Re: Problems with a forward rule

["C. L. Martinez" <carlopmart@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 544 bytes --]

On Sat, May 12, 2012 at 10:53 PM, Tom van Leeuwen
<tom.van.leeuwen@saasplaza.com> wrote:
> Indeed do iptables-save for the complete ruleset and tell us what you want
> and expect.
>
>
> On 12-5-2012 17:47, Jan Engelhardt wrote:
>>
>> On Friday 2012-05-11 17:04, C. L. Martinez wrote:
>>
>>> Hi all,
>>>
>>> I have setup the following rules in a centos6 gateway:
>>> [ugly iptables -L]
>>
>> *Use* iptables-save and provide a *full* ruleset.
>>

Ok, here they are. I want to allow connections from host 172.24.50.3
to one specific network only.

[-- Attachment #2: myiptables --]
[-- Type: application/octet-stream, Size: 2903 bytes --]

# Generated by iptables-save v1.4.7 on Mon May 14 07:37:11 2012
*nat
:PREROUTING ACCEPT [398:17466]
:POSTROUTING ACCEPT [52:3232]
:OUTPUT ACCEPT [52:3232]
-A PREROUTING -i prodif -p tcp -m tcp --dport 2222 -j DNAT --to-destination 172.24.50.2:22 
-A PREROUTING -i prodif -p tcp -m tcp --dport 8081 -j DNAT --to-destination 172.24.50.3:8081 
-A PREROUTING -i prodif -p tcp -m tcp --dport 8444 -j DNAT --to-destination 172.24.50.3:8444 
-A PREROUTING -i prodif -p tcp -m tcp --dport 5555 -j DNAT --to-destination 172.24.50.3:3389 
-A POSTROUTING -s 172.24.50.2/32 -o prodif -j MASQUERADE 
-A POSTROUTING -s 172.24.50.3/32 -o prodif -j MASQUERADE 
COMMIT
# Completed on Mon May 14 07:37:11 2012
# Generated by iptables-save v1.4.7 on Mon May 14 07:37:11 2012
*filter
:INPUT DROP [380:16172]
:FORWARD DROP [2:80]
:OUTPUT DROP [0:0]
:BADFLAGS - [0:0]
:SSH - [0:0]
:TCPFLAGS - [0:0]
-A INPUT -p tcp -j TCPFLAGS 
-A INPUT ! -s 172.24.50.0/28 -i siemif -j LOG --log-prefix "IPT SPOOFED packet: " 
-A INPUT ! -s 172.24.50.0/28 -i siemif -j DROP 
-A INPUT -i lo -j ACCEPT 
-A INPUT -s 224.0.0.0/4 -j DROP 
-A INPUT -d 224.0.0.0/4 -j DROP 
-A INPUT -s 240.0.0.0/5 -j DROP 
-A INPUT -d 10.196.129.255/32 -j DROP 
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -p icmp -m state --state NEW -m icmp --icmp-type 8 -m limit --limit 1/sec --limit-burst 1 -j ACCEPT 
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -j SSH 
-A INPUT -j LOG --log-prefix "IPT INPUT packet died: " 
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A FORWARD -s 172.24.50.3/32 -m state --state NEW -j ACCEPT 
-A FORWARD -j LOG --log-prefix "IPT FORWARD packet died: " 
-A OUTPUT -p tcp -j TCPFLAGS 
-A OUTPUT -o lo -j ACCEPT 
-A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT 
-A OUTPUT -j LOG --log-prefix "IPT OUTPUT packet died: " 
-A BADFLAGS -j LOG --log-prefix "IPT TCPFLAGS: " 
-A BADFLAGS -j DROP 
-A SSH -m limit --limit 3/min --limit-burst 1 -j ACCEPT 
-A SSH -j LOG --log-prefix "IPT SSH connection too fast: " 
-A SSH -j DROP 
-A TCPFLAGS -p tcp -m state --state INVALID -j LOG --log-prefix "IPT INVALID: " 
-A TCPFLAGS -p tcp -m state --state INVALID -j DROP 
-A TCPFLAGS -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j BADFLAGS 
-A TCPFLAGS -p tcp -m tcp --tcp-flags SYN,ACK SYN,ACK -m state --state NEW -j REJECT --reject-with tcp-reset 
-A TCPFLAGS -p tcp -m tcp --tcp-flags FIN,ACK FIN -j BADFLAGS 
-A TCPFLAGS -p tcp -m tcp --tcp-flags PSH,ACK PSH -j BADFLAGS 
-A TCPFLAGS -p tcp -m tcp --tcp-flags ACK,URG URG -j BADFLAGS 
-A TCPFLAGS -p tcp -m tcp --tcp-flags FIN,RST FIN,RST -j BADFLAGS 
-A TCPFLAGS -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j BADFLAGS 
-A TCPFLAGS -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j BADFLAGS 
-A TCPFLAGS -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j BADFLAGS 
COMMIT
# Completed on Mon May 14 07:37:11 2012