Gopinath írta:
Please find the correct IP details below... Is it neccessary to
upgrade my kernel and iptables to achieve NAT and Default deny
functionality ?
Not neccessary but suggested... At least you should upgrade your
iptables to 1.3.7.
Now I comment your rules... :D
:INPUT ACCEPT [364:57615]
:FORWARD ACCEPT [1:52]
:OUTPUT ACCEPT [211:18044]
If there is no matching rule then EVERYTHING is ACCEPTED because your 3
policies above is set to ACCEPT.
In DEFAULT DENY mode you should set these policies to DROP as mentioned
in the previos mail of mine:
iptables -t filter -P INPUT DROP
iptables -t filter -P FORWARD DROP
iptables -t filter -P OUTPUT DROP
-A INPUT -s 10.44.20.70 -p icmp -j ACCEPT
-A INPUT -s 10.44.2.140 -p icmp -j ACCEPT
Here you enable 2 IPs to use ICMP (ping) on your host.
-A INPUT -s 10.44.2.140 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -s 10.44.20.70 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -s 10.1.0.246 -p tcp -m tcp --dport 22 -j ACCEPT
The above 3 IPs are enabled to SSH to your host.
BUT IF YOU DO NOT SET THE DEFAULT POLICY TO DROP THEN THESE RULES ARE
MEANINGLESS!!!
-A FORWARD -s 10.2.10.240 -d 10.44.2.140 -i eth0 -o eth1 -p tcp -m
state --state NEW -j ACCEPT
-A FORWARD -s 10.2.10.240 -d 10.44.2.100 -i eth0 -o eth1 -p tcp -m
state --state NEW -j ACCEPT
10.2.10.240 can create NEW connections to 10.44.2.100 and 10.44.2.140...
10.2.10.240 should be on eth0
10.44.2.100 should be on eth1
10.44.2.140 should be on eth1
-A FORWARD -o eth0 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
ANY host that sends ANY (NEW,RELATED,ESTABLISHED) packets through eth0
(not only to 10.2.10.240) is ACCEPTED.
-A FORWARD -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
ANY host thar sends RELATED or ESTABLISED packets from eth0 (not only
from 10.2.10.240) is ACCEPTED.
AGAIN IF YOU DO NOT SET THE DEFAULT POLICY TO DROP THEN THESE RULES ARE
MEANINGLESS!!!
*nat
:PREROUTING ACCEPT [289:55706]
:POSTROUTING ACCEPT [77:6468]
:OUTPUT ACCEPT [77:6468]
These ACCEPTs are ok.
-A PREROUTING -d 10.1.60.240 -i eth0 -j DNAT --to-destination 10.44.2.100
-A PREROUTING -d 10.1.60.245 -i eth0 -j DNAT --to-destination 10.44.2.140
Anything that comes form eth0 and would go to 10.1.60.240 should go to
10.44.2.100.
Anything that comes form eth0 and would go to 10.1.60.245 should go to
10.44.2.140.
-A POSTROUTING -s 10.44.2.100 -o eth0 -j SNAT --to-source 10.1.60.240
-A POSTROUTING -s 10.44.2.140 -o eth0 -j SNAT --to-source 10.1.60.245
Anything that goes out on eth0 and comes from 10.44.2.100 should appear
as it would come from 10.1.60.240.
Anything that goes out on eth0 and comes from 10.44.2.140 should appear
as it would come from 10.1.60.245.
Maybe you do not need these last two rules at all because a DNAT rule
simply does the reverse SNAT is most cases.
# iptables -nv -L
Chain INPUT (policy ACCEPT 100 packets, 14882 bytes)
You had 100 packets that did not matched ANY rule in the INPUT chain.
pkts bytes target prot opt in out source
destination
0 0 ACCEPT icmp -- * * 10.44.20.70
0.0.0.0/0
0 0 ACCEPT icmp -- * * 10.44.2.140
0.0.0.0/0
0 0 ACCEPT tcp -- * * 10.44.2.140
0.0.0.0/0 tcp dpt:22
356 24672 ACCEPT tcp -- * * 10.44.20.70
0.0.0.0/0 tcp dpt:22
0 0 ACCEPT tcp -- * * 10.1.0.246
0.0.0.0/0 tcp dpt:22
No connection, no ping yet ???
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
0 0 ACCEPT tcp -- eth0 eth1 10.2.10.240
10.44.2.140 state NEW
0 0 ACCEPT tcp -- eth0 eth1 10.2.10.240
10.44.2.100 state NEW
0 0 ACCEPT all -- * eth0 0.0.0.0/0
0.0.0.0/0 state NEW,RELATED,ESTABLISHED
0 0 ACCEPT all -- eth0 * 0.0.0.0/0
0.0.0.0/0 state RELATED,ESTABLISHED
No NAT yet ???
Chain OUTPUT (policy ACCEPT 302 packets, 34150 bytes)
pkts bytes target prot opt in out source
destination
Just 302 packet that went out and no rule. Btw. maybe you do not want to
filter your outgoing traffic.
In that case you should leave your OUTPUT policy as ACCEPT.
Regards,
Gopinath.U
I think that you want something else then what you did in your rules.
I would restart the whole project from the ground.
!!!
Please describe the connected networks and the target of the firewalling.
!!!
Here is a core script that may help you:
(A bit long but can be usefull. And of course not working in current
state... :D )
#!/bin/bash
echo "Setting up FIREWALL rules:"
core_set="/proc/sys/net/core"
ip_set="/proc/sys/net/ipv4"
echo 0 > $ip_set/conf/all/rp_filter
echo 1 > $ip_set/conf/all/proxy_arp
echo 1 > $ip_set/icmp_echo_ignore_broadcasts
echo 1 > $ip_set/ip_forward
echo 32768 > $ip_set/netfilter/ip_conntrack_max
echo 1 > $ip_set/tcp_abort_on_overflow
echo 10 > $ip_set/tcp_fin_timeout
echo 1 > $ip_set/tcp_rfc1337
echo 1 > $ip_set/tcp_sack
echo 2 > $ip_set/tcp_synack_retries
echo 1 > $ip_set/tcp_syncookies
echo 16384 16384 16384 > $ip_set/tcp_wmem
echo 16384 > $core_set/rmem_default
echo 16384 > $core_set/wmem_default
echo 16384 > $core_set/wmem_max
sysctl -w net.ipv4.tcp_ecn=0 >/dev/null 2>/dev/null
modprobe ip_conntrack >/dev/null 2>/dev/null
modprobe ip_nat >/dev/null 2>/dev/null
modprobe iptable_nat >/dev/null 2>/dev/null
clean_subchain() {
$table -F $subchain >/dev/null 2>/dev/null
$table -X $subchain >/dev/null 2>/dev/null
$table -Z $subchain >/dev/null 2>/dev/null
}
create_subchain() {
subchain=$1
clean_subchain
$table -N $subchain
}
clean_table() {
subchain=""
clean_subchain
}
table="iptables -t nat"
clean_table
chain="PREROUTING"
$table -P $chain ACCEPT
create_subchain "DNAT_of_eth0"
$table -A $chain -j $subchain -i eth0
$table -A $subchain -j DNAT -d 10.1.60.240 --to-destination 10.44.2.100
$table -A $subchain -j DNAT -d 10.1.60.245 --to-destination 10.44.2.140
chain="POSTROUTING"
$table -P $chain ACCEPT
chain="OUTPUT"
$table -P $chain ACCEPT
table="iptables -t filter"
clean_table
create_subchain "send_reject"
$table -A $subchain -j REJECT -p tcp --reject-with tcp-reset
$table -A $subchain -j REJECT --reject-with icmp-admin-prohibited
$table -A $subchain -j DROP
create_subchain "log_invalid"
$table -A $subchain -j LOG --log-prefix "INVALID: " --log-level debug --log-tcp-sequence --log-tcp-options --log-ip-options
$table -A $subchain -j send_reject
create_subchain "con_icmp"
$table -A $subchain -j RETURN -p icmp --icmp-type echo-reply
$table -A $subchain -j RETURN -p icmp --icmp-type destination-unreachable
$table -A $subchain -j RETURN -p icmp --icmp-type source-quench
$table -A $subchain -j RETURN -p icmp --icmp-type echo-request -m hashlimit --hashlimit-name icmp --hashlimit 1/s --hashlimit-mode srcip
$table -A $subchain -j RETURN -p icmp --icmp-type time-exceeded
$table -A $subchain -j DROP -p icmp
create_subchain "con_udp"
#TODO
create_subchain "con_tcp"
$table -A $subchain -j RETURN -p tcp --syn -m conntrack --ctstate NEW
$table -A $subchain -j RETURN -m conntrack --ctstatus EXPECTED
$table -A $subchain -j log_invalid
create_subchain "connected"
$table -A $subchain -j ACCEPT -m conntrack --ctstate ESTABLISHED
$table -A $subchain -j ACCEPT -m conntrack --ctstate RELATED
$table -A $subchain -j RETURN -i lo -o lo
$table -A $subchain -j con_icmp -p icmp
$table -A $subchain -j RETURN -p icmp
$table -A $subchain -j con_udp -p udp
$table -A $subchain -j RETURN -p udp
$table -A $subchain -j con_tcp -p tcp
$table -A $subchain -j RETURN -p tcp
chain="INPUT"
$table -P $chain DROP
$table -A $chain -j connected
create_subchain "ICMP_ok"
$table -A $chain -j $subchain -p icmp
$table -j ACCEPT -s 10.44.20.70
$table -j ACCEPT -s 10.44.2.140
create_subchain "SSH_ok"
$table -A $chain -j $subchain -p tcp --dport 22
$table -j ACCEPT -s 10.1.0.246
$table -j ACCEPT -s 10.44.2.140
$table -j ACCEPT -s 10.44.20.70
chain="FORWARD"
$table -P $chain DROP
$table -A $chain -j connected
create_chain "enable_DNAT_to_eth1"
$table -A $chain -j $subchain -o eth1
$table -A $subchain -j ACCEPT -d 10.44.2.100
$table -A $subchain -j ACCEPT -d 10.44.2.140
chain="OUTPUT"
$table -P $chain ACCEPT
echo "done."
Swifty
