LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Security (https://www.linuxquestions.org/questions/linux-security-4/)
-   -   Problems with IPtables on Debian (https://www.linuxquestions.org/questions/linux-security-4/problems-with-iptables-on-debian-514132/)

Kanon 12-27-2006 05:02 PM
Problems with IPtables on Debian
 
Iv been sitting here for the last few days and cant seem to get hang of the iptables stuff.
How can I open port 80 to the web server whos on another box on the lan? I'v tried a zillion things but nothing works. :( All i found so far either old or for different distro and...well Iam about to give it up. Running fresh install of Debian with no gui btw.
And how come port 22 is open? I thought I closed it.

Code:
#!/bin/sh

PATH=/usr/sbin:/sbin:/bin:/usr/bin

#
# delete all existing rules.
#
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X

# Always accept loopback traffic
iptables -A INPUT -i lo -j ACCEPT

# Allow established connections, and those not coming from the outside
iptables -A OUTPUT -o eth0 -p tcp --dport 22 -j DROP
iptables -A FORWARD -p tcp -s 192.168.0.0/24 -i eth0 -j DROP
iptables -A FORWARD -p udp -s 192.168.0.0/24 -i eth0 -j DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state NEW -i ! eth0 -j ACCEPT
iptables -A FORWARD -i eth0 -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow outgoing connections from the LAN side.
iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT

# Masquerade.
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# Don't forward from the outside to the inside.
iptables -A FORWARD -i eth0 -o eth0 -j REJECT

# Enable routing.
echo 1 > /proc/sys/net/ipv4/ip_forward

ppuru 12-27-2006 05:34 PM
Kanon

If you want to redirect traffic to another box - port 80 on another box, you need to use

PREROUTING and DNAT.

iptables -A FORWARD -i eth0 -d <ip of webserver> -j ACCEPT
iptables -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-dest <IP of webserver>:80

You have only closed ssh traffic going out.

iptables -A INPUT -i eth0 -p tcp --dport 22 -j DROP

will close port 22 to incoming traffic on eth0. the OUTPUT rule for port 22 is not necessary.

Suggest you start your rules with

iptables -P INPUT DROP
iptables -P FORWARD DROP

This will enforce the default deny stance, effectively seals your system.

rickh 12-27-2006 05:35 PM
Working with iptables is an art as well as a science. Do you have to do it manually? Firestarter is an easy and fairly secure GUI. Shorewall or some other front-end for iptables is easier and as secure as you want to make it.

Jaqui 12-27-2006 06:00 PM
Quote:
Originally Posted by rickh
Working with iptables is an art as well as a science. Do you have to do it manually? Firestarter is an easy and fairly secure GUI. Shorewall or some other front-end for iptables is easier and as secure as you want to make it.
true enough, but the op did state that this is a cli only box he is working on, so not really a viable option.

Kanon 12-28-2006 12:55 AM
Quote:
Originally Posted by ppuru
Kanon

If you want to redirect traffic to another box - port 80 on another box, you need to use

PREROUTING and DNAT.

iptables -A FORWARD -i eth0 -d <ip of webserver> -j ACCEPT
iptables -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-dest <IP of webserver>:80

You have only closed ssh traffic going out.

iptables -A INPUT -i eth0 -p tcp --dport 22 -j DROP

will close port 22 to incoming traffic on eth0. the OUTPUT rule for port 22 is not necessary.

Suggest you start your rules with

iptables -P INPUT DROP
iptables -P FORWARD DROP

This will enforce the default deny stance, effectively seals your system.
Nice! ssh port is now closed. :)
But I dont have PREROUTING. How do I add the file/filter? Im assuming its going into the netfilter.

Thanks for the solution to port 22! :)

sarajevo 12-28-2006 08:43 AM
Quote:
Originally Posted by Kanon
Nice! ssh port is now closed. :)
But I dont have PREROUTING. How do I add the file/filter? Im assuming its going into the netfilter.

Thanks for the solution to port 22! :)
I think solution before will solve problem related to forwarding.
But you have to put

echo 1 >/proc/sys/net/ipv4/ip_forward

in order to make your machine able to forward packets.
Just put this as last line inside your script

Regards and best wishes

:twocents:

Kanon 12-28-2006 09:28 AM
I got "echo 1 >/proc/sys/net/ipv4/ip_forward" as the last line. But I get "Unable to connect" in my browser. And I get ann error:

Code:
bound to my.static.ip.10 -- renewal in 10800 seconds.
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
done.
if I remove or comment out the PREROUTING line I get no error. And no access to the web server; "Unable to connect".

Thanks for helping me out here every one! :)

ppuru 12-28-2006 12:23 PM
My sincere apologies Kanon

the prerouting line should be

iptables -t nat -A PREROUTING ...

Kanon 12-28-2006 02:23 PM
W00T!! I got no hair left now!! Just kidding :D

Ok, now its kinda working. Well, that is the port is open, but clients dont get any pages from the web server.

This is my iptables now:

Code:
#!/bin/sh

PATH=/usr/sbin:/sbin:/bin:/usr/bin

#
# delete all existing rules.
#
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X

#iptables -P INPUT DROP
#iptables -P FORWARD DROP

# Always accept loopback traffic
iptables -A INPUT -i lo -j ACCEPT

# Allow established connections, and those not coming from the outside
iptables -A INPUT -s the.bad.guy.ip -j DROP
iptables -A OUTPUT -o eth0 -p tcp --dport 31337 --sport 31337 -j DROP
iptables -A INPUT -i eth0 -p tcp --dport 22 -j DROP
#iptables -A FORWARD -p tcp -s 192.168.0.0/24 -i eth0 -j DROP
#iptables -A FORWARD -p udp -s 192.168.0.0/24 -i eth0 -j DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state NEW -i ! eth0 -j ACCEPT
iptables -A FORWARD -i eth0 -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow outgoing connections from the LAN side.
iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT

# Masquerade.
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# Don't forward from the outside to the inside.
iptables -A FORWARD -i eth0 -d 192.168.0.120 -j ACCEPT
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-dest 192.168.0.120:80
iptables -A FORWARD -i eth0 -o eth0 -j REJECT

# Enable routing.
echo 1 > /proc/sys/net/ipv4/ip_forward
Now, I can connect to the web server from the inside with no problem. But not from the outside. And I can get out from the web server (Lynx) with no problem.
Can any one see any problems with the table? Think Im going iptables-blind :P

timdsmith 12-28-2006 02:48 PM
Try changing this line, the one right before your PREROUTING line
Code:
iptables -A FORWARD -i eth0 -d 192.168.0.120 -j ACCEPT
to this:
Code:
iptables -A FORWARD -p tcp -d 192.168.0.120 --dport 80 -j ACCEPT
And you may also need this line before those two...
Code:
iptables -A INPUT -p tcp -i eth0 -s 0.0.0.0/0 --dport 80 -j ACCEPT

Kanon 12-28-2006 05:06 PM
Hmm Did not help any. How can I check to see if the gw establishes connection at all between the machines?

theNbomr 12-28-2006 05:52 PM
It appears that you are trying to build a firewall to protect a home network on a DSL connection. May I suggest the nicely tailored setup HomeLANSecurity, which is easy to figure out & easy to add stuff for your specific purposes. It just makes a lot of sense to me, to use a mature configuration, in which someone has paid a lot of attention to details, and has had the benefit of many previous users' input. You can still modify it to your specification, in case it doesn't do everything you want (ie. hacking is encouragead).

--- rod.

Kanon 12-28-2006 05:57 PM
Yeah, looks good. And its cli too! :)
I'll have a go at it after a few hours of sleep :)

Thanks all, for all the help!! :)


All times are GMT -5. The time now is 10:44 PM.