ok I know there are a million IPTABLES threads, but.... see inside

*flamesuit on*

i've searched and tried a million different strings and went through a dozen guide's, but I still cant get something to work

i have a fedora machine with two network cards, i am trying to get traffic from one network card across to the other network card



(172.16.19.2)machine-A (http, dns, dhcp, ftp server for machine B)
^
|
|
|
|
(eth0-172.16.19.1)
[router fedora BOX]
(eth1-192.168.43.153)
^
|
|
|
|
machine-B(192.168.43.154)



how can get machine B to be able to get an address (its static for testing), get to the http(9090), ftp(2020), and dns from machine A, there is no internet in this scenario, i presume I need to use forward chains which i've tried over and over again and back to square one.





#### this is what I have so far in my firewall script ####

iptables -F

echo 1 > proc/sys/net/ipv4/ip_forward

iptables -P INPUT DROP

iptables -P OUTPUT ACCEPT

iptables -A INPUT -i lo -j ACCEPT

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED

#HTTP
iptables -A INPUT -p tcp --dport 9090 -j ACCEPT
#FTP
iptables -A INPUT -p tcp --dport 2020 -j ACCEPT
#DNS
#iptables -A INPUT -p tcp --dport 53 -j ACCEPT
#iptables -A INPUT -p udp --dport 53 -j ACCEPT
#DHCP
#iptables -A INPUT -p tcp --dport 67 -j ACCEPT
#iptables -A INPUT -p udp --dport 68 -j ACCEPT

#iptables -A INPUT -j REJECT
#iptables -A FORWARD -j REJECT


### END OF FILE ###


Please.. if anyone can help me out

Originally Posted by alesserfate *flamesuit on* i've searched and tried a million different strings and went through a dozen guide's, but I still cant get something to work i have a fedora machine with two network cards, i am trying to get traffic from one network card across to the other network card (172.16.19.2)machine-A (http, dns, dhcp, ftp server for machine B) ^ | | | | (eth0-172.16.19.1) [router fedora BOX] (eth1-192.168.43.153) ^ | | | | machine-B(192.168.43.154) how can get machine B to be able to get an address (its static for testing), get to the http(9090), ftp(2020), and dns from machine A, there is no internet in this scenario, i presume I need to use forward chains which i've tried over and over again and back to square one. #### this is what I have so far in my firewall script #### iptables -F echo 1 > proc/sys/net/ipv4/ip_forward iptables -P INPUT DROP iptables -P OUTPUT ACCEPT iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -i eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A OUTPUT -m state --state RELATED,ESTABLISHED #HTTP iptables -A INPUT -p tcp --dport 9090 -j ACCEPT #FTP iptables -A INPUT -p tcp --dport 2020 -j ACCEPT #DNS #iptables -A INPUT -p tcp --dport 53 -j ACCEPT #iptables -A INPUT -p udp --dport 53 -j ACCEPT #DHCP #iptables -A INPUT -p tcp --dport 67 -j ACCEPT #iptables -A INPUT -p udp --dport 68 -j ACCEPT #iptables -A INPUT -j REJECT #iptables -A FORWARD -j REJECT ### END OF FILE ### Please.. if anyone can help me out

firstly - turn on logging. it helps massively.
second...

these rules are incorrect

iptables -A FORWARD -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT

why?? because they are saying only related or established connections should be allowed.
RELATED - meaning that the packet is starting a new connection, but is associated with an existing connection.
You would need to add NEW, just in front of RELATED.

the rule would look more like this

iptables -A FORWARD  -i eth0 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD  -i eth1 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

this is one way.


another is to use NAT

iptables -t nat -A POSTROUTING -j SNAT --to-source eth0

#add ports to this for diff services
iptables -A INPUT -o eth1 -d x.x.x.x -dport 21 -m state --state NEW -j ACCEPT

#accept all related/established connections
iptables -m state --state ESTABLISHED,RELATED -j ACCEPT

before you carry on with testing, dont forget to turn on logging.
it implemented correctly, it points straight away to why rules are not working

Thanks so much for your excellent help, here's where I'm at after that:


Hmm... I'm trying to use the NAT method you suggested,

But it's giving me an error at the --to-source option in the POSTROUTING string, so I gave it the 172.16.19.2 IP address (IP of the server, correct ?)

Then it gives me 'multiple -d flags not allowed' in the specific service input chain,

And then a 'no command' specified in the "iptables -m state --state ESTABLISHED,RELATED -j ACCEPT" string.

Originally Posted by alesserfate Thanks so much for your excellent help, here's where I'm at after that: Hmm... I'm trying to use the NAT method you suggested, But it's giving me an error at the --to-source option in the POSTROUTING string, so I gave it the 172.16.19.2 IP address (IP of the server, correct ?) Then it gives me 'multiple -d flags not allowed' in the specific service input chain, And then a 'no command' specified in the "iptables -m state --state ESTABLISHED,RELATED -j ACCEPT" string.

because you have not added the INPUT or OUTPUT or FORWARD or any type of chain rule

Originally Posted by centosboy because you have not added the INPUT or OUTPUT or FORWARD or any type of chain rule

here is a simple tutorial, in case you get stuck

http://www.howtoforge.com/nat_iptables

skip to next post

Just an update, i'm at

iptables -F

echo 1 > /proc/sys/net/ipv4/ip_forward

iptables -P INPUT DROP

iptables -P OUTPUT ACCEPT

iptables -A INPUT -i lo -j ACCEPT

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

iptables -t nat -A POSTROUTING -j SNAT --to-source 172.16.19.2

iptables -A INPUT -o eth1 -d 172.16.19.2 -dport 9090 -m state --state NEW -j ACCEPT
iptables -A INPUT -o eth1 -d 172.16.19.2 -dport 2020 -m state --state NEW -j ACCEPT

and trying to figure out the "'multiple -d flags not allowed'" error in the

iptables -A INPUT -o eth1 -d 172.16.19.2 -dport 9090 -m state --state NEW -j ACCEPT
iptables -A INPUT -o eth1 -d 172.16.19.2 -dport 2020 -m state --state NEW -j ACCEPT

lines

Originally Posted by alesserfate Just an update, i'm at iptables -F echo 1 > /proc/sys/net/ipv4/ip_forward iptables -P INPUT DROP iptables -P OUTPUT ACCEPT iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT iptables -A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT iptables -t nat -A POSTROUTING -j SNAT --to-source 172.16.19.2 iptables -A INPUT -o eth1 -d 172.16.19.2 -dport 9090 -m state --state NEW -j ACCEPT iptables -A INPUT -o eth1 -d 172.16.19.2 -dport 2020 -m state --state NEW -j ACCEPT and trying to figure out the "'multiple -d flags not allowed'" error in the iptables -A INPUT -o eth1 -d 172.16.19.2 -dport 9090 -m state --state NEW -j ACCEPT iptables -A INPUT -o eth1 -d 172.16.19.2 -dport 2020 -m state --state NEW -j ACCEPT lines

iptables -A INPUT -o eth1 -d 172.16.19.2 -dport 9090 -m state --state NEW -j ACCEPT
iptables -A INPUT -o eth1 -d 172.16.19.2 -dport 2020 -m state --state NEW -j ACCEPT

you cant use -o with INPUT.
-dport...should be --dport

Originally Posted by centosboy iptables -A INPUT -o eth1 -d 172.16.19.2 -dport 9090 -m state --state NEW -j ACCEPT iptables -A INPUT -o eth1 -d 172.16.19.2 -dport 2020 -m state --state NEW -j ACCEPT you cant use -o with INPUT. -dport...should be --dport

i've changed that to the -i and to --dport already, and tried to fight with it for a while, its saying Unknown arg '--dport'.

i think the logic here is right, just that the syntax order is incorrect somehow

Originally Posted by alesserfate i've changed that to the -i and to --dport already, and tried to fight with it for a while, its saying Unknown arg '--dport'. i think the logic here is right, just that the syntax order is incorrect somehow

ok, cool...post me the exact command lines being used

I got:

iptables -F

echo 1 > /proc/sys/net/ipv4/ip_forward

#iptables -P INPUT DROP
iptables -P INPUT ACCEPT

iptables -P OUTPUT ACCEPT

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

iptables -A INPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

iptables -t nat -A POSTROUTING -j SNAT --to-source 172.16.19.2

iptables -A INPUT -i eth1 -d 172.16.19.2 --dport 2020 -m state --state NEW -j ACCEPT
iptables -A INPUT -i eth1 -d 172.16.19.2 --dport 9090 -m state --state NEW -j ACCEPT

iptables -I FORWARD -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

iptables is quite complex

the way i learned (and stil am) most rules is by using and examing this script

http://easyfwgen.morizot.net/gen/

it has been really useful for me since it can be very confusing with all the arguments

ive had the same problems like you unknown argument etc
by using this and examing it i learned how to use correct syntax

not really a direct answer to the question but it has really helped me understand iptables better

Originally Posted by Cybrax iptables is quite complex the way i learned (and stil am) most rules is by using and examing this script http://easyfwgen.morizot.net/gen/ it has been really useful for me since it can be very confusing with all the arguments ive had the same problems like you unknown argument etc by using this and examing it i learned how to use correct syntax not really a direct answer to the question but it has really helped me understand iptables better

thanks, it's a useful util, but its concentrating on internet gateway which I already know how to do, what I'm trying to do is get two seperate network segments to communicate (see first post)

Originally Posted by alesserfate thanks, it's a useful util, but its concentrating on internet gateway which I already know how to do, what I'm trying to do is get two seperate network segments to communicate (see first post)

i understand that but the basics of the script is to route one interface to another in your first post u say "i am trying to get traffic from one network card across to the other network card" thats what this does

im using this (modified) script myself to have other machines to use the internet so if you analyze this script and remove the gateway and parts u dont need u should end up with what you want

theres a couple of rules on there that allow traffic from one to the other
also some rules for routing

with the script for example u can route ports from one to another (the option comes as you go on) i use this myself to route ports from the internet so say my workstation.

am i wrong here but isnt that in essence what a router or gateway does

also didnt really mean this specific script as solution but to use parts from it thats how i learned and solved errors

well in any case i hope you solve it i was hoping that script had some lines that could help you debug yours

I don't want to use MASQUERADING, I just want to allow/forward specific services through.

Still can't figure it out. Anyone ?