LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
LinkBack Search this Thread
Old 11-09-2002, 01:50 AM   #1
chris200t
LQ Newbie
 
Registered: Nov 2002
Distribution: Redhat 8.0
Posts: 4

Rep: Reputation: 0
IPTABLES rule file (need help)




Okay I setup IPTABLES and want it to use the
/etc/sysconfig/iptables rule file as I am useing webmin and thats the file it updates. But I am geting a error. Here is what happens

[root@router rc3.d]# ./S09iptables restart
Flushing all current rules and user defined chains: [ OK ]
Clearing all current rules and user defined chains: [ OK ]
Applying iptables firewall rules: iptables-restore v1.2.6a: Line 3 seems to have a -t table option.

Try `iptables-restore -h' or 'iptables-restore --help' for more information.
[FAILED]
[root@router rc3.d]#


Okay here is the /etc/sysconfig/iptables file what am I doing wrong?

-------------------------
# Generated by iptables-save v1.2.5 on Wed Oct 16 17:47:42 2002
*nat
:PREROUTING ACCEPT [11:1351]
-A PREROUTING -t nat -p tcp -d 4.3.2.2 --dport 4899 -j DNAT --to 192.168.4.100:4899
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT
# Completed on Wed Oct 16 17:47:42 2002
# Generated by iptables-save v1.2.5 on Wed Oct 16 17:47:42 2002
*filter
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A FORWARD -m state -i eth0 -o eth1 --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -i eth1 -o eth0 -j ACCEPT
-A FORWARD -m state -i eth0 -o eth2 --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -i eth2 -o eth0 -j ACCEPT
-A FORWARD -m state -i eth0 -o eth3 --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -i eth3 -o eth0 -j ACCEPT
-A FORWARD -m state -i eth0 -o eth4 --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -i eth4 -o eth0 -j ACCEPT
-A FORWARD -p tcp -m tcp -s 192.168.1.0/24 ! -d 192.168.1.0/24 --dport 41031:41900 -j REJECT
-A FORWARD -p tcp -m tcp -m state -i eth0 -o eth4 --dport 4899 --state NEW,ESTABLISHED,RELATED -j ACCEPT -tcp
COMMIT
# Completed on Wed Oct 16 17:47:42 2002
# Generated by webmin
*mangle
:OUTPUT ACCEPT [0:0]
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:INPUT ACCEPT [0:0]
COMMIT
# Completed
-----------------------

What is wrong with this????
 
Old 11-09-2002, 07:35 AM   #2
peter_robb
Senior Member
 
Registered: Feb 2002
Location: Szczecin, Poland
Distribution: Gentoo, Debian
Posts: 2,458

Rep: Reputation: 47
The third line is a rule.
It belongs after the last policy reference...
and doesn't have a '-t nat" in the line.
Sould be...

*nat
:PREROUTING ACCEPT [11:1351]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A PREROUTING -p tcp -d 4.3.2.2 --dport 4899 -j DNAT --to 192.168.4.100:4899
COMMIT
# Completed on Wed Oct 16 17:47:42 2002

Last edited by peter_robb; 11-09-2002 at 07:37 AM.
 
Old 11-09-2002, 07:38 AM   #3
Griffon26
Member
 
Registered: Sep 2001
Location: The Netherlands
Distribution: Gentoo, Debian, Mandrake, LFS
Posts: 182

Rep: Reputation: 30
If you ask me you shouldn't be editing this file directly at all.

I think the best way is to create the rules through a script and then save them.
 
Old 11-09-2002, 07:59 AM   #4
peter_robb
Senior Member
 
Registered: Feb 2002
Location: Szczecin, Poland
Distribution: Gentoo, Debian
Posts: 2,458

Rep: Reputation: 47
It's an interesting ruleset...

With a FORWARD policy ACCEPT, there is no need to write ACCEPT rules, unless your last rule is a DROP or REJECT
PREROUTING handles the destination changes.

I personally find it easier (& clearer) to always use interface references in rules so I can be sure which packets are being defined.
I will only make 1 rule when all 3 interfaces have the same definition.

So this line may be confusing unless you remember which packets you are refering to
-A FORWARD -p tcp -m tcp -s 192.168.1.0/24 ! -d 192.168.1.0/24 --dport 41031:41900 -j REJECT

I personally edit this file directly rather than using a script, to avoid having the delay of flushing and clearing and reloading.
I'll enter the rule by the command line then add it to this file if it works.
If you keep a good backup/copy habit going, you'll only make small mistakes...
 
Old 11-09-2002, 02:30 PM   #5
chris200t
LQ Newbie
 
Registered: Nov 2002
Distribution: Redhat 8.0
Posts: 4

Original Poster
Rep: Reputation: 0
Quote:
Originally posted by peter_robb
The third line is a rule.
It belongs after the last policy reference...
and doesn't have a '-t nat" in the line.
Sould be...

*nat
:PREROUTING ACCEPT [11:1351]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A PREROUTING -p tcp -d 4.3.2.2 --dport 4899 -j DNAT --to 192.168.4.100:4899
COMMIT
# Completed on Wed Oct 16 17:47:42 2002
Ahhh I see will this rule allow me to nat inbound to the hosting service at IP 192.168.4.100 on port 4899
4899=radmin for a win2k server..
 
Old 11-11-2002, 02:33 PM   #6
peter_robb
Senior Member
 
Registered: Feb 2002
Location: Szczecin, Poland
Distribution: Gentoo, Debian
Posts: 2,458

Rep: Reputation: 47
Dunno if I am qualified enough to answer that...

I am used to Micro$oft using a lot of udp services and several ports, 1 for connect and 1 for data etc...
That rule will certainly pass the port, if all the conditions are met...

I don't usually do the -d x.x.x.x in the rule tho'.
I have separate filtering, eg 'rp_filter' and a "-d ! x.x.x.x -j DROP" to catch people trying to use me as a gateway from the internet.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are Off
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
help with iptables rule!! vishamr2000 Linux - Security 6 11-09-2005 05:34 AM
iptables rule order Kumado Linux - Security 4 10-13-2005 11:12 PM
iptables rule to let samba in phishintrip Linux - Networking 7 10-17-2003 10:25 AM
IPTables Rule... Grim Reaper Linux - Software 8 04-28-2003 12:20 PM
iptables rule order dunkyb Linux - Security 2 03-21-2003 07:56 AM


All times are GMT -5. The time now is 05:38 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration