From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Gilles Yue" Subject: RE: Help on IPTABLES Date: Mon, 13 Oct 2003 16:09:20 +0400 Sender: netfilter-admin@lists.netfilter.org Message-ID: <83055D4B014C9E478D2F04624B9E82CFD475@noveldc.novelgmt.mu> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C39182.D5293C32" Return-path: content-class: urn:content-classes:message Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: =?iso-8859-1?Q?Leonardo_Rodrigues_Magalh=E3es?= Cc: netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------_=_NextPart_001_01C39182.D5293C32 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Dear Leonardo, Thanks for your reply. =20 I've just allowed port 53/443 as well. Still cannot browse. Do u think = it's got something to do with the routing of my two network cards. =20 When I change my INPUT chain to accept all, = browsing works. (Note I am talking about browsing on the host where = iptables has been installed) =20 Or do I have to insert a new rule to enable NAT. = Below is my chain rules. Thanks for replying. =20 gilles =20 =20 Chain INPUT (policy DROP) target prot opt source destination RH-Lokkit-0-50-INPUT all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:80 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:443 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp spt:53 ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp spt:53 =20 Chain FORWARD (policy ACCEPT) target prot opt source destination RH-Lokkit-0-50-INPUT all -- 0.0.0.0/0 0.0.0.0/0 =20 Chain OUTPUT (policy ACCEPT) target prot opt source destination =20 Chain RH-Lokkit-0-50-INPUT (2 references) target prot opt source destination ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 REJECT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp=20 dpts:0:1023 flags:0x16/0x02 reject-with icmp-port-unreachable REJECT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:2049 = flags:0x16/0x02 reject-with icmp-port-unreachable REJECT udp -- 0.0.0.0/0 0.0.0.0/0 udp=20 dpts:0:1023 reject-with icmp-port-unreachable REJECT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:2049 = reject-with icmp-port-unreachable REJECT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp=20 dpts:6000:6009 flags:0x16/0x02 reject-with icmp-port-unreachable REJECT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:7100 = flags:0x16/0x02 reject-with icmp-port-unreachable =20 =20 =20 =20 -----Original Message----- From: Leonardo Rodrigues Magalh=E3es [mailto:leolistas@solutti.com.br]=20 Sent: Saturday, October 11, 2003 6:33 PM To: info; netfilter@lists.netfilter.org Subject: Re: Help on IPTABLES =20 =20 You'll probably browse with no problems if you use IP addresses. If = you try to browse using names (www.something.com), you'll need to do a = DNS request for the IP of that hostname. The request will go out with no = problems, as OUTPUT is ACCEPT. But DNS reply will be blocked, as INPUT = only allows port 80 traffic. =20 For allowing web browsing ONLY, you'll have to allow AT LEAST = packets with source port 53 (TCP and UDP - almost all will be UDP but = TCP can be also used). Dont forget HTTPS too, which is port 443. =20 You should also analyse the RH-Lokkit-0-50-INPUT chain. As packets = are getting to this chain BEFORE reaching your rules, if something gets = blocked there, it will NEVER reach YOUR rules. =20 For static rules, you can create them on /etc/rc.d/rc.local. This = file will be executed after ALL daemons got UP on the reboot process. =20 Sincerily, Leonardo Rodrigues =20 ----- Original Message -----=20 From: info =20 To: netfilter@lists.netfilter.org=20 Sent: Thursday, October 09, 2003 9:20 AM Subject: Help on IPTABLES =20 hi all, =09 Can somebody explain to me why is when i changed my Chain INPUT Rules = from ACCEPT to DROP, i cannot browse the internet despite opening port = 80 in the INPUT rule. However, when Chain INPUT is changed to ACCEPT, browsing the internet = works fine. (Note: CHAIN Output is accept for ALL) =09 =09 The configurations on my IPTABLES are as follows =09 Chain INPUT (policy DROP) target prot opt source destination RH-Lokkit-0-50-INPUT all -- anywhere anywhere ACCEPT tcp -- anywhere anywhere tcp = spt:http ACCEPT udp -- anywhere anywhere udp = spt:http =09 Note that my OUTPUT Rules are as follows: =09 Chain OUTPUT (policy ACCEPT) target prot opt source destination =09 I have two network cards installed on my pc - running Red Hat 9.0 =09 Routing for static routes are follows: =09 xx.yy.zz.aa 0.0.0.0 255.255.255.0 U 0 0 = 0 eth0 xx.0.0.0 0.0.0.0 255.0.0.0 U 0 0 = 0 eth1 127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 = 0 lo 0.0.0.0 zz.zz.zz.zz 0.0.0.0 UG 0 0 = 0 eth0 0.0.0.0 zz.zz.zz.zz 0.0.0.0 UG 0 0 = 0 eth1 =09 where zz.zz.zz.zz is my gateway to the internet. eth0 - Interface with local address eth1 - Interface with Internet address. =09 By the way, is there a way to save static routes because when i reboot = my pc, all routes are lost. =09 Thanks for any help. =09 guy =09 =09 ------_=_NextPart_001_01C39182.D5293C32 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Dear Leonardo,

=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 Thanks for your reply.

 

I’ve just allowed port 53/443 as well. Still cannot = browse. Do u think it’s got something to do with the routing of my two = network cards.

 

=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 When I change my INPUT chain to accept all, browsing works. (Note I am talking about = browsing on the host where iptables has been installed)

 

=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0= =A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 Or do I have to insert a new rule to enable NAT. Below is my chain rules. Thanks for = replying.

 

gilles

 

 

Chain INPUT (policy = DROP)

target=A0=A0=A0=A0 = prot opt source=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 = destination

RH-Lokkit-0-50-INPUT=A0 all=A0 --=A0 0.0.0.0/0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 = 0.0.0.0/0

ACCEPT=A0=A0=A0=A0 = tcp=A0 --=A0 0.0.0.0/0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 = 0.0.0.0/0=A0=A0=A0=A0=A0=A0=A0=A0=A0 tcp dpt:80

ACCEPT=A0=A0=A0=A0 = udp=A0 --=A0 0.0.0.0/0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 = 0.0.0.0/0=A0=A0=A0=A0=A0=A0=A0=A0=A0 udp dpt:80

ACCEPT=A0=A0=A0=A0 = tcp=A0 --=A0 0.0.0.0/0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 = 0.0.0.0/0=A0=A0=A0=A0=A0=A0=A0=A0=A0 tcp dpt:443

ACCEPT=A0=A0=A0=A0 = udp=A0 --=A0 0.0.0.0/0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 = 0.0.0.0/0=A0=A0=A0=A0=A0=A0=A0=A0=A0 udp dpt:443

ACCEPT=A0=A0=A0=A0 = tcp=A0 --=A0 0.0.0.0/0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 = 0.0.0.0/0=A0=A0=A0=A0=A0=A0=A0=A0=A0 tcp spt:53

ACCEPT=A0=A0=A0=A0 = udp=A0 --=A0 0.0.0.0/0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 = 0.0.0.0/0=A0=A0=A0=A0=A0=A0=A0=A0=A0 udp spt:53

 

Chain FORWARD (policy = ACCEPT)

target=A0=A0=A0=A0 = prot opt source=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 = destination

RH-Lokkit-0-50-INPUT=A0 all=A0 --=A0 0.0.0.0/0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 = 0.0.0.0/0

 

Chain OUTPUT (policy = ACCEPT)

target=A0=A0=A0=A0 = prot opt source=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 destination

 

Chain = RH-Lokkit-0-50-INPUT (2 references)

target=A0=A0=A0=A0 = prot opt source=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 = destination

ACCEPT=A0=A0=A0=A0 = all=A0 --=A0 0.0.0.0/0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 0.0.0.0/0

REJECT=A0=A0=A0=A0 = tcp=A0 --=A0 0.0.0.0/0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 = 0.0.0.0/0=A0=A0=A0=A0=A0=A0=A0=A0=A0 tcp

dpts:0:1023 = flags:0x16/0x02 reject-with icmp-port-unreachable

REJECT=A0=A0=A0=A0 = tcp=A0 --=A0 0.0.0.0/0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 = 0.0.0.0/0=A0=A0=A0=A0=A0=A0=A0=A0=A0 tcp dpt:2049

flags:0x16/0x02 = reject-with icmp-port-unreachable

REJECT=A0=A0=A0=A0 = udp=A0 --=A0 0.0.0.0/0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 = 0.0.0.0/0=A0=A0=A0=A0=A0=A0=A0=A0=A0 udp

dpts:0:1023 = reject-with icmp-port-unreachable

REJECT=A0=A0=A0=A0 = udp=A0 --=A0 0.0.0.0/0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 = 0.0.0.0/0=A0=A0=A0=A0=A0=A0=A0=A0=A0 udp dpt:2049

reject-with = icmp-port-unreachable

REJECT=A0=A0=A0=A0 = tcp=A0 --=A0 0.0.0.0/0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 = 0.0.0.0/0=A0=A0=A0=A0=A0=A0=A0=A0=A0 tcp

dpts:6000:6009 flags:0x16/0x02 reject-with icmp-port-unreachable

REJECT=A0=A0=A0=A0 = tcp=A0 --=A0 0.0.0.0/0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0=A0 = 0.0.0.0/0=A0=A0=A0=A0=A0=A0=A0=A0=A0 tcp dpt:7100

flags:0x16/0x02 = reject-with icmp-port-unreachable

 

 

 

 

-----Original = Message-----
From: Leonardo Rodrigues = Magalh=E3es [mailto:leolistas@solutti.com.br]
Sent: Saturday, October = 11, 2003 6:33 PM
To: info; netfilter@lists.netfilter.org
Subject: Re: Help on = IPTABLES

 

 

    You'll = probably browse with no problems if you use IP addresses. If you try to browse = using names (www.something.com), = you'll need to do a DNS request for the IP of that hostname. The request will go out = with no problems, as OUTPUT is ACCEPT. But DNS reply will be blocked, as INPUT = only allows port 80 traffic.

 

    For = allowing web browsing ONLY, you'll have to allow AT LEAST packets with source port 53 = (TCP and UDP - almost all will be UDP but TCP can be also used). Dont forget = HTTPS too, which is port 443.

 

    You = should also analyse the RH-Lokkit-0-50-INPUT chain. As packets are getting to this chain BEFORE reaching your rules, if something gets blocked there, = it will NEVER reach YOUR rules.

 

    For = static rules, you can create them on /etc/rc.d/rc.local. This file will be executed = after ALL daemons got UP on the reboot process.

 

    = Sincerily,

    Leonardo Rodrigues

 

----- Original Message = -----

From: info

Sent: Thursday, October 09, 2003 9:20 AM

Subject: Help on IPTABLES

 

hi all,

 Can somebody explain to me why is when i changed my Chain INPUT = Rules from ACCEPT to DROP, i cannot browse the internet despite opening port = 80 in the INPUT rule.
However, when Chain INPUT is changed to ACCEPT, browsing the internet = works fine. (Note: CHAIN Output is accept for ALL)


The configurations on my IPTABLES are as follows

Chain INPUT (policy DROP)
target     prot opt source           &= nbsp;   destination
RH-Lokkit-0-50-INPUT  all  --  anywhere           = ;  anywhere
ACCEPT     tcp  --  anywhere           = ;  anywhere           tcp spt:http
ACCEPT     udp  --  anywhere           = ;  anywhere           udp spt:http

Note that my OUTPUT Rules are as follows:

Chain OUTPUT (policy = ACCEPT)
target     prot opt source           &= nbsp;   destination

I have two network cards installed on my pc - running Red Hat 9.0

Routing for static routes are follows:

xx.yy.zz.aa        0.0.0.0         255.255.255.0       U     0      = 0        0 eth0
xx.0.0.0           0.0.0.0         255.0.0.0           U     0      = 0        0 eth1
127.0.0.0          0.0.0.0         255.0.0.0           U     0      = 0        0 lo
0.0.0.0            zz.zz.zz.zz       0.0.0.0           UG    0      = 0        0 eth0
0.0.0.0            zz.zz.zz.zz       0.0.0.0           UG    0      = 0        0 eth1

where zz.zz.zz.zz is my gateway to the internet.
eth0 - Interface with local address
eth1 - Interface with Internet address.

By the way, is there a way to save static routes because when i reboot = my pc, all routes are lost.

Thanks for any help.

guy

=00 ------_=_NextPart_001_01C39182.D5293C32--