Iptables / Net Access Problem

Centinul · 08-24-2005, 07:08 AM

if I disable Iptables I can ping www.google.com fine. As soon as I turn it on and try and ping www.google.com I get the "unknown host www.google.com" error. But if I ping the IP address for www.google.com when the firewall is on it pings fine. How come I lose DNS functionality when I turn IPTABLEs on?

I've tried two scripts and they are both from gentoo-wiki.com. The first script listed worked the other day and now it doesn't for some reason. The second script doesn't seem to work at all for some reason. Also, I have the right IP configurations on both the firewall and the client machine.

Script #1

Code:

#!/bin/bash 
IPTABLES='/sbin/iptables' 
# Set interface values 
EXTIF='ppp0' 
INTIF1='eth1' 
INTIF2='eth2' 
# enable ip forwarding in the kernel 
/bin/echo 1 > /proc/sys/net/ipv4/ip_forward 
# flush rules and delete chains 
$IPTABLES -F 
$IPTABLES -X 
# enable masquerading to allow LAN internet access 
$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE 
# forward LAN traffic from $INTIF1 to Internet interface $EXTIF 
$IPTABLES -A FORWARD -i $INTIF1 -o $EXTIF -m state --state NEW,ESTABLISHED -j ACCEPT 
# forward LAN traffic from $INTIF2 to Internet interface $EXTIF 
$IPTABLES -A FORWARD -i $INTIF2 -o $EXTIF -m state --state NEW,ESTABLISHED -j ACCEPT 
#echo -e "       - Allowing access to the SSH server" 
$IPTABLES -A INPUT --protocol tcp --dport 22 -j ACCEPT 
#echo -e "       - Allowing access to the HTTP server" 
$IPTABLES -A INPUT --protocol tcp --dport 80 -j ACCEPT 
# block out all other Internet access on $EXTIF 
$IPTABLES -A INPUT -i $EXTIF -m state --state NEW,INVALID -j DROP 
$IPTABLES -A FORWARD -i $EXTIF -m state --state NEW,INVALID -j DROP

Script #2

The following code before the script is rules I do not understand.

Code:

### Should this be set to accept ### 
$IPT        -P OUTPUT      DROP 

### I don't know what these are for ### 
echo 1 > /proc/sys/net/ipv4/tcp_syncookies 
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts 
# Source Address Verification 
for f in /proc/sys/net/ipv4/conf/*/rp_filter; 
do 
 echo 1 > $f 
done 
# Disable IP source routing and ICMP redirects 
for f in /proc/sys/net/ipv4/conf/*/accept_source_route; 
do 
 echo 0 > $f 
done 
for f in /proc/sys/net/ipv4/conf/*/accept_redirects; 
do 
 echo 0 > $f 
done 
### SEEMS TO BE MISSING A MATCH ### 
$IPT -t nat -A PREROUTING  -j ACCEPT 
$IPT -t nat -A POSTROUTING -j ACCEPT 
$IPT -t nat -A OUTPUT -j ACCEPT

Here is the actual script

Code:

# First set LC_ALL to en to avoid l10n problems when awk-ing IPs etc. 
export LC_ALL="en" 
# External interface 
EXTIF=ppp0 
# Internal interface 
INTIF1=eth1 
INTIF2=eth2 
# Loop device/localhost 
LPDIF=lo 
LPDIP=127.0.0.1 
LPDMSK=255.0.0.0 
LPDNET="$LPDIP/$LPDMSK" 
# Text tools variables 
IPT='/sbin/iptables' 
IFC='/sbin/ifconfig' 
G='/bin/grep' 
SED='/bin/sed' 
# Last but not least, the users 
JAMES=192.168.1.77 
TERESA=192.168.2.77 
# Deny then accept: this keeps holes from opening up 
# while we close ports and such 
$IPT        -P INPUT       DROP 
$IPT        -P OUTPUT      DROP 
$IPT        -P FORWARD     DROP 
# Flush all existing chains and erase personal chains 
CHAINS=`cat /proc/net/ip_tables_names 2>/dev/null` 
for i in $CHAINS; 
do 
 $IPT -t $i -F 
done 
for i in $CHAINS; 
do 
 $IPT -t $i -X 
done 
echo 1 > /proc/sys/net/ipv4/tcp_syncookies 
echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts 
# Source Address Verification 
for f in /proc/sys/net/ipv4/conf/*/rp_filter; 
do 
 echo 1 > $f 
done 
# Disable IP source routing and ICMP redirects 
for f in /proc/sys/net/ipv4/conf/*/accept_source_route; 
do 
 echo 0 > $f 
done 
for f in /proc/sys/net/ipv4/conf/*/accept_redirects; 
do 
 echo 0 > $f 
done 
echo 1 > /proc/sys/net/ipv4/ip_forward 
# Setting up external interface environment variables 
EXTIP="`$IFC $EXTIF|$G addr:|$SED 's/.*addr:\([^ ]*\) .*/\1/'`" 
#EXTBC="`$IFC $EXTIF|$G Bcast:|$SED 's/.*Bcast:\([^ ]*\) .*/\1/'`" 
EXTBC="255.255.255.255" 
EXTMSK="`$IFC $EXTIF|$G Mask:|$SED 's/.*Mask:\([^ ]*\)/\1/'`" 
EXTNET="$EXTIP/$EXTMSK" 
#echo "EXTIP=$EXTIP EXTBC=$EXTBC EXTMSK=$EXTMSK EXTNET=$EXTNET" 
echo "EXTIP=$EXTIP EXTBC=$EXTBC EXTMSK=$EXTMSK EXTNET=$EXTNET" 
# Due to absence of EXTBC I manually set it to 255.255.255.255 
# this (hopefully) will serve the same purpose 
# Setting up environment variables for internal interface one 
INTIP1="`$IFC $INTIF1|$G addr:|$SED 's/.*addr:\([^ ]*\) .*/\1/'`" 
INTBC1="`$IFC $INTIF1|$G Bcast:|$SED 's/.*Bcast:\([^ ]*\) .*/\1/'`" 
INTMSK1="`$IFC $INTIF1|$G Mask:|$SED 's/.*Mask:\([^ ]*\)/\1/'`" 
INTNET1="$INTIP1/$INTMSK1" 
echo "INTIP1=$INTIP1 INTBC1=$INTBC1 INTMSK1=$INTMSK1 INTNET1=$INTNET1" 
#Setting up environment variables for internal interface two 
INTIP2="`$IFC $INTIF2|$G addr:|$SED 's/.*addr:\([^ ]*\) .*/\1/'`" 
INTBC2="`$IFC $INTIF2|$G Bcast:|$SED 's/.*Bcast:\([^ ]*\) .*/\1/'`" 
INTMSK2="`$IFC $INTIF2|$G Mask:|$SED 's/.*Mask:\([^ ]*\)/\1/'`" 
INTNET2="$INTIP2/$INTMSK2" 
echo "INTIP2=$INTIP2 INTBC2=$INTBC2 INTMSK2=$INTMSK2 INTNET2=$INTNET2" 
# We are now going to create a few custom chains that will result in 
# logging of dropped packets. This will enable us to avoid having to 
# enter a log command prior to every drop we wish to log. The 
# first will be first log drops the other will log rejects. 
# Do not complain if chain already exists (so restart is clean) 
$IPT -N DROPl   2> /dev/null 
$IPT -A DROPl   -j LOG --log-prefix 'DROPl:' 
$IPT -A DROPl   -j DROP 
$IPT -N REJECTl 2> /dev/null 
$IPT -A REJECTl -j LOG --log-prefix 'REJECTl:' 
$IPT -A REJECTl -j REJECT 
# Now we are going to accpet all traffic from our loopback device 
# if the IP matches any of our interfaces. 
$IPT -A INPUT   -i $LPDIF -s   $LPDIP   -j ACCEPT 
$IPT -A INPUT   -i $LPDIF -s   $EXTIP   -j ACCEPT 
$IPT -A INPUT   -i $LPDIF -s   $INTIP1  -j ACCEPT 
$IPT -A INPUT   -i $LPDIF -s   $INTIP2  -j ACCEPT 
# Blocking Broadcasts 
$IPT -A INPUT   -i $EXTIF  -d   $EXTBC   -j DROPl 
$IPT -A INPUT   -i $INTIF1 -d   $INTBC1  -j DROPl 
$IPT -A INPUT   -i $INTIF2 -d   $INTBC2  -j DROPl 
$IPT -A OUTPUT  -o $EXTIF  -d   $EXTBC   -j DROPl 
$IPT -A OUTPUT  -o $INTIF1 -d   $INTBC1  -j DROPl 
$IPT -A OUTPUT  -o $INTIF2 -d   $INTBC2  -j DROPl 
$IPT -A FORWARD -o $EXTIF  -d   $EXTBC   -j DROPl 
$IPT -A FORWARD -o $INTIF1 -d   $INTBC1  -j DROPl 
$IPT -A FORWARD -o $INTIF2 -d   $INTBC2  -j DROPl 
# Block WAN access to internal network 
# This also stops nefarious crackers from using our network as a 
# launching point to attack other people 
# iptables translation: 
# "if input going into our external interface does not originate from our isp assigned 
# ip address, drop it like a hot potato 
$IPT -A INPUT   -i $EXTIF -d ! $EXTIP  -j DROPl 
# Now we will block internal addresses originating from anything but our 
# two predefined interfaces.....just remember that if you jack your 
# your laptop or another pc into one of these NIC's directly, you'll need 
# to ensure that they either have the same ip or that you add a line explicitly 
# for that IP as well                                                                                
# Interface one/internal net one 
$IPT -A INPUT   -i $INTIF1 -s ! $INTNET1 -j DROPl 
$IPT -A OUTPUT  -o $INTIF1 -d ! $INTNET1 -j DROPl 
$IPT -A FORWARD -i $INTIF1 -s ! $INTNET1 -j DROPl 
$IPT -A FORWARD -o $INTIF1 -d ! $INTNET1 -j DROPl 
# Interface two/internal net two 
$IPT -A INPUT   -i $INTIF2 -s ! $INTNET2 -j DROPl 
$IPT -A OUTPUT  -o $INTIF2 -d ! $INTNET2 -j DROPl 
$IPT -A FORWARD -i $INTIF2 -s ! $INTNET2 -j DROPl 
$IPT -A FORWARD -o $INTIF2 -d ! $INTNET2 -j DROPl 
# An additional Egress check 
$IPT -A OUTPUT  -o $EXTIF -s ! $EXTNET -j DROPl 
# Block outbound ICMP (except for PING) 
$IPT -A OUTPUT  -o $EXTIF -p icmp --icmp-type ! 8 -j DROPl 
$IPT -A FORWARD -o $EXTIF -p icmp --icmp-type ! 8 -j DROPl 
# COMmon ports: 
# 0 is tcpmux; SGI had vulnerability, 1 is common attack 
# 13 is daytime 
# 98 is Linuxconf 
# 111 is sunrpc (portmap) 
# 137:139, 445 is Microsoft 
# SNMP: 161,2 
# Squid flotilla: 3128, 8000, 8008, 8080 
# 1214 is Morpheus or KaZaA 
# 2049 is NFS 
# 3049 is very virulent Linux Trojan, mistakable for NFS 
# Common attacks: 1999, 4329, 6346 
# Common Trojans 12345 65535 
COMBLOCK="0:1 13 98 111 137:139 161:162 445 1214 1999 2049 3049 4329 6346 3128 8000 8008 8080 12345 65535" 
# TCP ports: 
# 98 is Linuxconf 
# 512-515 is rexec, rlogin, rsh, printer(lpd) 
#   [very serious vulnerabilities; attacks continue daily] 
# 1080 is Socks proxy server 
# 6000 is X (NOTE X over SSH is secure and runs on TCP 22) 
# Block 6112 (Sun's/HP's CDE) 
TCPBLOCK="$COMBLOCK 98 512:515 1080 6000:6009 6112" 
# UDP ports: 
# 161:162 is SNMP 
# 520=RIP, 9000 is Sangoma 
# 517:518 are talk and ntalk (more annoying than anything) 
UDPBLOCK="$COMBLOCK 161:162 520 123 517:518 1427 9000" 
echo -n "FW: Blocking attacks to TCP port " 
for i in $TCPBLOCK; 
do 
  echo -n "$i " 
  $IPT -A INPUT   -p tcp --dport $i  -j DROPl 
  $IPT -A OUTPUT  -p tcp --dport $i  -j DROPl 
  $IPT -A FORWARD -p tcp --dport $i  -j DROPl 
done 
echo "" 
echo -n "FW: Blocking attacks to UDP port " 
for i in $UDPBLOCK; 
do 
  echo -n "$i " 
  $IPT -A INPUT   -p udp --dport $i  -j DROPl 
  $IPT -A OUTPUT  -p udp --dport $i  -j DROPl 
  $IPT -A FORWARD -p udp --dport $i  -j DROPl 
done 
echo "" 
# Opening up ftp connection tracking 
MODULES="ip_nat_ftp ip_conntrack_ftp" 
for i in $MODULES; 
do 
 echo "Inserting module $i" 
 modprobe $i 
done 
# Defining some common chat clients. Remove these from your accepted list for better security. 
# ICQ and AOL are 5190 
# MSN is 1863 
# Y! is 5050 
# Jabber is 5222 
# Y! and Jabber ports not added by author and therefore left out of the script 
IRC='ircd' 
MSN=1863 
ICQ=5190 
NFS='sunrpc' 
# We have to sync!! 
PORTAGE='rsync' 
OpenPGP_HTTP_Keyserver=11371 
# All services ports are read from /etc/services 
TCPSERV="domain ssh http https ftp ftp-data mail pop3 pop3s imap3 imaps imap2 \ 
         time $PORTAGE $IRC $MSN $ICQ  $OpenPGP_HTTP_Keyserver" UDPSERV="domain time" 
echo -n "FW: Allowing inside systems to use service:" 
for i in $TCPSERV; 
do 
  echo -n "$i " 
  $IPT -A OUTPUT  -o $EXTIF  -p tcp -s $EXTIP   --dport $i --syn -m state --state NEW -j ACCEPT 
  $IPT -A FORWARD -i $INTIF1 -p tcp -s $INTNET1 --dport $i --syn -m state --state NEW -j ACCEPT 
  $IPT -A FORWARD -i $INTIF2 -p tcp -s $INTNET2 --dport $i --syn -m state --state NEW -j ACCEPT 
done 
echo "" 
echo -n "FW: Allowing inside systems to use service:" 
for i in $UDPSERV; 
do 
  echo -n "$i " 
  $IPT -A OUTPUT  -o $EXTIF  -p udp -s $EXTIP   --dport $i -m state --state NEW -j ACCEPT 
  $IPT -A FORWARD -i $INTIF1 -p udp -s $INTNET1 --dport $i -m state --state NEW -j ACCEPT 
  $IPT -A FORWARD -i $INTIF2 -p udp -s $INTNET2 --dport $i -m state --state NEW -j ACCEPT 
done 
echo "" 
# Allow to ping out 
$IPT -A OUTPUT  -o $EXTIF  -p icmp -s $EXTIP   --icmp-type 8 -m state --state NEW -j ACCEPT 
$IPT -A FORWARD -i $INTIF1 -p icmp -s $INTNET1 --icmp-type 8 -m state --state NEW -j ACCEPT 
$IPT -A FORWARD -i $INTIF2 -p icmp -s $INTNET2 --icmp-type 8 -m state --state NEW -j ACCEPT 
# Allow firewall to ping internal systems 
$IPT -A OUTPUT  -o $INTIF1 -p icmp -s $INTNET1 --icmp-type 8 -m state --state NEW -j ACCEPT 
$IPT -A OUTPUT  -o $INTIF2 -p icmp -s $INTNET2 --icmp-type 8 -m state --state NEW -j ACCEPT 
$IPT -A INPUT   -i $INTIF1 -p tcp --dport 22 --syn -m state --state NEW -j ACCEPT 
$IPT -t nat -A PREROUTING  -j ACCEPT 
$IPT -t nat -A POSTROUTING -o $EXTIF -s $INTNET1 -j MASQUERADE 
$IPT -t nat -A POSTROUTING -o $EXTIF -s $INTNET2 -j MASQUERADE 
$IPT -t nat -A POSTROUTING -j ACCEPT 
$IPT -t nat -A OUTPUT -j ACCEPT 
$IPT -A INPUT -p tcp --dport auth --syn -m state --state NEW -j ACCEPT 
$IPT -A INPUT   -m state --state ESTABLISHED,RELATED -j ACCEPT 
$IPT -A OUTPUT  -m state --state ESTABLISHED,RELATED -j ACCEPT 
$IPT -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT 
# Block and log what me may have forgot 
$IPT -A INPUT   -j DROPl 
$IPT -A OUTPUT  -j REJECTl 
$IPT -A FORWARD -j DROPl

A little more clarification. I worked on the second script executed it and it didn't work. So I tried the first script that worked the other day and it failed to work also. I noticed that in the second script the default policy of the OUTPUT chain is DROP. Should that be set to ACCEPT? I just went through the whole second script in an effort to debug it and I do not see any lines that say that output is allowed to leave the firewall.

Do you think this explain my problem?

the only line I see that might resemble this is the following:

Code:

$IPT -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

if no new connections can get out from the firewall than this match will never happen. Same goes with the FORWARD chain.

I don't know if I'm on the wrong track here, but the top script definitely used to work and I don't know why it doesn't now. Thanks

nixcraft · 08-24-2005, 07:26 AM

You need to allow outgoing BIND/DNS request. Here are rules:

SERVER_IP is your system IP and DNS_SERVER are NS1 NS2 IP

Code:

SERVER_IP=”202.54.10.20”
DNS_SERVER=”202.54.1.5 202.54.1.6”
for ip in $DNS_SERVER
do
iptables -A OUTPUT -p udp -s $SERVER_IP --sport 1024:65535 -d $ip --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p udp -s $ip --sport 53 -d $SERVER_IP --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT-p tcp -s $SERVER_IP --sport 1024:65535 -d $ip --dport 53 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp -s $ip --sport 53 -d $SERVER_IP --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
done

Add these rules to your existing iptables script and should work.

Centinul · 08-24-2005, 07:28 AM

Well I got it working now. The more I look at this script the more funky it seems to me. I'm going to really go over it and weed it down and post back to see if ya'll think it's secure.