|
Iptables Roach Motel: Stuff gets in, can't get out.
I've got an iptables firewall set up on my Linux box, which serves as a gateway to the internet. The internet side is eth1, with a DHCP address in the range 66.235.0.0/16. The local network side is eth0, with a static address of 192.168.0.4. I'm running a server on the local network at 192.168.0.6:8333 that I want to make available to the internet. To test the server from the outside, I've set up a CGI-based reflector on an outside server that initiates requests and forwards responses back to my browser. I've done this before, so I know this part works reliably. What's happening is that the outside requests are getting through and logging on the local server, but the server's responses are not making it back out to the requestor. Here's a dump of my iptables:
***NAT***
Chain PREROUTING (policy ACCEPT 951 packets, 77717 bytes)
pkts bytes target prot opt in out source destination
2 120 DNAT tcp -- eth1 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:8333 to:192.168.0.6:8333
Chain POSTROUTING (policy ACCEPT 66 packets, 8576 bytes)
pkts bytes target prot opt in out source destination
296 22030 MASQUERADE all -- * eth1 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 252 packets, 24084 bytes)
pkts bytes target prot opt in out source destination
***FILTER***
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- eth1 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:9090 flags:0x16/0x02
15616 2925K FIREWALL all -- * * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- eth1 eth0 0.0.0.0/0 0.0.0.0/0 tcp dpt:8333
923 209K ACCEPT all -- eth0 eth1 0.0.0.0/0 0.0.0.0/0
1030 560K FIREWALL all -- * * 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
16309 3742K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain FIREWALL (2 references)
pkts bytes target prot opt in out source destination
9583 1874K ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
5203 757K ACCEPT all -- eth0 * 0.0.0.0/0 0.0.0.0/0
0 0 DROP all -- eth1 * 192.168.0.0/24 0.0.0.0/0
46 9566 ACCEPT udp -- eth1 * 66.235.59.6 0.0.0.0/0 udp spt:53
7 1732 ACCEPT udp -- eth1 * 66.235.59.7 0.0.0.0/0 udp spt:53
0 0 ACCEPT udp -- eth1 * 66.235.63.2 0.0.0.0/0 udp spt:53
0 0 ACCEPT udp -- eth1 * 66.235.63.4 0.0.0.0/0 udp spt:53
1 76 ACCEPT udp -- eth1 * 0.0.0.0/0 0.0.0.0/0 udp spt:123
144 35956 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT tcp -- eth0 * 192.168.0.0/24 0.0.0.0/0 tcp flags:0x16/0x02
0 0 ACCEPT tcp -- lo * 192.168.0.0/24 0.0.0.0/0 tcp flags:0x16/0x02
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x16/0x02
1662 807K ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 0
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 3
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 4
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 11
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 12
0 0 DROP icmp -- * * 0.0.0.0/0 0.0.0.0/0
Perhaps someone more experienced than I am can see where I've blundered.
Thanks,
Phil
|
