* Why is can't my clients use DNS?
@ 2006-02-09 10:18 Greg Cope
2006-02-09 10:34 ` Greg Cope
2006-02-09 10:48 ` Rob Sterenborg
0 siblings, 2 replies; 5+ messages in thread
From: Greg Cope @ 2006-02-09 10:18 UTC (permalink / raw)
To: netfilter
Hi All,
I have a simple firewall/router.
Behind are a few servers.
I need to be able to;
- Let clients use external dns (does not work)
- ssh onto firewall (works)
- NAT packets onto webservers behind firewall (works)
This is a simple problem, but I can't seem to crack it - please can
someone point out my stupidity;
Some of the rules I have;
${IPTABLES} -A INPUT -p udp -s ${EXT_DNS_IP} --source-port 53 -d
${DMZ_IP_RANGE} -j ACCEPT
${IPTABLES} -A INPUT -p udp -s ${EXT_DNS_IP2} --source-port 53 -d
${DMZ_IP_RANGE} -j ACCEPT
${IPTABLES} -A FORWARD -p udp -s ${EXT_DNS_IP} -d ${DMZ_IP_RANGE}
--sport 53 -j ACCEPT
What am I missing?
snipped output of iptables -nvL -t filter
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
119 8981 ACCEPT all -- eth1 * 0.0.0.0/0
0.0.0.0/0 state RELATED,ESTABLISHED
6 680 ACCEPT all -- eth0 * 0.0.0.0/0
0.0.0.0/0
0 0 ACCEPT all -- lo * 0.0.0.0/0
0.0.0.0/0
0 0 icmp_packets icmp -- eth1 * 0.0.0.0/0
0.0.0.0/0
0 0 DROP all -- eth1 * 192.168.0.0/16
0.0.0.0/0
0 0 DROP all -- eth1 * 127.0.0.0/8
0.0.0.0/0
0 0 ACCEPT tcp -- * * 0.0.0.0/0
0.0.0.0/0 tcp dpt:80 flags:0x16/0x02
0 0 ACCEPT tcp -- * * 0.0.0.0/0
0.0.0.0/0 tcp dpt:22 flags:0x16/0x02
0 0 ACCEPT udp -- * * 195.40.1.36
192.168.0.0/16 udp spt:53
0 0 ACCEPT udp -- * * 195.184.228.6
192.168.0.0/16 udp spt:53
0 0 DROP udp -- * * 0.0.0.0/0
0.0.0.0/0
1 40 DROP tcp -- * * 0.0.0.0/0
0.0.0.0/0 tcp flags:0x16/0x02
0 0 LOG all -- * * 0.0.0.0/0
0.0.0.0/0 LOG flags 0 level 7 prefix `INPUT DENY: '
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
8 536 ACCEPT all -- eth0 eth1 0.0.0.0/0
0.0.0.0/0
0 0 ACCEPT all -- eth1 eth0 0.0.0.0/0
0.0.0.0/0 state RELATED,ESTABLISHED
0 0 ACCEPT tcp -- * * 0.0.0.0/0
192.168.0.0/16 tcp dpt:22 flags:0x16/0x02
0 0 ACCEPT tcp -- * * 0.0.0.0/0
192.168.0.0/16 tcp dpt:80 flags:0x16/0x02
0 0 ACCEPT udp -- * * 195.40.1.36
192.168.0.0/16 udp spt:53
0 0 LOG all -- * * 0.0.0.0/0
0.0.0.0/0 LOG flags 0 level 7 prefix `FORWARD DENY: '
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: Why is can't my clients use DNS?
2006-02-09 10:18 Why is can't my clients use DNS? Greg Cope
@ 2006-02-09 10:34 ` Greg Cope
2006-02-09 10:48 ` Rob Sterenborg
1 sibling, 0 replies; 5+ messages in thread
From: Greg Cope @ 2006-02-09 10:34 UTC (permalink / raw)
To: netfilter
I am an idiot sorry
I was missing this;
${IPTABLES} -t nat -A POSTROUTING -s ${DMZ_IP_RANGE} -j MASQUERADE
Greg
On 09/02/06, Greg Cope <gregcope@gmail.com> wrote:
> Hi All,
>
> I have a simple firewall/router.
