Problems with IPtables on Debian

Kanon · 12-27-2006, 05:02 PM

Iv been sitting here for the last few days and cant seem to get hang of the iptables stuff.
How can I open port 80 to the web server whos on another box on the lan? I'v tried a zillion things but nothing works.

All i found so far either old or for different distro and...well Iam about to give it up. Running fresh install of Debian with no gui btw.
And how come port 22 is open? I thought I closed it.

Code:

#!/bin/sh

PATH=/usr/sbin:/sbin:/bin:/usr/bin

#
# delete all existing rules.
#
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X

# Always accept loopback traffic
iptables -A INPUT -i lo -j ACCEPT

# Allow established connections, and those not coming from the outside
iptables -A OUTPUT -o eth0 -p tcp --dport 22 -j DROP 
iptables -A FORWARD -p tcp -s 192.168.0.0/24 -i eth0 -j DROP
iptables -A FORWARD -p udp -s 192.168.0.0/24 -i eth0 -j DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state NEW -i ! eth0 -j ACCEPT
iptables -A FORWARD -i eth0 -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow outgoing connections from the LAN side.
iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT

# Masquerade.
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# Don't forward from the outside to the inside.
iptables -A FORWARD -i eth0 -o eth0 -j REJECT

# Enable routing.
echo 1 > /proc/sys/net/ipv4/ip_forward

ppuru · 12-27-2006, 05:34 PM

Kanon

If you want to redirect traffic to another box - port 80 on another box, you need to use

PREROUTING and DNAT.

iptables -A FORWARD -i eth0 -d <ip of webserver> -j ACCEPT
iptables -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-dest <IP of webserver>:80

You have only closed ssh traffic going out.

iptables -A INPUT -i eth0 -p tcp --dport 22 -j DROP

will close port 22 to incoming traffic on eth0. the OUTPUT rule for port 22 is not necessary.

Suggest you start your rules with

iptables -P INPUT DROP
iptables -P FORWARD DROP

This will enforce the default deny stance, effectively seals your system.

rickh · 12-27-2006, 05:35 PM

Working with iptables is an art as well as a science. Do you have to do it manually? Firestarter is an easy and fairly secure GUI. Shorewall or some other front-end for iptables is easier and as secure as you want to make it.

Jaqui · 12-27-2006, 06:00 PM

Quote:

Originally Posted by rickh

Working with iptables is an art as well as a science. Do you have to do it manually? Firestarter is an easy and fairly secure GUI. Shorewall or some other front-end for iptables is easier and as secure as you want to make it.

true enough, but the op did state that this is a cli only box he is working on, so not really a viable option.

Kanon · 12-28-2006, 12:55 AM

Quote:

Originally Posted by ppuru

Kanon

If you want to redirect traffic to another box - port 80 on another box, you need to use

PREROUTING and DNAT.

iptables -A FORWARD -i eth0 -d <ip of webserver> -j ACCEPT
iptables -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-dest <IP of webserver>:80

You have only closed ssh traffic going out.

iptables -A INPUT -i eth0 -p tcp --dport 22 -j DROP

will close port 22 to incoming traffic on eth0. the OUTPUT rule for port 22 is not necessary.

Suggest you start your rules with

iptables -P INPUT DROP
iptables -P FORWARD DROP

This will enforce the default deny stance, effectively seals your system.

Nice! ssh port is now closed.

But I dont have PREROUTING. How do I add the file/filter? Im assuming its going into the netfilter.

Thanks for the solution to port 22!

sarajevo · 12-28-2006, 08:43 AM

Quote:

Originally Posted by Kanon

Nice! ssh port is now closed.

But I dont have PREROUTING. How do I add the file/filter? Im assuming its going into the netfilter.

Thanks for the solution to port 22!

I think solution before will solve problem related to forwarding.
But you have to put

echo 1 >/proc/sys/net/ipv4/ip_forward

in order to make your machine able to forward packets.
Just put this as last line inside your script

Regards and best wishes

Kanon · 12-28-2006, 09:28 AM

I got "echo 1 >/proc/sys/net/ipv4/ip_forward" as the last line. But I get "Unable to connect" in my browser. And I get ann error:

Code:

bound to my.static.ip.10 -- renewal in 10800 seconds.
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
done.

if I remove or comment out the PREROUTING line I get no error. And no access to the web server; "Unable to connect".

Thanks for helping me out here every one!

ppuru · 12-28-2006, 12:23 PM

My sincere apologies Kanon

the prerouting line should be

iptables -t nat -A PREROUTING ...

Kanon · 12-28-2006, 02:23 PM

W00T!! I got no hair left now!! Just kidding

Ok, now its kinda working. Well, that is the port is open, but clients dont get any pages from the web server.

This is my iptables now:

Code:

#!/bin/sh

PATH=/usr/sbin:/sbin:/bin:/usr/bin

#
# delete all existing rules.
#
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X

#iptables -P INPUT DROP
#iptables -P FORWARD DROP

# Always accept loopback traffic
iptables -A INPUT -i lo -j ACCEPT

# Allow established connections, and those not coming from the outside
iptables -A INPUT -s the.bad.guy.ip -j DROP
iptables -A OUTPUT -o eth0 -p tcp --dport 31337 --sport 31337 -j DROP
iptables -A INPUT -i eth0 -p tcp --dport 22 -j DROP
#iptables -A FORWARD -p tcp -s 192.168.0.0/24 -i eth0 -j DROP
#iptables -A FORWARD -p udp -s 192.168.0.0/24 -i eth0 -j DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state NEW -i ! eth0 -j ACCEPT
iptables -A FORWARD -i eth0 -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow outgoing connections from the LAN side.
iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT

# Masquerade.
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# Don't forward from the outside to the inside.
iptables -A FORWARD -i eth0 -d 192.168.0.120 -j ACCEPT
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-dest 192.168.0.120:80
iptables -A FORWARD -i eth0 -o eth0 -j REJECT

# Enable routing.
echo 1 > /proc/sys/net/ipv4/ip_forward

Now, I can connect to the web server from the inside with no problem. But not from the outside. And I can get out from the web server (Lynx) with no problem.
Can any one see any problems with the table? Think Im going iptables-blind :P

timdsmith · 12-28-2006, 02:48 PM

Try changing this line, the one right before your PREROUTING line

Code:

iptables -A FORWARD -i eth0 -d 192.168.0.120 -j ACCEPT

to this:

Code:

iptables -A FORWARD -p tcp -d 192.168.0.120 --dport 80 -j ACCEPT

And you may also need this line before those two...

Code:

iptables -A INPUT -p tcp -i eth0 -s 0.0.0.0/0 --dport 80 -j ACCEPT

Kanon · 12-28-2006, 05:06 PM

Hmm Did not help any. How can I check to see if the gw establishes connection at all between the machines?

theNbomr · 12-28-2006, 05:52 PM

It appears that you are trying to build a firewall to protect a home network on a DSL connection. May I suggest the nicely tailored setup HomeLANSecurity, which is easy to figure out & easy to add stuff for your specific purposes. It just makes a lot of sense to me, to use a mature configuration, in which someone has paid a lot of attention to details, and has had the benefit of many previous users' input. You can still modify it to your specification, in case it doesn't do everything you want (ie. hacking is encouragead).

--- rod.

Kanon · 12-28-2006, 05:57 PM

Yeah, looks good. And its cli too!

I'll have a go at it after a few hours of sleep

Thanks all, for all the help!!