Re: rules to allow LAN navigation

Pandu Poluan <pandu@xxxxxxxxxxx> · Fri, 18 Mar 2011 09:15:13 +0700

(sorry for top posting; Gmail mobile can only top-post)

Can you post the output of iptables-save? iptables -L always give me
the headache.

Rgds,

On 2011-03-18, Esteban Cacavelos <estebancacavelos@xxxxxxxxx> wrote:
> Hi all, i am new on the list and i have the following scenario.
>
> ------------------------------------
> ---------------------------------------
> --------------------------------------------
> |ÂÂÂÂÂÂÂ router Â Â Â Â Â Â Â ÂÂ |ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ |ÂÂÂÂÂÂ linux server
> (ubuntu)|ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ |
> ÂÂÂÂÂÂÂÂÂÂÂ |
> |ÂÂ LAN: 192.168.3.xÂÂÂÂÂ | -------------- |ÂÂÂÂÂ eth0:192.168.3.12
> |Â -----------------------------Â |ÂÂÂ (WINDOWS PCs, etc)ÂÂÂ |
> |ÂÂ WAN: internetÂÂÂÂÂÂÂÂÂÂ |ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ | Â ÂÂ eth1:192.168.2.1
> ÂÂ |ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ |ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ LAN
> ÂÂÂ |
> -------------------------------------
> ---------------------------------------
> |ÂÂÂÂÂÂÂ 192.168.2.xÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ |
>
>
> -----------------------------------------------
>
>
> I want to: the computers in the LAN to navigate through internet.
>
> When the policies for INPUT, OUTPUT and FORWARD are ACCEPT, everithing
> works well (pcs in the LANÂ can navigate), BUT, when i change the
> policy to DROP for the INPUT chain i dont know how to allow http
> traffic for the LAN.
>
> My actual iptables configuration is :
>
> iptables -L
> Chain INPUT (policy DROP)
> targetÂÂÂÂ prot opt sourceÂÂÂÂÂÂÂÂÂÂÂÂÂÂ destination
> ACCEPTÂÂÂÂ allÂ --Â anywhereÂÂÂÂÂÂÂÂÂÂÂÂ anywhereÂÂÂÂÂÂÂÂÂÂÂ ctstate
> RELATED,ESTABLISHED
> ACCEPTÂÂÂÂ allÂ --Â anywhereÂÂÂÂÂÂÂÂÂÂÂÂ anywhereÂÂÂÂÂÂÂÂÂÂÂ state
> RELATED,ESTABLISHED
> ACCEPTÂÂÂÂ tcpÂ --Â anywhereÂÂÂÂÂÂÂÂÂÂÂÂ anywhereÂÂÂÂÂÂÂÂÂÂÂ tcp dpt:www
> LOGÂÂÂÂÂÂÂ allÂ --Â anywhereÂÂÂÂÂÂÂÂÂÂÂÂ anywhereÂÂÂÂÂÂÂÂÂÂÂ limit:
> avg 5/min burst 5 LOG level debug prefix `iptables denied: '
> ACCEPTÂÂÂÂ tcpÂ --Â anywhereÂÂÂÂÂÂÂÂÂÂÂÂ anywhereÂÂÂÂÂÂÂÂÂÂÂ tcp dpt:www
> ACCEPTÂÂÂÂ allÂ --Â anywhereÂÂÂÂÂÂÂÂÂÂÂÂ anywhere
> ACCEPTÂÂÂÂ allÂ --Â anywhereÂÂÂÂÂÂÂÂÂÂÂÂ anywhere
> ACCEPTÂÂÂÂ allÂ --Â anywhereÂÂÂÂÂÂÂÂÂÂÂÂ anywhere
> ACCEPTÂÂÂÂ tcpÂ --Â anywhereÂÂÂÂÂÂÂÂÂÂÂÂ anywhereÂÂÂÂÂÂÂÂÂÂÂ tcp dpt:2223
> ACCEPTÂÂÂÂ allÂ --Â 192.168.2.1ÂÂÂÂÂÂÂÂÂ anywhere
> ACCEPTÂÂÂÂ allÂ --Â 192.168.2.0ÂÂÂÂÂÂÂÂÂ anywhere
>
>
> Thanks for the help.
>
>
>
> --
> Esteban L. Cacavelos de Amoriza
> Cel: 0981 220 429
>

-- 
--
Pandu E Poluan - IT Optimizer
My website: http://pandu.poluan.info/
ÿô.nÇ‰·Ÿ®‰†+%ŠË±é¥Šwÿº{.nÇ‰·§z×–×þ)íèjg¬±¨¶‰šŽŠÝjÿ¾«þG«é¸¢·¦j:+v‰¨Šwèm¶Ÿÿþø®w¥þŠà£¢·hšâÿ†Ù