LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 12-22-2004, 08:16 PM   #1
RichardBuck
LQ Newbie
 
Registered: Dec 2004
Distribution: RedHat
Posts: 1

Rep: Reputation: 0
ipchains log and samba query


Hi all

Not new to Linux but entirely new to networking... Have recently linked an old machine running Windows 98 to a Linux box running RedHat 7.3 - direct cable conection, no hub. Linux box is linked to internet via cable modem on eth0, eth1 is the LAN interface. Set up firewall + masquerade using ipchains & a script based on the firemasq script found at unixgeeks.org -- this all seemed to work fine. Have now set up Samba as well & noticed a couple of oddities:

1) Whenever you see output from smbclient -L localhost -U% listed in examples it only ever mentions the LAN address, whereas the ouput when I run it lists both the eth1 address and the external IP address of the cable modem.
2) My ipchains log is filling up with hits ostensibly from the cable modem's external address on the port that Samba listens on. Don't know if this is spoofed (seems unlikely), should be dropped without bothering to log, or accepted.
3) Something is causing x/kde to slow down massively (not quite freezing) since I set this lot up...

Output of ifconfig:
eth0 Link encap:Ethernet HWaddr 00:0A:E6:43:98:48
inet addr:82.9.238.80 Bcast:255.255.255.255 Mask:255.255.255.0
UP BROADCAST NOTRAILERS RUNNING MULTICAST MTU:1500 Metric:1
RX packets:228095 errors:0 dropped:0 overruns:0 frame:0
TX packets:9722 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:17314490 (16.5 Mb) TX bytes:1061795 (1.0 Mb)
Interrupt:10 Base address:0xd000

eth1 Link encap:Ethernet HWaddr 00:04:E2:18:40:75
inet addr:192.168.0.1 Bcast:192.168.0.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:17838 errors:0 dropped:0 overruns:0 frame:0
TX packets:21758 errors:27 dropped:0 overruns:0 carrier:54
collisions:0 txqueuelen:100
RX bytes:2118070 (2.0 Mb) TX bytes:22438773 (21.3 Mb)
Interrupt:5 Base address:0x9c00

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:991 errors:0 dropped:0 overruns:0 frame:0
TX packets:991 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:400494 (391.1 Kb) TX bytes:400494 (391.1 Kb)

Output of route -n:
Destination Gateway Genmask Flags Metric Ref Use Iface
82.9.238.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1
127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo
0.0.0.0 82.9.238.254 0.0.0.0 UG 0 0 0 eth0

Output of smbclient -L localhost -U%:
added interface ip=82.9.238.80 bcast=82.9.238.255 nmask=255.255.255.0
added interface ip=192.168.0.1 bcast=192.168.0.255 nmask=255.255.255.0
Domain=[VALIS] OS=[Unix] Server=[Samba 2.2.3a]

Sharename Type Comment
--------- ---- -------
IPC$ IPC IPC Service (Linux Box)
ADMIN$ Disk IPC Service (Linux Box)
HP690C Printer

Server Comment
--------- -------
BIGNOODLE Windows 98 Box
DRSMILE Linux Box

Workgroup Master
--------- -------
VALIS DRSMILE

Example from ipchains log:
Dec 23 00:37:15 localhost kernel: Packet log: inet-in DENY eth0 PROTO=17 82.9.238.80:138 82.9.238.255:138 L=238 S=0x00 I=0 F=0x4000 T=64 (#22)
Dec 23 00:37:15 localhost kernel: Packet log: inet-in DENY eth0 PROTO=17 82.9.238.80:138 82.9.238.255:138 L=236 S=0x00 I=0 F=0x4000 T=64 (#22)
Dec 23 00:49:15 localhost kernel: Packet log: inet-in DENY eth0 PROTO=17 82.9.238.80:138 82.9.238.255:138 L=238 S=0x00 I=0 F=0x4000 T=64 (#22)
Dec 23 00:49:15 localhost kernel: Packet log: inet-in DENY eth0 PROTO=17 82.9.238.80:138 82.9.238.255:138 L=236 S=0x00 I=0 F=0x4000 T=64 (#22)

Content of /etc/rc.firemasq script:
#!/bin/sh

# Change IPCHAINS to the correct path for your system
IPCHAINS=/sbin/ipchains

# Change INETDEV to the network device connceted to the Internet (ppp0/eth0)
# This is ppp0 by default for dial-up connections. Most cable modem users
# will probably want eth0 or possibly eth1. When in doubt look at the command
# 'ifconfig'.
INETDEV="eth0"

# Change LAN to the correct network address and network mask for your LAN
# this can be found by using ifconfig from one of the clients
LAN="192.168.0.0/24"

# Change LANDEV to the network device connected to your LAN
LANDEV="eth1"

# There should be no need to change this: you may need to play with it a little.
# If you have problems, try the command on the command-line, substituing $LANDEV
# for 'eth0' (or 'eth1', etc if you're a cable user).
LOCALIP=`ifconfig $LANDEV | grep inet | cut -d : -f 2 | cut -d B -f 1`


echo ""
echo "FireMasq version 0.7 by Dr. Teeth (2000)"
echo "Rehashed(!) by munk (2001)"
echo "---------------------------------------------------------"
echo "Local Network Device: $LANDEV"
echo "Local IP: $LOCALIP"
echo "Local Network Address: $LAN"
echo "External Network Device: $INETDEV"
echo "---------------------------------------------------------"
echo ""

#Enable IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

#Set default chain policy
echo -n "Setting default chain policies..."
$IPCHAINS -P input DENY
$IPCHAINS -P forward DENY
$IPCHAINS -P output ACCEPT
echo " Done!"

#Flush all chains: start fresh
echo -n "Flushing chains..."
$IPCHAINS -F
$IPCHAINS -X
echo " Done!"

#Add custom chains
echo -n "Adding custom chains..."
$IPCHAINS -N inet-in # incoming from internet
$IPCHAINS -N inet-out # outgoing onto internet
echo " Done!"

#Set input rules
echo -n "Setting rules for input chain..."
#Any LAN address to any other LAN address is ok:
$IPCHAINS -A input -s $LAN -d $LAN -j ACCEPT
#Loopback interface comms all ok:
$IPCHAINS -A input -s 0.0.0.0/0 -d 0.0.0.0/0 -i lo -j ACCEPT
#ADDED BY RMB cablemodem and dns servers are ok:
$IPCHAINS -A input -s 192.168.100.1 53 -d 0/0 -p udp -j ACCEPT
$IPCHAINS -A input -s 194.168.4.100 53 -d 0/0 -p udp -j ACCEPT
$IPCHAINS -A input -s 194.168.8.100 53 -d 0/0 -p udp -j ACCEPT
#ADDED BY RMB ntp comms are ok:
$IPCHAINS -A input -p udp --destination-port 123 -s 130.159.196.118 -j ACCEPT
$IPCHAINS -A input -p udp --destination-port 123 -s 194.164.127.5 -j ACCEPT
$IPCHAINS -A input -p udp --destination-port 123 -s 130.88.200.98 -j ACCEPT
#Any LAN address to anywhere (including internet) is ok:
$IPCHAINS -A input -s $LAN -d 0.0.0.0/0 -i $LANDEV -j ACCEPT
#Any comms on the internet interface should be handled by the 'inet-in' chain:
$IPCHAINS -A input -s 0.0.0.0/0 -d 0.0.0.0/0 -i $INETDEV -j inet-in
echo " Done!"

#Set forward rules
echo -n "Setting rules for forward chain..."
#Forwarding LAN TO LAN ok:
$IPCHAINS -A forward -s $LAN -d $LAN -j ACCEPT
#Forwarding LAN to internet ok:
$IPCHAINS -A forward -s $LOCALIP -d 0.0.0.0/0 -j ACCEPT
echo " Done!"

#Activate masquerade
echo -n "Activating masquerade..."
$IPCHAINS -A forward -s $LAN -d 0.0.0.0/0 -j MASQ
#If you have trouble with timeouts, change this line:
# $IPCHAINS -M -S 7200 10 60
echo " Done!"

#Set output rules
echo -n "Setting rules for output chain..."
$IPCHAINS -A output -s $LAN -d $LAN -j ACCEPT
$IPCHAINS -A output -s 0.0.0.0/0 -d 0.0.0.0/0 -i lo -j ACCEPT
$IPCHAINS -A output -s $LAN -d 0.0.0.0/0 -j ACCEPT
$IPCHAINS -A output -s 0.0.0.0/0 -d 0.0.0.0/0 -i $INETDEV -j inet-out
echo " Done!"

#Set inet-in rules
echo "Setting rules for internet device incoming chain:"
echo -n " Setup port blocking on vulnerable ports..."
#These ports don't have to be blocked, but as they are
#these rules let you know when you're being attacked on
#the corresponding ports by logging the attack to /var/log/messages
#(or wherever your ipchains logging is done).
#Block NFS
$IPCHAINS -A inet-in -p tcp -s 0.0.0.0/0 -d 0.0.0.0/0 2049 -j DENY -l
$IPCHAINS -A inet-in -p udp -s 0.0.0.0/0 -d 0.0.0.0/0 2049 -j DENY -l
#Block postgres
$IPCHAINS -A inet-in -p tcp -s 0.0.0.0/0 -d 0.0.0.0/0 postgres -j DENY -l
$IPCHAINS -A inet-in -p udp -s 0.0.0.0/0 -d 0.0.0.0/0 postgres -j DENY -l
#Block X
$IPCHAINS -A inet-in -p tcp -s 0.0.0.0/0 -d 0.0.0.0/0 5999:6003 -j DENY -l
$IPCHAINS -A inet-in -p udp -s 0.0.0.0/0 -d 0.0.0.0/0 5999:6003 -j DENY -l
#Block XFS
$IPCHAINS -A inet-in -p tcp -s 0.0.0.0/0 -d 0.0.0.0/0 7100 -j DENY -l
$IPCHAINS -A inet-in -p udp -s 0.0.0.0/0 -d 0.0.0.0/0 7100 -j DENY -l
#Block Back Orifice
$IPCHAINS -A inet-in -p tcp -s 0.0.0.0/0 -d 0.0.0.0/0 31337 -j DENY -l
$IPCHAINS -A inet-in -p udp -s 0.0.0.0/0 -d 0.0.0.0/0 31337 -j DENY -l
#Block netbus
$IPCHAINS -A inet-in -p tcp -s 0.0.0.0/0 -d 0.0.0.0/0 12345:12346 -j DENY -l
$IPCHAINS -A inet-in -p udp -s 0.0.0.0/0 -d 0.0.0.0/0 12345:12346 -j DENY -l
echo " Done!"


echo -n ' Allowing ssh, dns, and icmp (ping/traceroute) traffic...'
#Vital for basic communications
$IPCHAINS -A inet-in -p tcp -s 0.0.0.0/0 ssh -d 0.0.0.0/0 -j ACCEPT
$IPCHAINS -A inet-in -p tcp -s 0.0.0.0/0 -d 0.0.0.0/0 ssh -j ACCEPT
$IPCHAINS -A inet-in -p tcp -s 0.0.0.0/0 -d 0.0.0.0/0 auth -j ACCEPT
$IPCHAINS -A inet-in -p tcp -s 0.0.0.0/0 -d 0.0.0.0/0 1023:65535 -j ACCEPT
$IPCHAINS -A inet-in -p udp -s 0.0.0.0/0 -d 0.0.0.0/0 1023:65535 -j ACCEPT
$IPCHAINS -A inet-in -p icmp -s 0.0.0.0/0 -d 0.0.0.0/0 -j ACCEPT
#ADDED BY RMB Allowing incoming dhcp traffic from cable modem and dhcp servers
$IPCHAINS -A inet-in -p udp -s 10.150.239.254 67 -d 255.255.255.255 68 -j ACCEPT
$IPCHAINS -A inet-in -p udp -s 62.254.128.20 67 -d 255.255.255.255 68 -j ACCEPT
$IPCHAINS -A inet-in -p udp -s 62.254.128.21 67 -d 255.255.255.255 68 -j ACCEPT
echo " Done!"

All ideas/suggestions gratefully received.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Query on /exim/reject.log TigerOC Linux - Networking 0 01-12-2004 12:08 PM
Samba and IPCHAINS puzz_1 Linux - Security 1 11-17-2003 09:26 AM
Samba and IPChains MaleMe Linux - Security 2 11-24-2002 09:36 PM
ipchains and samba Serena Linux - Networking 1 04-27-2002 11:20 AM
ipchains log Wazza Linux - Networking 9 04-02-2001 12:07 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 04:32 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration