Right - thanks for any insights - more details below.
On Sun, Jul 18, 2004 at 10:02:20PM +0100, Antony Stone wrote:
> On Sunday 18 July 2004 9:50 pm, Mail Lists wrote:
>
> > cRES_LDROP all -- 172.16.0.0/12 0.0.0.0/0
> > which I would expect to block 172.16 to 172.31.
> > ... blocked on 172.139.140.122
> > ...
> Please post your ruleset so we can see everything relating to cRES_LDROP.
>
Hi:
More details - firewall generated by a script - this is the
what the script actually runs ... I've removed some (hopefully)
not relevant bits and heres the remainder of script output.
If its easier I'm happy to post the script itself.
#Starting iptables firewall ...
# Initializing Iptables Firewall ...
# ** Entering Test mode - nothing is actually run now
iptables -F
iptables -F -t nat
iptables -F -t mangle
iptables -X # Remove any existing user-defined chains.
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
# User defined Chains ...
# [ ... delete non-relevant stuff ]
iptables --new cRES_LDROP
iptables -F cRES_LDROP
iptables -A cRES_LDROP -j LOG --log-level info --log-prefix [FW Drop-Res]
iptables -A cRES_LDROP -j DROP
# [ ... Drop self ips on outside i/f, accept local and so on ]
# [ ... Closed outbound Ports ..., nfs, X11, IRC, MSFT, etc ]
# [ ... NAT - whats allowed - the ususal established related etc ]
# [ ... Local traffic allowed ... ]
# Drop reserved, broadcast rfc 1918 etc
iptables -A INPUT -d 0.0.0.0 -i eth1 -j cRES_LDROP
iptables -A FORWARD -d 0.0.0.0 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -s 0.0.0.0 -o eth1 -j cRES_LDROP
iptables -A FORWARD -s 0.0.0.0 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 10.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 10.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 10.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 10.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 172.16.0.0/12 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 172.16.0.0/12 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 172.16.0.0/12 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 172.16.0.0/12 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 224.0.0.0/4 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 224.0.0.0/4 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 224.0.0.0/4 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 224.0.0.0/4 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 255.255.255.255 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 255.255.255.255 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 255.255.255.255 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 255.255.255.255 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 1.0.0.0/7 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 1.0.0.0/7 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 1.0.0.0/7 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 1.0.0.0/7 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 2.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 2.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 2.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 2.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 5.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 5.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 5.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 5.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 7.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 7.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 7.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 7.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 23.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 23.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 23.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 23.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 27.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 27.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 27.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 27.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 31.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 31.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 31.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 31.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 36.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 36.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 36.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 36.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 37.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 37.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 37.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 37.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 39.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 39.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 39.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 39.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 41.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 41.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 41.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 41.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 42.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 42.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 42.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 42.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 71.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 71.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 71.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 71.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 72.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 72.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 72.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 72.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 73.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 73.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 73.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 73.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 74.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 74.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 74.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 74.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 75.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 75.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 75.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 75.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 76.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 76.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 76.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 76.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 77.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 77.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 77.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 77.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 78.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 78.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 78.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 78.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 79.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 79.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 79.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 79.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 89.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 89.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 89.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 89.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 90.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 90.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 90.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 90.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 91.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 91.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 91.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 91.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 92.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 92.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 92.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 92.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 93.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 93.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 93.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 93.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 94.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 94.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 94.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 94.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 95.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 95.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 95.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 95.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 96.0.0.0/3 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 96.0.0.0/3 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 96.0.0.0/3 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 96.0.0.0/3 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 173.0.0.0/5 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 173.0.0.0/5 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 173.0.0.0/5 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 173.0.0.0/5 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 181.0.0.0/6 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 181.0.0.0/6 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 181.0.0.0/6 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 181.0.0.0/6 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 185.0.0.0/7 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 185.0.0.0/7 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 185.0.0.0/7 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 185.0.0.0/7 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 187.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 187.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 187.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 187.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 189.0.0.0/7 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 189.0.0.0/7 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 189.0.0.0/7 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 189.0.0.0/7 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 197.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 197.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 197.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 197.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 223.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 223.0.0.0/8 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 223.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 223.0.0.0/8 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 224.0.0.0/4 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 224.0.0.0/4 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 224.0.0.0/4 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 224.0.0.0/4 -o eth1 -j cRES_LDROP
iptables -A INPUT -s 240.0.0.0/4 -i eth1 -j cRES_LDROP
iptables -A FORWARD -s 240.0.0.0/4 -i eth1 -j cRES_LDROP
iptables -A OUTPUT -d 240.0.0.0/4 -o eth1 -j cRES_LDROP
iptables -A FORWARD -d 240.0.0.0/4 -o eth1 -j cRES_LDROP
# [... Allow Local SERVER offerings (smtp, http, etc) ]
# [... Any services which are forwarded ... ]
# [... Allow some ICMP ... ]
iptables -A INPUT -i eth1 -j cLDROP
iptables -A FORWARD -i eth1 -j cLDROP
# FW script done
