS.
2004-03-10 10:41 ` Antony Stone
0 siblings, 1 reply; 8+ messages in thread
From: Stanislav Puffler DiS. @ 2004-03-10 10:22 UTC (permalink / raw)
To: netfilter
Apologize, these are my rulesets. As for pinging internet hosts, it is
working corectly now (after accepting packets from ISP NameServer). But the
only one problem is, that there are still logs in shell prompt and i am not
typing anything...
iptables -L -nv
Chain INPUT (policy DROP 59 packets, 6498 bytes)
pkts bytes target prot opt in out source
destination
18 868 tcp_segmenty tcp -- eth0 * 0.0.0.0/0
0.0.0.0/0
43 5995 udp_pakety udp -- eth0 * 0.0.0.0/0
0.0.0.0/0
33 2772 ACCEPT icmp -- eth0 * 0.0.0.0/0
0.0.0.0/0 icmp type 0
0 0 ACCEPT icmp -- eth0 * 0.0.0.0/0
0.0.0.0/0 icmp type 3
1 92 ACCEPT icmp -- eth0 * 0.0.0.0/0
0.0.0.0/0 icmp type 8
0 0 ACCEPT icmp -- eth0 * 0.0.0.0/0
0.0.0.0/0 icmp type 11
9 756 ACCEPT all -- eth1 * 0.0.0.0/0
0.0.0.0/0
3168 435K ACCEPT all -- eth2 * 0.0.0.0/0
0.0.0.0/0
131 11622 ACCEPT all -- lo * 0.0.0.0/0
0.0.0.0/0
0 0 REJECT tcp -- eth0 * 0.0.0.0/0
0.0.0.0/0 tcp dpt:113 reject-with icmp-port-unreachable
56 6568 spoofing all -- eth0 * 0.0.0.0/0
0.0.0.0/0
56 6568 spoofing all -- eth0 * 0.0.0.0/0
0.0.0.0/0
20 2396 LOG all -- * * 0.0.0.0/0
0.0.0.0/0 limit: avg 3/hour burst 5 LOG flags 0 level 4
0 0 ACCEPT icmp -- * * 0.0.0.0/0
0.0.0.0/0 icmp type 8 limit: avg 1/sec burst 5
0 0 ACCEPT all -- eth1 * 0.0.0.0/0
0.0.0.0/0
0 0 ACCEPT all -- eth2 * 0.0.0.0/0
0.0.0.0/0
36 5139 ACCEPT all -- eth0 * 80.95.96.7
0.0.0.0/0
4 192 LOG all -- * * 0.0.0.0/0
0.0.0.0/0 LOG flags 0 level 4
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
0 0 ACCEPT all -- eth1 * 0.0.0.0/0
0.0.0.0/0
0 0 ACCEPT all -- eth2 * 0.0.0.0/0
0.0.0.0/0
0 0 ACCEPT all -- eth0 eth1 0.0.0.0/0
0.0.0.0/0 state RELATED,ESTABLISHED
0 0 ACCEPT all -- eth2 * 0.0.0.0/0
0.0.0.0/0
0 0 ACCEPT all -- eth1 eth2 0.0.0.0/0
0.0.0.0/0
0 0 ACCEPT all -- eth2 eth1 0.0.0.0/0
0.0.0.0/0
0 0 ACCEPT all -- eth1 * 0.0.0.0/0
0.0.0.0/0
0 0 ACCEPT all -- eth0 eth1 0.0.0.0/0
0.0.0.0/0 state RELATED,ESTABLISHED
0 0 spoofing all -- eth0 * 0.0.0.0/0
0.0.0.0/0
Chain OUTPUT (policy DROP 30 packets, 2520 bytes)
pkts bytes target prot opt in out source
destination
34 2728 ACCEPT all -- * * 127.0.0.1
0.0.0.0/0
0 0 ACCEPT all -- * * 192.168.0.201
0.0.0.0/0
145 13870 ACCEPT all -- * * 192.168.0.1
0.0.0.0/0
97 7286 ACCEPT all -- * * 82.142.67.253
0.0.0.0/0
0 0 ACCEPT all -- * * 127.0.0.1
0.0.0.0/0
0 0 ACCEPT all -- * * 192.168.0.1
0.0.0.0/0
53 4452 ACCEPT all -- * * 192.168.200.1
0.0.0.0/0
0 0 ACCEPT all -- * * 80.95.96.7
0.0.0.0/0
Chain spoofing (3 references)
pkts bytes target prot opt in out source
destination
0 0 DROP all -- * * 192.168.0.0/16
0.0.0.0/0
0 0 DROP all -- * * 172.16.0.0/12
0.0.0.0/0
0 0 DROP all -- * * 10.0.0.0/8
0.0.0.0/0
Chain syn_flood (0 references)
pkts bytes target prot opt in out source
destination
0 0 RETURN all -- * * 0.0.0.0/0
0.0.0.0/0 limit: avg 1/sec burst 5
0 0 DROP all -- * * 0.0.0.0/0
0.0.0.0/0
Chain tcp_segmenty (1 references)
pkts bytes target prot opt in out source
destination
0 0 ACCEPT tcp -- * * 0.0.0.0/0
0.0.0.0/0 tcp dpt:25
Chain udp_pakety (1 references)
pkts bytes target prot opt in out source
destination
0 0 ACCEPT udp -- * * 0.0.0.0/0
0.0.0.0/0 udp dpt:53
iptables -L -t nat -nv
Chain PREROUTING (policy ACCEPT 3084 packets, 395K bytes)
pkts bytes target prot opt in out source
destination
0 0 REDIRECT tcp -- eth2 * 0.0.0.0/0
0.0.0.0/0 tcp dpt:80 redir ports 3128
0 0 DROP all -- eth0 * 192.168.0.0/16
0.0.0.0/0
0 0 DROP all -- eth0 * 172.16.0.0/12
0.0.0.0/0
0 0 DROP all -- eth0 * 10.0.0.0/8
0.0.0.0/0
Chain POSTROUTING (policy ACCEPT 80 packets, 6594 bytes)
pkts bytes target prot opt in out source
destination
39 3035 MASQUERADE all -- * eth0 0.0.0.0/0
0.0.0.0/0
Chain OUTPUT (policy ACCEPT 149 packets, 12149 bytes)
pkts bytes target prot opt in out source
destination
Thanks in advance,
Stanley.
-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Antony Stone
Sent: Tuesday, March 09, 2004 2:23 PM
To: netfilter@lists.netfilter.org
Subject: Re: ping to internet hosta through NameServer of provider
On Tuesday 09 March 2004 1:00 pm, Stanislav Puffler DiS. wrote:
> It seems like anything you´ve described. Here is the ruleset :
>
> iptables -L -nv
<snip>
If this is your ruleset, where is the LOG rule which produced the output you
posted earlier?
> > IN=eth0 OUT= MAC=.............. SRC="my_providers_nameserver_ip"
> > DST="ip_on_my_eth0" LEN=127 TOS=0x00 PREC=0x00 TTL=61 ID=3268 DF
> > PROTO=UDP SPT=53 DPT=32792 LEN=107
Antony.
--
People who use Microsoft software should be certified.
Please reply to the
list;
please don't CC
me.
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: ping to internet hosta through NameServer of provider
2004-03-10 10:22 ` Stanislav Puffler DiS.
@ 2004-03-10 10:41 ` Antony Stone
2004-03-10 11:02 ` Stanislav Puffler DiS.
2004-03-11 7:57 ` Stanislav Puffler DiS.
0 siblings, 2 replies; 8+ messages in thread
From: Antony Stone @ 2004-03-10 10:41 UTC (permalink / raw)
To: netfilter
On Wednesday 10 March 2004 10:22 am, Stanislav Puffler DiS. wrote:
> Apologize, these are my rulesets. As for pinging internet hosts, it is
> working corectly now (after accepting packets from ISP NameServer).
Good.
> But the only one problem is, that there are still logs in shell prompt and i
> am not typing anything...
I am not sure I understand why this is a problem. Do you mean you want the
logs to go to syslog instead of the console, or do you mean that you don't
udnerstand why packets are arriving at your firewall and being logged when
you are not creating them?
If it's the first, then you should investigate the --log-level option to the
LOG target, and check your syslog.conf setup.
If it's the second, then the simple answer is that packets are sent to
arbitrary addresses around the Internet all the time, and it does not take
long after plugging a packet logger into a previously unused IP address
before you start seeing traffic turn up...
Regards,
Antony.
--
The words "e pluribus unum" on the Great Seal of the United States are from a
poem by Virgil entitled "Moretum", which is about cheese and garlic salad
dressing.
Please reply to the list;
please don't CC me.
^ permalink raw reply [flat|nested] 8+ messages in thread
* RE: ping to internet hosta through NameServer of provider
2004-03-10 10:41 ` Antony Stone
@ 2004-03-10 11:02 ` Stanislav Puffler DiS.
2004-03-11 7:57 ` Stanislav Puffler DiS.
1 sibling, 0 replies; 8+ messages in thread
From: Stanislav Puffler DiS. @ 2004-03-10 11:02 UTC (permalink / raw)
To: netfilter
It is the first one, i don´t want to see my logs only in syslog. So,
I´ll try to investigate the --log-level option. Thanks a lot Antony.
-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Antony Stone
Sent: Wednesday, March 10, 2004 11:41 AM
To: netfilter@lists.netfilter.org
Subject: Re: ping to internet hosta through NameServer of provider
On Wednesday 10 March 2004 10:22 am, Stanislav Puffler DiS. wrote:
> Apologize, these are my rulesets. As for pinging internet hosts, it is
> working corectly now (after accepting packets from ISP NameServer).
Good.
> But the only one problem is, that there are still logs in shell prompt and
i
> am not typing anything...
I am not sure I understand why this is a problem. Do you mean you want the
logs to go to syslog instead of the console, or do you mean that you don't
udnerstand why packets are arriving at your firewall and being logged when
you are not creating them?
If it's the first, then you should investigate the --log-level option to the
LOG target, and check your syslog.conf setup.
If it's the second, then the simple answer is that packets are sent to
arbitrary addresses around the Internet all the time, and it does not take
long after plugging a packet logger into a previously unused IP address
before you start seeing traffic turn up...
Regards,
Antony.
--
The words "e pluribus unum" on the Great Seal of the United States are from
a
poem by Virgil entitled "Moretum", which is about cheese and garlic salad
dressing.
Please reply to the
list;
please don't CC
me.
^ permalink raw reply [flat|nested] 8+ messages in thread
* RE: ping to internet hosta through NameServer of provider
2004-03-10 10:41 ` Antony Stone
2004-03-10 11:02 ` Stanislav Puffler DiS.
@ 2004-03-11 7:57 ` Stanislav Puffler DiS.
1 sibling, 0 replies; 8+ messages in thread
From: Stanislav Puffler DiS. @ 2004-03-11 7:57 UTC (permalink / raw)
To: netfilter
Hallo,
have tried this, but don´t know exactly what to do, could anyone help me
please ? In syslog.conf console output is remarked - not permited I think.
And as for --log-level option, don´t know how to set up LOG target only to
syslog. Thanks...
Stanley
-----Original Message-----
From: netfilter-admin@lists.netfilter.org
[mailto:netfilter-admin@lists.netfilter.org] On Behalf Of Antony Stone
Sent: Wednesday, March 10, 2004 11:41 AM
To: netfilter@lists.netfilter.org
Subject: Re: ping to internet hosta through NameServer of provider
On Wednesday 10 March 2004 10:22 am, Stanislav Puffler DiS. wrote:
> Apologize, these are my rulesets. As for pinging internet hosts, it is
> working corectly now (after accepting packets from ISP NameServer).
Good.
> But the only one problem is, that there are still logs in shell prompt and
i
> am not typing anything...
I am not sure I understand why this is a problem. Do you mean you want the
logs to go to syslog instead of the console, or do you mean that you don't
udnerstand why packets are arriving at your firewall and being logged when
you are not creating them?
If it's the first, then you should investigate the --log-level option to the
LOG target, and check your syslog.conf setup.
If it's the second, then the simple answer is that packets are sent to
arbitrary addresses around the Internet all the time, and it does not take
long after plugging a packet logger into a previously unused IP address
before you start seeing traffic turn up...
Regards,
Antony.
--
The words "e pluribus unum" on the Great Seal of the United States are from
a
poem by Virgil entitled "Moretum", which is about cheese and garlic salad
dressing.
Please reply to the
list;
please don't CC
me.
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2004-03-11 7:57 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2004-03-09 9:29 ping to internet hosts through NameServer of provider Stanislav Puffler DiS.
2004-03-09 10:40 ` Antony Stone
2004-03-09 13:00 ` ping to internet hosta " Stanislav Puffler DiS.
2004-03-09 13:22 ` Antony Stone
2004-03-10 10:22 ` Stanislav Puffler DiS.
2004-03-10 10:41 ` Antony Stone
2004-03-10 11:02 ` Stanislav Puffler DiS.
2004-03-11 7:57 ` Stanislav Puffler DiS.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox