LinuxQuestions.org - Server from inside LAN

Page 3 of 4

Show 50 post(s) from this thread on one page

- Linux - Networking (https://www.linuxquestions.org/questions/linux-networking-3/)

- - Server from inside LAN (https://www.linuxquestions.org/questions/linux-networking-3/server-from-inside-lan-248836/)

andrewjjones

01-09-2005 06:14 PM

Quote:

Post your complete iptable rules.

These are run each time the machine is turned on:

Code:

iptables -N log_n_drop

iptables -N log_n_pass

iptables -P INPUT DROP

iptables -P OUTPUT ACCEPT

iptables -P FORWARD DROP

iptables -t nat -P PREROUTING ACCEPT

iptables -t nat -P POSTROUTING ACCEPT

iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE

iptables -A log_n_pass -m limit --limit 6/m --limit-burst 2 -j LOG --log-level info --log-prefix "ACCEPTED:"

iptables -A log_n_pass -j ACCEPT

iptables -A log_n_drop -m limit --limit 12/m --limit-burst 2 -j LOG --log-level info --log-prefix "DROPPED:"

iptables -A log_n_drop -j DROP

iptables -A INPUT -i lo -s 127.0.0.1 -j ACCEPT

iptables -A INPUT -m state --state INVALID -j DROP

iptables -A INPUT -i ppp0 -m state --state NEW -j log_n_drop

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A INPUT -i wlan0 -s 192.168.0.0/24 -j log_n_pass

iptables -A FORWARD -m state --state INVALID -j DROP

iptables -A FORWARD -i ppp0 -m state --state NEW -j log_n_drop

iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A FORWARD -i wlan0 -s 192.168.0.0/24 -j log_n_pass

And then I manually enter the ones from this thread.

Quote:

Does your ISP block port 80 traffic?

Not that I know of. I have run a web server before when I had the modem connected directly to my computer.

michaelk

01-09-2005 06:57 PM

I'm no expert on this stuff but I see a potential problem.
iptables -A INPUT -i ppp0 -m state --state NEW -j log_n_drop

Anybody trying to access the webserver will be a new connection and therefore will be dropped. Try changing it to log_n_pass.

andrewjjones

01-14-2005 05:01 PM

At the moment there is a script that runs when the computer starts up, which executes the iptables commands to set up the network etc. (they are the commands I posted). If I type the 'log_n_pass' line after this script has run, should it work? That is, if I ttype that line, will it replace the old 'log_n_drop' command?

micxz

01-14-2005 05:15 PM

What you really should do is configure the firewall script that came with your distro. e.g. shorewall? I think that's the one on Mandrake.

Or if you like the rule set and simply need to delete a rule. go `iptables -L --line-numbers` and the find the line you want to delete and do a 'iptables -D chain rulenum' chain being the chain name and rulenum being the numbered line on that chain. I hope this is clear.

andrewjjones

01-15-2005 12:30 PM

This is the output of 'iptables --list --line-numbers':

Code:

Chain INPUT (policy DROP)

num  target    prot opt source              destination        

1    ACCEPT    all  --  localhost            anywhere            

2    DROP      all  --  anywhere            anywhere            state INVALID 

3    log_n_drop  all  --  anywhere            anywhere            state NEW 

4    ACCEPT    all  --  anywhere            anywhere            state RELATED,ESTABLISHED 

5    log_n_pass  all  --  localnet/24          anywhere            



Chain FORWARD (policy DROP)

num  target    prot opt source              destination        

1    DROP      all  --  anywhere            anywhere            state INVALID 

2    log_n_drop  all  --  anywhere            anywhere            state NEW 

3    ACCEPT    all  --  anywhere            anywhere            state RELATED,ESTABLISHED 

4    log_n_pass  all  --  localnet/24          anywhere            



Chain OUTPUT (policy ACCEPT)

num  target    prot opt source              destination        



Chain log_n_drop (2 references)

num  target    prot opt source              destination        

1    LOG        all  --  anywhere            anywhere            limit: avg 12/min burst 2 LOG level info prefix `DROPPED:' 

2    DROP      all  --  anywhere            anywhere            



Chain log_n_pass (2 references)

num  target    prot opt source              destination        

1    LOG        all  --  anywhere            anywhere            limit: avg 6/min burst 2 LOG level info prefix `ACCEPTED:' 

2    ACCEPT    all  --  anywhere            anywhere

What should I delete? I suppose I need to delete INPUT 3 and FORWARD 2, but what about the log_n_drop chains?

andrewjjones

01-16-2005 03:00 PM

I have just tried deleting the log_n_drop line (INPUT 3) and then typing in the new iptables commands. But then I can't get on the internet!

andrewjjones

01-17-2005 03:40 PM

Right then. I have restarted the computer so it is back to normal. Then I've typed this, in this order:

1. iptables -t nat -A PREROUTING -i ppp0 -p tcp --dport 80 -j DNAT --to 192.168.0.1:80
2. iptables -A FORWARD -p tcp -i ppp0 -d 192.168.0.1 --dport 80 -j ACCEPT
3. echo 1 > /proc/sys/net/ipv4/ip_forward
4. iptables --delete INPUT 3 [the 3 log_n_drop all -- anywhere anywhere state NEW line]
5. iptables -A INPUT -i ppp0 -m state --state NEW -j log_n_pass

After this, the internet works okay, but going to the gateway's external ip does not load the page from my web server.

Fle><

01-17-2005 04:14 PM

took me some time to read all your posts ;)
but I think I found something you all haven't looked at: -P DROP
This means each packet will be dropped, if there isn't a rule, which stops that.
My suggestion:
iptables -I INPUT -i ppp0 -p tcp --dport 80 -j ACCEPT
try this line instead of your 5th command ("iptables -A INPUT -i ppp0 -m state --state NEW -j log_n_pass
")
explanation:
With --state NEW you are meaning all packets opening a new connection (see also: 3-way-handshake). After a client has opened a new connection, it send packets without the NEW flag. Now there is no rule matching, so the policy says DROP and the packet is lost.

If it's working please show us the output of 'iptables -L -n' again. thx

andrewjjones

01-17-2005 04:23 PM

Thanks, I will try that. Just one thing though - as I have already entered the 5th command, will I have to restart the computer and type everything again, or will your command just replace the old one?

Fle><

01-17-2005 04:27 PM

You can restart and type everything again
or
you should type:

Code:

iptables -D INPUT -i ppp0 -m state --state NEW -j log_n_pass

iptables -I INPUT -i ppp0 -p tcp --dport 80 -j ACCEPT

Suddenly I have a doubt, that this works. What I said shouldn't be wrong, but if PREROUTING is working correctly,
the chain INPUT shouldn't be used for these packets.

Anyway try my tip. If it doesn't work, I will write down the complete firewall configuration..

andrewjjones

01-17-2005 04:35 PM

Yes, there are a lot of posts aren't there :D

I tried what you said. Thanks for trying to help, but it still doesn't do it. I didn't know all this was going to get so complicated :(

Fle><

01-17-2005 05:08 PM

hoping that's it:
I've written a tiny script. Copy it to a new file an make it executable. Then run it.
This script is deleting all your firewall settings and making new ones. It's only for trying to make your server accessible.
Make sure there are no rules in iptables -t nat. You can do this with iptables -t nat -L.
If you want to reset your configuration, you should restart your computer - I think that is the easiest way, because
your firewall loads a script which (re-)creates all firewallsettings.

Code:

EXTINT=ppp0



#Delete all rules

iptables -F INPUT

iptables -F FORWARD

iptables -F OUTPUT



#Set Policies

iptables -P INPUT DROP

iptables -P FORWARD DROP

iptables -P OUTPUT ACCEPT



#don't accept any new or invalid connections from outside, with one exception:

#only accept NEW packets on port 80 for forwarding

iptables -A INPUT -i "$EXTINT" -m state --state NEW,INVALID -j DROP

iptables -A FORWARD -i "$EXTINT" -p tcp --dport ! 80 -m state --state NEW -j DROP

iptables -A FORWARD -i "$EXTINT" -m state --state INVALID -j DROP



#Allow HTTP-connections from inside the firewall

iptables -A FORWARD -o "$EXTINT" -p tcp --sport 1024:65535 --dport 80 -j ACCEPT

iptables -A FORWARD -i "$EXTINT" -p tcp --dport 1024:65535 --sport 80 ! --syn -j ACCEPT



#Forward connections for your server

iptables -t nat -A PREROUTING -i "$EXTINT" -p tcp --dport 80 -j DNAT --to-destination 192.168.0.1

iptables -A FORWARD -i "$EXTINT" -p tcp --dport 80 -j ACCEPT

iptables -A FORWARD -o "$EXTINT" -p tcp --sport 80 -j ACCEPT



#Masquerading

iptables -t nat -A POSTROUTING -o "$EXTINT" -j MASQUERADE

I can not try it. I am only hoping that it works ;)

peter_robb

01-18-2005 10:58 AM

It would be a lot tidier to just replace the "$EXTINT" variable with ppp0..
Makes it way more readable.. ;)

Also to consider..
The original problem of not connecting to a LAN based server using it's external ip number..

If you send packet from 192.168.0.20 to 222.333.444.555 and it's dnatted to 192.168.0.1,
the server will see a source address of 192.168.0.20, notice it's local, and send it directly back, from 192.168.0.1..
So the original pc sees a packet going to 222.333.444.555 but a reply from 192.168.0.1
and drops it as rubbish..

If you have lots of workstations, the quickest answer is to run a small dns caching server on the firewall that converts all the names possible for the server back to it's internal number.
dnsmasq and dnrd are common..
Otherwise, add this list to everyone's /etc/host file (or lmhosts.sam for M$ )

eg
192.168.0.1 www.myserver.com pages.myserver.com myserver.com test.myserver.com

(You of course could have quite a few vitual domain names in the one server)

andrewjjones

01-18-2005 12:49 PM

Quote:

Originally posted by Fle><
I can not try it. I am only hoping that it works ;)

Sorry, it still doesn't do it. It just stops me connecting to the internet...

Quote:

Originally posted by peter_robb
If you send packet from 192.168.0.20 to 222.333.444.555 and it's dnatted to 192.168.0.1,
the server will see a source address of 192.168.0.20, notice it's local, and send it directly back, from 192.168.0.1..
So the original pc sees a packet going to 222.333.444.555 but a reply from 192.168.0.1
and drops it as rubbish.

So this might not work anyway? At the moment I am trying it by going to the gateway's external IP from the web server, as it's the computer I can get to the easiest.

Quote:

Originally posted by peter_robb
If you have lots of workstations, the quickest answer is to run a small dns caching server on the firewall that converts all the names possible for the server back to it's internal number.
dnsmasq and dnrd are common..
Otherwise, add this list to everyone's /etc/host file (or lmhosts.sam for M$ )

eg
192.168.0.1 www.myserver.com pages.myserver.com myserver.com test.myserver.com

(You of course could have quite a few vitual domain names in the one server)

I will look into that then...

andrewjjones

01-19-2005 06:11 PM

Thanks for everyone's help, I'm not having a go at you... but is this normally so complicated? I thought that all I would have to do is forward packets coming in on port 80 to my web server, and packets from the server back out again! ;)

All times are GMT -5. The time now is 05:11 PM.

Page 3 of 4

Show 50 post(s) from this thread on one page