LinuxQuestions.org
Review your favorite Linux distribution.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
Reload this Page DMZ and iptables breaks my head!!! Avanced Help please!!!!
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
Page 4 of 8 « First 23 4 56 Last »
  Search this Thread
Old 12-20-2009, 12:14 AM   #46
nimnull22
Senior Member
 
Registered: Jul 2009
Distribution: OpenSuse 11.1, Fedora 14, Ubuntu 12.04/12.10, FreeBSD 9.0
Posts: 1,571

Rep: Reputation: 92

Excuse me.
In your first post you told:

# 1.1 Internet Configuration.
#

INET_IFACE="eth0"
INET_IP=200.xxx.xxx.89
INET_BROADCAST="255.255.255.255"
HTTP_IP=200.xxx.xxx.89
DNS_IP=200.xxx.xxx.89

Is it true?
 
Old 12-20-2009, 12:25 AM   #47
MikeHammer
Member
 
Registered: Dec 2009
Posts: 61

Original Poster
Rep: Reputation: 15
Now I trying from other ISP. Telnet it stays hanging on "Connecting to 190...... 80" y nothing happens...

I send you the 2 files zero and zero1, both with new iptables-save
Attached Files
File Type: txt zero.txt (805 Bytes, 30 views)
File Type: txt zero1.txt (841 Bytes, 6 views)
 
Old 12-20-2009, 12:27 AM   #48
nimnull22
Senior Member
 
Registered: Jul 2009
Distribution: OpenSuse 11.1, Fedora 14, Ubuntu 12.04/12.10, FreeBSD 9.0
Posts: 1,571

Rep: Reputation: 92
In your first post you told:

# 1.1 Internet Configuration.
#

INET_IFACE="eth0"
INET_IP=200.xxx.xxx.89
INET_BROADCAST="255.255.255.255"
HTTP_IP=200.xxx.xxx.89
DNS_IP=200.xxx.xxx.89

Is it true?

Is your eth0 IP = 200.xxx.xxx.89 ???

This is from your first script.
Last edited by nimnull22; 12-20-2009 at 12:28 AM.
 
Old 12-20-2009, 12:33 AM   #49
MikeHammer
Member
 
Registered: Dec 2009
Posts: 61

Original Poster
Rep: Reputation: 15
No, I had explained you that is "fantasy" IP, the real begins 190.xxx.xxx.xx7
 
Old 12-20-2009, 12:36 AM   #50
MikeHammer
Member
 
Registered: Dec 2009
Posts: 61

Original Poster
Rep: Reputation: 15
What's? I imagine... My ISP intercepts a proxy and the real IP outgoing is 200......
 
Old 12-20-2009, 12:51 AM   #51
nimnull22
Senior Member
 
Registered: Jul 2009
Distribution: OpenSuse 11.1, Fedora 14, Ubuntu 12.04/12.10, FreeBSD 9.0
Posts: 1,571

Rep: Reputation: 92
Quote:
Originally Posted by MikeHammer View Post
No, I had explained you that is "fantasy" IP, the real begins 190.xxx.xxx.xx7
You are trying to confuse me.
I won't be able to help you.

If your eth0 IP is 190.xxx.xxx.xx7, why you put IP = 190.xxx.xxx.x89/32 to

IPTABLES -t nat -A PREROUTING -d 190.xxx.xxx.x89/32 -p tcp --dport 80 -j DNAT --to-destination 192.168.222.22:80

You have to know exactly what IP to listen for http.
Or you have to chenge "-d 190.xxx.xxx.x89/32" to "-i eth0"


And if your ISP has proxy, are you sure that your cable modem can be reached from outside?
Last edited by nimnull22; 12-20-2009 at 12:53 AM.
 
1 members found this post helpful.
Old 12-20-2009, 01:07 AM   #52
MikeHammer
Member
 
Registered: Dec 2009
Posts: 61

Original Poster
Rep: Reputation: 15
Quote:
Originally Posted by nimnull22 View Post
You are trying to confuse me.
I won't be able to help you.

If your eth0 IP is 190.xxx.xxx.xx7, why you put IP = 190.xxx.xxx.x89/32 to

IPTABLES -t nat -A PREROUTING -d 190.xxx.xxx.x89/32 -p tcp --dport 80 -j DNAT --to-destination 192.168.222.22:80

You have to know exactly what IP to listen for http.
Or you have to chenge "-d 190.xxx.xxx.x89/32" to "-i eth0"


And if your ISP has proxy, are you sure that your cable modem can be reached from outside?
No, how I'll try of confused you?? You help me so kindly...
Please, like I said before: I'm not writing the real IP here by privacy reasons.
So, 200.xxx.xxx.x89 is NOT real. But 190.xxx.xxx.xx7, partially yes.
Also, IN script REAL, I wrote ALL REAL IP.
 
Old 12-20-2009, 01:22 AM   #53
MikeHammer
Member
 
Registered: Dec 2009
Posts: 61

Original Poster
Rep: Reputation: 15
Also, I sent you a private message yesterday or before, I don't remember now, with the real IP....
 
Old 12-20-2009, 10:41 AM   #54
nimnull22
Senior Member
 
Registered: Jul 2009
Distribution: OpenSuse 11.1, Fedora 14, Ubuntu 12.04/12.10, FreeBSD 9.0
Posts: 1,571

Rep: Reputation: 92
OK, lets try make thing simple, change in your script:

IPTABLES -t nat -A PREROUTING -d 190.xxx.xxx.x89/32 -p tcp --dport 80 -j DNAT --to-destination 192.168.222.22:80

to

IPTABLES -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination 192.168.222.22:80

Check your self with iptable-save, that rules uploaded well.
Do telnet, and tell what you have.
 
1 members found this post helpful.
Old 12-20-2009, 09:21 PM   #55
MikeHammer
Member
 
Registered: Dec 2009
Posts: 61

Original Poster
Rep: Reputation: 15
Well, here again... (Understands you why me had gone crazy with this trouble?)

Send you 3 files.

fire.txt: firewall script
zero.txt: iptables-save after iptables --zero, echo 1 forward and before telnet.
zero1.txt: after telnet.

The Telneting don't connect to server 190.xxx.xxx.xx7 80, command line remains trying connect and nothing happens... I tried 2 times and it was same...

Regards
Attached Files
File Type: txt fire.txt (573 Bytes, 8 views)
File Type: txt zero.txt (786 Bytes, 8 views)
File Type: txt zero1.txt (832 Bytes, 8 views)
 
Old 12-20-2009, 09:43 PM   #56
MikeHammer
Member
 
Registered: Dec 2009
Posts: 61

Original Poster
Rep: Reputation: 15
I'm thinking about results and I see nothing coherent, which means that apparently the server is unreachable ... Am I right? Perhaps there is a proxy of my ISP and port 80 is filtered ?......

But when the webserver had run on the server outgoing Internet (not from DMZ like now) the website had been perfectly reachable... And of course, the ISP is the same,,,
Last edited by MikeHammer; 12-20-2009 at 09:52 PM.
 
Old 12-20-2009, 10:20 PM   #57
nimnull22
Senior Member
 
Registered: Jul 2009
Distribution: OpenSuse 11.1, Fedora 14, Ubuntu 12.04/12.10, FreeBSD 9.0
Posts: 1,571

Rep: Reputation: 92
Do me a favor.

From root console type:

tcpdump -n -i eth0 tcp port 80


Then try to do telnet to your web server. If there will be any output please let me know.

Thanks
 
1 members found this post helpful.
Old 12-20-2009, 11:00 PM   #58
MikeHammer
Member
 
Registered: Dec 2009
Posts: 61

Original Poster
Rep: Reputation: 15
On Debian don't find tcpdump command... To what pack I'll find it, for install it...
 
Old 12-20-2009, 11:05 PM   #59
nimnull22
Senior Member
 
Registered: Jul 2009
Distribution: OpenSuse 11.1, Fedora 14, Ubuntu 12.04/12.10, FreeBSD 9.0
Posts: 1,571

Rep: Reputation: 92
On debian web site I suppose should be a software search for rpm or something like this.
 
Old 12-20-2009, 11:16 PM   #60
MikeHammer
Member
 
Registered: Dec 2009
Posts: 61

Original Poster
Rep: Reputation: 15
Ok, I found it and installed, and I'm trying to telneting. On server console there are activity from ip of Kaspersky Labs Forum... Is you?
 
  


Reply
Page 4 of 8 « First 23 4 56 Last »



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Iptables and DMZ scroogie Linux - Networking 2 02-28-2008 05:39 AM
iptables DMZ garnser Linux - Security 2 12-15-2007 12:14 AM
question about iptables (DMZ machine connect to other DMZ machine 's publuic IP) wingmak Linux - Security 1 01-20-2007 04:01 PM
iptables + DMZ Braytac Linux - Networking 3 10-06-2006 05:57 AM
IPTABLES and DMZ Host htimst Linux - Security 1 12-21-2001 07:04 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 08:07 PM.

Contact Us - Advertising Info - Rules - Privacy - LQ Merchandise - Donations - Contributing Member - LQ Sitemap -
Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration