| View previous topic :: View next topic |
| Author |
Message |
tazinblack
Veteran
Joined: 23 Jan 2005
Posts: 1146
Location: Baden / Germany
|
 Posted: Sun Feb 13, 2005 7:50 pm Post subject: [solved] iptables + fwbuilder |
 |
|
Hallo Liste,
ich verwende Kernel 2.6.10 wo ich mir iptables unterstützung fest reinkompiliert hab.
Jetzt versuche ich mit dem fwbuilder eine Firewall zu bauen.
Nachdem ich diverse Regeln eingefügt hab und die Netzwerkinterfaces, etc kompiliere ich die Firewall, was auch durchläuft :
| Code: |
Compiling policy for bananafishbone ...
Detecting rule shadowing
Begin processing
Policy compiled successfully
|
Beim installieren dann folgendes :
| Code: |
Summary:* firewall name : bananafishbone
* user name : root
* management address : 192.168.1.1
* platform : iptables
* host OS : linux24
* Loading configuration from file /anpassung/firewall/bananafishbone.fwb
SSH terminated, exit status: 0
Running command on the firewall:
/etc/bananafishbone.fw
Logged in
[color=red]
Interface eth1 does not exist
[/color]
Connection to 192.168.1.1 closed.
SSH terminated, exit status: 0
|
Es sagt also, dass es das Interface eth1 nicht gibt !
Aber man sehe und staune :
| Code: |
bash-2.05b# ifconfig
eth0 Link encap:Ethernet HWaddr <Inhalt>
inet addr:192.168.2.1 Bcast:192.168.2.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:2122 errors:0 dropped:0 overruns:0 frame:0
TX packets:1988 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1715521 (1.6 Mb) TX bytes:233361 (227.8 Kb)
Interrupt:10 Base address:0xec00
eth1 Link encap:Ethernet HWaddr <Inhalt>
inet addr:192.168.1.1 Bcast:192.168.1.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:24 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:3595 (3.5 Kb) TX bytes:0 (0.0 b)
Interrupt:11 Base address:0xe000
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:274 errors:0 dropped:0 overruns:0 frame:0
TX packets:274 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:53992 (52.7 Kb) TX bytes:53992 (52.7 Kb)
ppp0 Link encap:Point-to-Point Protocol
inet addr:<Inhalt> P-t-P:<Inhalt> Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1492 Metric:1
RX packets:1952 errors:0 dropped:0 overruns:0 frame:0
TX packets:1817 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:3
RX bytes:1662257 (1.5 Mb) TX bytes:183043 (178.7 Kb)
bash-2.05b#
|
eth1 ist mein internes Interface und eth0 mein externes, wobei ppp0 dann nach adsl-start mein externes Interface ist !
Hat jemand ne Idee, was ich falsch mache ?
Welche Optionen im Kernel braucht man für iptables damit der fwbuilder läuft ?
Gruß
tazinblack
Last edited by tazinblack on Mon Feb 21, 2005 10:42 am; edited 1 time in total |
|
| Back to top |
|
 |
Lemy.ch
n00b
Joined: 13 Sep 2004
Posts: 23
Location: Switzerland
|
| Posted: Sun Feb 13, 2005 8:46 pm Post subject: |
|
|
Ich habe genau das selbe Problem:
Mein von fwbuilder produziertes script:
| Code: |
bash-2.05b$ cat gentoo.fw
#!/bin/sh
#
# This is automatically generated file. DO NOT MODIFY !
#
# Firewall Builder fwb_ipt v2.0.0-1
#
# Generated Sun Feb 13 21:40:25 2005 UTC by lemy
#
# files: * gentoo.fw
#
#
# This is an example of a firewall protecting a host ( a server or a workstation). Only SSH access to the host is permitted. Host has dynamic address.
#
#
#
PATH="/usr/sbin:/sbin:${PATH}"
export PATH
log() {
echo "$1"
test -x "$LOGGER" && $LOGGER -p info "$1"
}
va_num=1
add_addr() {
addr=$1
nm=$2
dev=$3
type=""
aadd=""
L=`$IP -4 link ls $dev | grep "$dev:"`
if test -n "$L"; then
OIFS=$IFS
IFS=" /:,<"
set $L
type=$4
IFS=$OIFS
L=`$IP -4 addr ls $dev to $addr | grep " inet "`
if test -n "$L"; then
OIFS=$IFS
IFS=" /"
set $L
aadd=$2
IFS=$OIFS
fi
fi
if test -z "$aadd"; then
if test "$type" = "POINTOPOINT"; then
$IP -4 addr add $addr dev $dev scope global label $dev:FWB${va_num}
va_num=`expr $va_num + 1`
fi
if test "$type" = "BROADCAST"; then
$IP -4 addr add $addr/$nm dev $dev brd + scope global label $dev:FWB${va_num}
va_num=`expr $va_num + 1`
fi
fi
}
getaddr() {
dev=$1
name=$2
L=`$IP -4 addr show dev $dev | grep inet`
test -z "$L" && {
eval "$name=''"
return
}
OIFS=$IFS
IFS=" /"
set $L
eval "$name=$2"
IFS=$OIFS
}
getinterfaces() {
NAME=$1
$IP link show | grep -E "$NAME[^ ]*: "| while read L; do
OIFS=$IFS
IFS=" :"
set $L
IFS=$OIFS
echo $2
done
}
LSMOD="lsmod"
MODPROBE="modprobe"
IPTABLES="iptables"
IP="ip"
LOGGER="logger"
INTERFACES="eth0 lo "
for i in $INTERFACES ; do
$IP link show "$i" > /dev/null 2>&1 || {
log "Interface $i does not exist"
exit 1
}
done
$IPTABLES -P OUTPUT DROP
$IPTABLES -P INPUT DROP
$IPTABLES -P FORWARD DROP
cat /proc/net/ip_tables_names | grep -v mangle | while read table; do
$IPTABLES -t $table -L -n | while read c chain rest; do
if test "X$c" = "XChain" ; then
$IPTABLES -t $table -F $chain
fi
done
$IPTABLES -t $table -X
done
$IP -4 neigh flush dev eth0 >/dev/null 2>&1
$IP -4 addr flush dev eth0 label "eth0:FWB*" >/dev/null 2>&1
add_addr 192.168.1.11 24 eth0
$IP link set eth0 up
add_addr 127.0.0.1 8 lo
$IP link set lo up
MODULE_DIR="/lib/modules/`uname -r`/kernel/net/ipv4/netfilter/"
MODULES=`(cd $MODULE_DIR; ls *_conntrack_* | sed 's/\.o.*$//' | sed 's/\.ko.*$//')`
for module in $(echo $MODULES); do
if $LSMOD | grep ${module} >/dev/null; then continue; fi
$MODPROBE ${module} || exit 1
done
log "Activating firewall script generated Sun Feb 13 21:40:25 2005 UTC by lemy"
$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
#
# Rule 0(eth0)
#
echo "Rule 0(eth0)"
#
# anti spoofing rule
#
$IPTABLES -N eth0_In_RULE_0
$IPTABLES -A FORWARD -i eth0 -s 192.168.1.11 -j eth0_In_RULE_0
$IPTABLES -A eth0_In_RULE_0 -j LOG --log-level info --log-prefix "RULE 0 -- DENY "
$IPTABLES -A eth0_In_RULE_0 -j DROP
#
# Rule 0(lo)
#
echo "Rule 0(lo)"
#
#
#
$IPTABLES -A INPUT -i lo -m state --state NEW -j ACCEPT
$IPTABLES -A OUTPUT -o lo -m state --state NEW -j ACCEPT
#
# Rule 0(global)
#
echo "Rule 0(global)"
#
#
#
$IPTABLES -A INPUT -s 192.168.1.0/24 -d 192.168.1.11 -m state --state NEW -j ACCEPT
#
# Rule 1(global)
#
echo "Rule 1(global)"
#
#
#
$IPTABLES -A OUTPUT -s 192.168.1.11 -m state --state NEW -j ACCEPT
#
# Rule 2(global)
#
echo "Rule 2(global)"
#
#
#
$IPTABLES -N RULE_2
$IPTABLES -A OUTPUT -j RULE_2
$IPTABLES -A INPUT -j RULE_2
$IPTABLES -A FORWARD -j RULE_2
$IPTABLES -A RULE_2 -j LOG --log-level info --log-prefix "RULE 2 -- DENY "
$IPTABLES -A RULE_2 -j DROP
#
#
echo 1 > /proc/sys/net/ipv4/ip_forward
|
Die Ausführung des Scriptes:
| Code: |
bash-2.05b$ ./gentoo.fw
Interface eth0 does not exist
|
Ifconfig:
| Code: | gentoo / # ifconfig
eth0 Link encap:Ethernet HWaddr 00:10:B5:86:CA:57
inet addr:192.168.1.11 Bcast:192.168.1.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:6478 errors:0 dropped:0 overruns:0 frame:0
TX packets:5292 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:4568953 (4.3 Mb) TX bytes:600176 (586.1 Kb)
Interrupt:11
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:133 errors:0 dropped:0 overruns:0 frame:0
TX packets:133 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:18464 (18.0 Kb) TX bytes:18464 (18.0 Kb)
|
Es grüsst euch
Lemy
_________________
Why-o-why, didn't I take the blue pill? |
|
| Back to top |
|
|
moe
Veteran
Joined: 28 Mar 2003
Posts: 1289
Location: Potsdam / Germany
|
| Posted: Mon Feb 14, 2005 8:37 am Post subject: |
|
|
fwbuilder benutzt wie man in dem Script sieht ip um zu gucken ob die Interfaces existieren, das ist in sys-apps/iproute2 enthalten. Alternativ kann man in den Optionen beim fwbuilder auch die Prüfung ausschalten (Rechtsklick auf die Firewall, edit, dann Firewall Settings, dann Script Options und dann "verify interfaces ..."
HTH Maurice |
|
| Back to top |
|
|
tazinblack
Veteran
Joined: 23 Jan 2005
Posts: 1146
Location: Baden / Germany
|
| Posted: Mon Feb 21, 2005 10:42 am Post subject: |
|
|
| Danke ! Das wars ! |
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
Deutsches Forum (German)
