Re: I still have no idea why this doesn't work...(further details)

Re: I still have no idea why this doesn't work...(further details)

[Garison Piatt]

At 03:57 PM 4/23/04 +0100, Antony Stone wrote:
># Set default drop polcy on all tables
>iptables -P INPUT DROP
>iptables -P OUTPUT DROP
>iptables -P FORWARD DROP
>
># Allow replies out for anything which comes in
>iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
># Allow the machine to do its own DNS lookups
>iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
>iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
># Allow replies in for anything which goes out (eg DNS)
>iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
># Allow the world to access by HTTP
>iptables -A INPUT -p tcp --dport 80 -j ACCEPT
># Allow the world to access by FTP (you *did* want that, yes?)
>iptables -A INPUT -p tcp --dport 21 -j ACCEPT
># Allow the world to access by SSH (would be nicer to restrict by IP addres,
>but we can't, so....)
>iptables -A INPUT -p tcp --dport 22 -j ACCEPT

Okay, I did this, and received the following when I tried to FTP into the site:
   i Control connection successfully established.
   < 220 ProFTPD FTP Server ready.
   i Time zone of server could not be determined.
   > USER admin
   < 331 Password required for admin.
   > PASS <password>
   < 230 User admin logged in.
   > SYST
   < 215 UNIX Type: L8
   > PWD
   < 257 "/home/admin" is current directory.
   > PASV
   < 227 Entering Passive Mode (207,36,232,90,132,36).
   i Data connection A8 could not be established (10060).
followed by a notice that the connection timed out.  Changing the FTP 
parameters didn't have much effect.  Also, the browser connects to the 
site, but times out before displaying any data.  And everything is *s-l-o-w*.

Any ideas?  

Re: I still have no idea why this doesn't work...(further details)

[IT Clown]

have you tried: modprobe ip_nat_ftp
Try iptables -A INPUT -p tcp --dport 20 -j ACCEPT
                                                            
                   
with your current rule of --dport 21


On Sat, 24 Apr 2004 18:53:43 -1000
 Garison Piatt <todo@garisonpiatt.com> wrote:
> At 03:57 PM 4/23/04 +0100, Antony Stone wrote:
> ># Set default drop polcy on all tables
> >iptables -P INPUT DROP
> >iptables -P OUTPUT DROP
> >iptables -P FORWARD DROP
> >
> ># Allow replies out for anything which comes in
> >iptables -A OUTPUT -m state --state ESTABLISHED,RELATED
> -j ACCEPT
> ># Allow the machine to do its own DNS lookups
> >iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
> >iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
> ># Allow replies in for anything which goes out (eg DNS)
> >iptables -A INPUT -m state --state ESTABLISHED,RELATED
> -j ACCEPT
> ># Allow the world to access by HTTP
> >iptables -A INPUT -p tcp --dport 80 -j ACCEPT
> ># Allow the world to access by FTP (you *did* want that,
> yes?)
> >iptables -A INPUT -p tcp --dport 21 -j ACCEPT
> ># Allow the world to access by SSH (would be nicer to
> restrict by IP addres,
> >but we can't, so....)
> >iptables -A INPUT -p tcp --dport 22 -j ACCEPT
> 
> Okay, I did this, and received the following when I tried
> to FTP into the site:
>    i Control connection successfully established.
>    < 220 ProFTPD FTP Server ready.
>    i Time zone of server could not be determined.
>    > USER admin
>    < 331 Password required for admin.
>    > PASS <password>
>    < 230 User admin logged in.
>    > SYST
>    < 215 UNIX Type: L8
>    > PWD
>    < 257 "/home/admin" is current directory.
>    > PASV
>    < 227 Entering Passive Mode (207,36,232,90,132,36).
>    i Data connection A8 could not be established (10060).
> followed by a notice that the connection timed out.
>  Changing the FTP parameters didn't have much effect.
>  Also, the browser connects to the site, but times out
> before displaying any data.  And everything is *s-l-o-w*.
> 
> Any ideas?  
> 

______________________________________________________________
Herbalife Independent Distributor http://www.healthiest.co.za

Re: I still have no idea why this doesn't work...(further details)

[Antony Stone]

On Sunday 25 April 2004 7:59 am, IT Clown wrote:

> have you tried: modprobe ip_nat_ftp

Why would he need ip_nat_ftp with rules in the INPUT chain?   There's no nat 
going on.

However, you have raised the question of whether he has compiled in or loaded 
as a module ip_conntrack_ftp support?   That would be needed in this 
situation.

Regards,

Antony.

