LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 08-04-2011, 06:07 AM   #1
mahesh.salunkhe
LQ Newbie
 
Registered: Aug 2011
Posts: 19

Rep: Reputation: Disabled
firewall script not getting effective


Hello all,
I have a simple firewall script which runs well on one node(RHEL5) but fails on the server(RHEL5) machine(not allowing the connections).
On both the machines SELinux is disabled.
Is there any other security setting to be set/unset?

The script goes like :

iptables -F

# Set default chain policies
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# MultiPorts (Allow incoming ssh,ftp, HTTP, and HTTPS)
iptables -A INPUT -i eth0 -p tcp -m multiport --dports 22,21,80,443 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp -m multiport --sports 22,21,80,443 -m state --state ESTABLISHED -j ACCEPT
 
Click here to see the post LQ members have rated as the most helpful post in this thread.
Old 08-04-2011, 11:04 AM   #2
win32sux
LQ Guru
 
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 379Reputation: 379Reputation: 379Reputation: 379
Maybe add a LOG rule to the end of both chains and show us what entries are generated when failure occurs? AFAICT, the only service which should fail with those rules is FTP. BTW, I'd recommend adding a rule for packets in state RELATED to each of those chains.
Code:
iptables -A INPUT -j LOG --log-prefix "INPUT DROP: "
iptables -A OUTPUT -j LOG --log-prefix "OUTPUT DROP: "
 
Old 08-04-2011, 11:43 AM   #3
anomie
Senior Member
 
Registered: Nov 2004
Location: Texas
Distribution: RHEL, Scientific Linux, Debian, Fedora
Posts: 3,935
Blog Entries: 5

Rep: Reputation: Disabled
Also, is that your entire ruleset? I'd at least add:
Code:
-A INPUT -i lo -j ACCEPT 
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
 
Old 08-05-2011, 07:59 AM   #4
mahesh.salunkhe
LQ Newbie
 
Registered: Aug 2011
Posts: 19

Original Poster
Rep: Reputation: Disabled
Thank you both for replying.
This is the script being run:


iptables -F

# Set default chain policies
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

# MultiPorts (Allow incoming ssh,ftp, HTTP, and HTTPS)
iptables -A INPUT -i eth0 -p tcp -m multiport --dports 22,21,80,443 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp -m multiport --sports 22,21,80,443 -m state --state ESTABLISHED -j ACCEPT

# MultiPorts (Allow outgoing ssh,ftp, HTTP, and HTTPS 3128 for squid)
iptables -A OUTPUT -o eth0 -p tcp -m multiport --dports 22,21,80,443,3128 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -m multiport --sports 22,21,80,443,3128 -m state --state ESTABLISHED -j ACCEPT

# allow data transfer from remote ftp server
iptables -A INPUT -i eth0 -p tcp --sport 20 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT

# allow data transfer to local ftp server
iptables -A OUTPUT -o eth0 -p tcp --sport 20 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 20 -m state --state ESTABLISHED -j ACCEPT

# allow incoming loopback connections
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT


# allow incoming ping connections
iptables -A INPUT -i eth0 -p icmp --icmp-type echo-request -j ACCEPT
iptables -A OUTPUT -o eth0 -p icmp --icmp-type echo-reply -j ACCEPT

# allow outgoing ping connections
iptables -A OUTPUT -o eth0 -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -i eth0 -p icmp --icmp-type echo-reply -j ACCEPT


#Log the dropped packets
iptables -A INPUT -j LOG --log-prefix "INPUT DROP: "
iptables -A OUTPUT -j LOG --log-prefix "OUTPUT DROP: "





When it is run on a node( say node1 )it runs fine. But when the same script is run on the server ,it doesn't work(only ping works in/out both).

Log generated when incoming hhtp req is tried on the server (172.32.0.250) is :

.
.
.
Aug 5 17:49:09 localhost kernel: INPUT DROP: IN=eth1 OUT= MAC=00:09:6b:7f:4e:6e:00:1d:09:19:27:59:08:00 SRC=172.32.0.101 DST=172.32.0.250 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=53407 DF PROTO=TCP SPT=17153 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0

Aug 5 17:49:21 localhost kernel: INPUT DROP: IN=eth1 OUT= MAC=00:09:6b:7f:4e:6e:00:1d:09:19:27:59:08:00 SRC=172.32.0.101 DST=172.32.0.250 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=53408 DF PROTO=TCP SPT=17153 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0

Aug 5 17:49:45 localhost kernel: INPUT DROP: IN=eth1 OUT= MAC=00:09:6b:7f:4e:6e:00:1d:09:19:27:59:08:00 SRC=172.32.0.101 DST=172.32.0.250 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=53409 DF PROTO=TCP SPT=17153 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0




What could be the reason?

Last edited by mahesh.salunkhe; 08-05-2011 at 08:25 AM.
 
Old 08-05-2011, 10:28 AM   #5
win32sux
LQ Guru
 
Registered: Jul 2003
Location: Los Angeles
Distribution: Ubuntu
Posts: 9,870

Rep: Reputation: 379Reputation: 379Reputation: 379Reputation: 379
Quote:
Originally Posted by mahesh.salunkhe View Post
IN=eth1
It's the interface name.

The rules explicitly state eth0, not eth1 (so the packets don't match the rules).
 
2 members found this post helpful.
Old 08-06-2011, 01:09 PM   #6
mahesh.salunkhe
LQ Newbie
 
Registered: Aug 2011
Posts: 19

Original Poster
Rep: Reputation: Disabled
Lightbulb

Thank you very much!
And am really very sorry, just forgot that!

Last edited by mahesh.salunkhe; 08-06-2011 at 01:14 PM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
What is effective user ID and effective group Id Anoop Madhusoodhanan P Linux - Kernel 1 01-11-2010 04:29 PM
rc firewall script okcomputer44 Linux - Networking 1 04-16-2009 04:54 AM
How do I write an effective Cron Script? wolfcreek Linux - Newbie 3 06-17-2006 10:01 AM
how to make an effective firewall with iptables jonc Linux - Newbie 3 12-09-2004 12:44 AM
slackware's /etc/rc.d/rc.firewall equivalent ||| firewall script startup win32sux Debian 1 03-06-2004 10:15 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 04:58 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration