Iptables with Apache - virtualhosts by name

Iptables with Apache - virtualhosts by name

[Javi Legido]

Hi.

i have the following machines:

[Router] <=> [Server]

I have a Apache with virtual hosts by name working properly in the
server. But when i 'turn on' iptables, it's impossible to connect to
ANY page.

iptables -S

-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A INPUT -s public_ip_pc_132 -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -s public_ip_pc_132 -i eth0 -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -s 192.168.1.31/32 -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -s public_ip_pc_2/32 -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -s public_ip_pc_2/32 -i eth0 -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -s public_ip_pc_3/32 -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -s public_ip_pc_3/32 -i eth0 -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -s 192.168.1.30/32 -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --sport 80 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 4080 -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --dport 4080 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --dport 21 -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --dport 21 -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --sport 53 -j ACCEPT
-A INPUT -i eth0 -p tcp -m tcp --sport 23 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -p tcp -m tcp --dport 9999 -j ACCEPT
-A FORWARD -p tcp -m tcp --dport 6882 -j ACCEPT
-A FORWARD -p udp -m udp --dport 5865 -j ACCEPT
-A FORWARD -p tcp -m tcp --dport 5865 -j ACCEPT
-A FORWARD -p udp -m udp --dport 8443 -j ACCEPT
-A FORWARD -p tcp -m tcp --dport 8443 -j ACCEPT
-A FORWARD -p udp -m udp --dport 4666 -j ACCEPT
-A FORWARD -p tcp -m tcp --dport 4662 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-port-unreachable

Can anybody tells me the right rule to allow iptables filter http
traffic (remember the virtual host setting)?

Thanks in advice.

Javier

Re: Iptables with Apache - virtualhosts by name

[Gáspár Lajos]

Hi,

Javi Legido írta:
> Hi.
>
> i have the following machines:
>
> [Router] <=> [Server]
>
> I have a Apache with virtual hosts by name working properly in the
> server. But when i 'turn on' iptables, it's impossible to connect to
> ANY page.
>
Is these rules are on your Server or on the Router?
I assume that these are the Router's rules because of the FORWARD part...
> iptables -S
>
> -P INPUT ACCEPT
> -P FORWARD ACCEPT
> -P OUTPUT ACCEPT
> -A INPUT -s public_ip_pc_132 -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
> -A INPUT -s public_ip_pc_132 -i eth0 -p tcp -m tcp --dport 443 -j ACCEPT
> -A INPUT -s 192.168.1.31/32 -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
> -A INPUT -s public_ip_pc_2/32 -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
> -A INPUT -s public_ip_pc_2/32 -i eth0 -p tcp -m tcp --dport 443 -j ACCEPT
> -A INPUT -s public_ip_pc_3/32 -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
> -A INPUT -s public_ip_pc_3/32 -i eth0 -p tcp -m tcp --dport 443 -j ACCEPT
> -A INPUT -s 192.168.1.30/32 -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
Why do you check the source addresses ???
eth0 is your WAN interface ???

And you should use the conntracking system...

> -A INPUT -i eth0 -p tcp -m tcp --dport 80 -j ACCEPT
This line should have enabled the connection... So you have a different 
problem...
> -A INPUT -i eth0 -p tcp -m tcp --sport 80 -j ACCEPT
sport ???? why???
> -A INPUT -i eth0 -p tcp -m tcp --dport 4080 -j ACCEPT
> -A INPUT -i eth0 -p udp -m udp --dport 4080 -j ACCEPT
> -A INPUT -i eth0 -p tcp -m tcp --dport 21 -j ACCEPT
> -A INPUT -i eth0 -p udp -m udp --dport 21 -j ACCEPT
> -A INPUT -i eth0 -p udp -m udp --sport 53 -j ACCEPT
> -A INPUT -i eth0 -p tcp -m tcp --sport 23 -j ACCEPT
> -A INPUT -i lo -j ACCEPT
I would ACCEPT all "lo" traffic first in my list...
> -A INPUT -j REJECT --reject-with icmp-port-unreachable
> -A FORWARD -p tcp -m tcp --dport 9999 -j ACCEPT
> -A FORWARD -p tcp -m tcp --dport 6882 -j ACCEPT
> -A FORWARD -p udp -m udp --dport 5865 -j ACCEPT
> -A FORWARD -p tcp -m tcp --dport 5865 -j ACCEPT
> -A FORWARD -p udp -m udp --dport 8443 -j ACCEPT
> -A FORWARD -p tcp -m tcp --dport 8443 -j ACCEPT
> -A FORWARD -p udp -m udp --dport 4666 -j ACCEPT
> -A FORWARD -p tcp -m tcp --dport 4662 -j ACCEPT
> -A FORWARD -j REJECT --reject-with icmp-port-unreachable
>   
So... If it is on the Router then please show the NAT part also...

iptables -S -t nat

If it is on the Server then why do you check the source addresses and 
why do you have any FORWARDing ???


Swifty