Gentoo Forums :: View topic - Please help my Router /iptable/ipchain/nat/

Please help my Router /iptable/ipchain/nat/

View unanswered posts
View posts from last 24 hours

Gentoo Forums Forum Index

Networking & Security

View previous topic :: View next topic

Author

Message

TheX
Guru
Guru

Joined: 31 Jul 2004
Posts: 349
Location: .de

Posted: Fri Sep 24, 2004 11:56 pm Post subject: Please help my Router /iptable/ipchain/nat/

I've got a simple homenetwork.
A small PC(called OXO) (333Mhz; 32 MB RAM; 8MB Graphic Card; 2 Network Cards)
And 2 Bigger PC's which are waiting for traffic from the worldwideweb.

The oxo is a dhcp an apache server. It opens the adsl connection with rp-pppoe.
Ipchains and some necessary stuff is compiled into the kernel.
Now it should route all stuff (later i'll set some iptable rules) to the Big PC's. :!:

( I forgot to say ; OXO is running Gentoo (What else

?!?))

So, my Problem is that oxo isn't routing the traffic from card eth0 (www) to card eth1 (LAN 192.168.99.0).

I emerged :
dhcp
iptables
dnsmasq

Now I'll paste some config's from OXO, to make it easier to know where the prob. is.

/etc/conf.d/net

Code:

iface_eth1="192.168.99.99 broadcast 192.168.99.255 netmask 255.255.255.0"

/etc/conf.d/dhcp

Code:

IFACE="eth1"
DHCPD_OPTS="-q"
#CHROOT="/chroot/dhcp"

/etc/dhcp/dhcp.conf

Code:

authoritative;
ddns-update-style ad-hoc;

subnet 192.168.99.0 netmask 255.255.255.0 {
range 192.168.99.10 192.168.99.50;
default-lease-time 259200;
max-lease-time 518400;

option subnet-mask 255.255.255.0;
option broadcast-address 192.168.99.255;

option routers 192.168.99.99;
option domain-name-servers 192.168.99.99;
}

######################################

# FIXED IP-s

host hansa {
hardware ethernet 00:E0:4C:02:41:85;
fixed-address 192.168.99.1;

/etc/conf.d/local.start

Code:

echo "1" > /proc/sys/net/ipv4/conf/all/forwarding
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmt

Now the config from the Client-PC (hansa), which shoulld get the routed (http) traffic.:

Code:

iface_eth0="dhcp";
gateway="eth0/192.168.99.99";

This may not be 100% right, because i'm in windows now and can't access the configs on hansa now.

I hope this is enough information to solve the problem. :roll:

Please help me to get my OXO working, and routing all stuff to the LAN.
I had a Debian System Running on OXO, and wanted to make it work with Gentoo. This Can Be done !!!!!!!! HELP ME !!!!

OH; my firewall-and-routing-script on the Debian - System looked like this:

Code:

#! /bin/sh

## ---MINI NETFILTER CONFIG---
## This Dokument was written by an IHKA
## V.02

PATH=/usr/sbin:/sbin:/usr/bin:/bin
export PATH

LAN_ADR=192.168.99.0/24
INTERFACE="ppp0"
IF_LAN="eth1"
HOST1=192.168.99.1
HOST2=192.168.99.7

# Adresse des Nameservers automatisch feststellen:
nameserver=`grep '^nameserver' /etc/resolv.conf | head -1 | awk '{print $2}'`

##### Kernel-Tuning ###########################################################

for i in /proc/sys/net/ipv4/conf/*/{accept_source_route,accept_redirects,send_r$
echo 0 >$i
done
echo 1 >/proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo 1 >/proc/sys/net/ipv4/tcp_syncookies
echo 1 >/proc/sys/net/ipv4/ip_forward

##### POLICIES ################################################################
# Bereits existierende Regeln löschen
iptables -F
iptables -X

# Voreinstellung: Unbekannte Pakete dürfen nicht passieren
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

##### INPUT-Chain #############################################################
# NUR ZUM TESTEN: Nameserver-Antworten von überall erlauben
# iptables -A INPUT -p udp --sport 53 -j ACCEPT

# NUR ZUM TESTEN: Alle Pakete annehmen
#iptables -A INPUT -j ACCEPT

# NUR ZUM TESTEN: Alle Pakete protokollieren
# iptables -A INPUT -j LOG

# vom Loopback-Interface ist alles erlaubt
iptables -A INPUT -i lo -j ACCEPT
#iptables -A INPUT -i $IF_LAN -j ACCEPT

# Falls -m state gewünscht ist: erkannte Verbindungen erlauben
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# X11 sperren
iptables -A INPUT -p tcp --dport 6000:6020 --syn -j LOG
iptables -A INPUT -p tcp --dport 6000:6020 --syn -j DROP

# NFS und SOCKS sperren
iptables -A INPUT -p tcp -m multiport --dport 1080,2049 --syn -j LOG
iptables -A INPUT -p tcp -m multiport --dport 1080,2049 --syn -j DROP

iptables -A INPUT -p udp -m multiport --dport 2049,4045 -j LOG
iptables -A INPUT -p udp -m multiport --dport 2049,4045 -j DROP

# Bestehende Verbindungen zu oberen Ports sind erlaubt
iptables -A INPUT -p tcp --dport 1024: ! --syn -j ACCEPT

# Einzelne Server-Ports sind ebenfalls erlaubt
iptables -A INPUT -p tcp -s $LAN_ADR --dport 631 -j ACCEPT # CUPS
iptables -A INPUT -p tcp -s $LAN_ADR --dport 901 -j ACCEPT
#iptables -A INPUT -p tcp -s $LAN_ADR --dport 10000 -j ACCEPT # Webmin
#iptables -A INPUT -p tcp -s $LAN_ADR --dport 80 -j ACCEPT #Apache Web Server
iptables -A INPUT -p tcp --dport 22 -j ACCEPT # ssh
iptables -A INPUT -p tcp -s $LAN_ADR -m multiport --dport 137,139 -j ACCEPT
iptables -A INPUT -p udp -s $LAN_ADR -m multiport --dport 137,139 -j ACCEPT

#iptables -A INPUT -p tcp --dport 80 -j ACCEPT # http
#iptables -A INPUT -p udp -s $LAN_ADR --dport 514 -j ACCEPT # syslog v.LAN
#iptables -A INPUT -p udp --dport 6970 -j ACCEPT # RealPlayer / nautilus

# auth-Anfragen werden mit einer Fehlermeldung an den Absender verweigert.
# Das beschleunigt den Aufbau zu Servern, die eine ident-Anfrage durchführen.
iptables -A INPUT -p tcp --dport auth -j REJECT --reject-with tcp-reset

# Drei Varianten für DNS:
# (1) DNS-Pakete nur von einem einzigen Nameserver
iptables -A INPUT -p tcp -s $nameserver --sport domain -j ACCEPT
iptables -A INPUT -p udp -s $nameserver --sport domain -j ACCEPT
# (3) UDP-DNS-Pakete von überall zu unserem DNS-Cache. Hier brauchen wir
# keine eigene TCP-Regel, weil BIND für TCP-Anfragen einen unprivilegierten
# Port benutzt.
#iptables -A INPUT -p udp --sport domain --dport 7531 -j ACCEPT

# Fragmentierte ICMP-Pakete blockieren
iptables -A INPUT -p icmp --fragment -j LOG
iptables -A INPUT -p icmp --fragment -j DROP

# Bestimmte ICMP-Pakete erlauben
iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
iptables -A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
iptables -A INPUT -p icmp --icmp-type source-quench -j ACCEPT
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT
iptables -A INPUT -p icmp --icmp-type parameter-problem -j ACCEPT

# Manche Ereignisse kommen so häufig vor, dass ich sie im Protokoll nicht
# sehen will.
iptables -A INPUT -p udp --dport netbios-ns -j DROP
iptables -A INPUT -p udp --dport netbios-dgm -j DROP
iptables -A INPUT -p tcp --dport netbios-ssn -j DROP

# Alles andere wird zunächst protokolliert und dann gesperrt.
iptables -A INPUT -j LOG
iptables -A INPUT -j DROP

##### OUTPUT-Chain ############################################################
# NUR ZUM TESTEN: Alle Pakete senden
# iptables -A OUTPUT -j ACCEPT

# Pakete nach Loopback
iptables -A OUTPUT -o lo -j ACCEPT

# Bestimmte UDP-Pakete
iptables -A OUTPUT -p udp --sport 1024: --dport 53 -j ACCEPT # domain/udp
#iptables -A OUTPUT -p udp --dport 7091 -j ACCEPT # nautilus

# Wir betreiben ein paar Server
iptables -A OUTPUT -p tcp -d $LAN_ADR -m multiport --sport 137,139 -j ACCEPT
iptables -A OUTPUT -p udp -d $LAN_ADR -m multiport --sport 137,139 -j ACCEPT
iptables -A OUTPUT -p udp -d $LAN_ADR --sport 756 -j ACCEPT
iptables -A OUTPUT -p tcp -d $LAN_ADR --sport 901 -j ACCEPT

# TCP-Pakete von lokalen Client-Programmen
iptables -A OUTPUT -p tcp --sport 1024: --dport 21 -j ACCEPT # ftp
iptables -A OUTPUT -p tcp --sport 1024: --dport 22 -j ACCEPT # ssh
#iptables -A OUTPUT -p tcp --sport 1024: --dport 23 -j ACCEPT # telnet
#iptables -A OUTPUT -p tcp --dport 25 -j ACCEPT # smtp
#iptables -A OUTPUT -p tcp --sport 1024: --dport 37 -j ACCEPT # time
#iptables -A OUTPUT -p tcp --sport 1024: --dport 43 -j ACCEPT # whois
#iptables -A OUTPUT -p tcp --sport 1024: --dport 53 -j ACCEPT # domain/tcp
#iptables -A OUTPUT -p tcp --sport 1024: --dport 79 -j ACCEPT # finger
iptables -A OUTPUT -p tcp --sport 1024: --dport 80 -j ACCEPT # www
#iptables -A OUTPUT -p tcp --sport 1024: --dport 110 -j ACCEPT # pop-3
iptables -A OUTPUT -p tcp --sport 1024: --dport 123 -j ACCEPT # ntp
#iptables -A OUTPUT -p tcp --sport 1024: --dport 143 -j ACCEPT # imap2
#iptables -A OUTPUT -p tcp --sport 1024: --dport 443 -j ACCEPT # https
iptables -A OUTPUT -p tcp --sport 1024: --dport 756 -j ACCEPT # SMB unknown

