FORWARD -P DROP + allow MSN

DISCUSSION Mihamina Rakotomandimby (R12y) 2 participants 4 messages Apr 16, 2009

Share & tools

Mihamina Rakotomandimby (R12y)

author

2009-04-16 09:30 UTC #0 lore raw

Hi,
These are my current rules:
http://lab.vectoris.fr/projects/vectoris/browser/IPTables/trunk/firewall
(It's a big mess yet because I miss one feature: MSN. I'll clean it later)

The box it's running on is the gateway of the LAN to the Internet.

As you noticed, FORWARD is DROP by default.

I would like to allow MSN to my LAN users.

The problem:
If I "FORWARD -P ACCEPT", MSN works for the LAN users.

If I use it as it is now, MSN doesnt work.

Anyway, when setting the MSN LAN clients to use HTTP, it's OK with this config.

Any tips?
Thank you.

PS: no comments on the crappy Facebook DROP ;-).

Signature · 4 lines

                             Chef de projet chez Vectoris
                                 Phone: +261 33 11 207 36
System: xUbuntu 8.10 with almost all from package install
   http://www.google.com/search?q=mihamina+rakotomandimby

Mart Frauenlob

2009-04-16 10:10 UTC #1 lore raw

Quoted 14 lines · Mihamina Rakotomandimby (R12y) wrote:

Hi,
These are my current rules:
http://lab.vectoris.fr/projects/vectoris/browser/IPTables/trunk/firewall
(It's a big mess yet because I miss one feature: MSN. I'll clean it later)
The box it's running on is the gateway of the LAN to the Internet.
As you noticed, FORWARD is DROP by default.
I would like to allow MSN to my LAN users.
The problem:
If I "FORWARD -P ACCEPT", MSN works for the LAN users.

Quoted 8 lines

If I use it as it is now, MSN doesnt work.
Anyway, when setting the MSN LAN clients to use HTTP, it's OK with this config.
Any tips?
Thank you.
PS: no comments on the crappy Facebook DROP ;-).

Hello,

first let me spend a few words on your current ruleset:

- The whole forwarding is stateless!
I strongly suggest to change that.
Allow that ports for your lan with something like that:
iptables -A FORWARD -i $WAN -o $LAN -d $ACCEPTED_MACHINE -m state --state ESTABLISHED,RELATED -j ACCEPT

this is the general 'allow all back in, which is tracked by the state machine' match.
now your ports:
iptables -A FORWARD -i $LAN -o $WAN -s $ACCEPTED_MACHINE -p tcp -m multiport --dports x,y,z... -m state --state NEW,ESTABLISHED -j ACCEPT

[...]
Same thing maybe on your $ACCEPTED_PORT in INPUT chain.

- Don't allow all icmp. Do you want your firewall to accept icmp redirects? Guess not...

- I will say some about the Facebook drop:
$IPT -A INPUT -p tcp -i $LAN --destination $IP_FACEBOOK -j DROP
is completely unnecessary. Will never match, unless your box holds a Facebook hosts IP.

Now, let me think about the MSN thing. Personally I never used it, and don't know what configuration it may need. Didn't try to look it up now too.
But, one thing I noticed:
You REDIRECT all port 80 traffic to the local port 3128. HTTP proxy I guess...
Now MSN uses all those ports and as it looks port 80.
If now port 80 traffic goes over the http proxy and the rest of the traffic does not, that may cause the MSN applications to fail.
How about a socks proxy for MSN? I just guess client applications will have such a feature. In that case, your socks proxy does all the work, and you only have to open that port on the inside of the lan.

Hope it helps...

greets

Mart

Mihamina Rakotomandimby (R12y)

author

2009-04-16 11:30 UTC #2 lore raw

Quoted 5 lines · Mart Frauenlob

- The whole forwarding is stateless!
I strongly suggest to change that.
Allow that ports for your lan with something like that:
iptables -A FORWARD -i $WAN -o $LAN -d $ACCEPTED_MACHINE -m state --state ESTABLISHED,RELATED -j ACCEPT

Done.

Quoted 6 lines

this is the general 'allow all back in, which is tracked by the state machine' match.
now your ports:
iptables -A FORWARD -i $LAN -o $WAN -s $ACCEPTED_MACHINE -p tcp -m multiport --dports x,y,z... -m state --state NEW,ESTABLISHED -j ACCEPT
[...]
Same thing maybe on your $ACCEPTED_PORT in INPUT chain.

Erm, supposing I will have to add some more ports, I'd rather add them in one place than in each line, so, for that purpose, looping seems better for me.

Quoted 2 lines

- Don't allow all icmp. Do you want your firewall to accept icmp redirects? Guess not...

Okay, It's just in order to debug, because we make several traceroutes.

Quoted 2 lines

- I will say some about the Facebook drop:
$IPT -A INPUT -p tcp -i $LAN --destination $IP_FACEBOOK -j DROP

It was for the following REDIRECT.
I did not filter REDIRECTing to the HTTP proxy, I filter when it INPUTs after the REDIRECT.

It's just a notice, not from a documentation reading.
Look at my ACCEPTED_PORT, it does not list 80, and web browsing fails if I block INPUTs. So, I guessed REDIRECTed packets are INPUT ones after REDIRECTion.

Quoted 1 line

Now, let me think about the MSN thing. Personally I never used it, and don't know what configuration it may need. Didn't try to look it up now too.

Happy you! Some collegues refuse to use Jabber.

Quoted 2 lines

But, one thing I noticed:
You REDIRECT all port 80 traffic to the local port 3128. HTTP proxy I guess...

IT's the running SQUID, yes.

Quoted 1 line

Now MSN uses all those ports and as it looks port 80.

I did not understand this sentence.

Quoted 2 lines

If now port 80 traffic goes over the http proxy and the rest of the traffic does not, that may cause the MSN applications to fail. How about a socks proxy for MSN?

Never heard about...

Quoted 1 line

I just guess client applications will have such a feature. In that case, your socks proxy does all the work,

I'll try: http://www.google.com/search?q=Ubuntu+SOCKS+proxy+MSN is not the right query yet, if you have a more powerful query, please tell ;-)

Signature · 4 lines

                             Chef de projet chez Vectoris
                                 Phone: +261 33 11 207 36
System: xUbuntu 8.10 with almost all from package install
   http://www.google.com/search?q=mihamina+rakotomandimby

Mart Frauenlob

2009-04-16 13:31 UTC #3 lore raw

Quoted 23 lines · Mihamina Rakotomandimby (R12y) wrote:

Quoted 5 lines · Mart Frauenlob
- The whole forwarding is stateless!
I strongly suggest to change that.
Allow that ports for your lan with something like that:
iptables -A FORWARD -i $WAN -o $LAN -d $ACCEPTED_MACHINE -m state --state ESTABLISHED,RELATED -j ACCEPT
Done.
Quoted 6 lines
this is the general 'allow all back in, which is tracked by the state machine' match.
now your ports:
iptables -A FORWARD -i $LAN -o $WAN -s $ACCEPTED_MACHINE -p tcp -m multiport --dports x,y,z... -m state --state NEW,ESTABLISHED -j ACCEPT
[...]
Same thing maybe on your $ACCEPTED_PORT in INPUT chain.
Erm, supposing I will have to add some more ports, I'd rather add them in one place than in each line, so, for that purpose, looping seems better for me.
Quoted 2 lines
- Don't allow all icmp. Do you want your firewall to accept icmp redirects? Guess not...
Okay, It's just in order to debug, because we make several traceroutes.

Quoted 9 lines

Quoted 2 lines
- I will say some about the Facebook drop:
$IPT -A INPUT -p tcp -i $LAN --destination $IP_FACEBOOK -j DROP
It was for the following REDIRECT.
I did not filter REDIRECTing to the HTTP proxy, I filter when it INPUTs after the REDIRECT.
It's just a notice, not from a documentation reading.
Look at my ACCEPTED_PORT, it does not list 80, and web browsing fails if I block INPUTs. So, I guessed REDIRECTed packets are INPUT ones after REDIRECTion.

ah, yes... didn't think of that, but than maybe the FORWARD rule is not needed....

Quoted 4 lines

Quoted 1 line
Now, let me think about the MSN thing. Personally I never used it, and don't know what configuration it may need. Didn't try to look it up now too.
Happy you! Some collegues refuse to use Jabber.

Quoted 9 lines

Quoted 2 lines
But, one thing I noticed:
You REDIRECT all port 80 traffic to the local port 3128. HTTP proxy I guess...
IT's the running SQUID, yes.
Quoted 1 line
Now MSN uses all those ports and as it looks port 80.
I did not understand this sentence.

because you said in your first post:
'Anyway, when setting the MSN LAN clients to use HTTP, it's OK with this config. ' And you have those iptables rules opening a lot of ports for MSN traffic.

Quoted 1 line

Quoted 1 line
If now port 80 traffic goes over the http proxy and the rest of the traffic does not, that may cause the MSN applications to fail.

It might happen that a part of the MSN traffic goes over the http proxy while the rest not, and that may cause a failure.

Quoted 8 lines

Quoted 1 line
How about a socks proxy for MSN?
Never heard about...
Quoted 1 line
I just guess client applications will have such a feature. In that case, your socks proxy does all the work,
I'll try: http://www.google.com/search?q=Ubuntu+SOCKS+proxy+MSN is not the right query yet, if you have a more powerful query, please tell ;-)

What clients are you using on the LAN side to connect to the MSN network?
If I open up Windows messenger on xp, under extras, options, network, I can specify a socks server. Your client application(s) should also provide such an option....

Now if you setup a socks server on your router (there are some available), and instruct your clients to use the socks server for MSN, you don't need to open up firewall ports.

If you don't want that, you need to find out what tcp/udp ports to open up for MSN. Quickly searching brings me this i.e.
http://www.gentoo-wiki.info/Iptables_port_reference#MSN_Messenger

But maybe more is required, I don't know...

One more thing.
I suggest to only REJECT to your LAN(s) as final rule, doing the reject thing other than on port 113 (auth) to the outside (untrusted) world, can lead to DOS attacks.

greets

Mart