| View previous topic :: View next topic |
| Author |
Message |
projkt4
Apprentice
Joined: 17 Dec 2004
Posts: 238
|
 Posted: Tue Apr 18, 2006 1:48 am Post subject: weird firewall problem [SOLVED] |
 |
|
ok, i just rebooted my router recently to see if i could figgure out if i fixed a problem with the boot sequence (it was stalling, i needed to recompile)
but now that its back up and running, my firewall services are not working. i cannot access the internet from any internal machines, but i can browse from the router. so there must be a problem with my firewall right? well here's the basic iptables script, or at lest the important part.
| Code: |
iptables -F; iptables -t nat -F; iptables -t mangle -F
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/conf/all/forwarding
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state new -i ! eth0 -j ACCEPT
iptables -A INPUT -p icmp -j ACCEPT
iptables -P INPUT DROP
|
all i can think of is that i ran the bastille script a few weeks ago, but i dont think that would affect the routing functions. where should i start?
Last edited by projkt4 on Tue Apr 25, 2006 7:09 pm; edited 1 time in total |
|
| Back to top |
|
 |
projkt4
Apprentice
Joined: 17 Dec 2004
Posts: 238
|
| Posted: Tue Apr 18, 2006 2:33 am Post subject: |
|
|
ok, i fixed a posible error on line 5 of that script, but it doesnt seem to be making any difference. heres a second script i tried.
| Code: | #!/bin/bash
IPTABLES='/sbin/iptables'
#interface values
EXTIF='eth0'
INTIF1='eth1'
#INTIF2='eth2'
#enable kernel based ip routing
/bin/echo 1 > /proc/sys/net/ipv4/ip_forward
#flush rules & delete chains!
$IPTABLES -F
$IPTABLES -X
#set default actions
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
# enable LAN amsqueraiding to WAN
$IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE
#foreward hardlined lan traffic to wan
$IPTABLES -A FORWARD -i $INTIF1 -o $EXTIF -m state --state NEW,ESTABLISHED -j ACCEPT
#same for a second ifdevice, just make it $INTIF2
#echo -e " - Allowing access to the SSH server"
$IPTABLES -A INPUT --protocol tcp --dport 22 -j ACCEPT
#blocking everything else
$IPTABLES -A INPUT -i $EXTIF -m state --state NEW,INVALID -j DROP
$IPTABLES -A FORWARD -i $EXTIF -m state --state NEW,INVALID -j DROP
|
but this gets me a destination not found error when i ping from inside the network. what is stopping traffic? |
|
| Back to top |
|
|
Extintor
Tux's lil' helper
Joined: 09 Oct 2004
Posts: 113
Location: Stockholm, Sweden
|
| Posted: Tue Apr 18, 2006 8:57 am Post subject: |
|
|
First off.
Did you run the script after rebooting ?
_________________
Beerhazard | Nobelium | VIm | Perl | Ruby |
|
| Back to top |
|
|
projkt4
Apprentice
Joined: 17 Dec 2004
Posts: 238
|
| Posted: Tue Apr 18, 2006 3:55 pm Post subject: |
|
|
| yes i did, i ran both scripts after rebooting. |
|
| Back to top |
|
|
projkt4
Apprentice
Joined: 17 Dec 2004
Posts: 238
|
| Posted: Tue Apr 18, 2006 6:25 pm Post subject: |
|
|
| ok, update/clarification. When i am using that first firewall script i get the standard "request timed out" error message. but when i run the second firewall script i get "ping request could not find host www.google.com. please check the name and try again." also odd, i can ping the router, but i cannot ping the the other machines on my network even though i know i'm pinging the correct address. i dont know where to start the troubleshooting for this and i dont want to have to rebuild the router again just because i cannot find the little problem. i would really appreciate any and all help on this. |
|
| Back to top |
|
|
projkt4
Apprentice
Joined: 17 Dec 2004
Posts: 238
|
| Posted: Wed Apr 19, 2006 8:49 am Post subject: |
|
|
| what do i need to clarify or expand on to get pointed in the right direction?? I know that there has got to be a simpler answer than rebuild the whole box.i'd be happy to answer any questions about my setup i just dont know where to start. |
|
| Back to top |
|
|
projkt4
Apprentice
Joined: 17 Dec 2004
Posts: 238
|
| Posted: Tue Apr 25, 2006 7:08 pm Post subject: |
|
|
the command that worked for me was
|
|
| Back to top |
|
|
|
Networking & Security