>
> Behind are a few servers.
>
> I need to be able to;
>
> - Let clients use external dns (does not work)
> - ssh onto firewall (works)
> - NAT packets onto webservers behind firewall (works)
>
> This is a simple problem, but I can't seem to crack it - please can
> someone point out my stupidity;
>
> Some of the rules I have;
>
> ${IPTABLES} -A INPUT -p udp -s ${EXT_DNS_IP} --source-port 53 -d
> ${DMZ_IP_RANGE} -j ACCEPT
> ${IPTABLES} -A INPUT -p udp -s ${EXT_DNS_IP2} --source-port 53 -d
> ${DMZ_IP_RANGE} -j ACCEPT
> ${IPTABLES} -A FORWARD -p udp -s ${EXT_DNS_IP} -d ${DMZ_IP_RANGE}
> --sport 53 -j ACCEPT
>
>
> What am I missing?
>
> snipped output of iptables -nvL -t filter
>
> Chain INPUT (policy DROP 0 packets, 0 bytes)
> pkts bytes target prot opt in out source
> destination
> 119 8981 ACCEPT all -- eth1 * 0.0.0.0/0
> 0.0.0.0/0 state RELATED,ESTABLISHED
> 6 680 ACCEPT all -- eth0 * 0.0.0.0/0
> 0.0.0.0/0
> 0 0 ACCEPT all -- lo * 0.0.0.0/0
> 0.0.0.0/0
> 0 0 icmp_packets icmp -- eth1 * 0.0.0.0/0
> 0.0.0.0/0
> 0 0 DROP all -- eth1 * 192.168.0.0/16
> 0.0.0.0/0
> 0 0 DROP all -- eth1 * 127.0.0.0/8
> 0.0.0.0/0
> 0 0 ACCEPT tcp -- * * 0.0.0.0/0
> 0.0.0.0/0 tcp dpt:80 flags:0x16/0x02
> 0 0 ACCEPT tcp -- * * 0.0.0.0/0
> 0.0.0.0/0 tcp dpt:22 flags:0x16/0x02
> 0 0 ACCEPT udp -- * * 195.40.1.36
> 192.168.0.0/16 udp spt:53
> 0 0 ACCEPT udp -- * * 195.184.228.6
> 192.168.0.0/16 udp spt:53
> 0 0 DROP udp -- * * 0.0.0.0/0
> 0.0.0.0/0
> 1 40 DROP tcp -- * * 0.0.0.0/0
> 0.0.0.0/0 tcp flags:0x16/0x02
> 0 0 LOG all -- * * 0.0.0.0/0
> 0.0.0.0/0 LOG flags 0 level 7 prefix `INPUT DENY: '
>
> Chain FORWARD (policy DROP 0 packets, 0 bytes)
> pkts bytes target prot opt in out source
> destination
> 8 536 ACCEPT all -- eth0 eth1 0.0.0.0/0
> 0.0.0.0/0
> 0 0 ACCEPT all -- eth1 eth0 0.0.0.0/0
> 0.0.0.0/0 state RELATED,ESTABLISHED
> 0 0 ACCEPT tcp -- * * 0.0.0.0/0
> 192.168.0.0/16 tcp dpt:22 flags:0x16/0x02
> 0 0 ACCEPT tcp -- * * 0.0.0.0/0
> 192.168.0.0/16 tcp dpt:80 flags:0x16/0x02
> 0 0 ACCEPT udp -- * * 195.40.1.36
> 192.168.0.0/16 udp spt:53
> 0 0 LOG all -- * * 0.0.0.0/0
> 0.0.0.0/0 LOG flags 0 level 7 prefix `FORWARD DENY: '
>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: Why is can't my clients use DNS?
