* whats wrong???
@ 2005-06-28 16:40 Juan Manuel Tato
2005-06-28 17:32 ` Vlad Janicek
2005-06-30 10:43 ` Jan Engelhardt
0 siblings, 2 replies; 5+ messages in thread
From: Juan Manuel Tato @ 2005-06-28 16:40 UTC (permalink / raw)
To: netfilter
hi, i'm configuring a firewall, and i need some port forwarding
to ip 192.168.100.1 from my public ip.
but isn't working....
where come the output of the chains
fw-new:~# iptables -L -n
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
ACCEPT all -- 192.168.100.1 0.0.0.0/0
ACCEPT all -- 192.168.100.2 0.0.0.0/0
ACCEPT all -- 192.168.100.3 0.0.0.0/0
ACCEPT all -- 192.168.100.4 0.0.0.0/0
ACCEPT all -- 192.168.100.5 0.0.0.0/0
ACCEPT all -- 192.168.100.6 0.0.0.0/0
ACCEPT all -- 192.168.100.7 0.0.0.0/0
ACCEPT all -- 192.168.100.8 0.0.0.0/0
ACCEPT all -- 192.168.100.9 0.0.0.0/0
badflags tcp -- 0.0.0.0/0 0.0.0.0/0 tcp
flags:0x3F/0x29
badflags tcp -- 0.0.0.0/0 0.0.0.0/0 tcp
flags:0x3F/0x3F
badflags tcp -- 0.0.0.0/0 0.0.0.0/0 tcp
flags:0x3F/0x37
badflags tcp -- 0.0.0.0/0 0.0.0.0/0 tcp
flags:0x3F/0x00
badflags tcp -- 0.0.0.0/0 0.0.0.0/0 tcp
flags:0x06/0x06
badflags tcp -- 0.0.0.0/0 0.0.0.0/0 tcp
flags:0x03/0x03
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 0
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 3
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 11
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8
limit: avg 1/sec burst 5
firewall icmp -- 0.0.0.0/0 0.0.0.0/0
ACCEPT tcp -- 192.168.100.0/24 0.0.0.0/0 tcp dpt:22
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:80
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:25
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:25
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:110
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:110
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:143
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:143
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:53
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:53
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state
RELATED,ESTABLISHED
silent udp -- 0.0.0.0/0 0.0.0.0/0 udp spt:137
dpt:137
dropwall all -- 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy ACCEPT)
target prot opt source destination
DROP all -- 0.0.0.0/0 0.0.0.0/0 state
INVALID,NEW
ACCEPT tcp -- 0.0.0.0/0 192.168.100.1 tcp dpt:80
ACCEPT udp -- 0.0.0.0/0 192.168.100.1 udp dpt:80
ACCEPT tcp -- 0.0.0.0/0 192.168.100.1 tcp dpt:25
ACCEPT udp -- 0.0.0.0/0 192.168.100.1 udp dpt:25
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain badflags (6 references)
target prot opt source destination
LOG all -- 0.0.0.0/0 0.0.0.0/0 limit: avg
15/min burst 5 LOG flags 0 level 4 prefix `Badflags:'
DROP all -- 0.0.0.0/0 0.0.0.0/0
Chain dropwall (1 references)
target prot opt source destination
LOG all -- 0.0.0.0/0 0.0.0.0/0 limit: avg
15/min burst 5 LOG flags 0 level 4 prefix `Dropwall:'
DROP all -- 0.0.0.0/0 0.0.0.0/0
Chain firewall (1 references)
target prot opt source destination
LOG all -- 0.0.0.0/0 0.0.0.0/0 limit: avg
15/min burst 5 LOG flags 0 level 4 prefix `Firewall:'
DROP all -- 0.0.0.0/0 0.0.0.0/0
Chain silent (1 references)
target prot opt source destination
DROP all -- 0.0.0.0/0 0.0.0.0/0
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: whats wrong???
2005-06-28 16:40 whats wrong??? Juan Manuel Tato
@ 2005-06-28 17:32 ` Vlad Janicek
2005-06-28 18:04 ` Juan Manuel Tato
2005-06-30 10:43 ` Jan Engelhardt
1 sibling, 1 reply; 5+ messages in thread
From: Vlad Janicek @ 2005-06-28 17:32 UTC (permalink / raw)
To: netfilter
which IP address are you using? could you paste the script you use and your
nic configurations??
2005/6/28, Juan Manuel Tato <madness@adinet.com.uy>:
>
> hi, i'm configuring a firewall, and i need some port forwarding
> to ip 192.168.100.1 <http://192.168.100.1> from my public ip.
> but isn't working....
> where come the output of the chains
>
> fw-new:~# iptables -L -n
> Chain INPUT (policy ACCEPT)
> target prot opt source destination
> ACCEPT all -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>
> ACCEPT all -- 192.168.100.1 <http://192.168.100.1> 0.0.0.0/0<http://0.0.0.0/0>
> ACCEPT all -- 192.168.100.2 <http://192.168.100.2> 0.0.0.0/0<http://0.0.0.0/0>
> ACCEPT all -- 192.168.100.3 <http://192.168.100.3> 0.0.0.0/0<http://0.0.0.0/0>
> ACCEPT all -- 192.168.100.4 <http://192.168.100.4> 0.0.0.0/0<http://0.0.0.0/0>
> ACCEPT all -- 192.168.100.5 <http://192.168.100.5> 0.0.0.0/0<http://0.0.0.0/0>
> ACCEPT all -- 192.168.100.6 <http://192.168.100.6> 0.0.0.0/0<http://0.0.0.0/0>
> ACCEPT all -- 192.168.100.7 <http://192.168.100.7> 0.0.0.0/0<http://0.0.0.0/0>
> ACCEPT all -- 192.168.100.8 <http://192.168.100.8> 0.0.0.0/0<http://0.0.0.0/0>
> ACCEPT all -- 192.168.100.9 <http://192.168.100.9> 0.0.0.0/0<http://0.0.0.0/0>
>
> badflags tcp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>tcp
> flags:0x3F/0x29
> badflags tcp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>tcp
> flags:0x3F/0x3F
> badflags tcp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>tcp
> flags:0x3F/0x37
> badflags tcp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>tcp
> flags:0x3F/0x00
> badflags tcp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>tcp
> flags:0x06/0x06
> badflags tcp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>tcp
> flags:0x03/0x03
> ACCEPT icmp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>icmp type 0
> ACCEPT icmp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>icmp type 3
> ACCEPT icmp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>icmp type 11
> ACCEPT icmp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>icmp type 8
> limit: avg 1/sec burst 5
> firewall icmp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>
> ACCEPT tcp -- 192.168.100.0/24 <http://192.168.100.0/24> 0.0.0.0/0<http://0.0.0.0/0>tcp dpt:22
> ACCEPT tcp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>tcp dpt:80
> ACCEPT udp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>udp dpt:80
> ACCEPT tcp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>tcp dpt:25
> ACCEPT udp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>udp dpt:25
> ACCEPT tcp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>tcp dpt:110
> ACCEPT udp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>udp dpt:110
> ACCEPT tcp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>tcp dpt:143
> ACCEPT udp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>udp dpt:143
