Hi

1) I have proxy squid server centos 5.3 say A having 2 network interface eth0 conneted to local lan and eth1 to to isp line in this server ip-forwading is enable to transfer traffic from lan to wan i.e from
etho to eth1 in same server we have iptable i.e firewall configure , we have one static ip

2) we have another server having centos 5.3 Say B
having ip 192.168.1.3 which is in our Lan

my query is that i want to access server B having ip 192.168.1.3 from ouside i.e from internet

i think i have to do port forwading in server A but how should i write rule in iptable

AMAR

What you need is NAT in addition to allowing ipforwarding in your kernel. The NAT function will translate addresses from the LAN domain (192.168.1.x) to the IP address of your ISP facing interface. This is easily done with Linux and Iptables using the MASQUERADE function in the NAT table (which is separate from the INPUT,OUTPUT,FORWARD) table. You will then need to configure your machine B to use machine A as the internet gateway.

Here is a link to a how to that describes the necessary steps: https://help.ubuntu.com/community/In...nectionSharing It has more detail than I think you need, but it does cover all of the aspects you require. Here is another one that distills it down to the core steps: http://null-byte.wonderhowto.com/blo...vices-0130528/

Hi

i want open port on server A i fire rule as

iptables -A INPUT -p tcp --dport 5050 -j ACCEPT

/etc/init.d/iptables save

service iptables restart

when i check port status by NmapFe on server it still shows me status closed?
AMAR

Even if you open a port in your firewall, unless there is an application actively accepting connections on that port it will show as closed. In fact, if the port is blocked by your firewall it may show as filtered instead of closed (see: http://nmap.org/book/man.html)
Try the output of the following (may need to run as root)
This will tell you if any application is listening on port 5050.

Hi

i checked with netstat -pane | grep 5050 it shows nothing

That would explain the state of the port. No application is listening on that port, hence it is closed but not blocked by your firewall. If you expected an application to be available at this port, you should look at the configuration file and see what interface and / or port it has bound to. You could also grep for the name of the application instead of 5050 in the above command to see if it is listening elsewhere.

Hi

i remove the iptable rule for port 5050 and add port 5050 in apache conf file i.e httpd.conf

for testing purpose ,when i check the apache web page with port with 5050 it is working and in nmapfe it shows port 5050 is open state but how it possible as i not open port 5050 in iptable .

so i add iptables -A INPUT -p tcp --dport 5050 -j REJECT

but still the apache page is open with 5050 how it is possible

AMAR

There are two possibilities. The first one is the trivial case, are you scanning with the server from a different machine that is OUTSIDE of your firewall? The second possibility is that your Iptables rules aren't working as intended. If there is a rule above the blocking rule that causes traffic to be accepted, the lower rule won't even be analyzed. If you need help analyzing the firewall function, please output of iptables -L.

Hi

i check on same server not from outside

output of iptables -L is as follows--

iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
RH-Firewall-1-INPUT all -- anywhere anywhere
REJECT tcp -- anywhere anywhere tcp dpt:mmcc reject-with icmp-port-unreachable

Chain FORWARD (policy ACCEPT)
target prot opt source destination
RH-Firewall-1-INPUT all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Chain RH-Firewall-1-INPUT (2 references)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere icmp any
ACCEPT esp -- anywhere anywhere
ACCEPT ah -- anywhere anywhere
ACCEPT udp -- anywhere 224.0.0.251 udp dpt:mdns
ACCEPT udp -- anywhere anywhere udp dpt:ipp
ACCEPT tcp -- anywhere anywhere tcp dpt:ipp
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited



and when i check iptables file in /etc/sysconfig the content of iptable file shows as follows---

# Generated by iptables-save v1.3.5 on Sun Feb 12 01:13:29 2012
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [25:1654]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A INPUT -p tcp -m tcp --dport 5050 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p esp -j ACCEPT
-A RH-Firewall-1-INPUT -p ah -j ACCEPT
-A RH-Firewall-1-INPUT -d 224.0.0.251 -p udp -m udp --dport 5353 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Sun Feb 12 01:13:29 2012

This is the problem. The second rule is not being used. since all packets are matching the first rule and jumping to "RH-Firewall-1".

In order to keep with the existing rules, you need to add your rule to RH-Firewall-1 not INPUT.

hi

i added rule as

iptables -A RH-Firewall-1-INPUT -p udp -m udp --dport 6565 -j REJECT

still the apache is open at port 6565

iptables file shows now



# Generated by iptables-save v1.3.5 on Sun Feb 12 01:44:08 2012
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [21:12386]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A INPUT -p tcp -m tcp --dport 5050 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p esp -j ACCEPT
-A RH-Firewall-1-INPUT -p ah -j ACCEPT
-A RH-Firewall-1-INPUT -d 224.0.0.251 -p udp -m udp --dport 5353 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
-A RH-Firewall-1-INPUT -p udp -m udp --dport 6565 -j REJECT --reject-with icmp-port-unreachable
COMMIT
# Completed on Sun Feb 12 01:44:08 2012

Same problem...
Think about how iptables works. It processes a packet by comparing it to the rules SEQUENTIALLY. If you have a catch all drop rule, any rules for allowed packets, need to go before it.

You need to remove the rules you have attempted, in the interests of neatness.
Then insert (-I) rather than append (-A) the rule in position above the drop all rule, with something to the effect of:

Thanks fukawi1!!!!

solved !!!!

one thing want to discuss that iptable rule is process from top to bottom sequentially if
i have rule one to accept packet at eth0 and
other rule below is same as first rule but it deny packet at etho
then in this case my packet is accept
but not deny by following first rule it is correct?

Correct, the first rule that matches is applied to the packet.
In the chain order shown here

1 members found this post helpful.

Thanks!!1