Hi!
Using ipchains for a while and relatively new to iptables.
I have to setup a somewhat special multihomed firewall:
It has three external interfaces with public addresses, one for http, one
for both smtp and pop3 and the third for ftp. These are real hardware NICS,
not virtual.
It has one internal interface which acts as the gateway for the LAN.
Debian 3.0r1 iptables 1.2.6a kernel 2.4.18 ISP router
+--------------------------------------------+
+----------------+
| 195.65.176.162 ftp | |
|
LAN --- +192.168.124.253 195.65.176.163 smtp/pop3 + --- + 195.65.176.161
+ --- Internet
| 195.65.176.164 http | |
|
+--------------------------------------------+
+----------------+
LAN: 192.168.124.0/24, public IP range: 195.65.176.160/29
DNSes are hosted by the ISP. I have local DNSes for the LAN.
What is working:
>From the LAN, everything works fine, all 4 protocols are working from any
client, all port redirections are fine.
>From the public IP range, as you might think, same thing, everything works
fine from any test workstation plugged in it.
The problem is from the Internet (aka going through the firewall...).
Every request to the http server run fine, both ICMP's and port 80
forwarding.
But I cannot even ping the smtp/pop3 external interface, and ports 25 and
110 do connect, just send no packets back, then disconnection occurs after
workstation timeout !
The same thing occurs with the ftp connection.
After some days and nights of fumbling and reading, I turn to the list.
Sorry if this topic has been already submitted and solved, I could not find
it.
Pleeeeeeease help !
Here are the output of iptables-save as well as the routing table of the
firewall:
# Generated by iptables-save v1.2.6a on Wed Jan 14 23:44:21 2004
*mangle
:PREROUTING ACCEPT [338:163396]
:INPUT ACCEPT [26:1386]
:FORWARD ACCEPT [297:161318]
:OUTPUT ACCEPT [68:8805]
:POSTROUTING ACCEPT [313:161958]
COMMIT
# Completed on Wed Jan 14 23:44:21 2004
# Generated by iptables-save v1.2.6a on Wed Jan 14 23:44:21 2004
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:allowed - [0:0]
:bad_tcp_packets - [0:0]
:icmp_packets - [0:0]
:tcp_packets - [0:0]
:udp_packets - [0:0]
-A INPUT -p tcp -j bad_tcp_packets
-A INPUT -s 192.168.124.0/255.255.255.0 -i eth0 -j ACCEPT
-A INPUT -s 127.0.0.1 -i lo -j ACCEPT
-A INPUT -s 192.168.124.254 -i lo -j ACCEPT
-A INPUT -s 195.65.176.162 -i lo -j ACCEPT
-A INPUT -s 195.65.176.163 -i lo -j ACCEPT
-A INPUT -s 195.65.176.164 -i lo -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --sport 68 --dport 67 -j ACCEPT
-A INPUT -d 195.65.176.162 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -d 195.65.176.163 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -d 195.65.176.164 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth1 -p tcp -j tcp_packets
-A INPUT -i eth1 -p udp -j udp_packets
-A INPUT -i eth1 -p icmp -j icmp_packets
-A INPUT -i eth2 -p tcp -j tcp_packets
-A INPUT -i eth2 -p udp -j udp_packets
-A INPUT -i eth2 -p icmp -j icmp_packets
-A INPUT -i eth3 -p tcp -j tcp_packets
-A INPUT -i eth3 -p udp -j udp_packets
-A INPUT -i eth3 -p icmp -j icmp_packets
-A INPUT -d 224.0.0.0/255.0.0.0 -i eth1 -j DROP
-A INPUT -d 224.0.0.0/255.0.0.0 -i eth2 -j DROP
-A INPUT -d 224.0.0.0/255.0.0.0 -i eth3 -j DROP
-A INPUT -m limit --limit 3/min --limit-burst 3 -j LOG --log-prefix "IPT
INPUT packet died: " --log-level 7
-A FORWARD -p tcp -j bad_tcp_packets
-A FORWARD -i eth0 -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -d 192.168.124.103 -p tcp -m tcp --dport 80 -j ACCEPT
-A FORWARD -d 192.168.124.104 -p tcp -m tcp --dport 25 -j ACCEPT
-A FORWARD -d 192.168.124.104 -p tcp -m tcp --dport 110 -j ACCEPT
-A FORWARD -d 192.168.124.105 -p tcp -m tcp --dport 21 -j ACCEPT
-A FORWARD -m limit --limit 3/min --limit-burst 3 -j LOG --log-prefix "IPT
FORWARD packet died: " --log-level 7
-A OUTPUT -p tcp -j bad_tcp_packets
-A OUTPUT -s 127.0.0.1 -j ACCEPT
-A OUTPUT -s 192.168.124.254 -j ACCEPT
-A OUTPUT -s 195.65.176.162 -j ACCEPT
-A OUTPUT -s 195.65.176.163 -j ACCEPT
-A OUTPUT -s 195.65.176.164 -j ACCEPT
-A OUTPUT -m limit --limit 3/min --limit-burst 3 -j LOG --log-prefix "IPT
OUTPUT packet died: " --log-level 7
-A allowed -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j ACCEPT
-A allowed -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT
-A allowed -p tcp -j DROP
-A bad_tcp_packets -p tcp -m tcp --tcp-flags SYN,ACK SYN,ACK -m
state --state NEW -j REJECT --reject-with tcp-reset
-A bad_tcp_packets -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m
state --state NEW -j LOG --log-prefix "NEW not SYN: " --log-level 7
-A bad_tcp_packets -p tcp -m tcp ! --tcp-flags SYN,RST,ACK SYN -m
state --state NEW -j DROP
-A icmp_packets -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A icmp_packets -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A tcp_packets -p tcp -m tcp --dport 21 -j allowed
-A tcp_packets -p tcp -m tcp --dport 80 -j allowed
-A udp_packets -d 195.65.176.167 -i eth1 -p udp -m udp --dport 135:139 -j
DROP
COMMIT
# Completed on Wed Jan 14 23:44:21 2004
# Generated by iptables-save v1.2.6a on Wed Jan 14 23:44:21 2004
*nat
:PREROUTING ACCEPT [32:1675]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [24:1752]
-A PREROUTING -d 195.65.176.164 -p tcp -m tcp --dport 80 -j
DNAT --to-destination 192.168.124.103:80
-A PREROUTING -d 195.65.176.163 -p tcp -m multiport --ports smtp,pop3 -j
DNAT --to-destination 192.168.124.104
-A PREROUTING -d 195.65.176.162 -p tcp -m tcp --dport 21 -j
DNAT --to-destination 192.168.124.105:21
-A POSTROUTING -d 192.168.124.105 -p tcp -m tcp --dport 21 -j
SNAT --to-source 192.168.124.254
-A POSTROUTING -d 192.168.124.104 -p tcp -m multiport --ports smtp,pop3 -j
SNAT --to-source 192.168.124.254
-A POSTROUTING -d 192.168.124.103 -p tcp -m tcp --dport 80 -j
SNAT --to-source 192.168.124.254
-A POSTROUTING -o eth1 -j SNAT --to-source 195.65.176.162
-A POSTROUTING -o eth2 -j SNAT --to-source 195.65.176.163
-A POSTROUTING -o eth3 -j SNAT --to-source 195.65.176.164
COMMIT
# Completed on Wed Jan 14 23:44:21 2004
---------------------------------------------------------------
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
195.65.176.160 * 255.255.255.248 U 0 0 0 eth1
195.65.176.160 * 255.255.255.248 U 0 0 0 eth2
195.65.176.160 * 255.255.255.248 U 0 0 0 eth3
localnet * 255.255.255.0 U 0 0 0 eth0
default 195.65.176.161 0.0.0.0 UG 0 0 0 eth3
default 195.65.176.161 0.0.0.0 UG 0 0 0 eth2
default 195.65.176.161 0.0.0.0 UG 0 0 0 eth1
default 192.168.124.253 0.0.0.0 UG 0 0 0 eth0
Caracal - G. Hostettler
e-mail travaux généraux : info@xxxxxxxxxx
e-mail travaux webmaster : info@xxxxxxxxxx
e-mail personnel : ghostettler@xxxxxxxxxx
