Debian Router/Firewall IPTables & the ugly NAT

garglkarg · 03-23-2009, 09:39 AM

Hello,
I have a debian (voyage lenny) router routing all my traffic to my adsl modem.
first of all: it works... for the most of them! but some won't...

that's my scenario:
-----------------------------------
router
|- eth0/ppp0 > connected to my adsl (works fine since I use pppoeconf)
|- eth1 > conntected to my network switch broadcasting dns and dhcp
|- eth2 > still unconnected

I make all my firewall settings via firewall builder and I tried most.
I started with a good scenraio and ened up with simpliest. I looked up posts suggesting port openings but that's not the problem I guess

what's good:
-----------------------------------
Skype, HTTP and HTTPS from any PC on behind the eth1 switch

the problem/symptom:
-----------------------------------
I can't get MSN Messenger running (it's the protocol not the client) same with ICQ. it tries to connect and with wireshark I see some communication but it ends in a timeout

AND the reason I get so confused: I have nothing in my firewall log! so it's NOT because any weird port is blocked.
In my small-knowledge compendium I think it's a debian hardcore switch which disables communication at some point.

any help recommended...

thx

jimjones · 03-23-2009, 03:06 PM

i'm not very messenger/icq savvy but this seems like a basic nat setup you missed
and if i'm not mistaken they both use a fixed port so you will only be able to set it up for 1 pc ...

oh and i have heard about a project trying to implement upnp on linux - that would solve all your problems ..

garglkarg · 03-23-2009, 03:21 PM

Quote:

Originally Posted by jimjones

i'm not very messenger/icq savvy but this seems like a basic nat setup you missed
and if i'm not mistaken they both use a fixed port so you will only be able to set it up for 1 pc ...

oh and i have heard about a project trying to implement upnp on linux - that would solve all your problems ..

hej, I think it's a basic nat setup I missed, too.
And it's no problem to use for any PC behind my router! I know this because I have an iptables firewall already! and everything works fine! it's the one shipped with my netgear 821 (not nice but working), same with my Asus 500 gP (nice but broken) and with my netgear wgt631U (old fashioned and broken). so it's should be no problem.

thank you for the upnp tip! I installed it already... couldn't help. maybe I malconfigured it. I don't know.

I know it's only a weird little setting. Or maybe it's something about the renaming: first the outbound is eth0 and then ppp0. I don't know...

I'm sorry, that I may sound a little angry but I tried so much already.

jimjones · 03-23-2009, 03:44 PM

http://linux-igd.sourceforge.net/documentation.php

So the thing is very simple - you want connectivity or security?
You want messenger to work behind the debian box - disable your firewall and get it working first. Then try putting up a firewall ..

Cheers

garglkarg · 03-24-2009, 04:16 AM

Quote:

Originally Posted by jimjones

http://linux-igd.sourceforge.net/documentation.php

So the thing is very simple - you want connectivity or security?
You want messenger to work behind the debian box - disable your firewall and get it working first. Then try putting up a firewall ..

Cheers

ok, I took the simple thing. removed all policy rules and leaving the NAT Rule (forwarding all to ppp0) running. but.... NO! Messenger still won't work.

this is what it's about:

Quote:

# Generated by iptables-save v1.4.1.1 on Tue Mar 24 10:05:56 2009
*filter
:INPUT DROP [42:2171]
:FORWARD DROP [26:1560]
:OUTPUT DROP [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
COMMIT
# Completed on Tue Mar 24 10:05:56 2009
# Generated by iptables-save v1.4.1.1 on Tue Mar 24 10:05:56 2009
*nat
:PREROUTING ACCEPT [238:23635]
:POSTROUTING ACCEPT [66:4181]
:OUTPUT ACCEPT [13:1001]
-A POSTROUTING -s 192.168.42.0/24 -o ppp0 -j MASQUERADE
-A POSTROUTING -s 192.168.23.0/24 -o ppp0 -j MASQUERADE
COMMIT
# Completed on Tue Mar 24 10:05:56 2009
# Generated by iptables-save v1.4.1.1 on Tue Mar 24 10:05:56 2009
*mangle
:PREROUTING ACCEPT [2536:639589]
:INPUT ACCEPT [1488:517883]
:FORWARD ACCEPT [664:98397]
:OUTPUT ACCEPT [990:129248]
:POSTROUTING ACCEPT [1638:230116]
COMMIT

and this is what firewall builder enables

Quote:

echo 1 > /proc/sys/net/ipv4/ip_dynaddr
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
echo 1 > /proc/sys/net/ipv4/conf/all/accept_source_route
echo 1 > /proc/sys/net/ipv4/conf/all/accept_redirects
echo 1 > /proc/sys/net/ipv4/conf/all/log_martians
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_all
echo 0 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
echo 500 > /proc/sys/net/ipv4/tcp_keepalive_intvl
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
[...]
echo 1 > /proc/sys/net/ipv4/ip_forward

any module I have to enable?

maxut · 03-24-2009, 06:14 AM

FORWARD policy is DROP. it means, not only messenger all of client side softwares will not work.
so run following
iptables -P FORWARD ACCEPT
and try again please.

regards

garglkarg · 03-24-2009, 07:24 AM

@maxut: sry, I run forward without noticing your post...

so I got it to work, but don't know why.
this is what i've done:
* upgrading voyage package (included iptables-package)
* correct locale (nothing was defined)
* installed ntp daemon (the alix board has no internal time and always run back or forth in time)
* booted my windows and my linux pc and tested on both clients with pidgin's msn-messenger wlm (pecan-package) AND msn protocol
* added upnp port to my internal fw (but no real action appears in the syslog)

this is what I get:
* all internet ist fine!
* my linux pc runs pidgin-wlm package, icq, skype etc... it will not run the standard pidgin msn (which runs through my former netgear router
* my win XP runs pidgin msn package fine

thx for any help. it seems the upgrade fixed it...

maxut · 03-24-2009, 08:35 AM

no problem.
nice to hear that it is works well..

regards.