> On Sat, 24 Apr 2004 18:53:43 -1000
>
>  Garison Piatt <todo@garisonpiatt.com> wrote:
>
> >    i Control connection successfully established.
> >    < 220 ProFTPD FTP Server ready.
> >    i Time zone of server could not be determined.
> >    > USER admin
> >    < 331 Password required for admin.
> >    > PASS <password>
> >    < 230 User admin logged in.
> >    > SYST
> >    < 215 UNIX Type: L8
> >    > PWD
> >    < 257 "/home/admin" is current directory.
> >    > PASV
> >    < 227 Entering Passive Mode (207,36,232,90,132,36).
> >    i Data connection A8 could not be established (10060).
> > followed by a notice that the connection timed out.

-- 
Late in 1972 President Richard Nixon announced that the rate of increase of 
inflation was decreasing.   This was the first time a sitting president used 
a third derivative to advance his case for re-election.

 - Hugo Rossi, Notices of the American Mathematical Society

                                                     Please reply to the list;
                                                           please don't CC me.

Re: I have no idea why this doesn't work...(further details)

[Garison Piatt]

At 09:57 PM 4/22/04 +0100, Antony Stone wrote:
>On Thursday 22 April 2004 9:10 pm, Garison Piatt wrote:
> > this was cobbled together from scripts that were said to work in
> > other places, and my assumption was that these were common port numbers.
>I'm reminded of the phrase "a little bit of knowledge can be a dangerous
>thing".  :)

I'm reminded of that on an hourly basis.  :)


> > As far as I know: one server, everything on the same machine,
>
>1. I assume the server is not the same machine running netfilter?   (ie: you
>are trying to set up a routing firewall, not create rules on a machine to
>protect itself?)

No, just the opposite: one machine, trying to protect itself.  Multiple web 
sites on the machine.  Sorry I wasn't clear.


>2. "One web site client"?   I don't understand.   Surely the server is
>accessible to the entire Internet (although maybe not...)?

Perhaps I should have said, "one client web site".

The server was set up because the ISP won't drop certain email 
restrictions, even though my client brings them *a lot* of business.  (Most 
of her customers want to send voluminous newsletters, but the ISP has a 
limit of 99 emails per hour.)  The eventual intent is to host all of her 
customers (12-15) on one web server.  Currently (by the end of this month), 
we have one customer to move over to this new server.  Within the next two 
months, that should go up to 8.  That's the target arrangement: up to 15 
(and maybe more) web sites hosted on one server, with a single firewall 
protecting all of them.


> > Support calls are $150 a pop, so she wants me to make
> > as few of those (read: zero) as possible.
>Support from whom (where)?   All we're asking is basic network configuration
>stuff - not technical assistance in getting something working.

 From the ISP; they've given out a limited amount of information -- 
basically, just the IP number.  They expect that all user maintenance will 
be done from the command console they provide -- which, they say, does a 
great job of creating and maintaining web sites -- but it doesn't do diddly 
about security.  We're supposed to handle that on our own, by hand.


> > We want to allow TELNET (just from me and her, if possible), all FTP, and
> > web traffic.
>Okay, where are you (in network terms, compared to the firewall and server
>we're talking about), where is she, and where does the web traffic come from?

Not sure what you're asking here.  Everything is outside of the server -- 
me, her, all web visitors, hackers, etc.  I'm assuming the server is on a 
table in Florida somewhere, connected only to the internet.  I'm on a cable 
customer (non-dedicated) line, which I believe means that my IP changes 
every time I log in.  Don't know about my client.


>Telnet is not a recommended protocol - everything is sent in clear text - is
>there any good reason why you are not using ssh?

Didn't know about it.  I just downloaded PuTTY.


>Note that the above rules will *not* give you remote access to the firewall
>itself.   You almost certainly do want this

With all the things I don't know, this one I definitely do: we *do* want 
remote access to the firewall.


Mahalo,
-garison  

Re: I have no idea why this doesn't work...(further details)

[Antony Stone]

On Thursday 22 April 2004 10:53 pm, Garison Piatt wrote:

> At 09:57 PM 4/22/04 +0100, Antony Stone wrote:
> >
> >1. I assume the server is not the same machine running netfilter?   (ie:
> > you are trying to set up a routing firewall, not create rules on a
> > machine to protect itself?)
>
> No, just the opposite: one machine, trying to protect itself.  Multiple web
> sites on the machine.  Sorry I wasn't clear.

Okay, in that case you need your rules in the INPUT chain, not the FORWARD 
chain, but otherwise things will be pretty similar.

> >2. "One web site client"?   I don't understand.   Surely the server is
> >accessible to the entire Internet (although maybe not...)?
>
> Perhaps I should have said, "one client web site".

Okay, thanks, yes, now I understand.

> The server was set up because the ISP won't drop certain email
> restrictions, even though my client brings them *a lot* of business.  (Most
> of her customers want to send voluminous newsletters, but the ISP has a
> limit of 99 emails per hour.)

So?   Just set yourself up a mail server somewhere else...

> The eventual intent is to host all of her
> customers (12-15) on one web server.

Sounds highly feasible, depending on bandwidth requirements, of course.

> Currently (by the end of this month),
> we have one customer to move over to this new server.  Within the next two
> months, that should go up to 8.  That's the target arrangement: up to 15
> (and maybe more) web sites hosted on one server, with a single firewall
> protecting all of them.

You mean, "with netfilter running on the same machine"?   If you say "a 
firewall protecting them", I think of a machine which is a firewall providing 
protection for other machine/s which are web servers.

Hence my previous confusion about whether we were talking about one machine or 
two here.

> > Support from whom (where)?   All we're asking is basic network
> > configuration stuff - not technical assistance in getting something
> > working.
>
>  From the ISP; they've given out a limited amount of information --
> basically, just the IP number.  They expect that all user maintenance will
> be done from the command console they provide -- which, they say, does a
> great job of creating and maintaining web sites -- but it doesn't do diddly
> about security.  We're supposed to handle that on our own, by hand.

I still say find another ISP.

> >Okay, where are you (in network terms, compared to the firewall and server
> >we're talking about), where is she, and where does the web traffic come
> > from?
>
> Not sure what you're asking here.  Everything is outside of the server --
> me, her, all web visitors, hackers, etc.

Okay, that's the answer I needed.   I wasn't sure whether you had different 
access to the server from the general Internet, or what.

> I'm on a cable customer (non-dedicated) line, which I believe means that my
> IP changes every time I log in.

In that case there's no way you can set up Telnet securely for you and only 
you to be able to use it.   Go for SSH, and use public-key exchange instead 
of passwords, as soon as you've figured out how to do that (it's not hard).

> >Telnet is not a recommended protocol - everything is sent in clear text -
> > is there any good reason why you are not using ssh?
>
> Didn't know about it.  I just downloaded PuTTY.

Does that, um, gulp, imply that you're using Windows !?

> With all the things I don't know, this one I definitely do: we *do* want
> remote access to the firewall.

Okay, here's a revised version of the rules I previously posted, to take 
account of the fact that there's only one machine:

# Set default drop polcy on all tables
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

# Allow replies out for anything which comes in
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Allow the machine to do its own DNS lookups
iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
# Allow replies in for anything which goes out (eg DNS)
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Allow the world to access by HTTP
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
# Allow the world to access by FTP (you *did* want that, yes?)
iptables -A INPUT -p tcp --dport 21 -j ACCEPT
# Allow the world to access by SSH (would be nicer to restrict by IP addres, 
but we can't, so....)
iptables -A INPUT -p tcp --dport 22 -j ACCEPT

PS: If you haven't already, I recommend you read Oskar Andreasson's netfilter 
tutorial at http://iptables-tutorial.frozentux.net

Regards,

Antony.

-- 
Never write it in Perl if you can do it in Awk.
Never do it in Awk if sed can handle it.
Never use sed when tr can do the job.
Never invoke tr when cat is sufficient.
Avoid using cat whenever possible.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: I still have no idea why this doesn't work...(further details)

[makahou]

At 03:57 PM 4/23/04 +0100, Antony Stone wrote:
># Set default drop polcy on all tables
>iptables -P INPUT DROP
>iptables -P OUTPUT DROP
>iptables -P FORWARD DROP
>
># Allow replies out for anything which comes in
>iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
># Allow the machine to do its own DNS lookups
>iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
>iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
># Allow replies in for anything which goes out (eg DNS)
>iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
># Allow the world to access by HTTP
>iptables -A INPUT -p tcp --dport 80 -j ACCEPT
># Allow the world to access by FTP (you *did* want that, yes?)
>iptables -A INPUT -p tcp --dport 21 -j ACCEPT
># Allow the world to access by SSH (would be nicer to restrict by IP addres,
>but we can't, so....)
>iptables -A INPUT -p tcp --dport 22 -j ACCEPT

Okay, I did this, and received the following when I tried to FTP into the site:
   i Control connection successfully established.
   < 220 ProFTPD FTP Server ready.
   i Time zone of server could not be determined.
   > USER admin
   < 331 Password required for admin.
   > PASS <password>
   < 230 User admin logged in.
   > SYST
   < 215 UNIX Type: L8
   > PWD
   < 257 "/home/admin" is current directory.
   > PASV
   < 227 Entering Passive Mode (207,36,232,90,132,36).
   i Data connection A8 could not be established (10060).
followed by a notice that the connection timed out.  Changing the FTP 
parameters didn't have much effect.  Also, the browser connects to the 
site, but times out before displaying any data.  And everything is *s-l-o-w*.

Any ideas?