Please find the correct IP details below... Is it neccessary to upgrade my kernel and iptables to achieve NAT and Default deny functionality ? # vi /etc/iptables.conf # Generated by iptables-save v1.2.11 on Fri Apr 27 08:16:21 2007 *filter :INPUT ACCEPT [364:57615] :FORWARD ACCEPT [1:52] :OUTPUT ACCEPT [211:18044] -A INPUT -s 10.44.20.70 -p icmp -j ACCEPT -A INPUT -s 10.44.2.140 -p icmp -j ACCEPT -A INPUT -s 10.44.2.140 -p tcp -m tcp --dport 22 -j ACCEPT -A INPUT -s 10.44.20.70 -p tcp -m tcp --dport 22 -j ACCEPT -A INPUT -s 10.1.0.246 -p tcp -m tcp --dport 22 -j ACCEPT -A FORWARD -s 10.2.10.240 -d 10.44.2.140 -i eth0 -o eth1 -p tcp -m state --state NEW -j ACCEPT -A FORWARD -s 10.2.10.240 -d 10.44.2.100 -i eth0 -o eth1 -p tcp -m state --state NEW -j ACCEPT -A FORWARD -o eth0 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT -A FORWARD -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT COMMIT # Completed on Fri Apr 27 08:16:21 2007 # Generated by iptables-save v1.2.11 on Fri Apr 27 08:16:21 2007 *nat :PREROUTING ACCEPT [289:55706] :POSTROUTING ACCEPT [77:6468] :OUTPUT ACCEPT [77:6468] -A PREROUTING -d 10.1.60.240 -i eth0 -j DNAT --to-destination 10.44.2.100 -A PREROUTING -d 10.1.60.245 -i eth0 -j DNAT --to-destination 10.44.2.140 -A POSTROUTING -s 10.44.2.100 -o eth0 -j SNAT --to-source 10.1.60.240 -A POSTROUTING -s 10.44.2.140 -o eth0 -j SNAT --to-source 10.1.60.245 COMMIT # Completed on Fri Apr 27 08:16:21 2007 # iptables -nv -L Chain INPUT (policy ACCEPT 100 packets, 14882 bytes) pkts bytes target prot opt in out source destination 0 0 ACCEPT icmp -- * * 10.44.20.70 0.0.0.0/0 0 0 ACCEPT icmp -- * * 10.44.2.140 0.0.0.0/0 0 0 ACCEPT tcp -- * * 10.44.2.140 0.0.0.0/0 tcp dpt:22 356 24672 ACCEPT tcp -- * * 10.44.20.70 0.0.0.0/0 tcp dpt:22 0 0 ACCEPT tcp -- * * 10.1.0.246 0.0.0.0/0 tcp dpt:22 Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 ACCEPT tcp -- eth0 eth1 10.2.10.240 10.44.2.140 state NEW 0 0 ACCEPT tcp -- eth0 eth1 10.2.10.240 10.44.2.100 state NEW 0 0 ACCEPT all -- * eth0 0.0.0.0/0 0.0.0.0/0 state NEW,RELATED,ESTABLISHED 0 0 ACCEPT all -- eth0 * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED Chain OUTPUT (policy ACCEPT 302 packets, 34150 bytes) pkts bytes target prot opt in out source destination Regards, Gopinath.U On 5/11/07, Gáspár Lajos <swifty@xxxxxxxxxxx> wrote:
Gopinath írta: > Good day everyone, > I am very new to this list. I am running FC3 and want to convert my > server to act as firewall, which does static NAT. I had setup > everything and works fine in simulation. But the only thing is i am > not able to make restriction in the FORWARD chain. The basic > functionality of firewall, the DEFAULT DENYING FUNCTIONALITY is > missing in my firewall. I tried to make it by applicy DROP policy to > the FORWARD chain & also appending a default DROP rule to the end of > the FORWARD chain. But when i do so, all the packets were getting > dropped at the firewall. I have pasted my firewall script below. I > have enabled ip_conntrack & iptable_nat modules during bootup. > > OS: Fedora Core 3 > IPtables Version: v1.2.11 It is kind of old... :D > > # Generated by iptables-save v1.2.11 on Fri Apr 27 08:16:21 2007 > *filter > :INPUT ACCEPT [364:57615] > :FORWARD ACCEPT [1:52] > :OUTPUT ACCEPT [211:18044] The DEFAULT DENYING FUNCTIONALITY is achieved by using these commands: iptables -t filter -P INPUT DROP iptables -t filter -P FORWARD DROP iptables -t filter -P OUTPUT DROP > -A INPUT -s 10.44.x.x -p icmp -j ACCEPT > -A INPUT -s 10.44.x.x -p icmp -j ACCEPT > -A INPUT -s 10.44.x.x -p tcp -m tcp --dport 22 -j ACCEPT > -A INPUT -s 10.44.x.x -p tcp -m tcp --dport 22 -j ACCEPT > -A INPUT -s 10.1.x.x -p tcp -m tcp --dport 22 -j ACCEPT > -A FORWARD -d 10.44.x.x -i eth0 -o eth1 -p tcp -m state --state NEW -j > ACCEPT > -A FORWARD -d 10.44.x.x -i eth0 -o eth1 -p tcp -m state --state NEW -j > ACCEPT > -A FORWARD -o eth0 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT > -A FORWARD -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT > COMMIT > # Completed on Fri Apr 27 08:16:21 2007 > # Generated by iptables-save v1.2.11 on Fri Apr 27 08:16:21 2007 > *nat > :PREROUTING ACCEPT [289:55706] > :POSTROUTING ACCEPT [77:6468] > :OUTPUT ACCEPT [77:6468] > -A PREROUTING -d 10.1.x.x -i eth0 -j DNAT --to-destination 10.44.x.x > -A PREROUTING -d 10.1.x.x. -i eth0 -j DNAT --to-destination 10.44.x.x > -A POSTROUTING -s 10.44.x.x -o eth0 -j SNAT --to-source 10.1.x.x > -A POSTROUTING -s 10.44.x.x -o eth0 -j SNAT --to-source 10.1.x.x > COMMIT > # Completed on Fri Apr 27 08:16:21 2007 > > Output of iptables -nv -L > > Chain INPUT (policy ACCEPT 73 packets, 13040 bytes) > > pkts bytes target prot opt in out source destination > 501 30228 ACCEPT icmp -- * * 10.44.x.x 0.0.0.0/0 > 8648 576K ACCEPT tcp -- * * 10.44.x.x 0.0.0.0/0 tcp dpt:22 > 52464 9344K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state > NEW,RELATED,ESTABLISHED > > Chain FORWARD (policy ACCEPT 68 packets, 5648 bytes) > > pkts bytes target prot opt in out source destination > 0 0 ACCEPT tcp -- eth0 eth1 0.0.0.0/0 10.44.x.x state NEW > 0 0 ACCEPT tcp -- eth0 eth1 0.0.0.0/0 10.44.x.x state NEW > 0 0 ACCEPT all -- * eth0 0.0.0.0/0 0.0.0.0/0 state > NEW,RELATED,ESTABLISHED > 0 0 ACCEPT all -- eth0 * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED There is no packet that matches your rules.... What are these destinations : 10.44.x.x ??? Do you mean 10.44.0.0/16 ??? fw1:~# whois 10.44.0.0 ... NetRange: 10.0.0.0 - 10.255.255.255 CIDR: 10.0.0.0/8 NetName: RESERVED-10 NetHandle: NET-10-0-0-0-1 Parent: NetType: IANA Special Use NameServer: BLACKHOLE-1.IANA.ORG NameServer: BLACKHOLE-2.IANA.ORG Comment: This block is reserved for special purposes. Comment: Please see RFC 1918 for additional information. Comment: RegDate: Updated: 2002-09-12 > > Chain OUTPUT (policy ACCEPT 10236 packets, 1175K bytes) > pkts bytes target prot opt in out source destination > > Any help would be highly appreciated. > > Thanks & Regards, > Gopinath.U > >
