Gopinath írta:
Good day everyone,
I am very new to this list. I am running FC3 and want to convert my
server to act as firewall, which does static NAT. I had setup
everything and works fine in simulation. But the only thing is i am
not able to make restriction in the FORWARD chain. The basic
functionality of firewall, the DEFAULT DENYING FUNCTIONALITY is
missing in my firewall. I tried to make it by applicy DROP policy to
the FORWARD chain & also appending a default DROP rule to the end of
the FORWARD chain. But when i do so, all the packets were getting
dropped at the firewall. I have pasted my firewall script below. I
have enabled ip_conntrack & iptable_nat modules during bootup.
OS: Fedora Core 3
IPtables Version: v1.2.11
It is kind of old... :D
# Generated by iptables-save v1.2.11 on Fri Apr 27 08:16:21 2007
*filter
:INPUT ACCEPT [364:57615]
:FORWARD ACCEPT [1:52]
:OUTPUT ACCEPT [211:18044]
The DEFAULT DENYING FUNCTIONALITY is achieved by using these commands:
iptables -t filter -P INPUT DROP
iptables -t filter -P FORWARD DROP
iptables -t filter -P OUTPUT DROP
-A INPUT -s 10.44.x.x -p icmp -j ACCEPT
-A INPUT -s 10.44.x.x -p icmp -j ACCEPT
-A INPUT -s 10.44.x.x -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -s 10.44.x.x -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -s 10.1.x.x -p tcp -m tcp --dport 22 -j ACCEPT
-A FORWARD -d 10.44.x.x -i eth0 -o eth1 -p tcp -m state --state NEW -j
ACCEPT
-A FORWARD -d 10.44.x.x -i eth0 -o eth1 -p tcp -m state --state NEW -j
ACCEPT
-A FORWARD -o eth0 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
COMMIT
# Completed on Fri Apr 27 08:16:21 2007
# Generated by iptables-save v1.2.11 on Fri Apr 27 08:16:21 2007
*nat
:PREROUTING ACCEPT [289:55706]
:POSTROUTING ACCEPT [77:6468]
:OUTPUT ACCEPT [77:6468]
-A PREROUTING -d 10.1.x.x -i eth0 -j DNAT --to-destination 10.44.x.x
-A PREROUTING -d 10.1.x.x. -i eth0 -j DNAT --to-destination 10.44.x.x
-A POSTROUTING -s 10.44.x.x -o eth0 -j SNAT --to-source 10.1.x.x
-A POSTROUTING -s 10.44.x.x -o eth0 -j SNAT --to-source 10.1.x.x
COMMIT
# Completed on Fri Apr 27 08:16:21 2007
Output of iptables -nv -L
Chain INPUT (policy ACCEPT 73 packets, 13040 bytes)
pkts bytes target prot opt in out source destination
501 30228 ACCEPT icmp -- * * 10.44.x.x 0.0.0.0/0
8648 576K ACCEPT tcp -- * * 10.44.x.x 0.0.0.0/0 tcp dpt:22
52464 9344K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state
NEW,RELATED,ESTABLISHED
Chain FORWARD (policy ACCEPT 68 packets, 5648 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- eth0 eth1 0.0.0.0/0 10.44.x.x state NEW
0 0 ACCEPT tcp -- eth0 eth1 0.0.0.0/0 10.44.x.x state NEW
0 0 ACCEPT all -- * eth0 0.0.0.0/0 0.0.0.0/0 state
NEW,RELATED,ESTABLISHED
0 0 ACCEPT all -- eth0 * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
There is no packet that matches your rules....
What are these destinations : 10.44.x.x ???
Do you mean 10.44.0.0/16 ???
fw1:~# whois 10.44.0.0
...
NetRange: 10.0.0.0 - 10.255.255.255
CIDR: 10.0.0.0/8
NetName: RESERVED-10
NetHandle: NET-10-0-0-0-1
Parent:
NetType: IANA Special Use
NameServer: BLACKHOLE-1.IANA.ORG
NameServer: BLACKHOLE-2.IANA.ORG
Comment: This block is reserved for special purposes.
Comment: Please see RFC 1918 for additional information.
Comment:
RegDate:
Updated: 2002-09-12
Chain OUTPUT (policy ACCEPT 10236 packets, 1175K bytes)
pkts bytes target prot opt in out source destination
Any help would be highly appreciated.
Thanks & Regards,
Gopinath.U
