iptables rule

knueven7 · n00b Joined: 01 May 2004 Posts: 42

I am writing an iptables rule:

iptables -A FORWARD -s 0/0 -d x.x.x.3 -p TCP --sport 19283 --dport 19283 -j ACCEPT

Can I add another port to this rule? I know I can do a range of ports:
--sport 19283:19287

I would like to just have two ports instead of a range. Unfortunately the ports are not close together so I can't use a range.

ports:
19283 and 19315

Thanks for the help

Jeremy_Z · l33t Joined: 05 Apr 2004 Posts: 671 Location: Shanghai

Hi, you cna do this :

-p tcp -m multiport --sport 80,20,23 (example)
_________________
"Because two groups of consumers drive the absolute high end of home computing: the gamers and the porn surfers." /.
My gentoo projects, Kelogviewer and a QT4 gui for etc-proposals

cold_flame · Posted: Tue Jul 27, 2004 1:21 pm Post subject:

or you could just execute the rule twice, changing the port each time.....

knueven7 · n00b Joined: 01 May 2004 Posts: 42

I'm new to iptables and a little confused on when to use INPUT and when to use FORWARD.

If I have a web server and want to allow access on port 80 should I use INPUT of FORWARD?

Also, I am in campus environment where they do DNS for the entire campus so DNS must be allowed in. Would that be an INPUT?

Any easy hints to figure out which to use?

My firewall is a bridging firewall so I'm not sure if I even need to use FORWARD at all since it routes the traffic.

Thanks.

Jeremy_Z · l33t Joined: 05 Apr 2004 Posts: 671 Location: Shanghai

INPUT applies to packets that are targeted to your linux server and used by process on your server (like httpd, sshd, ect ..)

FORWARD applies to packet that are targeted to an ip behind your linux box, this happen when your act as a router, masquerading or forwarding packets. Those packets are not used by your internal process.
It also applies to packets coming from behind your box.
FORWARD is used to filter packets between two interfaces, should should use it for bridging, try setting the policy to DROP, and your bridge should stop.

OUTPUT applies to packets made by your linux box.
_________________
"Because two groups of consumers drive the absolute high end of home computing: the gamers and the porn surfers." /.
My gentoo projects, Kelogviewer and a QT4 gui for etc-proposals

knueven7 · n00b Joined: 01 May 2004 Posts: 42

Just want to make sure I'm on the right track here.

I have 3 NIC's in my bridge. The one that's assigned an IP needs DNS. For DNS to that interface on my bridge I use the INPUT command? Then use the INPUT command again for ssh to my bridge. So any service going to the eth0 device on my bridge itself will use INPUT.

The rest of my servers sit behind the bridge/firewall so I will use FORWARD for rules applying to traffic sent to them through the bridge.

Do I have the right idea here?

splooge · l33t Joined: 30 Aug 2002 Posts: 636

input, output and forward are only filter chains. They allow or disallow packets. What you're looking to do is called network address translation, or NAT. This is done in the prerouting and postrouting chains.
_________________
http://get.a.clue.de

Jeremy_Z · l33t Joined: 05 Apr 2004 Posts: 671 Location: Shanghai

Yeap, any connection that go to your box is managed by INPUT/OUTPUT whatever the interface is, and any connection that goes through is managed by FORWARD.

You can use -i and/or -o flags to specify the interface.
_________________
"Because two groups of consumers drive the absolute high end of home computing: the gamers and the porn surfers." /.
My gentoo projects, Kelogviewer and a QT4 gui for etc-proposals

Jeremy_Z · l33t Joined: 05 Apr 2004 Posts: 671 Location: Shanghai

splooge · l33t Joined: 30 Aug 2002 Posts: 636

Jeremy_Z · l33t Joined: 05 Apr 2004 Posts: 671 Location: Shanghai

Yep but could work without NAT. But i think the "bridge word" confused me.

knueven7 : can you post the topology of your network (with ips, servers, ect ..), just to clarify.
_________________
"Because two groups of consumers drive the absolute high end of home computing: the gamers and the porn surfers." /.
My gentoo projects, Kelogviewer and a QT4 gui for etc-proposals

knueven7 · n00b Joined: 01 May 2004 Posts: 42

Building Switch(outside world) -->Bridge --> Switch(My Network) --> Network(servers, workstations)

The building switch is controlled by our University Office of Info. Technology. They pump a feed to my switch that allows my network to connect to the outside world. The bridge will sit between their switch and mine. On my network I have an Open Directory server, web server, radmind server, key server, a bunch of other little things and about 300 desktop machines. My servers are connected to from 5 other subnets around campus for various things.

I am not using NAT or MASQ.

knueven7 · n00b Joined: 01 May 2004 Posts: 42

I have written a script for iptables, but don't know how to apply it. How can I apply it so that it will automatically run if the bridge is restarted?

Thanks for all of the help.

Jeremy_Z · l33t Joined: 05 Apr 2004 Posts: 671 Location: Shanghai

run it
check it (iptables -L -v)
save it : /etc/init.d/iptables save
add it to boot : rc-update add iptables default
_________________
"Because two groups of consumers drive the absolute high end of home computing: the gamers and the porn surfers." /.
My gentoo projects, Kelogviewer and a QT4 gui for etc-proposals

knueven7 · n00b Joined: 01 May 2004 Posts: 42

When I run the script it gives me an error:
iptables v1.2.9: bad rate 'l/s'

I have no idea what it means. Any ideas?

Jeremy_Z · l33t Joined: 05 Apr 2004 Posts: 671 Location: Shanghai

Probably an error in your script after -m limit or something like that. Post your script, for error checking.
_________________
"Because two groups of consumers drive the absolute high end of home computing: the gamers and the porn surfers." /.
My gentoo projects, Kelogviewer and a QT4 gui for etc-proposals

knueven7 · n00b Joined: 01 May 2004 Posts: 42

It was an error in the script.

How can I get my bridge configuration to stay when the machine is restarted? Do I need to write a script and have it run when the machine restarts?

Jeremy_Z · l33t Joined: 05 Apr 2004 Posts: 671 Location: Shanghai

I answered already, 2 posts before.
_________________
"Because two groups of consumers drive the absolute high end of home computing: the gamers and the porn surfers." /.
My gentoo projects, Kelogviewer and a QT4 gui for etc-proposals

knueven7 · n00b Joined: 01 May 2004 Posts: 42

I did that and it just kept my iptables configuration. When I restart I have to reconfigure my bridge everytime.

brctl addbr br0
brctl addif br0 eth1
brctl addif br0 eth2
ifconfig br0 0.0.0.0 up

Is it similar (or exact) to what i had to do for iptables?

Jeremy_Z · l33t Joined: 05 Apr 2004 Posts: 671 Location: Shanghai

This is in /etc/conf.d/net..., should be set up at install. Search in the install handbook if you need documentation.
_________________
"Because two groups of consumers drive the absolute high end of home computing: the gamers and the porn surfers." /.
My gentoo projects, Kelogviewer and a QT4 gui for etc-proposals