iptables rules help request

jamtat · 12-08-2015, 08:38 PM

So, I've got a little machine with both wired and wireless NICs in it, where I've installed Linux. The wireless NIC connects the machine to my LAN--all is working fine there. On the wired NIC, I set up a subnet so that I can connect another device to that and have the little machine's internet connection shared over that port. I found some great directions for setting that up and that's working quite well too.

The directions I found offered a set of iptables rules that allow NAT'ing between the two interfaces and, as I mentioned, that's working. But the directions envisioned what is the wifi NIC in my set-up as being an internet-facing interface, so it added some additional rules that would block most ports connecting through it (only port 22 was opened). That part of the directions has gotten me into a bit of trouble because, since this machine is on an internal LAN, I don't really need the port blocking stuff--all I need is the NAT'ing stuff.

I already had to explicitly open port 80 on the little machine, since I run a web server on it that needs to be accessible on my LAN. Now I think I'm running into another problem with those rules, since I am now trying to get access to this machine from my LAN on another port and cannot. So, what I want to do is, like I said, keep the NAT'ing rules but get rid of the port blocking rules. Since my iptables-fu is sketchy at best, I wanted to ask here for some help in implementing the right rules for this scenario.

So, the current rules are implemented as follows:

Code:

root #iptables -F 
root #iptables -t nat -F 
root #iptables -P INPUT ACCEPT 
root #iptables -P OUTPUT ACCEPT 
root #iptables -P FORWARD DROP 
root #export wired=eth0
root #export wifi=wlan0
root #iptables -I INPUT 1 -i ${wired} -j ACCEPT 
root #iptables -I INPUT 1 -i lo -j ACCEPT 
root #iptables -A INPUT -p UDP --dport bootps ! -i ${wired} -j REJECT 
root #iptables -A INPUT -p UDP --dport domain ! -i ${wired} -j REJECT 
root #iptables -A INPUT -p TCP --dport ssh -i ${wifi} -j ACCEPT 
root #iptables -A INPUT -p TCP --dport 80 -i wlan0 -j ACCEPT 
root #iptables -A INPUT -p TCP ! -i ${wired} -d 0/0 --dport 0:1023 -j DROP 
root #iptables -A INPUT -p UDP ! -i ${wired} -d 0/0 --dport 0:1023 -j DROP 
root #iptables -I FORWARD -i ${wired} -d 192.168.0.0/255.255.0.0 -j DROP 
root #iptables -A FORWARD -i ${wired} -s 192.168.0.0/255.255.0.0 -j ACCEPT 
root #iptables -A FORWARD -i ${wifi} -d 192.168.0.0/255.255.0.0 -j ACCEPT 
root #iptables -t nat -A POSTROUTING -o ${wifi} -j MASQUERADE 
root #echo 1 > /proc/sys/net/ipv4/ip_forward 
root #for f in /proc/sys/net/ipv4/conf/*/rp_filter ; do echo 1 > $f ; done 
root #/etc/init.d/iptables save

I believe, but want to double check here, that something like the following might actually do what I need:

Code:

 echo 1 > /proc/sys/net/ipv4/ip_forward 
iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE 
iptables -A FORWARD -i wlan0 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT 
iptables -A FORWARD -i wlan0 -o eth0 -j ACCEPT 
for f in /proc/sys/net/ipv4/conf/*/rp_filter ; do echo 1 > $f ; done 
/etc/init.d/iptables save

Can anyone confirm for me whether I'm on the right track in reformulating these rules and whether using these might result in NAT continuing to work between these two interfaces, but without any port blocking?

jamtat · 12-09-2015, 01:27 AM

Found a couple of additional resources touching in this matter. First one is at http://serverfault.com/questions/431...-two-interface and, adapted to my scenario, it looks like the rules would be something like the following:

Code:

 echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -A FORWARD -i eth0 -o wlan0 -j ACCEPT
iptables -A FORWARD -i wlan0 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE

Another one I found at http://www.yourownlinux.com/2013/07/...as-router.html is similar. Adapted to my scenario, the rules should probably be implemented in a manner like the following:

Code:

iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE
iptables -A FORWARD -i wlan0 -o eth0 -m state -–state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i eth0 -o wlan0 -j ACCEPT

Comparing the two, the differences are really only the order of the rules and transposition of some words. And both are essentially like the example I included at the end of my OP. So perhaps I'm on the right track there. In any case, input will be appreciated.

PS So wlan0 is the wifi interface that connects the little machine to the LAN, while eth0 is the wired interface on which the subnet for some other wired device to be hooked there gets established.

zhjim · 12-09-2015, 04:47 AM

The order you mention in your second post dos not matter cause you not only use a different chain POSTROUTING but also another filter -t nat. Not sure where you actually want to insert the new rules good practice is to get the --state ESTABLISHED,RELATED rule quite high in the chain. This releaves iptables of walking down all the way to hit it. Also iptables rules below numbers of 1000 should not effect latency at all.
What I'm missing from your new rules is the new port you wanted to be opened...

Maybe you could use some self created chains to order the rules by wired and wireless interface?

Quote:

iptables -N wireless
iptables -A INPUT -i ${wifi} -j wireless
iptables -A wireless -p UDP -j DROP

Your FORWARD rules might block connections between your wired LAN and wifi LAN if you have the 192.168.0.0/16 ip range in use.
Also the MASQUERADE rule after them might not be what you want. It changes every sender ip that goes out to the wifi LAN to use the address of the little box. Normaly you would use MASQUERADE if you go out to the internet (WAN).

Maybe you can draw a quick diagram of you network and describe what connections you want to allow and which ones to deny. Also if you want to have a LAN on the wired interface of the little box maybe get another wired interface. This way you could seperate the WAN (internet), LAN and WLAN networks.

jamtat · 12-09-2015, 12:41 PM

Thanks for your input, zhjim, and apologies for the unclarity. To be clear, I want no port blocking at all to be happening between the two interfaces: all traffic should flow freely on all ports. I'd rather not have to create any more addition iptables rules and manually open any more ports: both machines are on a private LAN and port blocking is not needed.

Here's a crude diagram that may help depict what I'm intending to do:

Code:

               ((((( + )))  ((( + ))))
                     |          |
                     |          |
                     +          +
                   +---------------+
                   |wired/wifi     |
                   |  router/AP    |
                   |               |
                   +---------------+
                      +
                      |                     ((( + )))
<---------------------+                         |
 connection to internet                         |
                                                +
                                            +-------------------+
                                            | wlan0 connects to |
                                            | router            |
                                            |little machine     |
                                            |               eth0|<------------------------+
                                            +-------------------+                         |
                                                                                          |
                                                                        +-----------------+-+
                                                                        |                   |
                                                                        | other device      |
                                                                        |                   |
                                                                        |                   |
                                                                        +-------------------+
                                                                         connects to little
                                                                        machine's eth0 & shares
                                                                        its connection to internet

lsalab · 12-10-2015, 02:00 PM

If what you want is to simply share your wifi connection, why block anything at all? You should try to just NAT everything with your wlan adapter (Provided that you have different subnets on each interface). To do so, you are on the right track:

To enable forwarding each time you boot up your machine:

Code:

echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf
sysctl -p

And the iptables rules you need:

Code:

iptables -P FORWARD ACCEPT
iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE

That establishes an ACCEPT policy on the FORWARD chain of the Filter table and adds a rule to NAT everything going out of your wlan0 interface to your local LAN.

Don't forget to set your default gateway via the wlan0 subnet router!

Hope it helps!