iptables and ip aliases

SpaceCowboy · 09-09-2004, 03:31 AM

I run my Mandrake 10 box with this ifconfig

Code:

eth0      Link encap:Ethernet  HWaddr 00:A0:A2:00:D8:5C
          inet addr:10.0.0.10  Bcast:10.0.0.255  Mask:255.255.255.0
          inet6 addr: fe80::2a0:a2ff:fe00:d85c/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:124109 errors:0 dropped:0 overruns:0 frame:0
          TX packets:138700 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:41993748 (40.0 Mb)  TX bytes:72004095 (68.6 Mb)
          Interrupt:12 Base address:0x7000

eth0:1    Link encap:Ethernet  HWaddr 00:A0:A2:00:D8:5C
          inet addr:192.168.0.1  Bcast:192.168.0.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:123572 errors:0 dropped:0 overruns:0 frame:0
          TX packets:137775 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:39174113 (37.3 Mb)  TX bytes:68604205 (65.4 Mb)
          Interrupt:12 Base address:0x7000

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:701 errors:0 dropped:0 overruns:0 frame:0
          TX packets:701 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:147283 (143.8 Kb)  TX bytes:147283 (143.8 Kb)

ppp0      Link encap:Point-to-Point Protocol
          inet addr:80.183.4.33  P-t-P:192.168.100.1  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1492  Metric:1
          RX packets:123572 errors:0 dropped:0 overruns:0 frame:0
          TX packets:137775 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:3
          RX bytes:39174113 (37.3 Mb)  TX bytes:68604205 (65.4 Mb)

I use my eth0 to connect my PC to PPP0, and I use eth0:1 to connect Mandrake to a Windows Laptop (IP: 192.168.0.2)

I found this script to enable internet sharing from Mandrake to Windows, and it works well:

Code:

#!/bin/sh
#an iptables rule to enable masquerading:

iptables -t nat -I POSTROUTING -o ppp0 -j MASQUERADE

#enable ip forwarding:

echo 1 > /proc/sys/net/ipv4/ip_forward

# An optional rule to allow the laptop to talk to
# _the desktop for ssh & samba

#windowslaptop
iptables -I INPUT -s 192.168.0.2 -d 192.168.0.1 -j ACCEPT

The question is..

When I try to set a rule like this:

Code:

 iptables -A OUTPUT -o eth0:1 -s 192.168.0.1/24 -d 192.168.0.0/24 -j ACCEPT

I receive this output:

Code:

 Warning: wierd character in interface `eth0:1' (No aliases, :, ! or *).

I don't know very well iptables... Googling around I found iptables doesn't like ip aliases... I looking for a way to write rules without "eth0:1" inside... There's a way to build a firewall/router with this requirements?

1. allow every protocol inside my LAN

2. Protect my LAN from internet.

3. allow my Laptop and my Mandrake BOX to access internet without problem (POP3, FTP, HTTP, P2P)

4. Allow my Mandrake box to accept incoming connection from internet with FTP, HTTP, P2P, WEBMIN etc.

Thank you in advance.

SC

maxut · 09-09-2004, 04:56 AM

iptables -A OUTPUT -o eth0:1 -s 192.168.0.1/24 -d 192.168.0.0/24 -j ACCEPT
what do u want to do?
it is not necessary to block output chain. it is your local output.

eth0:1 doesnt work here too. i dont know if it is possible to use aliased net devices. u can configure your firewall like this without "eth0:1" :

if u want to share your internet securely. u must do that by FORWARD chain.
iptables -F FORWARD # remove all rules in forward chain
iptables -P FOWARD DROP # assing the default policy to drop for FORWARD chain
iptables -A FORWARD -s 192.168.0.0/24 -j ACCEPT # accpet all packets which come from 192.168.0.0/24 and go to other networks (like internet)
iptables -A FORWARD -s 10.0.0.0/24 -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT # allow all established related packets.

now your local networks behind your firewall is in secure enough.

and if u wanna secure your gateway linux, u must do that by INPUT chain:
iptables -F INPUT
iptables -P INPUT DROP
iptables -A INPUT -d lo -j ACCEPT
iptables -A INPUT -s 192.168.0.0/24 -j ACCPET
iptables -A INPUT -s 10.0.0.0/24 -j ACCPET
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

and open necessary ports comes from ppp0 interface like that:
iptables -A INPUT -i ppp0 -p (protocol) --dport (port_no) -j ACCEPT

u can see the porocols and port numbers of services in /etc/services file.
u can add these iptables rules to your iptables scripts.

good luck

SpaceCowboy · 09-09-2004, 07:18 AM

It works!!! (until now :-)

Only a problem..

iptables doesn't like "lo" interface

Code:

iptables v1.2.9: host/network `lo' not found

So I've changed

Code:

iptables -A INPUT -d lo -j ACCEPT

to

Code:

iptables -A INPUT -d 127.0.0.1/255.0.0.0 -j ACCEPT

Now..my script

Code:

#!/bin/sh
#Firewall/router script.. Thanx to maxut and Linuxquestions.org


# if u want to share your internet securely. u must do that by FORWARD chain.
 
iptables -F FORWARD # remove all rules in forward chain
iptables -P FORWARD DROP # assing the default policy to drop for FORWARD chain
iptables -A FORWARD -s 192.168.0.0/24 -j ACCEPT # accept all which come from your net and go to other net (like internet)
iptables -A FORWARD -s 10.0.0.0/24 -j ACCEPT 
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT # allow all established related packets.
 
#now your local networks behind your firewall is in secure enough. 
 
#and if u wanna secure your gateway linux, u must do that by INPUT chain:

iptables -F INPUT
iptables -P INPUT DROP
iptables -A INPUT -d 127.0.0.1/255.0.0.0 -j ACCEPT
iptables -A INPUT -s 192.168.0.0/24 -j ACCEPT
iptables -A INPUT -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#open port:
#rule: iptables -A INPUT -i ppp0 -p (protocol) --dport (port_no) -j ACCEPT

#FTP
iptables -A INPUT -i ppp0 -p tcp --dport 21 -j ACCEPT
#SSH
iptables -A INPUT -i ppp0 -p tcp --dport 22 -j ACCEPT
#SMTP
iptables -A INPUT -i ppp0 -p tcp --dport 25 -j ACCEPT
#HTTP and HTTPS
iptables -A INPUT -i ppp0 -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -i ppp0 -p tcp --dport 443 -j ACCEPT
#POP3
iptables -A INPUT -i ppp0 -p tcp --dport 110 -j ACCEPT
#NTP
iptables -A INPUT -i ppp0 -p tcp --dport 123 -j ACCEPT
#GAIM and C. on M$N
#iptables -A INPUT -i ppp0 -p tcp --dport 1863 -j ACCEPT
#eDonkey-aMule
iptables -A INPUT -i ppp0 -p tcp --dport 4661 -j ACCEPT
iptables -A INPUT -i ppp0 -p tcp --dport 4662 -j ACCEPT
iptables -A INPUT -i ppp0 -p udp --dport 4665 -j ACCEPT
iptables -A INPUT -i ppp0 -p udp --dport 4666 -j ACCEPT
#Webmin
iptables -A INPUT -i ppp0 -p tcp --dport 10000 -j ACCEPT
#FreeDB and CDDB
iptables -A INPUT -i ppp0 -p tcp --dport 888 -j ACCEPT
iptables -A INPUT -i ppp0 -p tcp --dport 8880 -j ACCEPT
#Nicotine/Soulseek
iptables -A INPUT -i ppp0 -p tcp --dport 2234 -j ACCEPT
#DNS
iptables -A INPUT -i ppp0 -p tcp --dport 53 -j ACCEPT

### MASQUERADING ###

# Next, an iptables rule to enable masquerading:

iptables -t nat -I POSTROUTING -o ppp0 -j MASQUERADE

# Finally, enable ip forwarding:

echo 1 > /proc/sys/net/ipv4/ip_forward

I think it's ok now... Any suggestion? What about "lo" interface?

thanks a lot.

SC

SpaceCowboy · 09-09-2004, 08:02 AM

It seems that I can't connect to my ppp0 address (every protocol fails: FTP, HTTP..etc)

So I think I'm unreachable from internet.. What's gone wrong?

thanx

SC

SpaceCowboy · 09-09-2004, 07:48 PM

I found this workaround:

Code:

iptables -A INPUT -s $EXTIP -j ACCEPT

$EXTIP is obtained with

Code:

EXTIP="`/sbin/ifconfig ppp0 | grep 'inet addr' | awk '{print $2}' | sed -e 's/.*://'`"

If I understand well, This rule allow every INPUT from my external IP (my ppp0 IP)

Now, Another question: Is this rule secure.. Or have I to allow only some protocol?

Thanx!!!

SC

r_213 · 09-09-2004, 11:29 PM

Can u send the contents of /proc/net/dev of the machine from where u have executed the ifconfig command.

Thank U in advance.
Regrads,
-Ranganathan.

maxut · 09-10-2004, 01:39 AM

Quote:

Originally posted by SpaceCowboy

Only a problem..

iptables doesn't like "lo" interface

Code:

iptables v1.2.9: host/network `lo' not found

So I've changed

Code:

iptables -A INPUT -d lo -j ACCEPT

to

Code:

iptables -A INPUT -d 127.0.0.1/255.0.0.0 -j ACCEPT

sorry, it was my mistake.

it should be

Code:

iptables -A INPUT -i lo -j ACCEPT

but your rule (-d 127.0.0.1) is ok too.

u should allow only certain protocols. like this:
iptables -A INPUT -i ppp0 -p tcp --dport 21 -j ACCEPT # do this, if u have a ftp server on gateway box
iptables -A INPUT -i ppp0 -p tcp --dport 80 -j ACCEPT # do this, if u have http server on gateway box

addational info:
if u have a server behind your firewall u can forward that service port.
iptables -t nat -A PREROUTING -i ppp0 -p tcp --dport 80 -j DNAT --to 192.168.0.10
this will forward http packets (tcp 80) to 192.168.0.10 if packets come to ppp0.

also u dont have to type $EXTIP, u can use device name. like ppp0.
and u mustnt use :
iptables -A INPUT -i ppp0 -j ACCEPT
if u do, u will allow everthing comes from external network to gateway box.. it is not recommended.

SpaceCowboy · 09-14-2004, 04:53 AM

Quote:

and u mustnt use :
iptables -A INPUT -i ppp0 -j ACCEPT
if u do, u will allow everthing comes from external network to gateway box.. it is not recommended.

Yes, Ok.. I don't use "-i ppp0" but "-s $EXTIP"

I think it means "accept all packets coming from the source $EXTIP", right?

And when I type iptables -L I found this line about it:

Code:

ACCEPT     all  --  host100-11.pool8000.myserver.com  anywhere

I don't know why, but I can't connect to myself using my no-ip account (if I type ftp://myaccount.no-ip.com from my mandrakeBox), without this rule!! (But FROM OUTSIDE I think all is ok, I tested my firewall using https://grc.com/x/ne.dll?bh0bkyd2 )

Thank you all!

SC

maxut · 09-14-2004, 07:17 AM

Quote:

Originally posted by SpaceCowboy
Yes, Ok.. I don't use "-i ppp0" but "-s $EXTIP"

I think it means "accept all packets coming from the source $EXTIP", right?

surely u r right.

SpaceCowboy · 09-14-2004, 11:03 AM

uh? Ok .. I'm right!

Thanks a lot!

SC