Port Forwarding and opening ports.

[ImpulseFG@netscape.net]

[-- Attachment #1: Type: text/plain, Size: 2026 bytes --]

I have iptables setup to port forward ftp , web, and a game server to another server on the local network. It works great. I have also set it up so it only accepts incoming and outgoing connections on port 22. I'm having 2 problems and a couple of questions.

1. I can ssh into the machine which is 192.168.1.1 from any computer on the local network. But I can't run X programs without allowing all incoming and outgoing connections on this machine.
I've tried: $iptables -A INPUT -i eth1 -j ACCEPT
            $iptables -A OUTPUT -o eth1 -j ACCEPT

This wouldn't fix the problem. So I tried.
            $iptables -A INPUT -s 192.168.1.2-192.168.1.255 -j ACCEPT
            $iptables -A OUTPUT -d 192.168.1.2-192.68.1.255 -j ACCEPT

This didn't work either. Only only accepting all incomeing and outgoing connections would.

2. I'm having problems with the nat features.
    I want to be able to ssh into the routing machine from of the local network but I can't. I have it set to accept local connections on port 22 for udp and tcp. 
    But nat is nating the packets before it can accept them.
    The only way I am able to get them to accept them is to disable nat.
    I tried natting all the ports around 22. See the attache script but for some reason that wouln't work either.

Does anyone have any idea how to do this?


3. Does anyone know why? iptables -A mytable -p all --sport 22 -j ACCEPT won't work?
It seems that the all keywork doesn't work at all.

I am using iptables v.1.2.5 with RH7.3 most updated kernel.

Sorry for the lenght of this post I'm just looking for some solutions. Thanks for any help. I changed my IP in the firewall script. to 128.x.x.x hope this doesn't confuse anyone.

                                    -Impulse



__________________________________________________________________
The NEW Netscape 7.0 browser is now available. Upgrade now! http://channels.netscape.com/ns/browsers/download.jsp 

Get your own FREE, personal Netscape Mail account today at http://webmail.netscape.com/

[-- Attachment #2: rc.firewall-2.4.mailing --]
[-- Type: application/octet-stream, Size: 8664 bytes --]

#!/bin/sh
#
# rc.firewall-2.4
FWVER=0.72
#

# The location of the iptables and kernel module programs
#
#	If your Linux disribution came with a copy of iptables 
#	most likely all the programs will be located in /sbin. If
#	you manually compiled iptables, the default location will
#	be in /usr/local/sbin
#
# ** Please use the "whereis iptabbles" command to figure out
# ** where your copy is and change the path below to reflect
# ** your setup
#
#
IPTABLES=/sbin/iptables
#IPTABLES=/usr/local/sbin/iptables
DEPMOD=/sbin/depmod
INSMOD=/sbin/insmod


#Setting the EXTERNAL and INTERAL interfaces for the network
#
#	Each IP Masquerade network needs to have at least one
#	external and one internal network. The external network 
# 	is where the natting will occur and the interal network
#	should preferably be addessed with a RFC1918 private addres
#	scheme.
#
#	For this example, "eth0" is external and "eth1" is internal
#
#
#	NOTE:	If this doesn't EXACTLY fit your configuration, you must
#		change the EXTIF or the INTIF variables above. For example:
#
#
EXTIF="eth0"
INTIF="eth1"


#===========================================================================
#==No editing beyond this line is required for initial MASQ testing 	 ==


echo -en "	loading modulees: "

# Need to verify that all modules have all required dependencies
#
echo "	- Verifying that all kerel modules are ok"
$DEPMOD -a

# With the new IPTABLES code, the core MASQ functionality is now either
# modular or compilied into the kerel. This HOWTO shows ALL IPTABLES
# options as MODULES. IF your kernel is compiled correctly, there is
# NO need to load the kernel modlules manually.
#
#  NOTE: THe following items are listed ONLY for informational reasons.
#	 There is no reason to manual load these modules unless your
#	 kernel is either mis-configured ore you intentionally dieabled
#	 the kernel module autoloader.
#

# Upon the commands of starting up IP Masq on the server, the 
# following kernel modules will be automatically loaded:
#
# NOTE: Only load the IP MASQ modules you need. All current IP MASQ
#	modules are sown below but are commented out from loading.
#=======================================================================

echo "------------------------------------------------------------------"

#Load the main body of the IPTABLES module - "iptable"
#  - Loaded automaticlly when the "iptables" command is invoked
#
#  - Loaded manually to clean up kernel auto- loading timing issues
#
echo -en "ip_tables, " 
$INSMOD ip_tables


#Load the IPTABLES filtering module - "iptable_filter"
# - Loaded automatically when filter polices are activated

#Load the stateful connection tracking framework - "ip_conntrack"
#
# The conntrack module in itself does nothing without other specific
# conntract modules being loaded afterwareds such as the "ip_conntrack_ftp"
# module
#
# -	This module is loaded automatically when MASQ functionality is 
#	enabled
#
# - 	Loaded manually to clean up kerel auto-loading timing issures
#
echo -en "ip_conntrack, " 
$INSMOD ip_conntrack


#Load the FTP tracking mechanism for full FTP tracking
#
# Enabled by default -- insert a "#" on the next line to deactivate
#
echo -en "ip_conntrack_ftp, "
$INSMOD ip_conntrack_ftp

#Load the IRC tracking mechanism for full IRC tracking
#
# Enabled by default -- insert a "#" on the next line to deactivate
#
echo -en "ip_contrack_irc, "
$INSMOD ip_conntrack_irc

#Load the gernal IPTABLES NAT ccode - "iptable_nat"
# - 	Loaded automatically when MASQ functionality is turned on
#
#  - Loaded manually to clean up kernel auto-loading timing issures
#
echo -en "iptable_nat, "
$INSMOD iptable_nat

#Loads the FTP NAT functionality into the core IPTABLES code
# Required to support non -PASV FTP.
#
# Enabled by default -- insert a "#" on the next line to deactivate 
#
echo -en "ip_nat_ftp, "
$INSMOD ip_nat_ftp


#Loads the IRC NAT functionality into the core IPTABLES code
# Required to support NAT of IRC DCC requests
#
# Disabled by default -- remove the "3" on the next line to activate
#
#echo -e "ip_nat_irc, "
#$INSMOD ip_nat_irc

echo "--------------------------------------------------------------"

# Just to be complete, here is a list of the remaining kernl modules
# and their function. Please note that serveral modules should be only
# loaded by the correct master kernel module for proper operation.
# -----------------------------------------------------------------
#
#   ipt_mark     -   This targe marks a giver packet for futre action
#   		THis automatically loads the ipt_MARK module
#
#   ip_tcpmss	- 			


echo ". Done loading modules."

#CRITICAL:	Enable IP forwarding since it is disabled by default since
#		/etc/sysconfig/network form:
#
#	   FORWARD_IPV4=false
#		to
#	   FORWARD_IPV4=true
#
echo "   enabling forwarding.."
echo "1" > /proc/sys/net/ipv4/ip_forward

# Enable simple IP forwarding and Masquerading
#
#  Note:    In IPTABLES speak, IP Masuerading is a form of SourceNAT or SNAT.
#
#  NOTE #2:	The following is an example for an internal LAN addres in the
#		192.168.0.x network with a 255.255.255.0 or a "24" bi subnet mask
#		connecting to the Internet on external interfac "eth0". This 
#		example with MASQ internal traffice out to the Internet but not
#		allow not-initiated traffic into your interal network
#
#
#	** Please change the above network numbers, subnet madsk, and your
#       *** Internet connection interface name to match your setup


#Clearing any previous configuration
#
#  Unless specified, the defaults for INPUT and OUTPUT is ACCEPT
#	The default for FORWARD is REJECT
#
echo "   clearing any existing rules and setting default policy.."
# Commmented out for a rewrite, Lets try to get this thing ritght.
# Lets enable packet-filtering Now


