Re: iptable in fc5

list user <xktnniuymlla@xxxxxxxxxxxxxx> · Mon, 15 May 2006 15:12:53 -0700

Hongwei Li wrote:
I don't know if the output of tcpdump -nn helps or not:
...
16:02:40.803697 IP 128.252.85.35.22 > 128.252.85.103.2167: P

<snip />

oooh :(  SSH makes alot of noise.  Not too useful this way.

Here is iptables-save output:

# Generated by iptables-save v1.3.5 on Mon May 15 15:59:18 2006
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RH-Firewall-1-INPUT - [0:0]
:okay - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A OUTPUT -s 127.0.0.1 -j ACCEPT
-A OUTPUT -s 128.252.85.35 -j ACCEPT
-A RH-Firewall-1-INPUT -s 127.0.0.1 -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -s 128.252.85.35 -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p ipv6-crypt -j ACCEPT
-A RH-Firewall-1-INPUT -p ipv6-auth -j ACCEPT
-A RH-Firewall-1-INPUT -d 224.0.0.251 -p udp -m udp --dport 5353 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW,RELATED,ESTABLISHED -m
tcp
--dport 21 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW,RELATED,ESTABLISHED -m
tcp
--dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW,RELATED,ESTABLISHED -m
tcp
--dport 25 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state --state NEW,RELATED,ESTABLISHED -m
tcp
--dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m state --state NEW,RELATED,ESTABLISHED -m
udp
--dport 137 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m state --state NEW,RELATED,ESTABLISHED -m
udp
--dport 139 -j ACCEPT
-A RH-Firewall-1-INPUT -s 128.252.85.0/255.255.255.0 -p tcp -m state --state
NEW,RELATED,ESTABLISHED -m tcp --dport 2049 -j ACCEPT
-A RH-Firewall-1-INPUT -s 128.252.85.0/255.255.255.0 -p udp -m state --state
NEW,RELATED,ESTABLISHED -m udp --dport 2049 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
-A okay -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j ACCEPT
-A okay -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT
COMMIT
# Completed on Mon May 15 15:59:18 2006

I just added udp for nfs port, but still the same problem.

Ok.  Just looked through your "iptables-save".  There is some
duplication but nothing that I can see that is wrong.

Since you are hitting the REJECT you are not matching a previous rule.
From what I can see, the rules must be failing because
  a) source address/mask isn't what is being used;
  b) port number is not the one being used.

If you use "tcpdump -nn port ! ssh" while you try using nfs you should
receive something more useable.

Here it is:

# tcpdump -v -nn port ! ssh
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
16:44:14.724722 IP (tos 0x0, ttl 128, id 673, offset 0, flags [none], proto:
UDP (17), length: 78) 128.252.85.189.137 > 128.252.85.255.137: NBT UDP
PACKET(137): QUERY; REQUEST; BROADCAST
16:44:15.474700 IP (tos 0x0, ttl 128, id 708, offset 0, flags [none], proto:
UDP (17), length: 78) 128.252.85.189.137 > 128.252.85.255.137: NBT UDP
PACKET(137): QUERY; REQUEST; BROADCAST
16:44:15.657608 IP (tos 0xc0, ttl   2, id 0, offset 0, flags [none], proto:
UDP (17), length: 48) 128.252.85.250.1985 > 224.0.0.2.1985: HSRPv0-hello 20:
state=active group=85 addr=128.252.85.254 hellotime=3s holdtime=10s
priority=110 auth="cisco^@^@^@"
16:44:15.673489 IP (tos 0x0, ttl   1, id 17732, offset 0, flags [none], proto:
IGMP (2), length: 40, options ( RA (148) len 4 )) 128.252.85.91 > 224.0.0.22:
igmp v3 report, 1 group record(s) [gaddr 239.255.255.250 to_in, 0 source(s)]
16:44:15.903332 802.1d config 8055.00:0d:65:75:74:80.8006 root
2000.00:09:44:d3:98:54 pathcost 23 age 2 max 20 hello 2 fdelay 15
16:44:16.187422 arp who-has 128.252.85.40 tell 128.252.85.189
16:44:16.215126 arp who-has 128.252.85.88 tell 128.252.85.189
16:44:16.224694 IP (tos 0x0, ttl 128, id 735, offset 0, flags [none], proto:
UDP (17), length: 78) 128.252.85.189.137 > 128.252.85.255.137: NBT UDP
PACKET(137): QUERY; REQUEST; BROADCAST
16:44:16.338898 IP (tos 0x0, ttl   1, id 17733, offset 0, flags [none], proto:
IGMP (2), length: 40, options ( RA (148) len 4 )) 128.252.85.91 > 224.0.0.22:
igmp v3 report, 1 group record(s) [gaddr 239.255.255.250 to_in, 0 source(s)]
16:44:17.099723 IP (tos 0x0, ttl 128, id 749, offset 0, flags [none], proto:
UDP (17), length: 78) 128.252.85.189.137 > 128.252.85.255.137: NBT UDP
PACKET(137): QUERY; REQUEST; BROADCAST
16:44:17.849770 IP (tos 0x0, ttl 128, id 851, offset 0, flags [none], proto:
UDP (17), length: 78) 128.252.85.189.137 > 128.252.85.255.137: NBT UDP
PACKET(137): QUERY; REQUEST; BROADCAST
16:44:17.905851 802.1d config 8055.00:0d:65:75:74:80.8006 root
2000.00:09:44:d3:98:54 pathcost 23 age 2 max 20 hello 2 fdelay 15
16:44:18.569998 IP (tos 0xc0, ttl   2, id 0, offset 0, flags [none], proto:
UDP (17), length: 48) 128.252.85.250.1985 > 224.0.0.2.1985: HSRPv0-hello 20:
state=active group=85 addr=128.252.85.254 hellotime=3s holdtime=10s
priority=110 auth="cisco^@^@^@"
16:44:18.587619 aarp who-has 85.4.9 tell 85.1.4
16:44:18.599725 IP (tos 0x0, ttl 128, id 873, offset 0, flags [none], proto:
UDP (17), length: 78) 128.252.85.189.137 > 128.252.85.255.137: NBT UDP
PACKET(137): QUERY; REQUEST; BROADCAST
16:44:19.009393
16:44:19.903665 802.1d config 8055.00:0d:65:75:74:80.8006 root
2000.00:09:44:d3:98:54 pathcost 23 age 2 max 20 hello 2 fdelay 15
16:44:20.224157 et1 AT 85.4.9.1 > 0.0.1:  at-rtmp 232
16:44:20.225361 IP (tos 0x0, ttl 128, id 19752, offset 0, flags [none], proto:
UDP (17), length: 78) 128.252.85.66.137 > 128.252.85.255.137: NBT UDP
PACKET(137): QUERY; REQUEST; BROADCAST
...

Sorry, Hongwei, I didn't see any nfs traffic in that log section.

I want to ask another question -- Why do we need the last line in the file
iptables:
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited

If I comment it out, then everything works.

Of course, because then you're no longer "firewalling".  It says, 
"Everybody with tickets stand in this line; everybody else gets in free".

  Will that cause firewall actually
not functioning?  In fc3,fc4 I don't see similar line in the default firewall
setting.  Something new in fc5?

Thanks!

Hongwei

--
fedora-list mailing list
fedora-list@xxxxxxxxxx
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list