Bridging firewall setup

Hi all, new to the list. I'm trying to get a bridging firewall setup on a RH 9 box and I'm not having much luck. The bridge itself works fine but when I try to add rules using netfilter they seem to be ignored and packets I'm trying to block go on through. I've been digging through the list archives, google, various forums and HOWTOs and I still haven't found the answer so I'm hoping someone here can point out what I'm doing wrong :)

Here's what I have. The bridge is nothing special, its not the gateway and it doesn't do NAT. It does do traffic shapping but turning that part on/off didn't seem to make a difference here.

I decided to start simple by blocking some (presumably) msblast traffic on port 135. From the HOWTOs I've been reading all rules on the bridge should be in chain FORWARD so I did:

iptables -F
iptables -X # RH has some user-defined chains and i just dumped those iptables -A FORWARD -p udp --dport 135 -j DROP
iptables -A FORWARD -p tcp --dport 135 -j DROP

Nothing ... traffic still gets through ... so I explicitly added the interface

iptables -i br0 -A FORWARD -p udp --dport 135 -j DROP

# same for tcp

Still nothing.
Next I tried filtering connection attempts to mysql from the outside world (something I want to do anyway) (IP address hidden to protect the innocent :) ) iptables -A FORWARD -d x.x.x.x/24 -p tcp --dport 3306 -j DROP

Tried to connect to mysql from the outside world. No luck I can still get to it.

For grins I also tried the rules on INPUT and on OUTPUT with the same results. I tried enabling ip forwarding which some of HOWTOs I read said was an optional step but that didn't make a difference either, that also seemed to be if I were to be using the machine as the gateway. A friend of mine even suggested using -t nat -A PREROUTING which didn't make a lot of sense to me but I tried it anyway, still with the same result.

I don't see any errors when I execute the commands and I can see all the rules in iptables -L but they don't seem to do anything ... its very perplexing, any ideas?

thanks in advance
Chris

Chris Brown
System Administrator / Web Application Developer
Wavetex Inc.
903-533-1700
http://wavetex.com/

I don't know the answer to your question, but in situations like this I always think it's a good idea to turn on some LOGging so you can see where the packets are, and then you can try filtering them.

One thing you could do straight off is just request a detailed listing of the chains, to see if you have any packet counts at all:

iptables -L -n -v -x

will print out the filter tables in the INPUT, FORWARD and OUTPUT chains, and you should see from the byte & packet counters whether packets seem to have been going past.

You can do the same thing with the nat tables to see what happens just before & after the above:

iptables -L -t nat -n -v -x

However, if you simply put a LOG rule into all five chains, and then send some packet through the bridge, see what gets logged where:

iptables -I INPUT -j LOG
iptables -I FORWARD -j LOG
iptables -I OUTPUT -j LOG
iptables -I PREROUTING -t nat -j LOG
iptables -I POSTROUTING -t nat -j LOG

Let us know what you find....

Antony.

Never write it in Perl if you can do it in Awk.
Never do it in Awk if sed can handle it.
Never use sed when tr can do the job.
Never invoke tr when cat is sufficient.
Avoid using cat whenever possible.

                                                     Please reply to the list;
                                                           please don't CC me.

Thanks for the suggestions. I tried these two commands and on both it shows 0 packets being filtered. I took the rules out of nat as they didn't seem to be doing anything

This is a production machine so leaving logging on for extended periods isn't an option since it would quickly fill up the logs. However I turned in on briefly and even though using tcpdump I see constant traffic through the bridge the logs only show traffic going in and out to the bridge's IP that I have setup for maintenence, mostly my SSH session. Any ideas how I can get it to see the traffic going through?

Chris

Chris Brown
System Administrator / Web Application Developer
Wavetex Inc.
903-533-1700
http://wavetex.com/

You can filter tcpdump, e.g.:

tcpdump port not ssh

tcpdump -i eth0 port 135 and host a.b.c.d

tcpdump -p tcp -i any net a.b.c.d/e

Also man tcpdump, for more detail than you probably ever wanted.

Did you patch the kernel to support this? The bridging code in the stock 2.4 kernels doesn't support firewalling,