iptables: about FORWADING and nat

win32sux · 05-13-2005, 05:19 AM

since there's no REJECT rules in the script, i'd have to say i believe the issue is at 172.16.0.2 (maybe there isn't even an ssh daemon running at that address)...

if the packet was getting dropped by this script you'd be getting a timeout and not a refusal...

win32sux · 05-13-2005, 05:24 AM

Quote:

Originally posted by fei
I think some thing wrong the the server 172.16.0.2, not your fault. I'll try to fix it.

Seriously, Thanks for your help. It might took me forever to do it. It's so hard to understand how iptables works. Especially, FORWARD and nat.

yeah, i had figured that: http://www.linuxquestions.org/questi...28#post1640328

hehe... still, the script you had was a mess, i know the one i posted will work much better for you, and it's much cleaner so you'll be able to understand it better... let me know if you have any questions about the script (or about iptables in general) and i'll be glad to do my best and answer them to help you get the hang of iptables...

good luck...

fei · 05-13-2005, 05:28 AM

Some thing is wrong with 172.16.0.2. It should work at the first time you gave the code, if I could enabled ip_forward. There are so many things I need to know to solve a single prolbem. If I don't know enought, I cann't even find out what causes the problem.

One last thing. I'm really like playing with firewall. Do you know any good resource to learn iptables. (not doc on the http://netfilter.org. all the docs are leaking details of explanation for what's really going on).

win32sux · 05-13-2005, 05:34 AM

well, this tutorial is a very popular link here at LQ:

http://iptables-tutorial.frozentux.n...-tutorial.html

personally i haven't read it, but it's always recommended by folks here at LQ...

feel free to ask me any iptables questions you want... i'll be back online when i wake-up, i'm going to sleep now... take care buddy... buh-bye...

win32sux · 05-13-2005, 05:41 PM

i've added a few things to the script which i accidentally left-out yesterday cuz i was so sleepy:

- added input rule for loopback interface (very important)...

- added "--sport 68" to the dhcp input rule cuz that's what dhcp packets look like, they come from port 68 and into port 67...

- added "new not syn" input rule to drop any packets of state NEW which aren't SYN...

you can get the updated script at the same place:

http://www.linuxquestions.org/questi...70#post1640370

fei · 05-22-2005, 08:35 PM

Hi, win32sux. I've got the forward and nat working properly. BUT, There is still one thing bothering me for a long time.

Code:

    # (1) allow ssh from ralf to client1
    $IPTABLES -A INPUT -i $EthernetIface -p tcp --sport 22 -j ACCEPT
    $IPTABLES -A OUTPUT -o $EthernetIface -p tcp --dport 22 -j ACCEPT
    
    # (2) allow ssh from client1 to ralf
    $IPTABLES -A INPUT -i $EthernetIface -p tcp --dport 22  -j ACCEPT
    $IPTABLES -A OUTPUT -o $EthernetIface -p tcp --sport 22 -j ACCEPT

The above code is the partial code I wrote originally by myself. In order to allow ssh from ralf to client1, I need to specify the first rule in the firewall. The thing I can only check it's tcp and with source port 22, but I cann't check destination port 22. So the code will be like this:

Code:

    # (1) allow ssh from ralf to client1
    $IPTABLES -A INPUT -i $EthernetIface -p tcp --sport 22 --dport 22 -j ACCEPT
    $IPTABLES -A OUTPUT -o $EthernetIface -p tcp --dport 22 --sport 22 -j ACCEPT

If I specify the rule like this, then both of the rules will be the same. This doesn't seem right.

I don't know if I explained clearly.

The question is how I can know when to check source port only and when to check destination port only??

Thanks.

win32sux · 05-22-2005, 10:30 PM

Quote:

Originally posted by fei
Hi, win32sux. I've got the forward and nat working properly. BUT, There is still one thing bothering me for a long time.

Code:

# (1) allow ssh from ralf to client1 $IPTABLES -A INPUT -i $EthernetIface -p tcp --sport 22 -j ACCEPT $IPTABLES -A OUTPUT -o $EthernetIface -p tcp --dport 22 -j ACCEPT # (2) allow ssh from client1 to ralf $IPTABLES -A INPUT -i $EthernetIface -p tcp --dport 22 -j ACCEPT $IPTABLES -A OUTPUT -o $EthernetIface -p tcp --sport 22 -j ACCEPT

The above code is the partial code I wrote originally by myself. In order to allow ssh from ralf to client1, I need to specify the first rule in the firewall. The thing I can only check it's tcp and with source port 22, but I cann't check destination port 22. So the code will be like this:

Code:

# (1) allow ssh from ralf to client1 $IPTABLES -A INPUT -i $EthernetIface -p tcp --sport 22 --dport 22 -j ACCEPT $IPTABLES -A OUTPUT -o $EthernetIface -p tcp --dport 22 --sport 22 -j ACCEPT

If I specify the rule like this, then both of the rules will be the same. This doesn't seem right.

I don't know if I explained clearly.

The question is how I can know when to check source port only and when to check destination port only??

Thanks.

you aren't specifying any host on any of those rules, so i'm not sure where "ralf" is... the rule i placed in the script would allow SSH coming into $EthernetIface, but (at least) it would check to make sure it was coming from an IP in subnet $EthernetIPs:

Code:

$IPTABLES -A INPUT -p TCP -i $EthernetIface -s $EthernetIPs --dport 22 \
-m state --state NEW -j ACCEPT

if you need to specify the IP of the host you want to allow to connect via SSH just use the host's IP instead of the subnet, like:

Code:

$IPTABLES -A INPUT -p TCP -i $EthernetIface -s 192.168.1.104 --dport 22 \
-m state --state NEW -j ACCEPT

also, you don't need to include any OUTPUT rule when the policy is ACCEPT - it's pointless...

BTW, these rules you've posted aren't checking for the packet's state, kinda defeats the purpose of having a packet-state filtering firewall... those rules are part of the ones i erased when i cleaned-up your script as they didn't make any sense...

as for the source ports: it depends, some connection types always use the same source port, some don't... you need to read docs in order to know which... for example, DHCP will use source port 68 by standard, but SSH won't use any specific source port so using a "--sport 22" in your SSH rules will give you nothing but headaches...