Rob Sterenborg wrote:
I have tried to get this iptables script on my Centos 4.4 machine
working, with some help, but still have not succeeded in forwarding
port 722 to a machine on the LAN attached to the machine running
iptables attached to the internet. The logging of the FORWARD
packets just before drop tells me they are being forwarded. I also
made sure the the LAN attached machine on eth0 does accept ssh -D
722 once I logged into the public facing machine via ssh. So I kinda
assume it is the return packet that is the problem, but cannot see
why. Ideas? 333.333.333.333 is substituted for the public IP addr,
111.111.111.111 222.222.222.222 are machines I want to be the only
ones that can access. eth0 is the LAN NIC and eth1 is the public
facing NIC.
# Generated by iptables-save v1.2.11 on Thu Dec 15 17:00:25 2005
*filter
[...]
-A FORWARD -j LOG --log-level debug
-A FORWARD -d 192.168.0.0/255.255.255.0 -i eth1 -o eth0 \
-p tcp -m multiport --dports 22,3306 -m state --state NEW \
-j ACCEPT
So NEW packets forwarded to port 22 will be allowed.
-A FORWARD -i eth1 -o eth0 -m state \
--state RELATED,ESTABLISHED -j ACCEPT
Here you are only accepting packets from eth1 -> eth0 in a RELATED or
ESTABLISHED connection. What about the return packets that will go from
eth0 -> eth1? I really don't think you can setup a connection this way.
Try:
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
Tried this, it made no difference. I broadened the ports on the NEW to
cover 722, so there was no confusion to the port 22 used to connect to
the machine with the public facing NIC. Do I need a postrouting rule for
the FORWARD used for the return packets?
David
Grts,
Rob
-
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
-
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
