Port Forwarding and opening ports.

Port Forwarding and opening ports.

[ImpulseFG]

[-- Attachment #1: Type: text/plain, Size: 2026 bytes --]

I have iptables setup to port forward ftp , web, and a game server to another server on the local network. It works great. I have also set it up so it only accepts incoming and outgoing connections on port 22. I'm having 2 problems and a couple of questions.

1. I can ssh into the machine which is 192.168.1.1 from any computer on the local network. But I can't run X programs without allowing all incoming and outgoing connections on this machine.
I've tried: $iptables -A INPUT -i eth1 -j ACCEPT
            $iptables -A OUTPUT -o eth1 -j ACCEPT

This wouldn't fix the problem. So I tried.
            $iptables -A INPUT -s 192.168.1.2-192.168.1.255 -j ACCEPT
            $iptables -A OUTPUT -d 192.168.1.2-192.68.1.255 -j ACCEPT

This didn't work either. Only only accepting all incomeing and outgoing connections would.

2. I'm having problems with the nat features.
    I want to be able to ssh into the routing machine from of the local network but I can't. I have it set to accept local connections on port 22 for udp and tcp. 
    But nat is nating the packets before it can accept them.
    The only way I am able to get them to accept them is to disable nat.
    I tried natting all the ports around 22. See the attache script but for some reason that wouln't work either.

Does anyone have any idea how to do this?


3. Does anyone know why? iptables -A mytable -p all --sport 22 -j ACCEPT won't work?
It seems that the all keywork doesn't work at all.

I am using iptables v.1.2.5 with RH7.3 most updated kernel.

Sorry for the lenght of this post I'm just looking for some solutions. Thanks for any help. I changed my IP in the firewall script. to 128.x.x.x hope this doesn't confuse anyone.

                                    -Impulse



__________________________________________________________________
The NEW Netscape 7.0 browser is now available. Upgrade now! http://channels.netscape.com/ns/browsers/download.jsp 

Get your own FREE, personal Netscape Mail account today at http://webmail.netscape.com/

[-- Attachment #2: rc.firewall-2.4.mailing --]
[-- Type: application/octet-stream, Size: 8664 bytes --]

#!/bin/sh
#
# rc.firewall-2.4
FWVER=0.72
#

# The location of the iptables and kernel module programs
#
#	If your Linux disribution came with a copy of iptables 
#	most likely all the programs will be located in /sbin. If
#	you manually compiled iptables, the default location will
#	be in /usr/local/sbin
#
# ** Please use the "whereis iptabbles" command to figure out
# ** where your copy is and change the path below to reflect
# ** your setup
#
#
IPTABLES=/sbin/iptables
#IPTABLES=/usr/local/sbin/iptables
DEPMOD=/sbin/depmod
INSMOD=/sbin/insmod


#Setting the EXTERNAL and INTERAL interfaces for the network
#
#	Each IP Masquerade network needs to have at least one
#	external and one internal network. The external network 
# 	is where the natting will occur and the interal network
#	should preferably be addessed with a RFC1918 private addres
#	scheme.
#
#	For this example, "eth0" is external and "eth1" is internal
#
#
#	NOTE:	If this doesn't EXACTLY fit your configuration, you must
#		change the EXTIF or the INTIF variables above. For example:
#
#
EXTIF="eth0"
INTIF="eth1"


#===========================================================================
#==No editing beyond this line is required for initial MASQ testing 	 ==


echo -en "	loading modulees: "

# Need to verify that all modules have all required dependencies
#
echo "	- Verifying that all kerel modules are ok"
$DEPMOD -a

# With the new IPTABLES code, the core MASQ functionality is now either
# modular or compilied into the kerel. This HOWTO shows ALL IPTABLES
# options as MODULES. IF your kernel is compiled correctly, there is
# NO need to load the kernel modlules manually.
#
#  NOTE: THe following items are listed ONLY for informational reasons.
#	 There is no reason to manual load these modules unless your
#	 kernel is either mis-configured ore you intentionally dieabled
#	 the kernel module autoloader.
#

# Upon the commands of starting up IP Masq on the server, the 
# following kernel modules will be automatically loaded:
#
# NOTE: Only load the IP MASQ modules you need. All current IP MASQ
#	modules are sown below but are commented out from loading.
#=======================================================================

echo "------------------------------------------------------------------"

#Load the main body of the IPTABLES module - "iptable"
#  - Loaded automaticlly when the "iptables" command is invoked
#
#  - Loaded manually to clean up kernel auto- loading timing issues
#
echo -en "ip_tables, " 
$INSMOD ip_tables


#Load the IPTABLES filtering module - "iptable_filter"
# - Loaded automatically when filter polices are activated

#Load the stateful connection tracking framework - "ip_conntrack"
#
# The conntrack module in itself does nothing without other specific
# conntract modules being loaded afterwareds such as the "ip_conntrack_ftp"
# module
#
# -	This module is loaded automatically when MASQ functionality is 
#	enabled
#
# - 	Loaded manually to clean up kerel auto-loading timing issures
#
echo -en "ip_conntrack, " 
$INSMOD ip_conntrack


#Load the FTP tracking mechanism for full FTP tracking
#
# Enabled by default -- insert a "#" on the next line to deactivate
#
echo -en "ip_conntrack_ftp, "
$INSMOD ip_conntrack_ftp

#Load the IRC tracking mechanism for full IRC tracking
#
# Enabled by default -- insert a "#" on the next line to deactivate
#
echo -en "ip_contrack_irc, "
$INSMOD ip_conntrack_irc

#Load the gernal IPTABLES NAT ccode - "iptable_nat"
# - 	Loaded automatically when MASQ functionality is turned on
#
#  - Loaded manually to clean up kernel auto-loading timing issures
#
echo -en "iptable_nat, "
$INSMOD iptable_nat

#Loads the FTP NAT functionality into the core IPTABLES code
# Required to support non -PASV FTP.
#
# Enabled by default -- insert a "#" on the next line to deactivate 
#
echo -en "ip_nat_ftp, "
$INSMOD ip_nat_ftp


#Loads the IRC NAT functionality into the core IPTABLES code
# Required to support NAT of IRC DCC requests
#
# Disabled by default -- remove the "3" on the next line to activate
#
#echo -e "ip_nat_irc, "
#$INSMOD ip_nat_irc

echo "--------------------------------------------------------------"

# Just to be complete, here is a list of the remaining kernl modules
# and their function. Please note that serveral modules should be only
# loaded by the correct master kernel module for proper operation.
# -----------------------------------------------------------------
#
#   ipt_mark     -   This targe marks a giver packet for futre action
#   		THis automatically loads the ipt_MARK module
#
#   ip_tcpmss	- 			


echo ". Done loading modules."

#CRITICAL:	Enable IP forwarding since it is disabled by default since
#		/etc/sysconfig/network form:
#
#	   FORWARD_IPV4=false
#		to
#	   FORWARD_IPV4=true
#
echo "   enabling forwarding.."
echo "1" > /proc/sys/net/ipv4/ip_forward

# Enable simple IP forwarding and Masquerading
#
#  Note:    In IPTABLES speak, IP Masuerading is a form of SourceNAT or SNAT.
#
#  NOTE #2:	The following is an example for an internal LAN addres in the
#		192.168.0.x network with a 255.255.255.0 or a "24" bi subnet mask
#		connecting to the Internet on external interfac "eth0". This 
#		example with MASQ internal traffice out to the Internet but not
#		allow not-initiated traffic into your interal network
#
#
#	** Please change the above network numbers, subnet madsk, and your
#       *** Internet connection interface name to match your setup


#Clearing any previous configuration
#
#  Unless specified, the defaults for INPUT and OUTPUT is ACCEPT
#	The default for FORWARD is REJECT
#
echo "   clearing any existing rules and setting default policy.."
# Commmented out for a rewrite, Lets try to get this thing ritght.
# Lets enable packet-filtering Now


# First lets us clear the tables

$IPTABLES -F INPUT
$IPTABLES -F OUTPUT
$IPTABLES -F FORWARD
$IPTABLES -t nat -F 
$IPTABLES -F block
$IPTABLES -X block
$IPTABLES -F openPort
$IPTABLES -X openPort
$IPTABLES -F reply
$IPTABLES -X reply

$IPTABLES -N openPort
$IPTABLES -A openPort -p tcp --dport 22 -j ACCEPT
$IPTABLES -A openPort -p udp --dport 22 -j ACCEPT
$IPTABLES -A openPort -s 192.168.1.2/24 -j ACCEPT
$IPTABLES -A openPort -j ACCEPT

$IPTABLES -N reply
$IPTABLES -A reply -p tcp --sport 22 -j ACCEPT
$IPTABLES -A reply -p udp --sport 22 -j ACCEPT
$IPTABLES -A reply -d 192.168.1.2/24 -j ACCEPT
$IPTABLES -A reply -j ACCEPT

$IPTABLES -N block
$IPTABLES -A block -j DROP


echo "   FWD: Allow all connection OUT and only existing and related connections IN"
$IPTABLES -A INPUT -j openPort
$IPTABLES -A OUTPUT -j reply
$IPTABLES -A INPUT -j block 
$IPTABLES -A OUTPUT -j block 

#Portforward FTP services to charlee

echo -e "\nForwarding FTP services to charlee"
$IPTABLES -t nat -A PREROUTING -d 128.x.x.x -p tcp --dport 21 -j DNAT --to 192.168.1.2
$IPTABLES -t nat -A PREROUTING -d 128.x.x.x  -p udp --dport 20 -j DNAT --to 192.168.1.2

#Portforward HTTP services to charlee
echo -e "\nForwarding HTTP services to charlee"

$IPTABLES -t nat -A PREROUTING -d 128.x.x.x -p tcp --dport 80 -j DNAT --to 192.168.1.2
$IPTABLES -t nat -A PREROUTING -d 128.x.x.x -p udp --dport 80 -j DNAT --to 192.168.1.2

#Portforward Half-life SErver to charlee
echo -e "\nSetting up ip forwarding for half-life  to charlee"

$IPTABLES -t nat -A PREROUTING -d 128.x.x.x -p tcp --dport 27015 -j DNAT --to 192.168.1.2
$IPTABLES -t nat -A PREROUTING -d 128.x.x.x -p udp --dport 27015 -j DNAT --to 192.168.1.2

#This enables the nat functionality for computers behind this one.

echo -e "\nEnabling NAT services."
$IPTABLES -t nat -A PREROUTING -i $EXTIF -p udp --sport :19 -j DNAT --to 192.168.1.2-192.168.1.255
#Not aditional natting udp port 19-22
$IPTABLES -t nat -A PREROUTING -i $EXTIF -p udp --sport 23:79 -j DNAT --to 192.168.1.2-192.168.1.255
#Port 80 already natted
$IPTABLES -t nat -A PREROUTING -i $EXTIF -p udp --sport 81:27014 -j DNAT --to 192.168.1.2-192.168.1.255
#Port 27015 already natted
$IPTABLES -t nat -A PREROUTING -i $EXTIF -p udp --sport 27016: -j DNAT --to 192.168.1.2-192.168.1.255

$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --sport :20 -j DNAT --to 192.168.1.2-192.168.1.255
#Skip 21 & 22
$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --sport 22:79 -j DNAT --to 192.168.1.2-192.168.1.255
$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --sport 81:27014 -j DNAT --to 192.168.1.2-192.168.1.255
$IPTABLES -t nat -A PREROUTING -i $EXTIF -p tcp --sport 27016: -j DNAT --to 192.168.1.2-192.168.1.255

#Only one line needed for out going packets
$IPTABLES -t nat -A POSTROUTING -s 192.168.1.0/24 -j SNAT --to 128.x.x.x


echo -e "\nrc.firewall-2.4 v$FWVER done.\n"
		

Re: Port Forwarding and opening ports.

[Joel Newkirk]

[-- Attachment #1: Type: text/plain, Size: 2509 bytes --]

On Tuesday 04 March 2003 03:56 pm, ImpulseFG@netscape.net wrote:
> I have iptables setup to port forward ftp , web, and a game server to
> another server on the local network. It works great. I have also set
> it up so it only accepts incoming and outgoing connections on port 22.
> I'm having 2 problems and a couple of questions.
>
> 1. I can ssh into the machine which is 192.168.1.1 from any computer
> on the local network. But I can't run X programs without allowing all
> incoming and outgoing connections on this machine. I've tried:
> $iptables -A INPUT -i eth1 -j ACCEPT
>             $iptables -A OUTPUT -o eth1 -j ACCEPT
>
> This wouldn't fix the problem. So I tried.
>             $iptables -A INPUT -s 192.168.1.2-192.168.1.255 -j ACCEPT
>             $iptables -A OUTPUT -d 192.168.1.2-192.68.1.255 -j ACCEPT
>
> This didn't work either. Only only accepting all incomeing and
> outgoing connections would.

Try

$iptables -A INPUT -i lo -j ACCEPT
$iptables -A OUTPUT -o lo --j ACCEPT

to let the box talk to itself...

> 2. I'm having problems with the nat features.
>     I want to be able to ssh into the routing machine from of the
> local network but I can't. I have it set to accept local connections
> on port 22 for udp and tcp. But nat is nating the packets before it
> can accept them.
>     The only way I am able to get them to accept them is to disable
> nat. I tried natting all the ports around 22. See the attache script
> but for some reason that wouln't work either.
>
> Does anyone have any idea how to do this?

In your script you have lots of rules with "-j DNAT --to 
192.168.1.2-192.168.1.255" - do you really want to spread all this 
traffic out across all these addresses?  This construction will take any 
connection coming in on a matching port and send it to the first address 
in that list that doesn't currently have traffic, or the one with the 
lowest traffic.

My impression of what you want is that you want to DNAT a handful of 
specific connections to specific destinations, and then allow return 
traffic from the internet to reach the proper client, am I right?  I've 
attached your original script trimmed to the essentials and then 
commented by myself, and also attached a proposed replacement script 
that will allow the local machines to connect out, and outside 
connections only to SSH on the gateway or the three DNATs to "charlee".  
If I'm way off-base on your intentions here I apologize.

j

[-- Attachment #2: ImpulseFG.rc.firewall-2.4.mailing --]
[-- Type: application/x-shellscript, Size: 3262 bytes --]

[-- Attachment #3: ImpulseFG.revised --]
[-- Type: application/x-shellscript, Size: 1362 bytes --]

RE: Port Forwarding and opening ports.

[Eugene Joubert]

[-- Attachment #1: Type: text/plain, Size: 3590 bytes --]

On point 1 do the following rule.

 iptables -A INPUT -i local -j ACCEPT
 iptables -A OUTPUT -i local -j ACCEPT

The second rule only applies if you have your OUTPUT policy set to default
DROP.

On point 2 do the following.

I assume you want to ssh into the linux system itself. This would not need
to be natted and you say if you disable nat it works, why then still persue
natting? Any connection destined for the linux system would be "guarded" by
your input chain, as any natting is only used for connections not destined
for the local system i.e packets going through the linux box.

On point 3. 

Are you looking to ssh again. Look at your rule. Remember when making a
network TCP connection your packet contains a source and destination port.
Your source port is assigned by your operating system. It will use whatever
is not being used at that time. Your destination is the important thing to
look at. Your rule in point three refers to a source port. So if I
understand your question correctly you can simply making your --sport to
--dport in other words specify the destination port and not the source port.

I am by no means a guru but understand main principals pretty good.

Hope this helps 




-----Original Message-----
From: ImpulseFG@netscape.net [mailto:ImpulseFG@netscape.net
<mailto:ImpulseFG@netscape.net> ] 
Sent: 04 03 2003 22:56 PM
To: netfilter@lists.netfilter.org
Subject: Port Forwarding and opening ports.


I have iptables setup to port forward ftp , web, and a game server to
another server on the local network. It works great. I have also set it up
so it only accepts incoming and outgoing connections on port 22. I'm having
2 problems and a couple of questions.

1. I can ssh into the machine which is 192.168.1.1 from any computer on the
local network. But I can't run X programs without allowing all incoming and
outgoing connections on this machine. I've tried: $iptables -A INPUT -i eth1
-j ACCEPT
            $iptables -A OUTPUT -o eth1 -j ACCEPT

This wouldn't fix the problem. So I tried.
            $iptables -A INPUT -s 192.168.1.2-192.168.1.255 -j ACCEPT
            $iptables -A OUTPUT -d 192.168.1.2-192.68.1.255 -j ACCEPT

This didn't work either. Only only accepting all incomeing and outgoing
connections would.

2. I'm having problems with the nat features.
    I want to be able to ssh into the routing machine from of the local
network but I can't. I have it set to accept local connections on port 22
for udp and tcp. 
    But nat is nating the packets before it can accept them.
    The only way I am able to get them to accept them is to disable nat.
    I tried natting all the ports around 22. See the attache script but for
some reason that wouln't work either.

Does anyone have any idea how to do this?


3. Does anyone know why? iptables -A mytable -p all --sport 22 -j ACCEPT
won't work? It seems that the all keywork doesn't work at all.

I am using iptables v.1.2.5 with RH7.3 most updated kernel.

Sorry for the lenght of this post I'm just looking for some solutions.
Thanks for any help. I changed my IP in the firewall script. to 128.x.x.x
hope this doesn't confuse anyone.

                                    -Impulse



__________________________________________________________________
The NEW Netscape 7.0 browser is now available. Upgrade now!
http://channels.netscape.com/ns/browsers/download.jsp
<http://channels.netscape.com/ns/browsers/download.jsp>  

Get your own FREE, personal Netscape Mail account today at
http://webmail.netscape.com/ <http://webmail.netscape.com/>  << File:
rc.firewall-2.4.mailing >> 

[-- Attachment #2: Type: text/html, Size: 6154 bytes --]