LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 11-01-2002, 12:10 PM   #16
Mara
Moderator
 
Registered: Feb 2002
Location: Grenoble
Distribution: Debian
Posts: 9,696

Rep: Reputation: 232Reputation: 232Reputation: 232

Hmmm.. For me it looks like ssh configuration problem, not a firewalling issue...
 
Old 11-01-2002, 01:08 PM   #17
closer
LQ Newbie
 
Registered: Oct 2002
Location: Cedar Lake, IN
Distribution: Redhat 7.3
Posts: 21

Original Poster
Rep: Reputation: 15
The thing is every time I try to SSH back into my box I also try FTP and that will not work.

I dont know, Ive been playing with that gShield. Im going to try to make a configuration as close as I can to the script and see what differences it makes. That may help me to discover what the problem is with my script.

-Scott
 
Old 11-01-2002, 02:53 PM   #18
Mara
Moderator
 
Registered: Feb 2002
Location: Grenoble
Distribution: Debian
Posts: 9,696

Rep: Reputation: 232Reputation: 232Reputation: 232
In your ftp part of the firewall you only allow ESTABILISHED and RELATED, not NEW packets, so a connection cannot be made (or I can't see the right fragment).
 
Old 11-04-2002, 09:48 AM   #19
peter_robb
Senior Member
 
Registered: Feb 2002
Location: Szczecin, Poland
Distribution: Gentoo, Debian
Posts: 2,458

Rep: Reputation: 48
Several large problems in both versions of rules,
but a couple of questions first...

You are Masquerading everything outward on eth1, which means it is your "Internet" interface, YES?
You are directing traffic to a couple of internal servers, 10.0.0.3 & 4 YES?
You have some servers on the firewall, at least http, ssh, ftp YES?

There are a lot of OUTPUT rules, which will block any traffic the firewall itself generates, including dns queries which ssh may want for verification.
I suggest you comment them ALL out and change the POLICY to ACCEPT. There should be no reason to mistrust what the firewall itself generates, not just yet...

Remove the INPUT -s *my.ip.add.ress* -j DROP rule. The rp_filter does this.

I suggest you add some -j LOG rules immediately before any -j DROP rules and last of all on any DROP POLICY chains, to catch the information until you get an idea what is happening. eg
iptables -A INPUT -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j LOG --log-prefix "INPUT_NEW_!_SYN " --log-level 6
iptables -A INPUT -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m state --state NEW -j DROP

These can be viewed with "tail -f /var/log/messages" in a default syslog install.

I suggest you add at least...
iptables -A FORWARD -i eth1 -o eth0 -p tcp ! --syn -m state NEW -j DROP
iptables -A FORWARD -i eth1 -o eth0 -m state --state INVALID -j DROP
iptables -A FORWARD -i eth1 -o eth0 -f -j DROP
for protection in the FORWARD chain. Fragments should be handled inside netfilter automatically, but in case...

Because there are similar port descriptions in the INPUT chain and the PREROUTING chains, I think you may be confusing the packet paths.
INPUT is only used for packets which will stop on the firewall, usu at a server on the firewall.
FORWARD is for the packets going to LAN based servers.
Forwarded packets go through PREROUTING, FORWARD & POSTROUTING chains

See how that goes..
Regards,
Peter
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Iptables (with masq) troubleshooting, very simple script attached script and logs. xinu Linux - Networking 13 11-01-2007 04:19 AM
iptables script tomsasse Linux - Networking 3 09-17-2005 05:25 PM
Yet another iptables script Cron Linux - Networking 0 03-12-2005 11:11 AM
my first iptables script sh1ft Linux - Security 1 02-24-2005 04:17 PM
My iptables script is /etc/sysconfig/iptables. How do i make this baby execute on boo ForumKid Linux - General 3 01-22-2002 07:36 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 02:35 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration