LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 03-23-2009, 09:39 AM   #1
garglkarg
LQ Newbie
 
Registered: Mar 2009
Posts: 5

Rep: Reputation: 0
Debian Router/Firewall IPTables & the ugly NAT


Hello,
I have a debian (voyage lenny) router routing all my traffic to my adsl modem.
first of all: it works... for the most of them! but some won't...

that's my scenario:
-----------------------------------
router
|- eth0/ppp0 > connected to my adsl (works fine since I use pppoeconf)
|- eth1 > conntected to my network switch broadcasting dns and dhcp
|- eth2 > still unconnected

I make all my firewall settings via firewall builder and I tried most.
I started with a good scenraio and ened up with simpliest. I looked up posts suggesting port openings but that's not the problem I guess

what's good:
-----------------------------------
Skype, HTTP and HTTPS from any PC on behind the eth1 switch

the problem/symptom:
-----------------------------------
I can't get MSN Messenger running (it's the protocol not the client) same with ICQ. it tries to connect and with wireshark I see some communication but it ends in a timeout

AND the reason I get so confused: I have nothing in my firewall log! so it's NOT because any weird port is blocked.
In my small-knowledge compendium I think it's a debian hardcore switch which disables communication at some point.

any help recommended...

thx
 
Old 03-23-2009, 03:06 PM   #2
jimjones
Member
 
Registered: May 2005
Location: Belgium
Distribution: slackware 10.2
Posts: 43

Rep: Reputation: 15
i'm not very messenger/icq savvy but this seems like a basic nat setup you missed
and if i'm not mistaken they both use a fixed port so you will only be able to set it up for 1 pc ...

oh and i have heard about a project trying to implement upnp on linux - that would solve all your problems ..

Last edited by jimjones; 03-23-2009 at 03:10 PM.
 
Old 03-23-2009, 03:21 PM   #3
garglkarg
LQ Newbie
 
Registered: Mar 2009
Posts: 5

Original Poster
Rep: Reputation: 0
Quote:
Originally Posted by jimjones View Post
i'm not very messenger/icq savvy but this seems like a basic nat setup you missed
and if i'm not mistaken they both use a fixed port so you will only be able to set it up for 1 pc ...

oh and i have heard about a project trying to implement upnp on linux - that would solve all your problems ..
hej, I think it's a basic nat setup I missed, too.
And it's no problem to use for any PC behind my router! I know this because I have an iptables firewall already! and everything works fine! it's the one shipped with my netgear 821 (not nice but working), same with my Asus 500 gP (nice but broken) and with my netgear wgt631U (old fashioned and broken). so it's should be no problem.

thank you for the upnp tip! I installed it already... couldn't help. maybe I malconfigured it. I don't know.

I know it's only a weird little setting. Or maybe it's something about the renaming: first the outbound is eth0 and then ppp0. I don't know...

I'm sorry, that I may sound a little angry but I tried so much already.
 
Old 03-23-2009, 03:44 PM   #4
jimjones
Member
 
Registered: May 2005
Location: Belgium
Distribution: slackware 10.2
Posts: 43

Rep: Reputation: 15
http://linux-igd.sourceforge.net/documentation.php

So the thing is very simple - you want connectivity or security?
You want messenger to work behind the debian box - disable your firewall and get it working first. Then try putting up a firewall ..

Cheers
 
Old 03-24-2009, 04:16 AM   #5
garglkarg
LQ Newbie
 
Registered: Mar 2009
Posts: 5

Original Poster
Rep: Reputation: 0
Quote:
Originally Posted by jimjones View Post
http://linux-igd.sourceforge.net/documentation.php

So the thing is very simple - you want connectivity or security?
You want messenger to work behind the debian box - disable your firewall and get it working first. Then try putting up a firewall ..

