Hi.
We have a branch which connects to the main site via a VPN connection. Recently, I've installed a Linux Bridge and I've just started to apply firewall rules to it.
Main site - 10.1.0.0 / 16 (yes, i
know the subnet is iffy)
Branch - 10.5.0.0 / 16
ADSL Router - 10.5.0.1 /16
Bridge/FW - 10.5.0.2 /16
All machines at the site connect through the bridge fine and dandy. I've blocked them from seeing anything but the main site. The bridge also contains Squid and DansGuardian which is running wonderfully.
Only problem is, when I try to ping or connect to the bridge machine from the main site, it's very sporadic, certainly not a good enough connection to hold it open long enough to do anything. All the machines behind it ping and connect without any problems- the only way I can shell into it presently is to VNC into a workstation behind the router and then shell as if I were local to it!
Obviously, I'd like to be able to connect to 10.5.0.2 from 10.1.x.x. Anyone have any idea what's wrong with this script? It's only a basic one, but I'm sure there's a bit of something fundamental I've missed off.
Thanks in advance!
John
#
# flush existing
#
iptables -F
#
# policies on existing templates
#
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
#
# input rules
# local, dns, ssh, http, socks, http -> dansg (8080)
#
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p icmp --icmp-type any -j ACCEPT
iptables -A INPUT -p 50 -j ACCEPT
iptables -A INPUT -p 51 -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp -s 10.1.0.0/16 --dport 22 -j ACCEPT
iptables -A INPUT -m state --state NEW -m tcp -p tcp -s 10.5.0.0/16 --dport 22 -j ACCEPT
iptables -A INPUT -i br0 -p tcp -d 10.5.0.2 -s 10.5.0.0/16 --dport 8080 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -j REJECT --reject-with icmp-host-prohibited
iptables -A INPUT -j DROP
#
# forwarding rules
#
#
# Allow everyone from the inside network to connect and
# for the reply packets to come back
#
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
#
# This is to connect the VPN traffic
#
iptables -A FORWARD -s 10.1.0.0/16 -d 10.5.0.0/16 -j ACCEPT
iptables -A FORWARD -s 10.5.0.0/16 -d 10.1.0.0/16 -j ACCEPT
iptables -A FORWARD -s 10.5.0.0/16 -d 10.5.0.0/16 -j ACCEPT
#
# drop everything else
#
iptables -A FORWARD -j DROP 
