Help!

Help!

[btjiang]

Hello,
     I do not understand some things about netfilter.There are two hash table in NAT(bysource and byipsproto).What are they used for?It's just for fast check? Please help me!
                                 Lucky!
                                              
charlie

Help!

[Stephan Higuti]

Hello guys....
I have a question about PREROUTING and POSTROUTING.
I'm making a new firewall script.....
In this script, i put some PREROUTING rules , ex:

####################### Apache ##########################
iptables -t nat -A PREROUTING -d 200.xxx.yyy.zzz -p tcp --dport 80 -j
DNAT --to-destination 192.168.23.7:80

But i need to put some POSTROUTING rules to this?
My situation: My firewall will reply for 4 differents Ip's (reals) ,
one for apache , other for e-mail server, etc............
This PREROUTING rule get a pack that come from internet to a IP "x" ,
and i want that all that incoming to this ip , to be forward to my
internal ip.
So , i think that PREROUTING rules its right... but i dont if i need
to create a POSTROUTING for this.....
Waiting Help....

p.s.:* Sorry for my bad, bad english   =D

Cheers

-- 
---------------------------------------------------------------------
Stephan Higuti
MSN: higutisam@hotmail.com
Email: higuti@fai.com.br
---------------------------------------------------------------------

Re: Help!

[Stephan Higuti]

thank'z Manish!

But i dont understant what you mean here:

> In ur scenario u will require only PREROUTING rule, but if want to
> access internet behind ur friewall, then need the POSTROUTING rule
> also. Choice is URs.

If i want that my servers access internet?

On 6/1/06, manish Jamwal <manish.jamwal@gmail.com> wrote:
> Hi
> When the server's r behind the firewall, u only need PREROUTING rule
> with target as DNAT.
> The POSTROUTING rule is required when ur traffic will be outwards,
> means u access the server's which are on ur WAN side.
> In ur scenario u will require only PREROUTING rule, but if want to
> access internet behind ur friewall, then need the POSTROUTING rule
> also. Choice is URs.
> This information is as per my knowledge. :)
> Manish
>
> On 6/1/06, Stephan Higuti <higuti.sam@gmail.com> wrote:
> > Hello guys....
> > I have a question about PREROUTING and POSTROUTING.
> > I'm making a new firewall script.....
> > In this script, i put some PREROUTING rules , ex:
> >
> > ####################### Apache ##########################
> > iptables -t nat -A PREROUTING -d 200.xxx.yyy.zzz -p tcp --dport 80 -j
> > DNAT --to-destination 192.168.23.7:80
> >
> > But i need to put some POSTROUTING rules to this?
> > My situation: My firewall will reply for 4 differents Ip's (reals) ,
> > one for apache , other for e-mail server, etc............
> > This PREROUTING rule get a pack that come from internet to a IP "x" ,
> > and i want that all that incoming to this ip , to be forward to my
> > internal ip.
> > So , i think that PREROUTING rules its right... but i dont if i need
> > to create a POSTROUTING for this.....
> > Waiting Help....
> >
> > p.s.:* Sorry for my bad, bad english   =D
> >
> > Cheers
> >
> > --
> > ---------------------------------------------------------------------
> > Stephan Higuti
> > MSN: higutisam@hotmail.com
> > Email: higuti@fai.com.br
> > ---------------------------------------------------------------------
> >
> >
>


-- 
---------------------------------------------------------------------
Stephan Higuti
MSN: higutisam@hotmail.com
Email: higuti@fai.com.br

Técnico em Informática
Adm servidores Linux
FAI - Faculdades Adamantinenses Integradas
---------------------------------------------------------------------

RE: Help!

[Sietse van Zanen]

You are doing it exactly as it should be done.
 
DNAT rules go to PREROUTING CHAIN (as you first want to set the new destination and the do routing)
SNAT rules go to POSTROUTING (usually, as it wouldn't really matter where they go, unless you do source routing).
 
Ofcourse you will need to ACCEPT the connections in your filter table too.
 
-Sietse

________________________________

From: netfilter-bounces@lists.netfilter.org on behalf of Stephan Higuti
Sent: Thu 01-Jun-06 13:53
To: netfilter@lists.netfilter.org
Subject: Help!



