LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 08-30-2016, 05:33 PM   #1
kraziekris
LQ Newbie
 
Registered: Jan 2012
Posts: 26

Rep: Reputation: Disabled
IPTables help please


Hi

My company is using an old version of iptables, it has lots of rules and chains. I have a new subnet which is coming in through a vpn tunnel into the iptables. The range is 10.11.0.0/16, I have added an allow rule and put it at the top but its stil getting blocked.

Here is how I added the rule

Code:
 iptables -I INPUT 1 -s 10.11.0.0/16 -j ACCEPT
It now looks like this

Code:
oot@www:/etc/iptables# iptables -L -n|more
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
FailSafe   all  --  0.0.0.0/0            0.0.0.0/0
CountryLockouts  tcp  --  0.0.0.0/0            0.0.0.0/0
PortDenies  tcp  --  0.0.0.0/0            0.0.0.0/0
HostingLockouts  tcp  --  0.0.0.0/0            0.0.0.0/0
Cyveillance  tcp  --  0.0.0.0/0            0.0.0.0/0
Websense   tcp  --  0.0.0.0/0            0.0.0.0/0
Verisign   tcp  --  0.0.0.0/0            0.0.0.0/0
PicScout   tcp  --  0.0.0.0/0            0.0.0.0/0
MSAzure    tcp  --  0.0.0.0/0            0.0.0.0/0
MailLockouts  tcp  --  0.0.0.0/0            0.0.0.0/0
WebLockouts  tcp  --  0.0.0.0/0            0.0.0.0/0
ProblemIPs  tcp  --  0.0.0.0/0            0.0.0.0/0
REJECT     tcp  --  82.81.32.0/20        0.0.0.0/0            reject-with icmp-port-unreachable
REJECT     tcp  --  192.185.0.0/16       0.0.0.0/0            reject-with icmp-port-unreachable
REJECT     tcp  --  162.144.0.0/16       0.0.0.0/0            reject-with icmp-port-unreachable

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
but its still getting blocked, I am seeing this in the log

Code:
Aug 30 18:37:33 fw-gs iptables GSFWD denied:  IN=tun1 OUT=eth0 MAC= SRC=10.11.0.201 DST=10.1.60.50 LEN=60 TOS=00 PREC=0x00 TTL=60 ID=6274 DF PROTO=TCP SPT=48066 DPT=10050 SEQ=488128362 ACK=0 WINDOW=29200 SYN URGP=0
Really need some urgent help please
 
Old 08-30-2016, 06:13 PM   #2
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3599Reputation: 3599Reputation: 3599Reputation: 3599Reputation: 3599Reputation: 3599Reputation: 3599Reputation: 3599Reputation: 3599Reputation: 3599Reputation: 3599
First of all the best representation of the current rule set is to post '/sbin/iptables-save;' output.
Secondly you don't just slot a rule in the filter table INPUT chain 1st place: understand the actual rule set, then decide.
Third did you notice your rule doesn't even "stick"? It's not shown in your output. Please check such things before you post (efficiency).
Finally the block occurs on "-i tun1" to "-o eth0" so would you need masquerading and FORWARD chain usage?
(Also see https://www.frozentux.net/iptables-t...-tutorial.html ?)
 
Old 08-31-2016, 01:15 AM   #3
agillator
Member
 
Registered: Aug 2016
Distribution: Mint 19.1
Posts: 419

Rep: Reputation: Disabled
I agree partially with unSpawn except I rarely use the save format unless I am saving to reload later. The -L output you use is what I am most comfortable with for just looking at the rules. What he says about your rule is correct - you shouldn't need the '1' you show. Try this command:
iptables -I INPUT -s 10.11.0.0/16 -j ACCEPT

Be aware of what you are telling it to do. It will accept anything on any interface from anyone with an ip address in the 10.11.0.0 to 10.11.255.255 range. No further checking is done. Is that what you want?

By the way, for listing the rules I add rule numbers for my convenience: iptables -L -v -n --line-numbers is my standard command. I find that useful if I then want to delete a rule because THEN the line number can be used: iptables -D INPUT 3 deletes the third rule in the INPUT chain (whatever that may be, so be cautious).
 
Old 09-01-2016, 09:34 AM   #4
lazydog
Senior Member
 
Registered: Dec 2003
Location: The Key Stone State
Distribution: CentOS Sabayon and now Gentoo
Posts: 1,249
Blog Entries: 3

Rep: Reputation: 194Reputation: 194
I think what everyone above is missing is how is your dropped packet being logged without having a logging rule?
You state that the version of iptables you are running has lots of rules and chains but you are not showing this above.
So the question is are you showing us the correct rule set from the correct firewall, and I believe you are not.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
iptables can't initialize iptables table `filter': Bad file descriptor donalbane Linux - Networking 2 08-17-2011 09:36 AM
iptables error in android: iptables-save and iptables-restore not working preetb123 Linux - Mobile 5 04-11-2011 02:56 PM
iptables v1.2.9: Unknown arg `/sbin/iptables' Try `iptables -h' or 'iptables --help' Niceman2005 Linux - Security 4 12-29-2005 09:20 PM
Iptables - Couldn't load target `ACCPET':/lib/iptables/libipt_ACCPET.so: z00t Linux - Security 3 01-26-2004 03:24 AM
My iptables script is /etc/sysconfig/iptables. How do i make this baby execute on boo ForumKid Linux - General 3 01-22-2002 08:36 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 11:33 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration