LinuxQuestions.org
View the Most Wanted LQ Wiki articles.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 04-05-2004, 11:23 PM   #1
phekno
Member
 
Registered: May 2003
Distribution: Gentoo, Slackware
Posts: 75

Rep: Reputation: 15
Howto punch a hole in my router/firewall?


OK. I have a Slackware 9.1 machine that I use primarily as a firewall/router/webserver/distraction. I have managed to get IP Masquerading to work using the following commands:

>iptables -F; iptables -t nat -F; iptables -t mangle -F

>iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

>echo 1 > /proc/sys/net/ipv4/ip_forward

>iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

>iptables -A INPUT -m state --state NEW -i ! eth0 -j ACCEPT

>iptables -P INPUT DROP

The external interface is eth0 and the internal one is eth1. What I'm trying to do is get my windows box (which is behind the firewall) to use iTunes to connect to other people on the other side of the box (i.e. on the larger network I am connected to). I read a post from a Mac user who said that he had port 3689 open on his firewall for iTunes sharing. I tried to punch a hole in my firewall at port 3689 but I'm not sure which chain it's supposed to be in and I'm also no sure weather it's supposed to be destination port or source port. Anyway, here's a listing of my 'iptables -L' command. It's kind of a mess.

Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp dpt:3689
ACCEPT tcp -- anywhere anywhere tcp spt:3689
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere state NEW

Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp dpt:3689
ACCEPT tcp -- anywhere anywhere tcp spt:3689

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere tcp spt:3689
ACCEPT tcp -- anywhere anywhere tcp dpt:3689

Hopefully someone can make sense of my post and help me figure this out. A quick and dirty iptables tutorial would be nice, but I'm not holding my breath.

Thanks in advance,
Phekno
 
Old 04-06-2004, 12:14 AM   #2
win32sux
Guru
 
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 371Reputation: 371Reputation: 371Reputation: 371
check-out this web-based customized iptables script generator:

http://easyfwgen.morizot.net/gen/
 
Old 04-06-2004, 02:38 PM   #3
bentman78
Member
 
Registered: Mar 2003
Location: Washington DC, USA
Distribution: Redhat
Posts: 212

Rep: Reputation: 30
are you natting? do you have private addesses behind? I.e 192.168.0.0/24?
 
Old 04-06-2004, 10:31 PM   #4
phekno
Member
 
Registered: May 2003
Distribution: Gentoo, Slackware
Posts: 75

Original Poster
Rep: Reputation: 15
I'm kinda "natting." I'm using IP Masquerading which, if I'm not mistaken, is not exactly the same as NAT. Anyway, the firewall is being used as a DHCP server for the internal network too. It will assign IP addresses from 192.168.0.2 - 192.168.0.200 to any system plugged into the internal network.

Hope this helps.

Later,
Phekno
 
Old 04-06-2004, 11:16 PM   #5
win32sux
Guru
 
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 371Reputation: 371Reputation: 371Reputation: 371
okay, so what you're asking is how to forward port 3689 on your gateway to the windows box on the lan, right???

something like this should do it:

iptables -A FORWARD -p tcp -i eth0 --destination-port 3689 --destination 192.168.0.200 -j ACCEPT

iptables -t nat -A PREROUTING -p tcp -i eth0 --destination-port 3689 -j DNAT --to-destination 192.168.0.200:3689
 
Old 04-07-2004, 06:39 AM   #6
bentman78
Member
 
Registered: Mar 2003
Location: Washington DC, USA
Distribution: Redhat
Posts: 212

Rep: Reputation: 30
got there before I did Win32Sux......

I have an iptables firewall doing DHCP and BIND for my internal home network. Those lines Win32SUX put is how you do it. Ensure to put the prerouting rule in.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
punch a hole in a router compzoo Linux - Newbie 4 01-31-2005 09:20 PM
Howto give permission to hole directory js72 Debian 3 12-08-2004 04:50 PM
Howto setup two stage firewall? Linux and router-in-a-box? drdirt Linux - Security 5 01-10-2004 02:51 AM
Mandrake Firewall/router networked to US Robotics 8000A router jrzplace Linux - Networking 0 11-17-2003 04:48 PM
TCP FIREWALL HOLE? tfrye Linux - Security 3 04-24-2001 03:19 AM


All times are GMT -5. The time now is 02:48 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration