LinuxQuestions.org - Another iptables nat configuration question

- Linux - Security (https://www.linuxquestions.org/questions/linux-security-4/)

- - Another iptables nat configuration question (https://www.linuxquestions.org/questions/linux-security-4/another-iptables-nat-configuration-question-864348/)

Another iptables nat configuration question

hello, i have this script for my centos nat gateway. net.ipv4.ip_forward is set to 1 in sysctl.conf. i need to grant internet access through my gateway to the ips i choose, and only mail access (ports 25,110) for other ips. it goes like this:

Code:

#!/bin/sh

ipt=/sbin/iptables

extip=192.168.1.70  # ur internet external - eth1

lan=192.168.100.0/24 # ur lan - eth0

chains=`cat /proc/net/ip_tables_names`

for i in $chains; do

 $debug $ipt -t $i -F

 $debug $ipt -t $i -X

 $debug $ipt -t $i -Z

done

$ipt -P INPUT DROP

$ipt -P FORWARD DROP

$ipt -t nat -A POSTROUTING -o eth1 -j SNAT --to-source $extip

$ipt -A INPUT -i lo -j ACCEPT

$ipt -A INPUT -i eth0 -s $lan -j ACCEPT

$ipt -A INPUT -i eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT

$ipt -A INPUT -p tcp --destination-port 22 -j ACCEPT

$ipt -A FORWARD -i eth0 -s 192.168.100.144 -j ACCEPT

$ipt -A FORWARD -i eth0 -s 192.168.100.125 -j ACCEPT

$ipt -A FORWARD -i eth0 -p tcp -m tcp -s 192.168.100.126 --dport 25 -j ACCEPT

$ipt -A FORWARD -i eth0 -p tcp -m tcp -s 192.168.100.126 --dport 110 -j ACCEPT

$ipt -A FORWARD -i eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT

$ipt -A FORWARD -i eth0 -s $lan -j REJECT

service iptables save

service iptables restart

the ips of my local lan {192.168.100.144-145} have internet access, but the ip 192.168.100.126 still cant connect to outlook. what am i doing wrong?

Add a LOG rule before the REJECT rule and DROP policy to see what is being filtered. Like:

Code:

$ipt -A FORWARD -i eth0 -s 192.168.100.144 -j ACCEPT

$ipt -A FORWARD -i eth0 -s 192.168.100.125 -j ACCEPT

$ipt -A FORWARD -i eth0 -p tcp -m tcp -s 192.168.100.126 --dport 25 -j ACCEPT

$ipt -A FORWARD -i eth0 -p tcp -m tcp -s 192.168.100.126 --dport 110 -j ACCEPT

$ipt -A FORWARD -i eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT

$ipt -A FORWARD -i eth0 -s $lan -j LOG --log-prefix "FORWARD REJECT: "

$ipt -A FORWARD -i eth0 -s $lan -j REJECT

$ipt -A FORWARD -j LOG --log-prefix "FORWARD DROP: "

...then show us what the relevant log entries look like.

log:

FORWARD REJECT: IN=eth0 OUT=eth1 SRC=192.168.100.126 DST=192.168.1.254 LEN=67 TOS=0x00 PREC=0x00 TTL=127 ID=6740 PROTO=UDP SPT=51432 DPT=53 LEN=47

Looks like you need to make a rule for DNS lookups (UDP port 53).

Quote:

Originally Posted by win32sux (Post 4267761)

Looks like you need to make a rule for DNS lookups (UDP port 53).

yup u were right mr dude. thanks :o