# First lets us clear the tables

$IPTABLES -F INPUT
$IPTABLES -F OUTPUT
$IPTABLES -F FORWARD
$IPTABLES -t nat -F 
$IPTABLES -F block
$IPTABLES -X block
$IPTABLES -F openPort
$IPTABLES -X openPort
$IPTABLES -F reply
$IPTABLES -X reply

$IPTABLES -N openPort
$IPTABLES -A openPort -p tcp --dport 22 -j ACCEPT
$IPTABLES -A openPort -p udp --dport 22 -j ACCEPT
$IPTABLES -A openPort -s 192.168.1.2/24 -j ACCEPT
$IPTABLES -A openPort -j ACCEPT

$IPTABLES -N reply
$IPTABLES -A reply -p tcp --sport 22 -j ACCEPT
$IPTABLES -A reply -p udp --sport 22 -j ACCEPT
$IPTABLES -A reply -d 192.168.1.2/24 -j ACCEPT
$IPTABLES -A reply -j ACCEPT

$IPTABLES -N block
$IPTABLES -A block -j DROP


echo "   FWD: Allow all connection OUT and only existing and related connections IN"
$IPTABLES -A INPUT -j openPort
$IPTABLES -A OUTPUT -j reply
$IPTABLES -A INPUT -j block 
$IPTABLES -A OUTPUT -j block 

#Portforward FTP services to charlee

echo -e "\nForwarding FTP services to charlee"
$IPTABLES -t nat -A PREROUTING -d 128.x.x.x -p tcp --dport 21 -j DNAT --to 192.168.1.2
$IPTABLES -t nat -A PREROUTING -d 128.x.x.x  -p udp --dport 20 -j DNAT --to 192.168.1.2

#Portforward HTTP services to charlee
echo -e "\nForwarding HTTP services to charlee"

$IPTABLES -t nat -A PREROUTING -d 128.x.x.x -p tcp --dport 80 -j DNAT --to 192.168.1.2
$IPTABLES -t nat -A PREROUTING -d 128.x.x.x -p udp --dport 80 -j DNAT --to 192.168.1.2

#Portforward Half-life SErver to charlee
echo -e "\nSetting up ip forwarding for half-life  to charlee"

$IPTABLES -t nat -A PREROUTING -d 128.x.x.x -p tcp --dport 27015 -j DNAT --to 192.168.1.2
$IPTABLES -t nat -A PREROUTING -d 128.x.x.x -p udp --dport 27015 -j DNAT --to 192.168.1.2

#This enables the nat functionality for computers behind this one.

echo -e "\nEnabling NAT services."
$IPTABLES -t nat -A PREROUTING -i $EXTIF -p udp --sport :19 -j DNAT --to 192.168.1.2-192.168.1.255
#Not aditional natting udp port 19-22
$IPTABLES -t nat -A PREROUTING -i $EXTIF -p udp --sport 23:79 -j DNAT --to 192.168.1.2-192.168.1.255
#Port 80 already natted
$IPTABLES -t nat -A PREROUTING -i $EXTIF -p udp --sport 81:27014 -j DNAT --to 192.168.1.2-192.168.1.255
#Port 27015 already natted
$IPTABLES -t nat -A PREROUTING -i $EXTIF -p udp --sport 27016: -j DNAT --to 192.168.1.2-192.168.1.255

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --sport :20 -j DNAT --to 192.168.1.2-192.168.1.255
#Skip 21 & 22
$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --sport 22:79 -j DNAT --to 192.168.1.2-192.168.1.255
$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --sport 81:27014 -j DNAT --to 192.168.1.2-192.168.1.255
$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --sport 27016: -j DNAT --to 192.168.1.2-192.168.1.255

#Only one line needed for out going packets
$IPTABLES -t nat -A POSTROUTING -s 192.168.1.0/24 -j SNAT --to 128.x.x.x


echo -e "\nrc.firewall-2.4 v$FWVER done.\n"