2006-02-09 10:18 Why is can't my clients use DNS? Greg Cope
2006-02-09 10:34 ` Greg Cope
@ 2006-02-09 10:48 ` Rob Sterenborg
2006-02-10 3:50 ` ludi
1 sibling, 1 reply; 5+ messages in thread
From: Rob Sterenborg @ 2006-02-09 10:48 UTC (permalink / raw)
To: netfilter
On Thu, February 9, 2006 11:18, Greg Cope wrote:
> Hi All,
>
> I have a simple firewall/router.
>
> Behind are a few servers.
>
> I need to be able to;
>
> - Let clients use external dns (does not work)
> - ssh onto firewall (works)
> - NAT packets onto webservers behind firewall (works)
>
> This is a simple problem, but I can't seem to crack it - please can
> someone point out my stupidity;
>
> Some of the rules I have;
>
> ${IPTABLES} -A INPUT -p udp -s ${EXT_DNS_IP} --source-port 53 -d
> ${DMZ_IP_RANGE} -j ACCEPT
> ${IPTABLES} -A INPUT -p udp -s ${EXT_DNS_IP2} --source-port 53 -d
> ${DMZ_IP_RANGE} -j ACCEPT
> ${IPTABLES} -A FORWARD -p udp -s ${EXT_DNS_IP} -d ${DMZ_IP_RANGE}
> --sport 53 -j ACCEPT
I'm sorry, but for me it's not enough information. Are your clients DMZ
servers or real clients ? I think there's some rules missing to evaluate it
properly.
For your problem :
> - Let clients use external dns (does not work)
You need to create rules like these (I'll assume your "clients" are DMZ
servers) :
$ipt -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
$ipt -A FORWARD -m state --state NEW -i <if_dmz> -s <net_dmz> \
[-d <ip_ext_dns>] -p udp --dport 53 -j ACCEPT
$ipt -A FORWARD -m state --state NEW -i <if_dmz> -s <net_dmz> \
[-d <ip_ext_dns>] -p tcp --dport 53 -j ACCEPT
$ipt -t nat -A POSTROUTING -o <if_inet> -s <net_dmz> [-d <ip_ext_dns>] \
-p udp --dport 53 -j SNAT <ip_inet>
$ipt -t nat -A POSTROUTING -o <if_inet> -s <net_dmz> [-d <ip_ext_dns>] \
-p tcp --dport 53 -j SNAT <ip_inet>
Gr,
Rob
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: Why is can't my clients use DNS?
2006-02-09 10:48 ` Rob Sterenborg
@ 2006-02-10 3:50 ` ludi
2006-02-10 4:06 ` Cedric Blancher
0 siblings, 1 reply; 5+ messages in thread
From: ludi @ 2006-02-10 3:50 UTC (permalink / raw)
To: netfilter
-m state --state RELATED,ESTABLISHED
Does it work on the UDP?
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: Why is can't my clients use DNS?
2006-02-10 3:50 ` ludi
@ 2006-02-10 4:06 ` Cedric Blancher
0 siblings, 0 replies; 5+ messages in thread
From: Cedric Blancher @ 2006-02-10 4:06 UTC (permalink / raw)
To: ludi; +Cc: netfilter
Le vendredi 10 février 2006 à 11:50 +0800, ludi a écrit :
> -m state --state RELATED,ESTABLISHED
> Does it work on the UDP?
Yes. And on ICMP as well...
--
http://sid.rstack.org/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
>> Hi! I'm your friendly neighbourhood signature virus.
>> Copy me to your signature file and help me spread!
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2006-02-10 4:06 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2006-02-09 10:18 Why is can't my clients use DNS? Greg Cope
2006-02-09 10:34 ` Greg Cope
2006-02-09 10:48 ` Rob Sterenborg
2006-02-10 3:50 ` ludi
2006-02-10 4:06 ` Cedric Blancher
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox