iptables

uguoT · 02-17-2006, 02:29 AM

iptables -L tcp_packets
Chain tcp_packets (1 references)
target prot opt source destination
allowed tcp -- unknown/24 anywhere tcp dpt:ftp
allowed tcp -- unknown/24 anywhere tcp dpt:ssh
........

Why my source ip is unknown? I have another machine with almost the same configuration (patched for TTL support only) and everithing is fine??

Slackware 10.2 (current); iptables 2.3.3 ; kernel 2.4.31

Thanks!

win32sux · 02-17-2006, 10:04 PM

welcome to LQ!!!

Quote:

Originally Posted by uguoT

iptables -L tcp_packets
Chain tcp_packets (1 references)
target prot opt source destination
allowed tcp -- unknown/24 anywhere tcp dpt:ftp
allowed tcp -- unknown/24 anywhere tcp dpt:ssh
........

Why my source ip is unknown? I have another machine with almost the same configuration (patched for TTL support only) and everithing is fine??

Slackware 10.2 (current); iptables 2.3.3 ; kernel 2.4.31

Thanks!

please show us what the actual commands you've run for chain tcp_packets look like... it would also help to know your network configuration...

is it slackware-current or 10.2?? it can't be both...

BTW, i assume you mean iptables 1.3.3, right??

uguoT · 02-21-2006, 01:31 AM

It's Slack current sorry. Iptables 1.3.3. Here's the script:

Quote:

#!/bin/sh

INET_IFACE="eth0"

DHCP="yes"
DHCP_SERVER=""

PPPOE_PMTU="no"

LAN_IP="192.168.0.1"
LAN_IP_RANGE="192.168.0.0/16"
LAN_IFACE="eth1"

LO_IFACE="lo"
LO_IP="127.0.0.1"

IPTABLES="/usr/sbin/iptables"

echo "1" > /proc/sys/net/ipv4/ip_forward
echo "1" > /proc/sys/net/ipv4/ip_dynaddr

$IPTABLES -F INPUT
$IPTABLES -F OUTPUT
$IPTABLES -F FORWARD
$IPTABLES -t mangle -F mark-out
$IPTABLES -t mangle -F POSTROUTING

$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP

$IPTABLES -N bad_tcp_packets

$IPTABLES -N allowed
$IPTABLES -N tcp_packets
$IPTABLES -N udp_packets
$IPTABLES -N icmp_packets

$IPTABLES -A bad_tcp_packets -p tcp --tcp-flags SYN,ACK SYN,ACK \
-m state --state NEW -j REJECT --reject-with tcp-reset
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG \
--log-prefix "[IPTABLES BAD_TCP_PACKETS] : "
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP

$IPTABLES -A allowed -p TCP --syn -j ACCEPT
$IPTABLES -A allowed -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A allowed -p TCP -j DROP

$IPTABLES -A tcp_packets -p TCP -s 192.168.2.0/16 --dport 21 -j allowed
$IPTABLES -A tcp_packets -p TCP -s 192.168.2.0/16 --dport 22 -j allowed
$IPTABLES -A tcp_packets -p TCP -s 192.168.0.0/16 --dport 80 -j allowed
$IPTABLES -A tcp_packets -p TCP -s 192.168.2.0/16 --dport 2401 -j allowed

$IPTABLES -A udp_packets -p UDP -s 192.168.0.0/16 --source-port 53 -j ACCEPT

$IPTABLES -A INPUT -p tcp -j bad_tcp_packets

$IPTABLES -A INPUT -p ALL -i $LAN_IFACE -s $LAN_IP_RANGE -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -j ACCEPT

$IPTABLES -A INPUT -p ALL -i $INET_IFACE -m state --state ESTABLISHED,RELATED \
-j ACCEPT
$IPTABLES -A INPUT -p TCP -i $INET_IFACE -j tcp_packets
$IPTABLES -A INPUT -p UDP -i $INET_IFACE -j udp_packets
$IPTABLES -A INPUT -p ICMP -i $INET_IFACE -j icmp_packets

$IPTABLES -A INPUT -i $INET_IFACE -d 224.0.0.0/8 -j DROP

$IPTABLES -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG \
--log-level DEBUG --log-prefix "[IPTABLES INPUT] : "

$IPTABLES -A FORWARD -p tcp -j bad_tcp_packets

$IPTABLES -A FORWARD -i $LAN_IFACE -j ACCEPT
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

$IPTABLES -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG \
--log-level DEBUG --log-prefix "[IPTABLES FORWARD] : "

$IPTABLES -A OUTPUT -p tcp -j bad_tcp_packets

$IPTABLES -A OUTPUT -p ALL -s $LO_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $LAN_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -o $INET_IFACE -j ACCEPT

$IPTABLES -A OUTPUT -m limit --limit 3/minute --limit-burst 3 -j LOG \
--log-level DEBUG --log-prefix "[IPTABLES OUTPUT] : "

if [ $PPPOE_PMTU == "yes" ] ; then
$IPTABLES -t nat -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN \
-j TCPMSS --clamp-mss-to-pmtu
fi
$IPTABLES -t nat -A POSTROUTING -o $INET_IFACE -j MASQUERADE

$IPTABLES -t mangle -N mark-out

Result:

Quote:

Chain tcp_packets (1 references)
target prot opt source destination
allowed tcp -- unknown/16 anywhere tcp dpt:ftp
allowed tcp -- unknown/16 anywhere tcp dpt:ssh
allowed tcp -- unknown/16 anywhere tcp dpt:http
allowed tcp -- unknown/16 anywhere tcp dpt:cvspserver
...
...
..

win32sux · 02-21-2006, 01:44 AM

check if it still happens if you do this before running the script:

Code:

echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter

also, check using an "-n":

Code:

iptables -n -L tcp_packets

BTW, please post the ifconfig for your LAN interface...

uguoT · 02-21-2006, 02:06 AM

With "-n" everything is OK.. The question is why without it doesn't work on this pc?

eth1: ip-192.168.0.1 ; mask-255.255.0.0

win32sux · 02-21-2006, 02:16 AM

did the rp_filter option have any effect??

i'm not sure why this is happening to you... but i suspect that, considering it works fine with "-n" , it might have something to do with your DNS... from "man iptables":

Quote:

-n, --numeric
Numeric output. IP addresses and port numbers will be printed
in numeric format. By default, the program will try to display
them as host names, network names, or services (whenever appli-
cable).

uguoT · 02-21-2006, 02:31 AM

Yes I know what is -n for

. BTW rp_filter helped and now it's OK. Thanks.

win32sux · 02-21-2006, 02:46 AM

Quote:

Originally Posted by uguoT

Yes I know what is -n for

. BTW rp_filter helped and now it's OK. Thanks.

awesome!!! glad to help!!!

as for the rp_filter fixing this, it would be great if you (or anyone else that knows) could post a quick explanation as to exactly why this behaviour was occurring and why it gets fixed with rp_filter...

BTW, i didn't mean to imply you didn't know what "-n" is for - please remember that this stuff gets read by many different people, so it's good to be a little verbose when posting...