Using default policy drop in FORWARD chain´s

Using default policy drop in FORWARD chain´s

[Juan Santamaria]

Hello Guys

Nowdays, I ´ve been working  in a firewall configuration. I want use default 
policy DROP, for the INPUT,FORWARD,OUTPUT chain´s.  I using the redwall 
firewall, it has support for l7-protocols. I need to block msn, but when I 
apply the ruler to the forward chain it isn´t block.

But when y change de default policy in Forward chain´s  to ACCEPT, tha same 
ruler block the msn traffic.

I appreciate some advices

Cheerio!

IPTABLES=/sbin/iptables

$IPTABLES -F
$IPTABLES -t nat -F
$IPTABLES -X
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP


$IPTABLES  -A FORWARD -p tcp -m tcp -m layer7 --l7proto msnmessenger
-j DROP




$IPTABLES -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
$IPTABLES -A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
$IPTABLES -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
$IPTABLES -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT
$IPTABLES -A OUTPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
$IPTABLES -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT

#$IPTABLES -A FORWARD -s 10.0.109.20 -j DROP

$IPTABLES -A INPUT   -i eth2 -p tcp -m tcp --dport 22 -j ACCEPT
$IPTABLES -A OUTPUT  -o eth2 -p tcp -m tcp --sport 22 -m state --state 
RELATED,ESTABLISHED -j ACCEPT



$IPTABLES -A FORWARD -p tcp -m tcp --sport 80 -j ACCEPT
$IPTABLES -A FORWARD -p tcp -m tcp --dport 80 -j ACCEPT

$IPTABLES -A FORWARD -p tcp -m tcp --sport 80 -m layer7 --l7proto 
msnmessenger -j DROP
$IPTABLES -A FORWARD -p tcp -m tcp --dport 80 -m layer7 --l7proto 
msnmessenger -j DROP
$IPTABLES -A FORWARD -p tcp -m tcp --sport 443 -j ACCEPT
$IPTABLES -A FORWARD -p tcp -m tcp --dport 443 -j ACCEPT

$IPTABLES -A FORWARD -p udp -m udp --sport 53 -j ACCEPT
$IPTABLES -A FORWARD -p udp -m udp --dport 53 -j ACCEPT

Re: Using default policy drop in FORWARD chain´s

[Mike Wright]

Juan Santamaria wrote:
> Hello Guys

Hi Juan,

> 
> Nowdays, I ´ve been working  in a firewall configuration. I want use 
> default policy DROP, for the INPUT,FORWARD,OUTPUT chain´s.  I using the 
> redwall firewall, it has support for l7-protocols. I need to block msn, 
> but when I apply the ruler to the forward chain it isn´t block.
> 
> But when y change de default policy in Forward chain´s  to ACCEPT, tha 
> same ruler block the msn traffic.
> 
> I appreciate some advices
> 
> Cheerio!
> 
> IPTABLES=/sbin/iptables
> 
> $IPTABLES -F
> $IPTABLES -t nat -F
> $IPTABLES -X
> $IPTABLES -P INPUT DROP
> $IPTABLES -P OUTPUT DROP
> $IPTABLES -P FORWARD DROP
> 
> 
> $IPTABLES  -A FORWARD -p tcp -m tcp -m layer7 --l7proto msnmessenger
> -j DROP
> 
> 
> 
> 
> $IPTABLES -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
> $IPTABLES -A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
> $IPTABLES -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
> $IPTABLES -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT
> $IPTABLES -A OUTPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
> $IPTABLES -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT
> 
> #$IPTABLES -A FORWARD -s 10.0.109.20 -j DROP
> 
> $IPTABLES -A INPUT   -i eth2 -p tcp -m tcp --dport 22 -j ACCEPT
> $IPTABLES -A OUTPUT  -o eth2 -p tcp -m tcp --sport 22 -m state --state 
> RELATED,ESTABLISHED -j ACCEPT
> 

I think the problem occurs here.  It's important to put the more 
specific rules in front of the more general rules or they will never be 
seen because the condition has already been matched.  Move the following 
two rules to after those of "layer7" and all should be well.

Hope this is useful.

> 
> 
> $IPTABLES -A FORWARD -p tcp -m tcp --sport 80 -j ACCEPT
> $IPTABLES -A FORWARD -p tcp -m tcp --dport 80 -j ACCEPT
> 
> $IPTABLES -A FORWARD -p tcp -m tcp --sport 80 -m layer7 --l7proto 
> msnmessenger -j DROP
> $IPTABLES -A FORWARD -p tcp -m tcp --dport 80 -m layer7 --l7proto 
> msnmessenger -j DROP
> $IPTABLES -A FORWARD -p tcp -m tcp --sport 443 -j ACCEPT
> $IPTABLES -A FORWARD -p tcp -m tcp --dport 443 -j ACCEPT
> 
> $IPTABLES -A FORWARD -p udp -m udp --sport 53 -j ACCEPT
> $IPTABLES -A FORWARD -p udp -m udp --dport 53 -j ACCEPT
> 
> 
> 
> 
>