Hello guys....
I have a question about PREROUTING and POSTROUTING.
I'm making a new firewall script.....
In this script, i put some PREROUTING rules , ex:

####################### Apache ##########################
iptables -t nat -A PREROUTING -d 200.xxx.yyy.zzz -p tcp --dport 80 -j
DNAT --to-destination 192.168.23.7:80

But i need to put some POSTROUTING rules to this?
My situation: My firewall will reply for 4 differents Ip's (reals) ,
one for apache , other for e-mail server, etc............
This PREROUTING rule get a pack that come from internet to a IP "x" ,
and i want that all that incoming to this ip , to be forward to my
internal ip.
So , i think that PREROUTING rules its right... but i dont if i need
to create a POSTROUTING for this.....
Waiting Help....

p.s.:* Sorry for my bad, bad english   =D

Cheers

--
---------------------------------------------------------------------
Stephan Higuti
MSN: higutisam@hotmail.com
Email: higuti@fai.com.br
---------------------------------------------------------------------

Re: Help!

[Stephan Higuti]

thankz for help guys!
So , its right my rule?
Anyway... look this image:
http://img180.imageshack.us/my.php?image=firewallsemip2ok.jpg

My eth0 reply for 4 reals ip's...
And forward the packs to my servers......... so , PREROUTING its the
right way to do this?

Thank's a lot!

On 6/1/06, Sietse van Zanen <sietse@wizdom.nu> wrote:
> You are doing it exactly as it should be done.
>
> DNAT rules go to PREROUTING CHAIN (as you first want to set the new destination and the do routing)
> SNAT rules go to POSTROUTING (usually, as it wouldn't really matter where they go, unless you do source routing).
>
> Ofcourse you will need to ACCEPT the connections in your filter table too.
>
> -Sietse
>
> ________________________________
>
> From: netfilter-bounces@lists.netfilter.org on behalf of Stephan Higuti
> Sent: Thu 01-Jun-06 13:53
> To: netfilter@lists.netfilter.org
> Subject: Help!
>
>
>
> Hello guys....
> I have a question about PREROUTING and POSTROUTING.
> I'm making a new firewall script.....
> In this script, i put some PREROUTING rules , ex:
>
> ####################### Apache ##########################
> iptables -t nat -A PREROUTING -d 200.xxx.yyy.zzz -p tcp --dport 80 -j
> DNAT --to-destination 192.168.23.7:80
>
> But i need to put some POSTROUTING rules to this?
> My situation: My firewall will reply for 4 differents Ip's (reals) ,
> one for apache , other for e-mail server, etc............
> This PREROUTING rule get a pack that come from internet to a IP "x" ,
> and i want that all that incoming to this ip , to be forward to my
> internal ip.
> So , i think that PREROUTING rules its right... but i dont if i need
> to create a POSTROUTING for this.....
> Waiting Help....
>
> p.s.:* Sorry for my bad, bad english   =D
>
> Cheers
>
> --
> ---------------------------------------------------------------------
> Stephan Higuti
> MSN: higutisam@hotmail.com
> Email: higuti@fai.com.br
> ---------------------------------------------------------------------
>
>
>
>


-- 
---------------------------------------------------------------------
Stephan Higuti
MSN: higutisam@hotmail.com
Email: higuti@fai.com.br

Técnico em Informática
Adm servidores Linux
FAI - Faculdades Adamantinenses Integradas
---------------------------------------------------------------------

RE: Help!!!

[Baake, Matthias]

hi

maybe your workstation is starting the connections and the packets that you see are just the return packets?

/matthias

> -----Original Message-----
> From: netfilter-bounces@lists.netfilter.org
> [mailto:netfilter-bounces@lists.netfilter.org]On Behalf Of radu
> Sent: Thursday, June 23, 2005 1:51 PM
> To: netfilter@lists.netfilter.org
> Subject: Help!!!
> 
> 
> Hello all,
> 
>       My networck config:
> 
>   Internet -> linux box -> My PC(192.168.50.101)
> 
>   linux box
>   eth0 local 192.168.50.0/24
>   eth1 Internet
>   
>   my iptables config:
> 
> iptables -P FORWARD DROP
> iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 4662 -j 
> DNAT --to 192.168.50.101
> iptables -I FORWARD  -d 192.168.50.101 -p tcp --dport 4662 -j ACCEPT
> iptables -I FORWARD -i eth1 -o eth0 -m state --state 
> ESTABLISHED,RELATED -j ACCEPT
> iptables -I FORWARD -s 192.168.50.101 -j ACCEPT
> iptables -t nat -I POSTROUTING -o eth1 -j MASQUERADE
>   
> why I'm receiving on my PC  packages  with external ip on
> 4690,4544,4581.. ports???
> 
> -- 
> Best regards,
>  Radu                          mailto:radu@adm.utm.md
> 
> 
> 

Help!!!

[radu]

Hello all,

      My networck config:

  Internet -> linux box -> My PC(192.168.50.101)

  linux box
  eth0 local 192.168.50.0/24
  eth1 Internet
  
  my iptables config:

iptables -P FORWARD DROP
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 4662 -j DNAT --to 192.168.50.101
iptables -I FORWARD  -d 192.168.50.101 -p tcp --dport 4662 -j ACCEPT
iptables -I FORWARD -i eth1 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -I FORWARD -s 192.168.50.101 -j ACCEPT
iptables -t nat -I POSTROUTING -o eth1 -j MASQUERADE
  
why I'm receiving on my PC  packages  with external ip on
4690,4544,4581.. ports???

-- 
Best regards,
 Radu                          mailto:radu@adm.utm.md

Re: Help!!!

[/dev/rob0]

On Thursday 23 June 2005 06:50, radu wrote:
> why I'm receiving on my PC  packages  with external ip on
> 4690,4544,4581.. ports???

That would be me. I was trying to lure you into posting something on 
this list. ;)

>   Internet -> linux box -> My PC(192.168.50.101)
>
>   linux box
>   eth0 local 192.168.50.0/24
>   eth1 Internet
>
>   my iptables config:
>
> iptables -P FORWARD DROP

good

> iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 4662 -j DNAT
> --to 192.168.50.101

4662/tcp packet arriving at the external interface should have their 
destination changed to Radu's computer ...

> iptables -I FORWARD  -d 192.168.50.101 -p tcp 
> --dport 4662 -j ACCEPT

... and those packets should be accepted.

> iptables -I FORWARD -i eth1 -o eth0 -m state 
> --state ESTABLISHED,RELATED -j ACCEPT

Any replies to established or related connections arriving at the 
external interface, destined to the internal interface, should be 
accepted.

This is surely the rule letting those in. Check the connection tracking 
table when you see them come in.
-- 
    mail to this address is discarded unless "/dev/rob0"
    or "not-spam" is in Subject: header

Re: Help!!!

[Jason Opperisano]

On Thu, Jun 23, 2005 at 02:50:54PM +0300, radu wrote:
> Hello all,
> 
>       My networck config:
> 
>   Internet -> linux box -> My PC(192.168.50.101)
> 
>   linux box
>   eth0 local 192.168.50.0/24
>   eth1 Internet
>   
>   my iptables config:
> 
> iptables -P FORWARD DROP
> iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 4662 -j DNAT --to 192.168.50.101
> iptables -I FORWARD  -d 192.168.50.101 -p tcp --dport 4662 -j ACCEPT
> iptables -I FORWARD -i eth1 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
> iptables -I FORWARD -s 192.168.50.101 -j ACCEPT
> iptables -t nat -I POSTROUTING -o eth1 -j MASQUERADE

a cleaned-up version of your script:

  iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 4662 \
    -j DNAT --to 192.168.50.101
  iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

  iptables -P FORWARD DROP
  iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
  iptables -A FORWARD -p tcp -d 192.168.50.101 --dport 4662 -j ACCEPT
  iptables -A FORWARD -s 192.168.50.101 -j ACCEPT

-j

--
"Meg: Oh no! I'm missing the news!
 Peter: We all miss The News, Meg, but Huey Lewis needs time to create,
 and we need to be patient."
        --Family Guy

help!!

[Tuyo Board Unilago]

[-- Attachment #1: Type: text/plain, Size: 455 bytes --]

Hi, This is probably very basic to all of you guys, but i would apreciate a helping hand.

I have a linux red hat 9.2, 2.4 kernel machine with a cable modem signal with a DHCP ip adress from the cable company

I´m tring to "PROXY" all services to internet : telnet, Kazaa, httpd, etc...

But the more i try, the father my goal seems.

I been reading all the how to´s but no luck.

Any help. ANY. Will be apreciated.

Thanks

Tuyo Isaza



[-- Attachment #2: Type: text/html, Size: 1566 bytes --]

Help!!!

[Bharat (Hotmail Mithibaiguy)]

[-- Attachment #1: Type: text/plain, Size: 428 bytes --]

Hi,

Your help on iptables for blocking msn was pretty useful but the way u mentioned that u will be writing additional scripts to to make the rules permanent after linux is booted. 

I have successfully blocked msn but the rule just stays till i reboot the box or restart the iptable services.

Would be really obliged if u could help me on this to help me make the rules permanent



Thanks in advance

Bharat 


[-- Attachment #2: Type: text/html, Size: 776 bytes --]