# Abgehende TCP-Verbindungen sind erlaubt, wenn auf beiden Enden der
# Verbindung ein unsicherer Port benutzt wird. Unsicher, aber für
# passives FTP notwendig, sofern -m state nicht benutzt wird.
iptables -A OUTPUT -p tcp --sport 1024: --dport 1024: -j ACCEPT

# Alternative: Das Zustandsmodul erlaubt aktives und passives FTP
# (beachten Sie auch die entsprechende Regel in der INPUT-Chain!)
#iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Bestimmte ICMP-Pakete erlauben
iptables -A OUTPUT -p icmp -d $LAN_ADR --icmp-type echo-reply -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type destination-unreachable -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT

# Der Rest wird protokolliert und gesperrt. Bei TCP-Verbindungen senden
# wir eine Fehlermeldung an unser eigenes Programm, damit wir nicht auf
# den langwierigen Timeout warten müssen.
iptables -A OUTPUT -j LOG
iptables -A OUTPUT -p tcp -j REJECT --reject-with tcp-reset
iptables -A OUTPUT -j DROP

##### FORWARD-Chain ###########################################################

# NUR ZUM TESTEN: Alle Pakete protokollieren
# iptables -A FORWARD -j LOG

# Adressübersetzung: nat-Tabelle!
iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE

#Router darf Pakete zerhacken (MTU Problem - Bsp. www.gmx.de)
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

# Abgehende Pakete
iptables -A FORWARD -o ppp0 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -o ppp0 -p tcp -m multiport --sport 136,139 -j REJECT
# Ankommende Pakete
iptables -A FORWARD -o $IF_LAN -m state --state ESTABLISHED,RELATED -j ACCEPT

# iptables -A FORWARD -o $IF_LAN -p tcp --dport 22 -j ACCEPT
iptables -A FORWARD -o $IF_LAN -p tcp --dport 4659 -j ACCEPT
iptables -A FORWARD -o $IF_LAN -p tcp --dport 4662 -j ACCEPT
iptables -A FORWARD -o $IF_LAN -p tcp -m multiport --dport 5504,5553 -j ACCEPT

iptables -t nat -A PREROUTING -i ppp0 -p tcp --dport 4662 -j DNAT --to $HOST1:4662
# iptables -t nat -A PREROUTING -i ppp0 -p tcp --dport 4659 -j DNAT --to $HOST2:4659
# iptables -t nat -A PREROUTING -i ppp0 -p tcp --dport 26 -j DNAT --to $HOST1:22

#Portmapping HOST1
# iptables -t nat -A PREROUTING -i ppp0 -p tcp -m multiport --dport 5504,5553 -j DNAT --to $HOST1:5$

echo -e "\t\t FIREWALL UP =)"

Perhaps somebody knows some corrections, to this script do what i want.
At the moment it echoes on Gentoo :

Code:

sh /firewall-routing
head: `-1' option is obsolete; use `-n 1' since this will be removed in the future
/firewall-routing: line 26: /proc/sys/net/ipv4/tcp_syncookies: No such file or directory
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
iptables: No chain/target/match by that name
FIREWALL UP =)

OXO's rc-status:

Code:

local [ started ]
netmount [ started ]
hotplug [ started ]
syslog-ng [ started ]
vixie-cron [ started ]
sshd [ started ]
net.eth1 [ started ]
hdparm [ started ]
mysql [ started ]
verynice [ started ]
iptables [ started ]
dhcp [ started ]
dnsmasq [ started ]

That's all !!!!!!!! I've posted everything i thought that could be nessesary.

Thank you for reading as far as you are now !!
I hope that you got any suggestions ...

TheX

Last edited by TheX on Sat Sep 25, 2004 2:19 am; edited 1 time in total

splooge
l33t
l33t

Joined: 30 Aug 2002
Posts: 636

Posted: Sat Sep 25, 2004 1:07 am Post subject:

iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to 192.168.99.1-192.168.99.2 _________________ http://get.a.clue.de

Display posts from previous:

	Gentoo Forums Forum Index Networking & Security	All times are GMT
Page 1 of 1

Jump to:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum

Copyright 2001-2025 Gentoo Foundation, Inc. Designed by Kyle Manna © 2003; Style derived from original subSilver theme. | Hosting by Gossamer Threads Inc. © | Powered by phpBB 2.0.23-gentoo-p11 © 2001, 2002 phpBB Group
Privacy Policy