help in dmz iptables

packets · 06-07-2010, 02:45 AM

I created a gateway using iptables. My trusted LAN is eth1 (10.0.1.0/24) and DMZ is eth2 (10.4.0.0/24). My ip address is 10.0.1.156. I'm bypassing restriction and squid rules here. I can access the Internet. My question is how could I access those server on 10.4.0.0/24 network. The server can ping 10.4.0.0/24 but the client cannot ping nor access 10.4.0.0/24 network. I tried to command "iptables -I FORWARD -i eth1 -o eth2 -p tcp -s 10.0.1.0/24 -d 10.4.0.0/24 -j ACCEPT" but still I cannot access 10.4.0.0/24 network. I believe its only on FORWARD options its just that I think I'm just using a wrong options here.

NOTE: 1.2.3.4 is the public ip address provided by the ISP

Quote:

/sbin/iptables -F INPUT
/sbin/iptables -F OUTPUT
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT ACCEPT
/sbin/iptables -F FORWARD
/sbin/iptables -F -t nat
/sbin/iptables -P FORWARD DROP
/sbin/iptables -A FORWARD -i eth1 -j ACCEPT
/sbin/iptables -A INPUT -i eth1 -j ACCEPT
/sbin/iptables -A OUTPUT -o eth1 -j ACCEPT
/sbin/iptables -A FORWARD -i eth2 -j ACCEPT
/sbin/iptables -A INPUT -i eth2 -j ACCEPT
/sbin/iptables -A OUTPUT -o eth2 -j ACCEPT
/sbin/iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -t nat -A POSTROUTING -s 0.0.0.0/0 -o eth0 -j SNAT --to-source 1.2.3.4
/sbin/iptables -A INPUT -i lo -j ACCEPT
/sbin/iptables -A OUTPUT -o lo -j ACCEPT
/sbin/iptables -A INPUT -i eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -I FORWARD -i eth1 -p tcp -m multiport --dport 0:79 -j REJECT
/sbin/iptables -I FORWARD -i eth1 -p tcp -m multiport --dport 81:65535 -j REJECT
/sbin/iptables -I FORWARD -p TCP -i eth1 -s 10.0.1.156 -j ACCEPT
/sbin/iptables -A OUTPUT -p icmp -m state --state NEW -j ACCEPT
/sbin/iptables -A INPUT -p icmp -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -i eth0 -j ACCEPT
/sbin/iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 8080
/sbin/iptables -t nat -I PREROUTING -i eth1 -p tcp -s 10.0.1.156 --dport 80 -j ACCEPT
/sbin/iptables -A INPUT -p tcp --dport 3500 -j ACCEPT
/sbin/iptables -A FORWARD -i eth0 -p tcp --dport 8080 -j ACCEPT
/sbin/iptables -t nat -A PREROUTING -i eth0 -p tcp -d 1.2.3.4 --dport 80 -j DNAT --to-destination 10.0.1.122:8080
/sbin/iptables -A INPUT -i eth0 -p tcp -m limit --limit 1/s --dport 0:65535 -j LOG --log-prefix "tcp connection: "
/sbin/iptables -A INPUT -i eth0 -p udp -m limit --limit 1/s --dport 0:65535 -j LOG --log-prefix "udp connection: "
/sbin/iptables -A INPUT -i eth0 -p tcp --dport 0:65535 -j DROP
/sbin/iptables -A INPUT -i eth0 -p udp --dport 0:65535 -j DROP

packets · 06-07-2010, 02:59 AM

I tried this one but didn't work

Quote:

iptables -I FORWARD -i eth1 -o eth2 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -I FORWARD -i eth2 -o eth2 -m state --state ESTABLISHED,RELATED -j ACCEPT

win32sux · 06-07-2010, 02:59 AM

Quote:

Originally Posted by packets

I tried to command "iptables -I FORWARD -i eth1 -o eth2 -p tcp -s 10.0.1.0/24 -d 10.4.0.0/24 -j ACCEPT" but still I cannot access 10.4.0.0/24 network. I believe its only on FORWARD options its just that I think I'm just using a wrong options here.

Actually, that command seems okay (as in, it pretty much matches what you've said you want to do).

Did you create an appropriate POSTROUTING rule when you did this? Something like:

Code:

/sbin/iptables -t nat -A POSTROUTING -s 10.0.1.0/24 -o eth2 -j MASQUERADE

packets · 06-07-2010, 03:05 AM

This is only postrouting rules I did

Quote:

$iptables -t nat -A POSTROUTING -s 0.0.0.0/0 -o eth0 -j SNAT --to-source 1.2.3.4

I did not use any masquerade chain in postrouting.

win32sux · 06-07-2010, 05:25 PM

Then could you try the command I posted and report back?

packets · 06-07-2010, 09:31 PM

@win32sux

Thanks for the help. I'm now able to connect to 10.4.x.x network by typing the ff command:

Quote:

iptables -t nat -A POSTROUTING -s 10.0.1.156 -o eth2 -j MASQUERADE
iptables -I FORWARD -i eth1 -o eth2 -p tcp -m state --state NEW,ESTABLISHED,RELATED -s 10.0.1.156 -d 10.4.0.0/24 -j ACCEPT

packets · 06-07-2010, 10:07 PM

@win32sux

Could you help me out on iptables port forwarding. Thanks for all the help btw.

http://www.linuxquestions.org/questi...85#post3996085

Noway2 · 06-08-2010, 05:29 AM

Here is a tutorial on using iptables. It is the best one of I have seen so far: http://bodhizazen.net/Tutorials/iptables/

packets · 06-08-2010, 06:40 PM

@Noway2

Thanks for the link