iptables-portforwarding nach intern funzt fast

[PigPen|tuX]

huhu,

also irgendwie stehe auf dem schlauch.

das Fortwarding von extern auf intern funzt beinahe ;]

Sep 25 17:46:18 penntuete kernel: Firewalled packet:IN=ppp0 OUT=eth0 SRC=xxx.xxx.xxx.xxx DST=192.168.1.253 LEN=60 TOS=0x00 PREC=0x00 TTL=49 ID=2684 DF PROTO=TCP SPT=44518 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0

nur der output wird anscheind noch verwehrt,

habe sogar mit

Iptables -A Output -j ACCEPt alles freigegeben, dennoch siehe oben,

hat jemand mal eine zeile parat ? ;D

mir gehen irgendwie die einfälle, sitze nun schon seid tagen dran ;D

eth0 ist das Iface fürs LAN,
eth1 ist mit DSL verbunden und stellt sich als ppp0 dar, verständlicherweise
habe im firewallscript die regeln nur mit diesen beiden iFace gebaut, ppp0 & eth0

mfg.
thom

[Harry]

Hallo thom,

könntest Du mal Deinen bisherigen iptables-Regelsatz posten?
Wir sind im Raten alle sooooo schlecht :D

Harry

[PigPen|tuX]

huhu,

ja daran solls nicht scheitern ;D,

-----------------------------------------
#
## Flush everything, start from scratch
#
# Incoming packets from the outside network
$IPTABLES -F INPUT
# Outgoing packets from the internal network
$IPTABLES -F OUTPUT
# Forwarding/masquerading
$IPTABLES -F FORWARD
#Nat table
$IPTABLES -t nat -F
##Setup sysctl controls which affect tcp/ip
#This has been found to be a little buggy. Removed for now.
$IPTABLES -A INPUT -m unclean -j DROP
$IPTABLES -A FORWARD -m unclean -j DROP

#Kill invalid packets (illegal combinations of flags)
$IPTABLES -A INPUT -m state --state INVALID -j DROP
$IPTABLES -A FORWARD -m state --state INVALID -j DROP
# Allow all connections on the internal interface
#
$IPTABLES -A INPUT -i lo -j ACCEPT

#Kill connections to the local interface from the outside world.
$IPTABLES -A INPUT -d 127.0.0.0/8 -j REJECT


#Allow unlimited traffic from internal network using legit addresses
$IPTABLES -A INPUT -i $INTERNALIF -s $INTERNALNET -j ACCEPT
#
#Allow IPV6 tunnel traffic
#$IPTABLES -A INPUT -p ipv6 -j ACCEPT

#Allow IPSEC tunnel traffic
#$IPTABLES -A INPUT -p 50 -j ACCEPT
#Allow all traffic from the ipsec device to the internal network
#$IPTABLES -A FORWARD -i ipsec0 -o $INTERNALIF -j ACCEPT

#Kill anything from outside claiming to be from internal network
$IPTABLES -A INPUT -i $EXTERNALIF -s $INTERNALNET -j REJECT

##ICMP
#ping don't forward pings going inside
$IPTABLES -A FORWARD -p icmp --icmp-type echo-request -o $INTERNALIF -j REJECT
#ping flood protection
$IPTABLES -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
$IPTABLES -A INPUT -p icmp --icmp-type echo-request -j DROP
#Deny icmp to broadcast address
$IPTABLES -A INPUT -p icmp -d $INTERNALBCAST -j DROP

#Allow all other icmp
$IPTABLES -A INPUT -p icmp -j ACCEPT

##Allow established connections
#Unlike ipchains, we don't have to go through the business of allowing
#a local port range- just allow all connections already established.

$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#Note that unlike ipchains, the following must be enabled even with masquerading
#Don't forward SMB related traffic
$IPTABLES -A FORWARD -o $EXTERNALIF -p tcp --dport 137 -j REJECT
$IPTABLES -A FORWARD -o $EXTERNALIF -p tcp --dport 138 -j REJECT
$IPTABLES -A FORWARD -o $EXTERNALIF -p tcp --dport 139 -j REJECT
$IPTABLES -A FORWARD -o $EXTERNALIF -p udp --dport 137 -j REJECT
$IPTABLES -A FORWARD -o $EXTERNALIF -p udp --dport 138 -j REJECT
$IPTABLES -A FORWARD -o $EXTERNALIF -p udp --dport 139 -j REJECT

$IPTABLES -A INPUT -i $EXTERNALIF -p udp --dport 137 -j REJECT

#Allow ALL other forwarding going out
$IPTABLES -A FORWARD -o $EXTERNALIF -i $INTERNALIF -j ACCEPT

#Allow replies coming in

$IPTABLES -A FORWARD -i $EXTERNALIF -m state --state ESTABLISHED,RELATED -j ACCEPT

#Whack allowances
#Allow DHCP- Optus users need this
#$IPTABLES -A INPUT -p udp -d 255.255.255.255 --dport 68 -j ACCEPT

#Allow nameserver packets. Different versions of iptables seem to error here.
#Comment out if necessary.

cat /etc/resolv.conf | \
awk '/^nameserver/ {print $2}' | \
xargs -n1 $IPTABLES -A INPUT -p udp --sport 53 -j ACCEPT -s

#Allow Telstra hearbeat
#$IPTABLES -A INPUT -p udp --sport 5050 -j ACCEPT
#$IPTABLES -A INPUT -p udp --sport 5051 -j ACCEPT

#From here on, we're dealing with connection attempts.
#The -m limit is a DoS protection on connects
#First we allow a certain amount of connections per second
#DROP the rest (so we don't DoS ourself with rejections)
#We don't limit normal packets (!syn) by allowing the rest
##Basic services. Uncomment to allow in.
# ftp-data
#$IPTABLES -A INPUT -p tcp --dport 20 -j ACCEPT
# ftp
#$IPTABLES -A INPUT -p tcp --dport 21 -j ACCEPT
# ssh
#$IPTABLES -A INPUT -p tcp --dport 22 -j ACCEPT
#telnet
#$IPTABLES -A INPUT -p tcp --dport 23 -j ACCEPT
# smtp One per second limt -burst rate of ten
#$IPTABLES -A INPUT -p tcp --dport 25 --syn -m limit --limit 1/s \
# --limit-burst 10 -j ACCEPT
#$IPTABLES -A INPUT -p tcp --dport 25 --syn -j DROP
#$IPTABLES -A INPUT -p tcp --dport 25 -j ACCEPT

# DNS
#$IPTABLES -A INPUT -p tcp --dport 53 -j ACCEPT
#$IPTABLES -A INPUT -p udp --dport 53 -j ACCEPT
# http
$IPTABLES -A INPUT -p tcp --dport 80 -j ACCEPT
# POP-3
#$IPTABLES -A INPUT -p tcp --dport 110 -j ACCEPT
# identd
#$IPTABLES -A INPUT -p tcp --dport 113 -j ACCEPT
# https
$IPTABLES -A INPUT -p tcp --dport 443 -j ACCEPT
#
##DNAT
#Modify addresses and uncomment to allow DNAT (port forwarding)

#Send web requests to an internal machine
#Send mail to an internal machine
$IPTABLES -t nat -A POSTROUTING -o $EXTERNALIF -j MASQUERADE
$IPTABLES -A PREROUTING -t nat -i $EXTERNALIF -p tcp --dport 80 \
-j DNAT --to 192.168.1.253:80
#$IPTABLES -A FORWARD -i $EXTERNALIF -p tcp -d 192.168.1.253 --dport 80 -j ACCEPT

#$IPTABLES -A PREROUTING -t nat -i $EXTERNALIF -p tcp -d $MYADDR --dport 25 \
# -j DNAT --to 192.168.0.10:25
#$IPTABLES -A FORWARD -i $EXTERNALIF -p tcp -d 192.168.0.10 --dport 25 -j ACCEPT


##Some ports should be denied and logged.
$IPTABLES -A INPUT -p tcp --dport 6670 -m limit -j LOG \
--log-prefix "Firewalled Packet: Deepthroat"
$IPTABLES -A INPUT -p tcp --dport 6670 -j DROP
$IPTABLES -A INPUT -p tcp --dport 6711 -m limit -j LOG \
--log-prefix "Firewalled Packet: Subseven"
$IPTABLES -A INPUT -p tcp --dport 6711 -j DROP
$IPTABLES -A INPUT -p tcp --dport 6712 -m limit -j LOG \
--log-prefix "Firewalled Packet: Subseven"
$IPTABLES -A INPUT -p tcp --dport 6712 -j DROP
$IPTABLES -A INPUT -p tcp --dport 6713 -m limit -j LOG \
--log-prefix "Firewalled Packet: Subseven"
$IPTABLES -A INPUT -p tcp --dport 6713 -j DROP

$IPTABLES -A INPUT -p tcp --dport 12345 -m limit -j LOG \
--log-prefix "Firewalled Packet: Netbus"
$IPTABLES -A INPUT -p tcp --dport 12345 -j DROP
$IPTABLES -A INPUT -p tcp --dport 12346 -m limit -j LOG \
--log-prefix "Firewalled Packet: Netbus"
$IPTABLES -A INPUT -p tcp --dport 12346 -j DROP
$IPTABLES -A INPUT -p tcp --dport 20034 -m limit -j LOG \
--log-prefix "Firewalled Packet: Netbus"
$IPTABLES -A INPUT -p tcp --dport 20034 -j DROP
$IPTABLES -A INPUT -p tcp --dport 31337 -m limit -j LOG \
--log-prefix "Firewalled Packet: BO"
$IPTABLES -A INPUT -p tcp --dport 31337 -j DROP
$IPTABLES -A INPUT -p tcp --dport 6000 -m limit -j LOG \
--log-prefix "Firewalled Packet: XWin"
#Traceroutes depend on finding a rejected port. DROP the ones it uses

$IPTABLES -A INPUT -p udp --dport 33434:33523 -j DROP

#Don't log ident because it gets hit all the time eg connecting to an irc server
$IPTABLES -A INPUT -p tcp --dport 113 -j REJECT

#Don't log igmp. Some people get too many of these
$IPTABLES -A INPUT -p igmp -j REJECT

#Don't log web or ssl because people surfing for long times lose connection
#tracking and cause the system to create a new one, flooding logs.
$IPTABLES -A INPUT -p tcp --dport 80 -j REJECT
$IPTABLES -A INPUT -p tcp --dport 443 -j REJECT

##Catch all rules.
#iptables reverts to these if it hasn't matched any of the previous rules.
#Log. There's no point logging noise. There's too much of it.
#Just log connection requests
$IPTABLES -A INPUT -p tcp --syn -m limit --limit 5/minute -j LOG \
--log-prefix "Firewalled packet:"
$IPTABLES -A FORWARD -p tcp --syn -m limit --limit 5/minute -j LOG \
--log-prefix "Firewalled packet:"
#Reject
$IPTABLES -A INPUT -p tcp -j REJECT --reject-with tcp-reset
$IPTABLES -A INPUT -p all -j DROP

$IPTABLES -A FORWARD -p tcp -j REJECT --reject-with tcp-reset
$IPTABLES -A FORWARD -p all -j DROP

#Accept it anyway if it's only output
$IPTABLES -A OUTPUT -j ACCEPT

#Masquerade internal connections going out.
$IPTABLES -A POSTROUTING -t nat -o $EXTERNALIF -j MASQUERADE

-----------------------------------------------------------------------------------------


hier und da mal ein bissel gelesen, und dann halt zusammengestrickt,
sieht in meinen augen gut uas, klappt auch alles bis auf die eingehende connetcion

mfg.
thom

[Harry]

Hallo,


Original geschrieben von PigPen|oo|
huhu,

ja daran solls nicht scheitern ;D,

-----------------------------------------
$IPTABLES -A PREROUTING -t nat -i $EXTERNALIF -p tcp --dport 80 \
-j DNAT --to 192.168.1.253:80
#$IPTABLES -A FORWARD -i $EXTERNALIF -p tcp -d 192.168.1.253 --dport 80 -j ACCEPT

die zweite Zeile mußt Du für das gedroppte Paket auskommentieren -> aktivieren; dann sollte es auch funktionieren. Versuch's halt mal so.

Harry

[PigPen|tuX]

huhu,

das habe ich auch schon probiert, aber es brachte mich auch nicht wirklich weiter;

dann wird das paket zwar nicht mehr mitgeloggt, aber dennoch ist der port anscheind dicht ;[

im browser kommt dann immer noch ein refused, und ein portscanner sagt Port 80 closed.

mfg.
thom

[PigPen|tuX]

huhu,

bin noch mal in mich gekehrt, nun funzt es :D

thx für die hilfe

mfg.
thom