> ACCEPT tcp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>tcp dpt:53
> ACCEPT udp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>udp dpt:53
> ACCEPT all -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>state
> RELATED,ESTABLISHED
> silent udp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>udp spt:137
> dpt:137
> dropwall all -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>
>
> Chain FORWARD (policy ACCEPT)
> target prot opt source destination
> DROP all -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>state
> INVALID,NEW
> ACCEPT tcp -- 0.0.0.0/0 <http://0.0.0.0/0> 192.168.100.1<http://192.168.100.1>tcp dpt:80
> ACCEPT udp -- 0.0.0.0/0 <http://0.0.0.0/0> 192.168.100.1<http://192.168.100.1>udp dpt:80
> ACCEPT tcp -- 0.0.0.0/0 <http://0.0.0.0/0> 192.168.100.1<http://192.168.100.1>tcp dpt:25
> ACCEPT udp -- 0.0.0.0/0 <http://0.0.0.0/0> 192.168.100.1<http://192.168.100.1>udp dpt:25
>
> Chain OUTPUT (policy ACCEPT)
> target prot opt source destination
>
> Chain badflags (6 references)
> target prot opt source destination
> LOG all -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>limit: avg
> 15/min burst 5 LOG flags 0 level 4 prefix `Badflags:'
> DROP all -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>
>
> Chain dropwall (1 references)
> target prot opt source destination
> LOG all -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>limit: avg
> 15/min burst 5 LOG flags 0 level 4 prefix `Dropwall:'
> DROP all -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>
>
> Chain firewall (1 references)
> target prot opt source destination
> LOG all -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>limit: avg
> 15/min burst 5 LOG flags 0 level 4 prefix `Firewall:'
> DROP all -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>
>
> Chain silent (1 references)
> target prot opt source destination
> DROP all -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>
>
>
--
Vlad
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: whats wrong???
2005-06-28 17:32 ` Vlad Janicek
@ 2005-06-28 18:04 ` Juan Manuel Tato
2005-06-29 1:09 ` Vlad Janicek
0 siblings, 1 reply; 5+ messages in thread
From: Juan Manuel Tato @ 2005-06-28 18:04 UTC (permalink / raw)
To: Vlad Janicek, netfilter
Here goes de ifconfig output:
fw-new:~# ifconfig
eth0 Link encap:Ethernet HWaddr 00:E0:7D:AD:B4:FF
inet addr:192.168.100.9 Bcast:192.168.100.255
Mask:255.255.255.0
inet6 addr: fe80::2e0:7dff:fead:b4ff/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:636262 errors:0 dropped:0 overruns:0 frame:0
TX packets:265447 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:187859208 (179.1 MiB) TX bytes:106784159 (101.8 MiB)
Interrupt:3 Base address:0xde00
eth1 Link encap:Ethernet HWaddr 00:D0:09:25:21:DC
inet addr:pub.blic.ip.addr Bcast:200.40.86.255
Mask:255.255.255.252
inet6 addr: fe80::2d0:9ff:fe25:21dc/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:305065 errors:0 dropped:0 overruns:0 frame:0
TX packets:511416 errors:0 dropped:0 overruns:0 carrier:0
collisions:296 txqueuelen:1000
RX bytes:108708592 (103.6 MiB) TX bytes:128511858 (122.5 MiB)
Interrupt:12 Base address:0xd800
Here goes the script:
#!/bin/sh
IPT="/sbin/iptables"
INT="eth1"
#
# flushhhhh
#
$IPT -F
$IPT -F INPUT
$IPT -F OUTPUT
$IPT -F FORWARD
$IPT -F -t mangle
$IPT -F -t nat
$IPT -X
#
# Policies.
#
$IPT -P INPUT ACCEPT
$IPT -P OUTPUT ACCEPT
$IPT -P FORWARD ACCEPT
echo 1 > /proc/sys/net/ipv4/ip_forward
$IPT -t nat -A POSTROUTING -o $INT -j SNAT --to pub.lic.ip.addr
# This rule protects your fowarding rule.
$IPT -A FORWARD -i $INT -m state --state NEW,INVALID -j DROP
# defino la ip de mi servidor interno
SRV="192.168.100.1"
$IPT -t nat -A PREROUTING -i $INT -p tcp --dport 25 -j DNAT --to
192.168.100.1:25
$IPT -t nat -A PREROUTING -i $INT -p tcp --dport 53 -j DNAT --to $SRV
$IPT -t nat -A PREROUTING -i $INT -p udp --dport 53 -j DNAT --to $SRV
$IPT -t nat -A PREROUTING -i $INT -p tcp --dport 110 -j DNAT --to $SRV
$IPT -t nat -A PREROUTING -i $INT -p udp --dport 110 -j DNAT --to $SRV
$IPT -t nat -A PREROUTING -i $INT -p tcp --dport 80 -j DNAT --to
192.168.100.1:80
$IPT -t nat -A PREROUTING -i $INT -p udp --dport 80 -j DNAT --to
192.168.100.1:80
$IPT -t nat -A PREROUTING -i $INT -p tcp --dport 143 -j DNAT --to $SRV
$IPT -t nat -A PREROUTING -i $INT -p udp --dport 143 -j DNAT --to $SRV
# Now, our firewall chain. We use the limit commands to
# cap the rate at which it alerts to 15 log messages per minute.
$IPT -N firewall
$IPT -A firewall -m limit --limit 15/minute -j LOG --log-prefix Firewall:
$IPT -A firewall -j DROP
# Now, our dropwall chain, for the final catchall filter.
$IPT -N dropwall
$IPT -A dropwall -m limit --limit 15/minute -j LOG --log-prefix Dropwall:
$IPT -A dropwall -j DROP
# Our "hey, them's some bad tcp flags!" chain.
$IPT -N badflags
$IPT -A badflags -m limit --limit 15/minute -j LOG --log-prefix Badflags:
$IPT -A badflags -j DROP
# And our silent logging chain.
$IPT -N silent
$IPT -A silent -j DROP
# This rule will accept connections from local machines. If you have
# a home network, enter in the IP's of the machines on the
# network below.
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A INPUT -s 192.168.100.1 -d 0/0 -p all -j ACCEPT
$IPT -A INPUT -s 192.168.100.2 -d 0/0 -p all -j ACCEPT
$IPT -A INPUT -s 192.168.100.3 -d 0/0 -p all -j ACCEPT
$IPT -A INPUT -s 192.168.100.4 -d 0/0 -p all -j ACCEPT
$IPT -A INPUT -s 192.168.100.5 -d 0/0 -p all -j ACCEPT
$IPT -A INPUT -s 192.168.100.6 -d 0/0 -p all -j ACCEPT
$IPT -A INPUT -s 192.168.100.7 -d 0/0 -p all -j ACCEPT
$IPT -A INPUT -s 192.168.100.8 -d 0/0 -p all -j ACCEPT
$IPT -A INPUT -s 192.168.100.9 -d 0/0 -p all -j ACCEPT
# Drop those nasty packets! These are all TCP flag
# combinations that should never, ever occur in the
# wild. All of these are illegal combinations that
# are used to attack a box in various ways, so we
# just drop them and log them here.
$IPT -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j badflags
$IPT -A INPUT -p tcp --tcp-flags ALL ALL -j badflags
$IPT -A INPUT -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j badflags
$IPT -A INPUT -p tcp --tcp-flags ALL NONE -j badflags
$IPT -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j badflags
$IPT -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j badflags
# Drop icmp, but only after letting certain types through.
$IPT -A INPUT -p icmp --icmp-type 0 -j ACCEPT
$IPT -A INPUT -p icmp --icmp-type 3 -j ACCEPT
$IPT -A INPUT -p icmp --icmp-type 11 -j ACCEPT
$IPT -A INPUT -p icmp --icmp-type 8 -m limit --limit 1/second -j ACCEPT
$IPT -A INPUT -p icmp -j firewall
# If you would like to open up port 22 (SSH Access) to various IP's
# simply edit the IP's below and uncomment the line. If youw wish to
# enable SSH access from anywhere, uncomment the second line only.
#$IPT -A INPUT -i $INT -s 10.1.1.1 -d 0/0 -p tcp --dport 22 -j ACCEPT
$IPT -A INPUT -i $INT -s 192.168.100.0/24 -d 0/0 -p tcp --dport 22 -j ACCEPT
# If you are running a Web Server, uncomment the next line to open
# up port 80 on your machine.
$IPT -A INPUT -i $INT -s 0/0 -d 0/0 -p tcp --dport 80 -j ACCEPT
$IPT -A INPUT -i $INT -s 0/0 -d 0/0 -p udp --dport 80 -j ACCEPT
$IPT -A INPUT -i $INT -s 0/0 -d 0/0 -p tcp --dport 25 -j ACCEPT
$IPT -A INPUT -i $INT -s 0/0 -d 0/0 -p udp --dport 25 -j ACCEPT
$IPT -A INPUT -i $INT -s 0/0 -d 0/0 -p tcp --dport 110 -j ACCEPT
$IPT -A INPUT -i $INT -s 0/0 -d 0/0 -p udp --dport 110 -j ACCEPT
$IPT -A INPUT -i $INT -s 0/0 -d 0/0 -p tcp --dport 143 -j ACCEPT
$IPT -A INPUT -i $INT -s 0/0 -d 0/0 -p udp --dport 143 -j ACCEPT
$IPT -A INPUT -i $INT -s 0/0 -d 0/0 -p tcp --dport 53 -j ACCEPT
$IPT -A INPUT -i $INT -s 0/0 -d 0/0 -p udp --dport 53 -j ACCEPT
# Lets do some basic state-matching. This allows us
# to accept related and established connections, so
# client-side things like ftp work properly, for example.
$IPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# Uncomment to drop port 137 netbios packets silently.
# We don't like that netbios stuff, and it's way too
# spammy with windows machines on the network.
$IPT -A INPUT -p udp --sport 137 --dport 137 -j silent
# Our final trap. Everything on INPUT goes to the dropwall
# so we don't get silent drops.
$IPT -A INPUT -j dropwall
Vlad Janicek wrote:
> which IP address are you using? could you paste the script you use and your
> nic configurations??
>
> 2005/6/28, Juan Manuel Tato <madness@adinet.com.uy>:
>
>>hi, i'm configuring a firewall, and i need some port forwarding
>>to ip 192.168.100.1 <http://192.168.100.1> from my public ip.
>>but isn't working....
>>where come the output of the chains
>>
>>fw-new:~# iptables -L -n
>>Chain INPUT (policy ACCEPT)
>>target prot opt source destination
>>ACCEPT all -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>
>>ACCEPT all -- 192.168.100.1 <http://192.168.100.1> 0.0.0.0/0<http://0.0.0.0/0>
>>ACCEPT all -- 192.168.100.2 <http://192.168.100.2> 0.0.0.0/0<http://0.0.0.0/0>
>>ACCEPT all -- 192.168.100.3 <http://192.168.100.3> 0.0.0.0/0<http://0.0.0.0/0>
>>ACCEPT all -- 192.168.100.4 <http://192.168.100.4> 0.0.0.0/0<http://0.0.0.0/0>
>>ACCEPT all -- 192.168.100.5 <http://192.168.100.5> 0.0.0.0/0<http://0.0.0.0/0>
>>ACCEPT all -- 192.168.100.6 <http://192.168.100.6> 0.0.0.0/0<http://0.0.0.0/0>
>>ACCEPT all -- 192.168.100.7 <http://192.168.100.7> 0.0.0.0/0<http://0.0.0.0/0>
>>ACCEPT all -- 192.168.100.8 <http://192.168.100.8> 0.0.0.0/0<http://0.0.0.0/0>
>>ACCEPT all -- 192.168.100.9 <http://192.168.100.9> 0.0.0.0/0<http://0.0.0.0/0>
>>
>>badflags tcp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>tcp
>>flags:0x3F/0x29
>>badflags tcp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>tcp
>>flags:0x3F/0x3F
>>badflags tcp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>tcp
>>flags:0x3F/0x37
>>badflags tcp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>tcp
>>flags:0x3F/0x00
>>badflags tcp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>tcp
>>flags:0x06/0x06
>>badflags tcp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>tcp
>>flags:0x03/0x03
>>ACCEPT icmp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>icmp type 0
>>ACCEPT icmp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>icmp type 3
>>ACCEPT icmp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>icmp type 11
>>ACCEPT icmp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>icmp type 8
>>limit: avg 1/sec burst 5
>>firewall icmp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>
>>ACCEPT tcp -- 192.168.100.0/24 <http://192.168.100.0/24> 0.0.0.0/0<http://0.0.0.0/0>tcp dpt:22
>>ACCEPT tcp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>tcp dpt:80
>>ACCEPT udp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>udp dpt:80
>>ACCEPT tcp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>tcp dpt:25
>>ACCEPT udp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>udp dpt:25
>>ACCEPT tcp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>tcp dpt:110
>>ACCEPT udp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>udp dpt:110
>>ACCEPT tcp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>tcp dpt:143
>>ACCEPT udp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>udp dpt:143
>>ACCEPT tcp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>tcp dpt:53
>>ACCEPT udp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>udp dpt:53
>>ACCEPT all -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>state
>>RELATED,ESTABLISHED
>>silent udp -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>udp spt:137
>>dpt:137
>>dropwall all -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>
>>
>>Chain FORWARD (policy ACCEPT)
>>target prot opt source destination
>>DROP all -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>state
>>INVALID,NEW
>>ACCEPT tcp -- 0.0.0.0/0 <http://0.0.0.0/0> 192.168.100.1<http://192.168.100.1>tcp dpt:80
>>ACCEPT udp -- 0.0.0.0/0 <http://0.0.0.0/0> 192.168.100.1<http://192.168.100.1>udp dpt:80
>>ACCEPT tcp -- 0.0.0.0/0 <http://0.0.0.0/0> 192.168.100.1<http://192.168.100.1>tcp dpt:25
>>ACCEPT udp -- 0.0.0.0/0 <http://0.0.0.0/0> 192.168.100.1<http://192.168.100.1>udp dpt:25
>>
>>Chain OUTPUT (policy ACCEPT)
>>target prot opt source destination
>>
>>Chain badflags (6 references)
>>target prot opt source destination
>>LOG all -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>limit: avg
>>15/min burst 5 LOG flags 0 level 4 prefix `Badflags:'
>>DROP all -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>
>>
>>Chain dropwall (1 references)
>>target prot opt source destination
>>LOG all -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>limit: avg
>>15/min burst 5 LOG flags 0 level 4 prefix `Dropwall:'
>>DROP all -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>
>>
>>Chain firewall (1 references)
>>target prot opt source destination
>>LOG all -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>limit: avg
>>15/min burst 5 LOG flags 0 level 4 prefix `Firewall:'
>>DROP all -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>
>>
>>Chain silent (1 references)
>>target prot opt source destination
>>DROP all -- 0.0.0.0/0 <http://0.0.0.0/0> 0.0.0.0/0 <http://0.0.0.0/0>
>>
>>
>
>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: whats wrong???
2005-06-28 18:04 ` Juan Manuel Tato
@ 2005-06-29 1:09 ` Vlad Janicek
0 siblings, 0 replies; 5+ messages in thread
From: Vlad Janicek @ 2005-06-29 1:09 UTC (permalink / raw)
To: netfilter
2005/6/28, Juan Manuel Tato <madness@adinet.com.uy>:
>
> # Policies.
> #
> $IPT -P INPUT ACCEPT
> $IPT -P OUTPUT ACCEPT
> $IPT -P FORWARD ACCEPT
You usually drop everything first, then you open each port and service one
by one
Normalmente cierras todo primero, despues es que abres cada puerto y
servicio
echo 1 > /proc/sys/net/ipv4/ip_forward
>
> $IPT -t nat -A POSTROUTING -o $INT -j SNAT --to pub.lic.ip.addr
>
> # This rule protects your fowarding rule.
> $IPT -A FORWARD -i $INT -m state --state NEW,INVALID -j DROP
remove this for testing
quita esto para probar
# defino la ip de mi servidor interno
> SRV=" 192.168.100.1 <http://192.168.100.1/>"
>
> $IPT -t nat -A PREROUTING -i $INT -p tcp --dport 25 -j DNAT --to
> 192.168.100.1:25 <http://192.168.100.1:25/>
> $IPT -t nat -A PREROUTING -i $INT -p tcp --dport 53 -j DNAT --to $SRV
> $IPT -t nat -A PREROUTING -i $INT -p udp --dport 53 -j DNAT --to $SRV
> $IPT -t nat -A PREROUTING -i $INT -p tcp --dport 110 -j DNAT --to $SRV
> $IPT -t nat -A PREROUTING -i $INT -p udp --dport 110 -j DNAT --to $SRV
> $IPT -t nat -A PREROUTING -i $INT -p tcp --dport 80 -j DNAT --to
> 192.168.100.1:80 <http://192.168.100.1/>
> $IPT -t nat -A PREROUTING -i $INT -p udp --dport 80 -j DNAT --to
> 192.168.100.1:80 <http://192.168.100.1/>
> $IPT -t nat -A PREROUTING -i $INT -p tcp --dport 143 -j DNAT --to $SRV
> $IPT -t nat -A PREROUTING -i $INT -p udp --dport 143 -j DNAT --to $SRV
what if you tried something like this for external packets looking for a
system inside:
que si intentas algo como esto para el ruteo interno de paquetes externos:
iptables -A FORWARD -d your_lans_server_ip -p tcp --dport 110 -j ACCEPT
iptables -t nat -A PREROUTING -d your_external_nic -p tcp --dport 110 \
-j DNAT --to-destination your_lans_server_ip:110
--
Vlad
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: whats wrong???
2005-06-28 16:40 whats wrong??? Juan Manuel Tato
2005-06-28 17:32 ` Vlad Janicek
@ 2005-06-30 10:43 ` Jan Engelhardt
1 sibling, 0 replies; 5+ messages in thread
From: Jan Engelhardt @ 2005-06-30 10:43 UTC (permalink / raw)
To: Juan Manuel Tato; +Cc: netfilter
> where come the output of the chains
>
> fw-new:~# iptables -L -n
> Chain INPUT (policy ACCEPT)
> target prot opt source destination
> ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
> ACCEPT all -- 192.168.100.1 0.0.0.0/0
> ACCEPT all -- 192.168.100.2 0.0.0.0/0
> ACCEPT all -- 192.168.100.3 0.0.0.0/0
> ACCEPT all -- 192.168.100.4 0.0.0.0/0
> ACCEPT all -- 192.168.100.5 0.0.0.0/0
> ACCEPT all -- 192.168.100.6 0.0.0.0/0
> ACCEPT all -- 192.168.100.7 0.0.0.0/0
> ACCEPT all -- 192.168.100.8 0.0.0.0/0
> ACCEPT all -- 192.168.100.9 0.0.0.0/0
Uh you could merge those.
> ACCEPT tcp -- 192.168.100.0/24 0.0.0.0/0 tcp dpt:22
> ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
> ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:80
> ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:25
> ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:25
> ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:110
> ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:110
> ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:143
> ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:143
> ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:53
> ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:53
You can also merge this using -m dport
Jan Engelhardt
--
| Gesellschaft fuer Wissenschaftliche Datenverarbeitung Goettingen,
| Am Fassberg, 37077 Goettingen, www.gwdg.de
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2005-06-30 10:43 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2005-06-28 16:40 whats wrong??? Juan Manuel Tato
2005-06-28 17:32 ` Vlad Janicek
2005-06-28 18:04 ` Juan Manuel Tato
2005-06-29 1:09 ` Vlad Janicek
2005-06-30 10:43 ` Jan Engelhardt
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox