RH9-Shrike&iptables-->unbelieviable effect...ports are opened...

pablovschby · 10-03-2003, 01:49 AM

hello

I am just very confused about my strange REdHat9Shrike Firewall.... ...well I am running the script below....this script denies every connection exceptly the ssh-port and the local processes so, there should just the ssh-port be opened....here is what my nmap says: the ports 80-83, 1080, 1863, 5190, 11523 are opened...!!!!!

i can't understand this bemusing wonder.... there is a ghost conjuring up some stupid things right in my RedHat9...????????????here is my script:

Code:

[root@router1 pablo]# cat 1
#!/bin/tcsh
#script fr router
echo "firewall is starting now......"
set ipt = /sbin/iptables
set EXT = eth0
set INT = eth1
set IF = ( $EXT $INT )
set p_high = 1024:
#-------------------------
#kernelparameter setzen fuer alle interfaces extra:
echo "0" > /proc/sys/net/ipv4/ip_forward #erstmal abschalten
echo "1" > /proc/sys/net/ipv4/tcp_syncookies
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses

echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
echo "0" > /proc/sys/net/ipv4/conf/all/accept_redirects
echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route
echo "0" > /proc/sys/net/ipv4/conf/all/bootp_relay
echo "0" > /proc/sys/net/ipv4/conf/all/log_martians


#------------------------
#default policies:
$ipt -P INPUT DROP
$ipt -P OUTPUT DROP
$ipt -P FORWARD DROP
echo "...all BUILT-IN CHAINS are successfully dropped by default..."
$ipt -F
$ipt -t nat -F
$ipt -X
echo "...USERDEFINED CHAINS were flushed..."
#--------------------------------
#local processes:
$ipt -A OUTPUT -o lo -j ACCEPT
$ipt -A INPUT -i lo -j ACCEPT
#---------------------------------------------------

#set TTL (just affecting all the packets, that the router generated by himself):
echo "102" > /proc/sys/net/ipv4/ip_default_ttl
#set TTL for GENERAL OUTGOING PACKETS!
#$ipt -t mangle -A OUTPUT -j TTL --ttl-set 102
#$ipt -t mangle -A OUTPUT -j ttl_fertig --ttl-set 102

echo "...ttl is adjusted...!"
#$ipt -N ttl_fertig

#---------------------------------------------------
#rules for ssh-connection:

$ipt -A OUTPUT -p tcp --sport 22 ! --syn --dport $p_high -j ACCEPT
$ipt -A INPUT -p tcp --dport 22 --sport $p_high -j ACCEPT              #2mal server


echo "......"

pablovschby · 10-03-2003, 02:45 AM

don't you think these facts are strange??

pablovschby · 10-03-2003, 04:59 AM

how would you explane this??

jharris · 10-03-2003, 05:23 AM

This does seem a little odd. I'm a bit confused by your rules though. I would have used something like this instead

Code:

#!/bin/tcsh
#script fr router
echo "firewall is starting now......"
set ipt = /sbin/iptables
set EXT = eth0
set INT = eth1

#-------------------------
#kernelparameter setzen fuer alle interfaces extra:
echo "0" > /proc/sys/net/ipv4/ip_forward #erstmal abschalten
echo "1" > /proc/sys/net/ipv4/tcp_syncookies
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses

echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
echo "0" > /proc/sys/net/ipv4/conf/all/accept_redirects
echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route
echo "0" > /proc/sys/net/ipv4/conf/all/bootp_relay
echo "0" > /proc/sys/net/ipv4/conf/all/log_martians


#------------------------
#default policies:

$ipt -P INPUT DROP
$ipt -P OUTPUT ACCEPT
$ipt -P FORWARD DROP
echo "...all BUILT-IN CHAINS are successfully dropped by default..."
$ipt -F
$ipt -t nat -F
$ipt -X
echo "...USERDEFINED CHAINS were flushed..."
#--------------------------------
#local processes:
$ipt -A INPUT -i lo -j ACCEPT

#---------------------------------------------------
#rules for ssh-connection:

$ipt -A INPUT -i $EXT -p tcp --dport 22 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

echo "......"

Also, where are you running nmap from? If its the same box then clearly it will be allowed through by the lo rule.

cheers

Jamie...

pablovschby · 10-03-2003, 08:26 AM

Quote:

Also, where are you running nmap from?

i already told you--> from a workstation that's standing directly in my LAN....so it's connected with the router through eth1...

Quote:

If its the same box then clearly it will be allowed through by the lo rule.

yes, i know....

connections from the loopback-interface to itself are allowed....but that wasn't what i asked about....

welll...anyway....now, i ran a portscanner from a windows-workstation and it showed me....that there aren't any opened ports that shouldn't be so....

i can't understand this stupid effect, but....however

it isn't a solveable problem.....it seems just to be god, who's sticking my firewall up