default policy
Hi,
I am trying a routing firewall which will route internal machines to internet as well as redirect machines from outside to 1 ftp server inside.
But I am not able to get even the first part working. I use policy as default on FORWARD and,
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD DROP
$IPTABLES -t nat -A POSTROUTING -j MASQUERADE
$IPTABLES -A INPUT -p tcp -s 0/0 --dport 21 -j ACCEPT $IPTABLES -A INPUT -p tcp -s 0/0 --dport 25 -j ACCEPT $IPTABLES -A INPUT -i lo -j ACCEPT
$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT $IPTABLES -A INPUT -p icmp --icmp-type 0 -j ACCEPT
$IPTABLES -A FORWARD -s 125.125.125.0/24 -p tcp -m tcp --dport 21 -j ACCEPT $IPTABLES -A FORWARD -s 125.125.125.0/24 -p tcp -m tcp --dport 80 -j ACCEPT $IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT $IPTABLES -A FORWARD -p icmp --icmp-type 0 -j ACCEPT
When I make FORWARD POLICY as ACCEPT it works, but not when I make it to DROP? Is there any bad rule anywhere?
Is the MASQUERADE rule ok? (Traffic is coming form 2 interfaces). Is the ESTABLISHED,RELATED rule ok and at right position?
Please help me in this.
Thanks a lot and bye.
With warm regards,
-Payal
Signature · 3 lines
"Visit GNU/Linux Success Stories" http://payal.staticky.com Guest-Book Section Updated.
Am Die, 2003-08-26 um 10.35 schrieb Payal Rathod:
Quoted 6 lines
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD DROP$IPTABLES -t nat -A POSTROUTING -j MASQUERADE
Quoted 7 lines
$IPTABLES -A FORWARD -s 125.125.125.0/24 -p tcp -m tcp --dport 21 -j ACCEPT $IPTABLES -A FORWARD -s 125.125.125.0/24 -p tcp -m tcp --dport 80 -j ACCEPT $IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT $IPTABLES -A FORWARD -p icmp --icmp-type 0 -j ACCEPT
When I make FORWARD POLICY as ACCEPT it works, but not when I make it to DROP? Is there any bad rule anywhere?
Yes, apply masquerading only to the external interface, like $IPTABLES -t nat -A POSTROUTING -o eth1 -j MASQUERADE
If 125.125.125.0 is your internal ip-range you should be able to browse to:
http://217.160.128.61
But since you do not allow any DNS traffic you can't resolve any hostnames.
Cheers,
Ralf
Signature · 6 lines
Ralf Spenneberg RHCE, RHCX Book: Intrusion Detection für Linux Server http://www.spenneberg.com IPsec-Howto http://www.ipsec-howto.org Honeynet Project Mirror: http://honeynet.spenneberg.org
Quoted 12 lines · Ralf Spenneberg
Am Die, 2003-08-26 um 10.35 schrieb Payal Rathod:
Quoted 11 lines
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD DROP$IPTABLES -t nat -A POSTROUTING -j MASQUERADE
$IPTABLES -A FORWARD -s 125.125.125.0/24 -p tcp -m tcp --dport 21 -j ACCEPT $IPTABLES -A FORWARD -s 125.125.125.0/24 -p tcp -m tcp --dport 80 -j ACCEPT $IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT $IPTABLES -A FORWARD -p icmp --icmp-type 0 -j ACCEPT
Quoted 4 lines
Quoted 2 lines
When I make FORWARD POLICY as ACCEPT it works, but not when I make it to DROP? Is there any bad rule anywhere?
Yes, apply masquerading only to the external interface, like $IPTABLES -t nat -A POSTROUTING -o eth1 -j MASQUERADE
Both the ips are connected to real world. One is connected to the ISDN router (internal ip) and the other to lease line.
Some people use ISDN route some lease line route.
I have 1 default gateway for each interface.
Is this OK?
Quoted 6 lines
If 125.125.125.0 is your internal ip-range you should be able to browse to:
http://217.160.128.61
But since you do not allow any DNS traffic you can't resolve any hostnames.
Yes I releasied that. I have added tcp and udp for dns too. Waiting for the mail.
With regards,
-Payal
Signature · 2 lines
For GNU/Linux Success Stories and Articles visit:
http://payal.staticky.com