Cheers
ok, I took the simple thing. removed all policy rules and leaving the NAT Rule (forwarding all to ppp0) running. but.... NO! Messenger still won't work.

this is what it's about:
Quote:
# Generated by iptables-save v1.4.1.1 on Tue Mar 24 10:05:56 2009
*filter
:INPUT DROP [42:2171]
:FORWARD DROP [26:1560]
:OUTPUT DROP [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
COMMIT
# Completed on Tue Mar 24 10:05:56 2009
# Generated by iptables-save v1.4.1.1 on Tue Mar 24 10:05:56 2009
*nat
:PREROUTING ACCEPT [238:23635]
:POSTROUTING ACCEPT [66:4181]
:OUTPUT ACCEPT [13:1001]
-A POSTROUTING -s 192.168.42.0/24 -o ppp0 -j MASQUERADE
-A POSTROUTING -s 192.168.23.0/24 -o ppp0 -j MASQUERADE
COMMIT
# Completed on Tue Mar 24 10:05:56 2009
# Generated by iptables-save v1.4.1.1 on Tue Mar 24 10:05:56 2009
*mangle
:PREROUTING ACCEPT [2536:639589]
:INPUT ACCEPT [1488:517883]
:FORWARD ACCEPT [664:98397]
:OUTPUT ACCEPT [990:129248]
:POSTROUTING ACCEPT [1638:230116]
COMMIT
and this is what firewall builder enables
Quote:
echo 1 > /proc/sys/net/ipv4/ip_dynaddr
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter
echo 1 > /proc/sys/net/ipv4/conf/all/accept_source_route
echo 1 > /proc/sys/net/ipv4/conf/all/accept_redirects
echo 1 > /proc/sys/net/ipv4/conf/all/log_martians
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_all
echo 0 > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
echo 500 > /proc/sys/net/ipv4/tcp_keepalive_intvl
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
[...]
echo 1 > /proc/sys/net/ipv4/ip_forward
any module I have to enable?
 
Old 03-24-2009, 06:14 AM   #6
maxut
Senior Member
 
Registered: May 2003
Location: istanbul
Distribution: debian - redhat - others
Posts: 1,188

Rep: Reputation: 50
FORWARD policy is DROP. it means, not only messenger all of client side softwares will not work.
so run following
iptables -P FORWARD ACCEPT
and try again please.

regards
 
Old 03-24-2009, 07:24 AM   #7
garglkarg
LQ Newbie
 
Registered: Mar 2009
Posts: 5

Original Poster
Rep: Reputation: 0
@maxut: sry, I run forward without noticing your post...

so I got it to work, but don't know why.
this is what i've done:
* upgrading voyage package (included iptables-package)
* correct locale (nothing was defined)
* installed ntp daemon (the alix board has no internal time and always run back or forth in time)
* booted my windows and my linux pc and tested on both clients with pidgin's msn-messenger wlm (pecan-package) AND msn protocol
* added upnp port to my internal fw (but no real action appears in the syslog)

this is what I get:
* all internet ist fine!
* my linux pc runs pidgin-wlm package, icq, skype etc... it will not run the standard pidgin msn (which runs through my former netgear router
* my win XP runs pidgin msn package fine

thx for any help. it seems the upgrade fixed it...
 
Old 03-24-2009, 08:35 AM   #8
maxut
Senior Member
 
Registered: May 2003
Location: istanbul
Distribution: debian - redhat - others
Posts: 1,188

Rep: Reputation: 50
no problem.
nice to hear that it is works well..

regards.
 
  


Reply

Tags
debian, iptables, messenger, msn


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Debian: Home router / NAT / Firewall JussiKp Linux - Networking 4 12-27-2006 03:56 PM
Iptables Firewall Router Nat Problems Aps Linux - Networking 5 07-28-2006 03:49 AM
nat & firewall thru iptables jkmartha Linux - Security 5 05-13-2005 07:47 AM
iptables questions: NAT & firewall insanitee Linux - Networking 10 08-24-2003 06:32 AM
IPTABLES, NAT & Firewall dsylvester Slackware 1 02-15-2003 07:14 PM


All times are GMT -5. The time now is 08:35 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration