| View previous topic :: View next topic |
| Author |
Message |
jbpros
Tux's lil' helper
Joined: 05 May 2004
Posts: 133
Location: Brussels, Belgium
|
 Posted: Wed Jul 07, 2004 5:16 pm Post subject: NAT tweaking |
 |
|
Hi people!
I've just finished reconfiguring my LAN with a dedicated gentoo router, a dedicated gentoo server and several stations. LAN has got access to the Internet through the router, DNS, DHCP and all those stuffs seem to work nicely.
I've setup a jabber and http servers on the gentoo server (10.0.2.150) and used iptables forwarding rules to allow "internet to local server" access. There is only one thing I can't manage: I would like my LAN boxes to have access to the server through the public interface of my router. Here is a little representation:
1. Normal internal http connection from a local box to the HTTP server:
[LANBOX/10.0.2.12]<---->[SERVER/10.0.2.150:80]
2. Normal external http connection from the internet to my local server:
[INTERNET/195.238.12.45]<---->[212.124.23.12:80/ROUTER/10.0.2.253]<---->[SERVER/10.0.2.150:80]
3. What I'm willing to do:
[LANBOX/10.0.2.12]<---->[212.124.23.12:80/ROUTER/10.0.2.253]<---->[10.0.2.150:80/SERVER]
I'm learning iptables for some weeks now and understood a good number of basic concepts of the kernel IP stack but there I'm stuck.. I'm sure it's easy to implement though 
Here is my iptables script:
| Code: | !/bin/sh
#
# rc.firewall - DHCP IP Firewall script for Linux 2.4.x and iptables
#
# Copyright (C) 2001 Oskar Andreasson <bluefluxATkoffeinDOTnet>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; version 2 of the License.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program or from the site that you downloaded it
# from; if not, write to the Free Software Foundation, Inc., 59 Temple
# Place, Suite 330, Boston, MA 02111-1307 USA
#
FIREWALL_VER="0.1.0"
###########################################################################
#
# 1. Configuration options.
#
#
# 1.1 Internet Configuration.
#
INET_IFACE="ppp0"
#
# 1.1.1 DHCP
#
#
# Information pertaining to DHCP over the Internet, if needed.
#
# Set DHCP variable to no if you don't get IP from DHCP. If you get DHCP
# over the Internet set this variable to yes, and set up the proper IP
# address for the DHCP server in the DHCP_SERVER variable.
#
DHCP="no"
DHCP_SERVER="195.22.90.65"
#
# 1.1.2 PPPoE
#
# Configuration options pertaining to PPPoE.
#
# If you have problem with your PPPoE connection, such as large mails not
# getting through while small mail get through properly etc, you may set
# this option to "yes" which may fix the problem. This option will set a
# rule in the PREROUTING chain of the mangle table which will clamp
# (resize) all routed packets to PMTU (Path Maximum Transmit Unit).
#
# Note that it is better to set this up in the PPPoE package itself, since
# the PPPoE configuration option will give less overhead.
#
PPPOE_PMTU="no"
#
# 1.2 Local Area Network configuration.
#
# your LAN's IP range and localhost IP. /24 means to only use the first 24
# bits of the 32 bit IP address. the same as netmask 255.255.255.0
#
LAN_IP="10.0.2.253"
LAN_IP_RANGE="10.0.2.0/24"
LAN_IFACE="eth0"
# set to yes to allow lan to access the internet
LAN_INET_ACCESS="yes"
# set to yes to allow internet->lan forwarding (gateway must be specified on hosts)
INET_TO_LAN_FORWARD="yes"
#
# 1.3 DMZ Configuration.
#
#
# 1.4 Localhost Configuration.
#
LO_IFACE="lo"
LO_IP="127.0.0.1"
#
# 1.5 IPTables Configuration.
#
IPTABLES="/sbin/iptables"
#
# 1.6 Other Configuration.
#
###########################################################################
#
# 2. Module loading.
#
#
# Needed to initially load modules
#
/sbin/depmod -a
#
# 2.1 Required modules
#
/sbin/modprobe ip_conntrack
/sbin/modprobe ip_tables
/sbin/modprobe iptable_filter
/sbin/modprobe iptable_mangle
/sbin/modprobe iptable_nat
/sbin/modprobe ipt_LOG
/sbin/modprobe ipt_limit
/sbin/modprobe ipt_MASQUERADE
#
# 2.2 Non-Required modules
#
#/sbin/modprobe ipt_owner
#/sbin/modprobe ipt_REJECT
#/sbin/modprobe ip_conntrack_ftp
#/sbin/modprobe ip_conntrack_irc
#/sbin/modprobe ip_nat_ftp
#/sbin/modprobe ip_nat_irc
###########################################################################
#
# 3. /proc set up.
#
#
# 3.1 Required proc configuration
#
echo "1" > /proc/sys/net/ipv4/ip_forward
#
# 3.2 Non-Required proc configuration
#
#echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
#echo "1" > /proc/sys/net/ipv4/conf/all/proxy_arp
#echo "1" > /proc/sys/net/ipv4/ip_dynaddr
###########################################################################
#
# 4. rules set up.
#
######
# 4.1 Filter table
#
#
# 4.1.0 Flush everything
#
$IPTABLES -F
$IPTABLES -F -t nat
$IPTABLES -F -t mangle
$IPTABLES -X
$IPTABLES -X -t nat
$IPTABLES -X -t mangle
#
# 4.1.1 Set policies
#
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -P FORWARD DROP
#
# 4.1.2 Create userspecified chains
#
#
# Create chain for bad tcp packets
#
$IPTABLES -N bad_tcp_packets
#
# Create separate chains for ICMP, TCP and UDP to traverse
#
$IPTABLES -N allowed
$IPTABLES -N tcp_packets
$IPTABLES -N udp_packets
$IPTABLES -N icmp_packets
#
# 4.1.3 Create content in userspecified chains
#
#
# bad_tcp_packets chain
#
$IPTABLES -A bad_tcp_packets -p tcp --tcp-flags SYN,ACK SYN,ACK \
-m state --state NEW -j REJECT --reject-with tcp-reset
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG \
--log-prefix "New not syn:"
$IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP
#
# allowed chain
#
$IPTABLES -A allowed -p TCP --syn -j ACCEPT
$IPTABLES -A allowed -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A allowed -p TCP -j DROP
#
# TCP rules
#
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 22 -j allowed
$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 19150 -j allowed
#
# UDP ports
#
#$IPTABLES -A udp_packets -p UDP -s 0/0 --source-port 53 -j ACCEPT
if [ $DHCP == "yes" ] ; then
$IPTABLES -A udp_packets -p UDP -s $DHCP_SERVER --sport 67 \
--dport 68 -j ACCEPT
fi
#
# In Microsoft Networks you will be swamped by broadcasts. These lines
# will prevent them from showing up in the logs.
#
$IPTABLES -A udp_packets -p UDP -i $INET_IFACE \
--destination-port 135:139 -j DROP
#
# If we get DHCP requests from the Outside of our network, our logs will
# be swamped as well. This rule will block them from getting logged.
#
$IPTABLES -A udp_packets -p UDP -i $INET_IFACE -d 255.255.255.255 \
--destination-port 67:68 -j DROP
#
# ICMP rules
#
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j ACCEPT
$IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT
#$IPTABLES -A icmp_packets -p ICMP -j ACCEPT
#
# 4.1.4 INPUT chain
#
#
# Bad TCP packets we don't want.
#
$IPTABLES -A INPUT -p tcp -j bad_tcp_packets
#
# Rules for special networks not part of the Internet
#
$IPTABLES -A INPUT -p ALL -i $LAN_IFACE -s $LAN_IP_RANGE -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -j ACCEPT
#
# Special rule for DHCP requests from LAN, which are not caught properly
# otherwise.
#
$IPTABLES -A INPUT -p UDP -i $LAN_IFACE --dport 67 --sport 68 -j ACCEPT
#
# Rules for incoming packets from the internet.
#
$IPTABLES -A INPUT -p ALL -i $INET_IFACE -m state --state ESTABLISHED,RELATED \
-j ACCEPT
$IPTABLES -A INPUT -p TCP -i $INET_IFACE -j tcp_packets
$IPTABLES -A INPUT -p UDP -i $INET_IFACE -j udp_packets
$IPTABLES -A INPUT -p ICMP -i $INET_IFACE -j icmp_packets
#
# If you have a Microsoft Network on the outside of your firewall, you may
# also get flooded by Multicasts. We drop them so we do not get flooded by
# logs
#
$IPTABLES -A INPUT -i $INET_IFACE -d 224.0.0.0/8 -j DROP
#
# Log weird packets that don't match the above.
#
$IPTABLES -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG \
--log-level DEBUG --log-prefix "IPT INPUT packet died: "
#
# 4.1.5 FORWARD chain
#
#
# Bad TCP packets we don't want
#
$IPTABLES -A FORWARD -p tcp -j bad_tcp_packets
#
# Accept the packets we actually want to forward
#
if [ $LAN_INET_ACCESS == "yes" ] ; then
$IPTABLES -A FORWARD -i $LAN_IFACE -j ACCEPT
$IPTABLES -A FORWARD -i $INET_IFACE -o $LAN_IFACE -m state --state ESTABLISHED,RELATED -j ACCEPT
fi
if [ $INET_TO_LAN_FORWARD == "yes" ] ; then
:
# HTTP (->amenophis)
$IPTABLES -A FORWARD -p TCP -i $INET_IFACE --dport 80 -j ACCEPT
# JABBER (C2S,SSL,S2S)
$IPTABLES -A FORWARD -p TCP -i $INET_IFACE --dport 5222 -j ACCEPT
$IPTABLES -A FORWARD -p TCP -i $INET_IFACE --dport 5223 -j ACCEPT
$IPTABLES -A FORWARD -p TCP -i $INET_IFACE --dport 5269 -j ACCEPT
fi
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
#
# Log weird packets that don't match the above.
#
$IPTABLES -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG \
--log-level DEBUG --log-prefix "IPT FORWARD packet died: "
#
# 4.1.6 OUTPUT chain
#
#
# Bad TCP packets we don't want.
#
$IPTABLES -A OUTPUT -p tcp -j bad_tcp_packets
#
# Special OUTPUT rules to decide which IP's to allow.
#
$IPTABLES -A OUTPUT -p ALL -s $LO_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $LAN_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -o $INET_IFACE -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -o $LAN_IFACE -j ACCEPT
#
# Log weird packets that don't match the above.
#
$IPTABLES -A OUTPUT -m limit --limit 3/minute --limit-burst 3 -j LOG \
--log-level DEBUG --log-prefix "IPT OUTPUT packet died: "
######
# 4.2 nat table
#
#
# 4.2.1 Set policies
#
#
# 4.2.2 Create user specified chains
#
#
# 4.2.3 Create content in user specified chains
#
#
# 4.2.4 PREROUTING chain
#
if [ $INET_TO_LAN_FORWARD == "yes" ] ; then
:
# HTTP (->amenophis)
$IPTABLES -t nat -A PREROUTING -p TCP -i $INET_IFACE --dport 80 -j DNAT --to-destination 10.0.2.150:80
# JABBER (C2S,SSL,S2S)
$IPTABLES -t nat -A PREROUTING -p TCP -i $INET_IFACE --dport 5222 -j DNAT --to-destination 10.0.2.150:5222
$IPTABLES -t nat -A PREROUTING -p TCP -i $INET_IFACE --dport 5223 -j DNAT --to-destination 10.0.2.150:5223
$IPTABLES -t nat -A PREROUTING -p TCP -i $INET_IFACE --dport 5269 -j DNAT --to-destination 10.0.2.150:5269
fi
#
# 4.2.5 POSTROUTING chain
#
if [ $PPPOE_PMTU == "yes" ] ; then
$IPTABLES -t nat -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN \
-j TCPMSS --clamp-mss-to-pmtu
fi
if [ $LAN_INET_ACCESS == "yes" ] ; then
$IPTABLES -t nat -A POSTROUTING -o $INET_IFACE -j MASQUERADE
fi
#
# 4.2.6 OUTPUT chain
#
######
# 4.3 mangle table
#
#
# 4.3.1 Set policies
#
#
# 4.3.2 Create user specified chains
#
#
# 4.3.3 Create content in user specified chains
#
#
# 4.3.4 PREROUTING chain
#
#
# 4.3.5 INPUT chain
#
#
# 4.3.6 FORWARD chain
#
#
# 4.3.7 OUTPUT chain
#
#
# 4.3.8 POSTROUTING chain
#
echo "JBpro's Interactive Firewall $FIREWALL_VER ready."
echo -n "LAN Internet access is "
if [ $LAN_INET_ACCESS == "yes" ] ; then
echo "[ENABLED]!"
else
echo "[DISABLED]!"
fi
echo -n "Port forwarding to LAN is "
if [ $INET_TO_LAN_FORWARD == "yes" ] ; then
echo "[ENABLED]!"
else
echo "[DISABLED]!"
fi
|
Don't hesitate to make comments about errors in my script too |
|
| Back to top |
|
 |
moocha
Watchman
Joined: 21 Oct 2003
Posts: 5722
|
| Posted: Wed Jul 07, 2004 10:15 pm Post subject: |
|
|
The LAN boxes will always connect directly to the server because they're on the same subnet and thus have a net route to the server. In addition to the iptables rules you need to also locally add a host route on each of the LAN boxes telling them that the route to 10.0.2.150 is via 212.124.23.12. Under *nix do it with /sbin/route. Under Windows do it with route.exe.
_________________
Military Commissions Act of 2006: http://tinyurl.com/jrcto
"Those who would give up essential liberty to purchase a little temporary safety deserve neither liberty nor safety."
-- attributed to Benjamin Franklin |
|
| Back to top |
|
|
jbpros
Tux's lil' helper
Joined: 05 May 2004
Posts: 133
Location: Brussels, Belgium
|
| Posted: Wed Jul 07, 2004 10:30 pm Post subject: |
|
|
I'm not sure I was clear enough
What I want is to be able to connect to my web server by typing "http://212.124.23.12/" from a LAN box (in fact I'm even using a dynamic DNS address). This was working on my previous Red Hat routers (but I used "ready-to-go" iptables scripts there). So I'm sure I can access my server from a LAN node like any outside box on the Internet would do. I'm pretty sure this can be achieved, the public router IP address should not cause more problems than any other public IP address on the Internet (though I guess it needs one or two iptables rules )
Thank you for your help! |
|
| Back to top |
|
|
splooge
l33t
Joined: 30 Aug 2002
Posts: 636
|
| Posted: Wed Jul 07, 2004 10:55 pm Post subject: |
|
|
Well I am not gonna wade through that entire script, but often times if an IP packet with the source address of your internal network lands on your external interface it gets dropped. The reason for this is so malicious people can't spoof their source IP address and trick your firewall into letting them in.
_________________
http://get.a.clue.de |
|
| Back to top |
|
|
jbpros
Tux's lil' helper
Joined: 05 May 2004
Posts: 133
Location: Brussels, Belgium
|
| Posted: Wed Jul 07, 2004 11:13 pm Post subject: |
|
|
| splooge wrote: | | Well I am not gonna wade through that entire script, but often times if an IP packet with the source address of your internal network lands on your external interface it gets dropped. The reason for this is so malicious people can't spoof their source IP address and trick your firewall into letting them in. |
Ha yes! that's so evident, I'm stupid ^^ I'm checking this right now, thank you for the hint! |
|
| Back to top |
|
|
jbpros
Tux's lil' helper
Joined: 05 May 2004
Posts: 133
Location: Brussels, Belgium
|
| Posted: Thu Jul 08, 2004 12:08 am Post subject: |
|
|
While trying to fix my problem I encountered something strange. When I'm on the router trying to ping itself on its public interface (ping 81.242.210.113), the operation fails as it is not "permitted". After some research in the logs I found that pinging my public IP was sending packets to the "lo" interface. I thought it would be using ppp0, no??? I have to allow traffic in the OUTPUT chain to the "lo" interface to be able to ping myself on my public IP... lo interface is naturally 127.0.0.1/8, nothing to do with 81.242.210.113 
Is this behaviour normal?
[EDIT] and for more informations, here are the routes, quite simple and correct. hu.
| Code: | nephtys root # ip route
81.242.210.1 dev ppp0 proto kernel scope link src 81.242.210.113
10.0.2.0/24 dev eth0 proto kernel scope link src 10.0.2.253
127.0.0.0/8 via 127.0.0.1 dev lo scope link
default via 81.242.210.1 dev ppp0 |
|
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
Networking & Security
